Matching CDBSC-DSF

URI: MP-CDBSC-DSF

Package: ProcessComms

< prev | next >

Description: Finds a process using a DB service and the associated service channel, plus the DB host and a copy of data served by the DB and flowing to it, but not from the process.

Root Pattern: R-CDBSCDADS

R-CDBSCDADS

Finds a process using a DB service to update data, where the data in this case may or may not normally be accessed via the process.

Threat Patterns (2)

DS.A.CDBSC-DSF.4

Malicious query from Client via database Service deletes data Data : an attacker having the ability to send arbitrary queries to Service from or via Client injects a query to delete data Data. In this scenario, an update/deletion query on Data would not be expected to come via Client, so the attack can be prevented using database access controls at Service.

DS.Auth.CDBSC-DSF.4

Malicious query from Client via database Service alters data Data : an attacker having the ability to send arbitrary queries to Service from or via Client injects a query to alter data Data. In this scenario, an update query on Data would not be expected to come via Client, so the attack can be prevented using database access controls at Service.