We ran a Veracode scan on our Sitecore solution and it has identified that the sitecore.logging.dll has SQL injection vulnerabilities.

A full description here:
SQL injection vulnerabilities occur when data enters an application from an untrusted source and is used to dynamically construct a SQL query. This allows an attacker to manipulate database queries in order to access, modify, or delete arbitrary data. Depending on the platform, database type, and configuration, it may also be possible to execute administrative operations on the database, access the filesystem, or execute arbitrary system commands. SQL injection attacks can also be used to subvert authentication and authorization schemes, which would enable an attacker to gain privileged access to restricted portions of the application.

I'm curious if this has already been flagged and fixed with a later version of Sitecore or if it something we could be doing.

Thanks James

  • How about you start by telling us, what version of Sitecore you are on?
    – Mark Cassidy
    Jul 7 '21 at 13:48
  • This is sitecore 9.0
    – James
    Jul 7 '21 at 14:09
  • My guess would be that it is looking at the code for log4net database appender. Not a lot you can do about this, and unlikely this has changed since even the most recent versions of log4net provide this type of logger. logging.apache.org/log4net/release/…
    – jammykam
    Jul 7 '21 at 17:58

I suggest you don't worry about it and with high probability, you can ignore it.

  1. Open Sitecore support ticket and ask them about it to be confident that it is not an issue.
  2. You can open Sitecore.Logging in ILSpy(or any other decompiler that you like). You will see that Sitecore.Logging is forked from log4net with some additions. Also, you will be able to find all code related to SQL(as we are interested in finding possible SQL injection). You will see that SQL code is used for ADONetAppender and ADONetAppenderParameter(probably somewhere else, but I have noticed after quick look). You will be able to make a conclusion that SQL is used by Sitecore.Logging only when you use a specific log4net appender that writes to the database. But by default Sitecore is configured to write logs only to files. It means that by default code that is marked as possibly vulnerable will be never called. You should worry only if for some reason you decided to use ADONetAppender(I have never seen it in any of Sitecore implementations).
  1. As you have identified in step 2 a place, where possibly where vulnerable code is located, you can use ildasm to convert Sitecore.Logging to IL code. Then completely remove ADONetAppender from the IL code and use ilasm to build Sitecore.Logging assembly without that vulnerable appender. (Do this step only if for some reason you need to get a report without any vulnerabilities. Because removing code that is not called, not from your libraries in this way is useless and will cause additional work now and in future Sitecore updates)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.