CodeQL documentation
CodeQL resources

Insecure SQL connection

ID: cs/insecure-sql-connection
Kind: path-problem
Security severity: 7.5
Severity: error
Precision: medium
Tags:
   - security
   - external/cwe/cwe-327
Query suites:
   - csharp-security-extended.qls
   - csharp-security-and-quality.qls

Click to see the query in the CodeQL repository

SQL Server connections where the client is not enforcing the encryption in transit are susceptible to multiple attacks, including a man-in-the-middle, that would potentially compromise the user credentials and/or the TDS session.

Recommendation

Ensure that the client code enforces the Encrypt option by setting it to true in the connection string.

Example

The following example shows a SQL connection string that is not explicitly enabling the Encrypt setting to force encryption.

using System.Data.SqlClient;

// BAD, Encrypt not specified
string connectString =
    "Server=1.2.3.4;Database=Anything;Integrated Security=true;";
SqlConnectionStringBuilder builder = new SqlConnectionStringBuilder(connectString);
var conn = new SqlConnection(builder.ConnectionString);

The following example shows a SQL connection string that is explicitly enabling the Encrypt setting to force encryption in transit.

using System.Data.SqlClient;

string connectString =
    "Server=1.2.3.4;Database=Anything;Integrated Security=true;;Encrypt=true;";
SqlConnectionStringBuilder builder = new SqlConnectionStringBuilder(connectString);
var conn = new SqlConnection(builder.ConnectionString);

References

  • © GitHub, Inc.
  • Terms
  • Privacy