Qualys 150568 Content-Based Blind SQL Injection on REST Endpoints

BenRomlein — Tue, 18 Feb 2025 22:14:36 GMT

My organization uses Qualys to scan web applications. It picked up my REST endpoints and flagged them with a level 5 high vulnerability and now I have people in the security department telling me I need to fix it.

This is the summary of the problem: https://blog.qualys.com/product-tech/2023/02/09/blind-sql-injection-content-based-time-based-approaches

True condition payload is ‘ AND 1=1
This condition is true, so available records are returned, which is the same as if the payload was the item by itself.
False condition payload is ‘ AND 1=2
The condition is false, so no records are returned and the output is nothing or a message such as No Results Found.
Seeing the difference in results, the scanning engine draws the conclusion that there is a blind SQL injection vulnerability.

If I understand this correctly, for it not to get flagged, I'd need the REST API to return the same result set for the true query "1=1" and the false query "1=1 AND 1=2" in the "where=" request parameter.

Firstly, am I reading this right? Secondly, is there any advice on how to either fix this, so it's no longer flagged as a vulnerability or convince the security department that this is not a vulnerability?

I'm Using ArcGIS Server 11.4.0 with standardizedQueries: "true" set and querying FeatureServices. (I've also tried turning off standardizedQueries as well, and it gives the same result)

The exact queries the scan used are:

False: '1=11 or 11=12'
True: '1=11 or 11=11'.

Re: Qualys 150568 Content-Based Blind SQL Injection on REST Endpoints

RandallWilliams — Thu, 29 May 2025 15:57:45 GMT

Hi Ben,

Happened to see this question, I don't typically follow this space.

This is expected behavior in ArcGIS. There's nothing to fix.

Users expect to be able to see all of the records in a spatial table. In a banking use case, where I'm only expected to see details related to my own bank record, this would be a problem. However, in the ArcGIS use case, the expected behavior is to see, for example, all points in a map in a given spatial envelope.

topic Re: Qualys 150568 Content-Based Blind SQL Injection on REST Endpoints in ArcGIS REST APIs and Services Questions

Qualys 150568 Content-Based Blind SQL Injection on REST Endpoints

Re: Qualys 150568 Content-Based Blind SQL Injection on REST Endpoints