From Prompt Injections to SQL Injection Attacks: How Protected is Your LLM-Integrated Web Application?

LLM-integrated middleware (e.g., LangChain) 提供API可以完成 (i) requesting the LLM to interpret the user’s input question and generate an auxiliary SQL query, (ii) executing said SQL query on the database, and (iii) asking the LLM to generate an answer in natural language 因此开发者只需要调用API并输入问题，并将Langchain的答案转发给用户。

但是unsanitized user input可以导致SQL Injection的问题，LLM生成malicious SQL query，App执行恶意代码，导致unauthorized access to the application’s database。

RQ1: impact on App security.

RQ2: To what extent does the effectiveness of P2SQL attacks depend on the adopted LLM in a web application?

RQ3: defense

(i) database permission hardening, (ii) SQL query rewriting, (iii) auxiliary LLM-based validation, and (iv) inprompt data preloading.

Background

Attack Variants (RQ1)

Threat Model

(i) reading information from the database that the attacker should not have access to; (ii) writing data on the database by inserting, modifying, or deleting data records not originally authorized to the users.

• Default prompt. chatbot will generate any query that the user requests.
• Direct attacks on restricted prompt
• Indirect attacks on restricted prompt.
  • Insert malicious prompt into the database → Answer manipulation.
  • Langchain’s agents: multi-step P2SQL attacks

P2SQL Across Models