CWE-1072 is a product that accesses a data resource through a database without using a connection pooling capability. It concerns any service that talks to a database and handles more than a trickle of traffic.
How it happens
Each request opens a connection, runs a query and closes it. Opening a connection costs time. MITRE notes that connection pools allow connections to be reused without the overhead and time consumption of opening and closing a new connection.
# Pattern to avoid: a new connection for every call
def get_user(uid):
conn = psycopg2.connect(DSN)
cur = conn.cursor()
cur.execute("SELECT name FROM users WHERE id = %s", (uid,))
row = cur.fetchone()
conn.close()
return row
# Better: borrow from a pool created once at startup
from psycopg2.pool import SimpleConnectionPool
pool = SimpleConnectionPool(1, 10, DSN)
def get_user(uid):
conn = pool.getconn()
try:
cur = conn.cursor()
cur.execute("SELECT name FROM users WHERE id = %s", (uid,))
return cur.fetchone()
finally:
pool.putconn(conn)
What an attacker gains
MITRE lists reduced performance. If an attacker can reach the code, the slowdown "might introduce a vulnerability." Many cheap requests that each open a connection can slow the service sharply.
How to find it
The record lists no detection methods. Search for direct connect calls in request handling code, and watch the database for a high rate of new connections.
How to fix it
- Create a pool once at startup and reuse it.
- Always return connections in a finally block.
- Set a maximum pool size below the database limit.
Quick check
What does a pool save?
The cost of opening and closing a connection for every operation.
