-
Rajesh Kanna
- PowerBuilder
- Sunday, 8 November 2026 02:56 PM UTC
Hello PB Guru's,
I am looking for guidance from PowerBuilder experts regarding a security vulnerability identified during a penetration test of our PowerBuilder-based application.
Application Background:
Our application is a PowerBuilder thick-client application installed on end-user machines. It connects directly to SQL Server using database connection details stored in an INI/configuration file.
Currently, the database password is encrypted in the INI file. The application decrypts the password internally when establishing the database connection.
Penetration Test Finding – Password Disclosure:
During a penetration test, the security team identified the following vulnerability:
- A non-privileged Windows user was able to copy the entire application directory to another location where they had write permissions.
- The user modified the copied configuration file to redirect the database connection to an attacker-controlled fake SQL Server.
- The application attempted to connect to the fake SQL Server using its configured database credentials.
- The security team was able to capture the database credentials through Security controlled remote server and
the “auxiliary/server/capture/mssql” module was used to setup a fake MSSQL service.
The report indicates that the credentials were captured in plain text.
The security team also noted that this vulnerability is related to the thick-client architecture, where the application runs under the end user's control and requires database access.
My Question as a PowerBuilder Developer:
We would like to mitigate this vulnerability "without completely redesigning the existing application architecture or making extensive changes to the PowerBuilder business logic."
Since the database password is already encrypted in the INI file, I would like to understand what additional measures can be implemented at the PowerBuilder application or database connection level.
Specifically, I would appreciate guidance on the following:
1. Is there a recommended way in PowerBuilder to prevent database credentials from being captured when the application connects to a fake or unauthorised SQL Server?
2. Can SQL Server TLS encryption with mandatory certificate validation be configured through PowerBuilder's database connection settings to prevent this type of server impersonation?
3. Are there any recommended PowerBuilder techniques for securely handling decrypted database credentials at runtime?
4. Can the application validate the database server identity before attempting authentication?
5. Are there any existing Appeon/PowerBuilder features, best practices, or recommended approaches for mitigating this vulnerability while retaining the current thick-client architecture?
We understand that completely protecting reusable database credentials in a client-controlled application may require architectural changes. However, we would like to explore practical mitigation options that can be implemented in the existing application.
Any technical suggestions, code examples, or references to relevant PowerBuilder documentation would be greatly appreciated.
Thank you for your help.
Find Questions by Tag
Helpful?
If a reply or comment is helpful for you, please don’t hesitate to click the Helpful button. This action is further confirmation of their invaluable contribution to the Appeon Community.