Skip to main content

Non-encrypted confidential information

Need​

Secure storage of confidential information

Context​

  • Usage of C# 7.0 for modern language features and enhancements
  • Usage of Microsoft.AspNetCore.Mvc for building web applications using the ASP.NET Core MVC framework
  • Usage of Microsoft.EntityFrameworkCore for working with databases in .NET applications

Description​

Non compliant code​

public class UserController : Controller
{
    private readonly UserContext _context;

    public UserController(UserContext context)
    {
        _context = context;
    }

    // POST: User/Create
    [HttpPost]
    public async Task<IActionResult> Create([Bind("Id,Username,Password")] User user)
    {
        if (ModelState.IsValid)
        {
            _context.Add(user);
            await _context.SaveChangesAsync();
            return RedirectToAction(nameof(Index));
        }
        return View(user);
    }
}

The above code represents a simple user registration endpoint in an ASP.NET Core application where a new user can be created by sending a POST request. The UserController class has a dependency on UserContext, which is a DbContext for interacting with the database.

The vulnerable part of this code is within the Create method. This method is responsible for creating a new user with the provided details. The user's details, including their password, are bound from the POST data and directly stored into the database.

The problem here is that the password is stored in plain text in the database. This is a serious security vulnerability since anyone with access to the database can see all the user's passwords. If an attacker manages to gain access to the database, they can easily steal all the user's credentials.

Storing passwords in plain text is a bad practice and should be avoided. Passwords should always be stored in a hashed and salted form. This means that even if an attacker gains access to the database, they won't be able to reverse-engineer the original password from the stored hash.

Steps​

  • Implement encryption for storing confidential information.
  • Use a secure encryption algorithm such as AES or RSA.
  • Generate a unique encryption key for each user.
  • Encrypt the confidential information before storing it in the database.
  • Ensure that the encryption key is securely stored and not accessible to unauthorized users.
  • Implement decryption logic to retrieve and display the confidential information when needed.
  • Ensure that the decryption key is securely stored and not accessible to unauthorized users.
  • Regularly review and update the encryption mechanism to use the latest security standards.

Compliant code​

public class UserController : Controller
{
    private readonly UserContext _context;
    private readonly IEncryptionService _encryptionService;

    public UserController(UserContext context, IEncryptionService encryptionService)
    {
        _context = context;
        _encryptionService = encryptionService;
    }

    // POST: User/Create
    [HttpPost]
    public async Task<IActionResult> Create([Bind("Id,Username,Password")] User user)
    {
        if (ModelState.IsValid)
        {
            user.Password = _encryptionService.Encrypt(user.Password);
            _context.Add(user);
            await _context.SaveChangesAsync();
            return RedirectToAction(nameof(Index));
        }
        return View(user);
    }
}

The updated code now includes an encryption service that is used to encrypt the user's password before it is stored in the database. This encryption service uses a secure encryption algorithm such as AES or RSA to encrypt the password.

The IEncryptionService is an interface that defines the methods for encryption and decryption. The actual implementation of this service should generate a unique encryption key for each user and use this key to encrypt and decrypt the user's password.

The encryption key should be securely stored and not accessible to unauthorized users. The decryption logic should be implemented in a way that the decryption key is also securely stored and not accessible to unauthorized users.

The encryption mechanism should be regularly reviewed and updated to use the latest security standards.

This way, even if an attacker is able to access the database, they will not be able to view the user's password in plain text, thus protecting the confidentiality of the user's information.

References​

Last updated on