Skip to main content

Business information leak

Need​

Protection of sensitive business information from unauthorized access or leakage

Context​

  • Usage of C# for developing robust and efficient applications
  • Usage of the System library for accessing and manipulating system-level functionality
  • Usage of System.Collections.Generic for working with generic collections in .NET
  • Usage of Microsoft.AspNetCore.Mvc for building web applications with ASP.NET Core MVC
  • Usage of MyCompany.Models for defining and working with custom models in the application

Description​

Non compliant code​

using System;
using System.Collections.Generic;
using Microsoft.AspNetCore.Mvc;
using MyCompany.Models;

namespace MyCompany.Controllers
{
    [Route("api/[controller]")]
    [ApiController]
    public class EmployeeController : ControllerBase
    {
        // GET: api/Employee
        [HttpGet]
        public IEnumerable<Employee> Get()
        {
            return new List<Employee>
            {
                new Employee { Id = 1, Name = "John Doe", Position = "Manager", Salary = 70000 },
                new Employee { Id = 2, Name = "Jane Doe", Position = "Developer", Salary = 60000 },
                // ...
            };
        }

        // GET: api/Employee/5
        [HttpGet("{id}")]
        public Employee Get(int id)
        {
            // This is just a mock. In a real-world scenario, you would fetch the data from a database.
            return new Employee { Id = id, Name = "John Doe", Position = "Manager", Salary = 70000 };
        }
    }
}

The above code represents a web API that exposes sensitive business information without any form of protection or authorization.

The EmployeeController class contains two action methods: Get() and Get(int id).

The Get() method returns a list of all employees, including their names, positions, and salaries. This information is sensitive and should not be publicly accessible.

The Get(int id) method returns the details of a specific employee when provided with their ID. This method makes it possible for an attacker to iterate over different IDs and gather the information of all employees.

Both methods do not require any form of authentication or authorization, meaning any person or bot can access this information. This is a serious security vulnerability as it can lead to a business information leak.

The information leak can be exploited to gain knowledge about the company's employees (like their roles and salaries), which can further be used for social engineering attacks, salary benchmarking by competitors, or other malicious activities.

Steps​

  • Implement proper authentication and authorization mechanisms to restrict access to sensitive business information.
  • Ensure that only authorized users can access the employee data.
  • Use role-based access control (RBAC) to define different levels of access for different user roles.
  • Encrypt sensitive business information to protect it from unauthorized access.
  • Implement input validation to prevent any potential data leakage through malicious input.
  • Regularly review and update access control policies to ensure they align with the current security requirements.
  • Implement logging and monitoring mechanisms to detect and respond to any unauthorized access attempts.
  • Regularly perform security assessments and penetration testing to identify and address any vulnerabilities in the application.
  • Educate employees and users about the importance of data security and the potential risks of sharing sensitive information.

Compliant code​

using System;
using System.Collections.Generic;
using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Authorization;
using MyCompany.Models;

namespace MyCompany.Controllers
{
    [Route("api/[controller]")]
    [ApiController]
    [Authorize]
    public class EmployeeController : ControllerBase
    {
        // GET: api/Employee
        [HttpGet]
        [Authorize(Roles = "Manager, HR")]
        public IEnumerable<Employee> Get()
        {
            return new List<Employee>
            {
                new Employee { Id = 1, Name = "John Doe", Position = "Manager", Salary = 70000 },
                new Employee { Id = 2, Name = "Jane Doe", Position = "Developer", Salary = 60000 },
                // ...
            };
        }

        // GET: api/Employee/5
        [HttpGet("{id}")]
        [Authorize(Roles = "Manager, HR")]
        public Employee Get(int id)
        {
            // This is just a mock. In a real-world scenario, you would fetch the data from a database.
            return new Employee { Id = id, Name = "John Doe", Position = "Manager", Salary = 70000 };
        }
    }
}

The updated code now includes the [Authorize] attribute at the controller level, which means that all actions within the EmployeeController will require the user to be authenticated.

In addition, the Get methods now also include the [Authorize(Roles = "Manager, HR")] attribute. This attribute specifies that only users with the "Manager" or "HR" roles are authorized to access these methods. This is an example of Role-Based Access Control (RBAC), which allows for more granular control over who can access specific resources.

Please note that this code assumes that you have already set up authentication and role management in your application. If not, you will need to implement these features.

Also, remember that this is just one part of securing your application. You should also consider encrypting sensitive data, implementing input validation, regularly reviewing and updating your access control policies, implementing logging and monitoring, regularly performing security assessments and penetration testing, and educating your employees and users about data security.

References​

Last updated on