Skip to main content

Lack of multi-factor authentication

Need​

Implementation of multi-factor authentication for critical services

Context​

  • Usage of C# 7.0 for modern language features and enhancements
  • Usage of Microsoft.EntityFrameworkCore for object-relational mapping (ORM) in .NET applications
  • Usage of Microsoft.EntityFrameworkCore.SqlServer for working with SQL Server databases in .NET applications
  • Usage of Microsoft.AspNetCore.Identity.EntityFrameworkCore for managing user authentication and authorization in ASP.NET Core applications
  • Usage of Microsoft.AspNetCore.Mvc for building web applications with ASP.NET Core
  • Usage of Microsoft.AspNetCore.Mvc.RazorPages for building web pages with Razor syntax in ASP.NET Core MVC

Description​

Non compliant code​

// Startup.cs
public void ConfigureServices(IServiceCollection services)
{
    services.AddDbContext<ApplicationDbContext>(options =>
        options.UseSqlServer(
            Configuration.GetConnectionString("DefaultConnection")));
    services.AddDefaultIdentity<IdentityUser>(options => options.SignIn.RequireConfirmedAccount = true)
        .AddEntityFrameworkStores<ApplicationDbContext>();
    services.AddControllersWithViews();
    services.AddRazorPages();
}

The above code is a typical configuration for an ASP.NET Core application using Identity for user management. The AddDefaultIdentity method is used to add the default identity system configuration for the specified user type (IdentityUser in this case).

However, this configuration is vulnerable as it does not include multi-factor authentication (MFA). This means that an attacker who has compromised a user's account (for example, by obtaining their password) can easily access the system and sensitive resources. This is because the system only requires a single factor (the password) to authenticate the user.

The lack of MFA is a significant vulnerability as it does not provide an additional layer of security. With MFA, even if an attacker obtains a user's password, they would still need access to the second factor (like a code sent to the user's phone or email) to gain access to the system.

Steps​

  • Implement a multi-factor authentication mechanism for critical services.
  • Choose a reliable multi-factor authentication method, such as SMS verification, email verification, or authenticator apps.
  • Integrate the chosen multi-factor authentication method into the authentication process of the critical services.
  • Ensure that the multi-factor authentication is enforced for all users accessing the critical services.
  • Regularly review and update the multi-factor authentication mechanism to address any potential vulnerabilities or weaknesses.

Compliant code​

// Startup.cs
public void ConfigureServices(IServiceCollection services)
{
    services.AddDbContext<ApplicationDbContext>(options =>
        options.UseSqlServer(
            Configuration.GetConnectionString("DefaultConnection")));
    services.AddDefaultIdentity<IdentityUser>(options => options.SignIn.RequireConfirmedAccount = true)
        .AddEntityFrameworkStores<ApplicationDbContext>();
    services.AddControllersWithViews();
    services.AddRazorPages();

    // Add multi-factor authentication
    services.Configure<IdentityOptions>(options =>
    {
        // other options...

        options.SignIn.RequireConfirmedEmail = true;
        options.SignIn.RequireConfirmedPhoneNumber = true;
    });
}

The updated code includes the configuration for multi-factor authentication (MFA) in the ConfigureServices method of the Startup class.

The IdentityOptions class is used to configure identity settings, and in this case, it is used to enforce the requirement of a confirmed email and phone number for sign-in, which are the two factors in the MFA.

This means that when a user tries to sign in, they will need to provide not only their password (something they know) but also a verification code sent to their email or phone number (something they have). This significantly increases the security of the system as an attacker would need to compromise both factors to gain unauthorized access.

Remember to implement the necessary logic in your application to handle the email and phone number confirmation process. This typically involves sending a unique code to the user's email or phone number when they register or change their authentication details, and asking them to enter this code in your application to confirm that they have access to the email or phone number.

Also, ensure that you have the necessary infrastructure to handle the sending of emails or SMS messages. There are many services available that can handle this for you, such as SendGrid for emails and Twilio for SMS.

Regularly review and update the MFA mechanism to address any potential vulnerabilities or weaknesses. This could involve adding more factors, such as biometric data or security questions, or updating the way the confirmation codes are generated and validated to ensure they cannot be guessed or intercepted by an attacker.

References​

Last updated on