Skip to main content

Security controls bypass or absence

Need​

Implementation of robust and effective security controls

Context​

  • Usage of C# 8.0 for modern and efficient software development
  • Usage of Microsoft.AspNetCore.Mvc for building web applications with ASP.NET Core MVC
  • Usage of Microsoft.AspNetCore.Builder for configuring and building ASP.NET Core applications
  • Usage of Microsoft.AspNetCore.Hosting for hosting ASP.NET Core applications
  • Usage of Microsoft.Extensions.DependencyInjection for dependency injection in .NET applications
  • Usage of Microsoft.Extensions.Hosting for hosting and managing .NET Core applications

Description​

Non compliant code​

public class Startup
{
    public void ConfigureServices(IServiceCollection services)
    {
        services.AddControllers();
    }

    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
        }
        else
        {
            app.UseExceptionHandler("/Home/Error");
        }

        app.UseRouting();

        // No middleware for authentication and authorization
        app.UseEndpoints(endpoints =>
        {
            endpoints.MapControllerRoute(
                name: "default",
                pattern: "{controller=Home}/{action=Index}/{id?}");
        });
    }
}

This is a basic configuration of an ASP.NET Core application in the Startup class. The ConfigureServices method is used to add services to the application's dependency injection container, and the Configure method is used to specify how these services are used by the application.

In this case, the application is configured to use controllers, routing, and exception handling, but there are no security controls in place. There is no middleware for authentication and authorization in the application's request processing pipeline. This means that all endpoints in the application are publicly accessible, and there are no checks to ensure that a user is authenticated or has the necessary permissions to access a resource.

This absence of security controls allows an attacker to bypass any security measures that should be in place, potentially leading to unauthorized access and manipulation of data.

Steps​

  • Implement authentication and authorization middleware in the application.
  • Configure the authentication middleware to authenticate incoming requests.
  • Configure the authorization middleware to authorize access to resources based on user roles or permissions.
  • Ensure that the authentication and authorization middleware is added before the UseEndpoints middleware in the Configure method.
  • Test the application to verify that the security controls are properly enforced.

Compliant code​

public class Startup
{
    public void ConfigureServices(IServiceCollection services)
    {
        services.AddControllers();

        // Add authentication services
        services.AddAuthentication(options =>
        {
            options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
            options.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
            options.DefaultChallengeScheme = CookieAuthenticationDefaults.AuthenticationScheme;
        })
        .AddCookie();

        // Add authorization services
        services.AddAuthorization(options =>
        {
            options.FallbackPolicy = new AuthorizationPolicyBuilder()
                .RequireAuthenticatedUser()
                .Build();
        });
    }

    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
        }
        else
        {
            app.UseExceptionHandler("/Home/Error");
        }

        app.UseRouting();

        // Use authentication and authorization middleware
        app.UseAuthentication();
        app.UseAuthorization();

        app.UseEndpoints(endpoints =>
        {
            endpoints.MapControllerRoute(
                name: "default",
                pattern: "{controller=Home}/{action=Index}/{id?}");
        });
    }
}

The updated code now includes the necessary middleware for authentication and authorization in the ASP.NET Core application.

In the ConfigureServices method, the AddAuthentication and AddAuthorization methods are used to add the authentication and authorization services to the application. The AddAuthentication method is configured to use cookie authentication as the default scheme. The AddAuthorization method is configured with a fallback policy that requires all users to be authenticated.

In the Configure method, the UseAuthentication and UseAuthorization methods are used to add the authentication and authorization middleware to the application's request processing pipeline. These methods are called after UseRouting and before UseEndpoints, which ensures that authentication and authorization are enforced for all incoming requests before they reach the application's endpoints.

This update should fix the security vulnerability by ensuring that all incoming requests are authenticated and authorized before they can access any resources in the application. It's recommended to test the application thoroughly to verify that the security controls are properly enforced.

References​

Last updated on