Skip to main content

Non-encrypted confidential information - Credit Cards

Need​

Secure encryption and masking of credit card information

Context​

  • Usage of C# for building robust and scalable applications
  • Usage of Microsoft.AspNetCore.Mvc for building web applications with ASP.NET Core MVC

Description​

Non compliant code​

public class PaymentController : Controller
{
    [HttpPost]
    public IActionResult ProcessPayment(string cardNumber, string expiryDate, string cvv)
    {
        // Process Payment
        return Ok();
    }
}

The above code is a simple representation of a payment processing endpoint in an ASP.NET Core application. The ProcessPayment method takes in three parameters - cardNumber, expiryDate, and cvv - which represent the credit card details.

The vulnerability lies in the fact that these details are being transmitted in plaintext. There is no encryption being applied before the data is sent or received. This means that if an attacker is able to intercept the data transmission, they would be able to read the credit card details.

Additionally, the data is also not being masked. This means that even if the data is not intercepted, it could still be exposed in logs or other monitoring tools.

This is a serious vulnerability as it exposes sensitive user information. It is a violation of the PCI DSS standards, which require that all sensitive cardholder data be encrypted during transmission over open, public networks.

Steps​

  • Implement encryption for sensitive payment card information.
  • Use secure protocols (e.g., HTTPS) to transmit the data between the client and the server.
  • Mask the sensitive payment card information on the client-side before sending it to the server.
  • Implement server-side validation to ensure the received payment card information is valid and meets the required format.
  • Store the payment card information securely in a protected and encrypted format.
  • Follow the PCI DSS standard guidelines for handling and storing payment card information.
  • Regularly update and patch the server and application to address any security vulnerabilities.

Compliant code​

public class PaymentController : Controller
{
    private readonly IDataProtector _protector;

    public PaymentController(IDataProtectionProvider provider)
    {
        _protector = provider.CreateProtector("PaymentController_Protector");
    }

    [HttpPost]
    public IActionResult ProcessPayment(string cardNumber, string expiryDate, string cvv)
    {
        string encryptedCardNumber = _protector.Protect(cardNumber);
        string encryptedExpiryDate = _protector.Protect(expiryDate);
        string encryptedCvv = _protector.Protect(cvv);

        // Process Payment with encryptedCardNumber, encryptedExpiryDate, encryptedCvv

        return Ok();
    }
}

The updated code now includes encryption for sensitive payment card information. The IDataProtector interface from the Microsoft.AspNetCore.DataProtection namespace is used to encrypt the card details before processing the payment.

The IDataProtectionProvider is injected into the controller and a protector is created with a specific purpose string. This protector is then used to encrypt the card number, expiry date, and CVV.

Please note that this is just one part of the solution. To fully secure the payment card information, you should also:

  • Use secure protocols (e.g., HTTPS) to transmit the data between the client and the server.
  • Mask the sensitive payment card information on the client-side before sending it to the server.
  • Implement server-side validation to ensure the received payment card information is valid and meets the required format.
  • Store the payment card information securely in a protected and encrypted format.
  • Follow the PCI DSS standard guidelines for handling and storing payment card information.
  • Regularly update and patch the server and application to address any security vulnerabilities.

References​

Last updated on