Skip to main content

Insecure functionality - File Creation

Need​

Secure and enforce server-side restrictions on file creation functionality

Context​

  • Usage of C# 7.1 for developing applications with advanced language features and improvements
  • Usage of Microsoft.AspNetCore.Mvc for building web applications with ASP.NET Core
  • Usage of Microsoft.AspNetCore.Hosting for hosting ASP.NET Core applications
  • Usage of System.IO for input and output operations in .NET development

Description​

Non compliant code​

[HttpPost]
public async Task<IActionResult> CreateFile(string fileName, string fileContent)
{
    // No server-side check for user permissions
    string path = Path.Combine(_hostingEnvironment.WebRootPath, fileName);
    System.IO.File.WriteAllText(path, fileContent);
    return Ok();
}

The above code is an ASP.NET Core controller action that creates a file in the web root directory with the specified fileName and fileContent. This action is vulnerable because it does not perform any server-side checks to verify if the authenticated user has the necessary permissions to create a file.

The vulnerability lies in the fact that the restriction is performed only on the client-side (front end) by disabling the corresponding button for users who do not have the necessary permissions. However, a malicious user can easily bypass this client-side restriction by directly sending a POST request to the CreateFile endpoint.

Since there are no server-side checks, the application will process the request and create the file, thereby allowing the user to perform an action that they should not be allowed to do. This is a significant security flaw as it could potentially allow unauthorized file creation, leading to various types of attacks such as data tampering or unauthorized access to sensitive information.

Steps​

  • Implement server-side authorization checks to ensure that only authorized users can create files.
  • Validate the user's permissions before allowing the file creation process.
  • Use a secure file naming convention to prevent any potential security risks.
  • Sanitize and validate the file content to prevent any potential security vulnerabilities.
  • Consider implementing file size restrictions to prevent abuse or denial of service attacks.
  • Implement logging and monitoring to track any suspicious file creation activities.

Compliant code​

[HttpPost]
[Authorize(Roles = "Admin")] // Only allow users with Admin role to create files
public async Task<IActionResult> CreateFile(string fileName, string fileContent)
{
    // Check if the user is authenticated and has the necessary permissions
    var user = await _userManager.GetUserAsync(User);
    if (user == null || !await _userManager.IsInRoleAsync(user, "Admin"))
    {
        return Unauthorized();
    }

    // Sanitize and validate the file name and content
    fileName = SanitizeFileName(fileName);
    if (!IsValidFileName(fileName) || !IsValidFileContent(fileContent))
    {
        return BadRequest();
    }

    // Check the file size to prevent abuse or denial of service attacks
    if (Encoding.UTF8.GetByteCount(fileContent) > MaxFileSize)
    {
        return BadRequest("File size exceeds the limit");
    }

    // Write the file to the server
    string path = Path.Combine(_hostingEnvironment.WebRootPath, fileName);
    System.IO.File.WriteAllText(path, fileContent);

    // Log the file creation activity
    _logger.LogInformation($"User {user.UserName} created a file {fileName}");

    return Ok();
}

The updated code now includes server-side authorization checks to ensure that only authenticated users with the necessary permissions can create files. This is done by using the [Authorize] attribute and checking the user's role with _userManager.IsInRoleAsync().

The file name and content are sanitized and validated before the file is created. This is done by calling SanitizeFileName() and IsValidFileName() for the file name, and IsValidFileContent() for the file content. These methods should be implemented to perform the necessary sanitization and validation checks.

The file size is also checked to prevent abuse or denial of service attacks. This is done by checking the byte count of the file content and comparing it to a predefined maximum file size (MaxFileSize).

Finally, the file creation activity is logged using _logger.LogInformation(). This can help track any suspicious file creation activities.

References​

Last updated on