Skip to main content

Insecure object reference - Data

Need​

Secure access control and data validation

Context​

  • Usage of C# 7.1 for developing applications with advanced language features and improvements
  • Usage of Microsoft.AspNetCore.Mvc for building web applications with ASP.NET Core
  • Usage of Microsoft.EntityFrameworkCore for working with databases in .NET applications

Description​

Non compliant code​

[HttpGet("{id}")]
public async Task<ActionResult<Member>> GetMember(int id)
{
    var member = await _context.Members.FindAsync(id);

    if (member == null)
    {
        return NotFound();
    }

    return member;
}

[HttpPut("{id}")]
public async Task<IActionResult> UpdateMember(int id, Member member)
{
    if (id != member.Id)
    {
        return BadRequest();
    }

    _context.Entry(member).State = EntityState.Modified;

    try
    {
        await _context.SaveChangesAsync();
    }
    catch (DbUpdateConcurrencyException)
    {
        if (!MemberExists(id))
        {
            return NotFound();
        }
        else
        {
            throw;
        }
    }

    return NoContent();
}

In the above code, the GetMember method retrieves a member object from the database by its identifier without checking if the current user has the necessary permissions to access this data. This is a direct object reference (IDOR) vulnerability because an attacker can guess or brute-force the id parameter to access data they are not supposed to have access to.

The UpdateMember method also suffers from the same vulnerability. It allows any user to update the member data if they know the id of the member. The method does not verify if the user making the request has the appropriate permissions to modify the data.

These vulnerabilities expose sensitive data and allow unauthorized modifications, which can lead to serious data breaches and unauthorized actions performed on behalf of other users.

Steps​

  • Implement proper authorization and authentication mechanisms to ensure that only authorized users can access and modify member data.
  • Validate the user's permissions before allowing access to member data.
  • Ensure that the user can only access and modify members that belong to the same store they are assigned to.
  • Use a secure identifier for member data that cannot be easily guessed or manipulated by users.
  • Implement access control checks at the API level to prevent unauthorized access to member data.
  • Regularly review and update the access control mechanisms to ensure they are effective and up to date.

Compliant code​

[HttpGet("{id}")]
public async Task<ActionResult<Member>> GetMember(int id)
{
    var userId = User.FindFirstValue(ClaimTypes.NameIdentifier);
    var member = await _context.Members.Where(m => m.Id == id && m.UserId == userId).FirstOrDefaultAsync();

    if (member == null)
    {
        return NotFound();
    }

    return member;
}

[HttpPut("{id}")]
public async Task<IActionResult> UpdateMember(int id, Member member)
{
    var userId = User.FindFirstValue(ClaimTypes.NameIdentifier);
    if (id != member.Id || member.UserId != userId)
    {
        return BadRequest();
    }

    _context.Entry(member).State = EntityState.Modified;

    try
    {
        await _context.SaveChangesAsync();
    }
    catch (DbUpdateConcurrencyException)
    {
        if (!MemberExists(id))
        {
            return NotFound();
        }
        else
        {
            throw;
        }
    }

    return NoContent();
}

The updated code now includes proper authorization checks to ensure that only authorized users can access and modify member data.

In the GetMember method, we now filter the members by both the member id and the user id. This ensures that the user can only access members that belong to the same store they are assigned to.

In the UpdateMember method, we now check that the member id matches the id provided in the request and that the user id matches the id of the user making the request. This ensures that only the user who is assigned to the member can modify the member data.

The user id is obtained from the User object, which is populated by ASP.NET Core based on the authenticated user's claims. This ensures that the user id cannot be easily guessed or manipulated by users.

These changes implement access control checks at the API level to prevent unauthorized access to member data. It is recommended to regularly review and update these access control mechanisms to ensure they are effective and up to date.

References​

Last updated on