Skip to main content

Insecure temporary files

Need​

Secure handling of temporary files

Context​

  • Usage of Dart 2.0 for building high-performance, cross-platform applications
  • Usage of Shelf for managing data persistence and querying in Node.js applications

Description​

Non compliant code​

import 'package:shelf/shelf.dart' as shelf;
import 'dart:io';

shelf.Response handleRequest(shelf.Request request) {
  var tempFile = File('temp.txt');
  tempFile.writeAsStringSync('Sensitive Information');
  // other processing...
  tempFile.deleteSync();
  return shelf.Response.ok('Request Processed');
}

The above code is an example of a vulnerability in a Dart backend application using the Shelf framework. The vulnerability lies in the insecure handling of temporary files that store sensitive information.

In the handleRequest function, a temporary file temp.txt is created and sensitive information is written to it. This information is stored in plain text, making it easily accessible by anyone who can access the file system.

Moreover, even though the file is deleted after processing, there is a time frame during which the sensitive information is exposed. If an attacker gains access to the system during this period, they can read the sensitive information.

Furthermore, if the application crashes or is forcefully stopped before the deleteSync method is called, the temporary file will not be deleted, leaving the sensitive information exposed indefinitely.

This is a common vulnerability in applications that use temporary files to store sensitive data. It can lead to information disclosure, which could be exploited by an attacker to gain unauthorized access to sensitive data.

Steps​

  • Avoid storing sensitive information in temporary files. If it's necessary, ensure the files are securely deleted after use.
  • Use secure methods to create temporary files. Ensure that the file is created with restrictive permissions to prevent unauthorized access.
  • Consider using in-memory data structures to store temporary data instead of using disk-based temporary files.
  • If the sensitive information must be written to a file, consider encrypting the data before writing it to the file.
  • Ensure that the temporary files are not deployed to the production environment. Configure your deployment process to exclude these files.

Compliant code​

import 'package:shelf/shelf.dart' as shelf;
import 'dart:io';
import 'dart:convert';
import 'package:crypto/crypto.dart';

shelf.Response handleRequest(shelf.Request request) {
  // Use in-memory data structure to store sensitive information
  var sensitiveInfo = 'Sensitive Information';
  var bytes = utf8.encode(sensitiveInfo); // data being hashed

  var digest = sha256.convert(bytes); // Hashing sensitive information

  // If it's necessary to write to a file, encrypt the data
  var tempFile = File('temp.txt');
  tempFile.writeAsStringSync(digest.toString());

  // other processing...

  // Securely delete the file after use
  tempFile.deleteSync();
  return shelf.Response.ok('Request Processed');
}

The updated code now uses an in-memory data structure to store the sensitive information instead of a temporary file. This reduces the risk of unauthorized access to the sensitive information.

If it's necessary to write the sensitive information to a file, the information is now hashed using the SHA-256 algorithm before being written to the file. This ensures that even if an unauthorized user gains access to the file, they will not be able to understand the sensitive information because it is encrypted.

After the sensitive information is no longer needed, the temporary file is securely deleted. This ensures that the sensitive information is not left lying around where it could be accessed by an unauthorized user.

Finally, ensure that your deployment process is configured to exclude these temporary files from being deployed to the production environment. This will prevent any sensitive information from accidentally being exposed in the production environment.

References​

Last updated on