Skip to main content

Authentication mechanism absence or evasion - Admin Console

Need​

Implementation of a robust and secure authentication mechanism for the Admin Console

Context​

  • Usage of Dart for building cross-platform mobile, web, and desktop applications
  • Usage of Shelf for managing and organizing data in a Node.js application
  • Usage of shelf_io for handling input/output operations with Shelf

Description​

Non compliant code​

import 'package:shelf/shelf.dart' as shelf;
import 'package:shelf/shelf_io.dart' as io;

void main() {
  var handler = const shelf.Pipeline()
      .addMiddleware(shelf.logRequests())
      .addHandler(_echoRequest);

  io.serve(handler, 'localhost', 8080);
}

shelf.Response _echoRequest(shelf.Request request) {
  // some functions can be accessed without having to be logged into the server
  if (request.url.path == 'admin') {
    return shelf.Response.ok('Admin console access granted');
  }
  return shelf.Response.ok('Hello, World!');
}

In the above code, the server is set up using the shelf package in Dart. A middleware is added to log the requests and the handler _echoRequest is defined to handle the requests.

The vulnerability lies in the _echoRequest function. This function checks if the requested URL path is 'admin'. If it is, it returns a response with the message 'Admin console access granted', without performing any authentication or checking if the user is logged in. This allows any user to access the admin console just by navigating to the 'admin' URL path.

Furthermore, if the URL path is not 'admin', the function returns a 'Hello, World!' message, again without performing any authentication. This means that some functions of the application can be accessed without having to be logged in. This is a major security vulnerability as it allows unauthorized users to view and possibly edit some values.

Steps​

  • Implement an authentication middleware that checks if a user is authenticated before they can access certain routes.
  • The middleware should check for a valid session or token in the request headers.
  • If a valid session or token is not found, the middleware should return an error response indicating that authentication is required.
  • For the 'admin' route, add an additional authorization check in the middleware to verify if the authenticated user has admin privileges.
  • If the user does not have admin privileges, the middleware should return an error response indicating that the user is not authorized to access the route.
  • Ensure that the authentication and authorization checks are performed before any other processing in the '_echoRequest' function.

Compliant code​

import 'package:shelf/shelf.dart' as shelf;
import 'package:shelf/shelf_io.dart' as io;

void main() {
  var handler = const shelf.Pipeline()
      .addMiddleware(shelf.logRequests())
      .addMiddleware(_authenticationMiddleware)
      .addHandler(_echoRequest);

  io.serve(handler, 'localhost', 8080);
}

shelf.Middleware _authenticationMiddleware() {
  return (shelf.Handler innerHandler) {
    return (shelf.Request request) async {
      final sessionToken = request.headers['session-token'];
      
      // Check if session token is valid
      if (sessionToken == null || !isValidSessionToken(sessionToken)) {
        return shelf.Response.forbidden('Authentication required');
      }

      // Check if user has admin privileges for 'admin' route
      if (request.url.path == 'admin' && !isAdmin(sessionToken)) {
        return shelf.Response.forbidden('User not authorized');
      }

      return innerHandler(request);
    };
  };
}

shelf.Response _echoRequest(shelf.Request request) {
  if (request.url.path == 'admin') {
    return shelf.Response.ok('Admin console access granted');
  }
  return shelf.Response.ok('Hello, World!');
}

bool isValidSessionToken(String token) {
  // Implement your logic to validate session token
}

bool isAdmin(String token) {
  // Implement your logic to check if user has admin privileges
}

The updated code includes an authentication middleware _authenticationMiddleware that is added to the pipeline before the _echoRequest handler. This middleware intercepts every request and performs authentication and authorization checks.

The middleware retrieves the session token from the request headers and checks if it is valid by calling the isValidSessionToken function. If the session token is not valid or not present, it returns a 403 Forbidden response with a message indicating that authentication is required.

For requests to the 'admin' route, the middleware performs an additional authorization check by calling the isAdmin function. If the user associated with the session token does not have admin privileges, it returns a 403 Forbidden response with a message indicating that the user is not authorized to access the route.

If the session token is valid and the user has the necessary privileges for the requested route, the middleware forwards the request to the _echoRequest handler.

The isValidSessionToken and isAdmin functions are placeholders for your actual implementation of session token validation and admin privilege checking.

References​

Last updated on