Skip to main content

Insecure functionality - File Creation

Need​

Secure and enforce server-side restrictions on file creation functionality

Context​

  • Usage of Dart 2.0 for building high-performance, cross-platform applications
  • Usage of Shelf for managing and organizing data in a Node.js application

Description​

Non compliant code​

import 'package:shelf/shelf.dart' as shelf;

Future<shelf.Response> createFileHandler(shelf.Request request) async {
  var fileName = request.url.queryParameters['fileName'];

  // Create the file without checking user permissions
  var file = File(fileName);
  await file.create();

  return shelf.Response.ok('File created successfully');
}

void main() {
  var handler = const shelf.Pipeline().addMiddleware(shelf.logRequests()).addHandler(createFileHandler);

  io.serve(handler, 'localhost', 8080).then((server) {
    print('Serving at http://${server.address.host}:${server.port}');
  });
}

The code above represents a simple server using the Shelf framework in Dart. It has a single endpoint that creates a file with a name specified in the query parameters of the request.

The vulnerability lies in the createFileHandler function. This function takes a request, extracts the filename from the query parameters, and creates a file with that name. The problem is that there is no check for user permissions before creating the file. This means that even if a user's profile restricts file creation, they can still create a file by sending a request to this endpoint.

In the main function, this handler is added to the server pipeline without any middleware that would check for user permissions. This means that any request that reaches the createFileHandler can create a file, regardless of the user's permissions.

This is an example of insecure functionality where the restriction (in this case, the restriction on file creation) is only enforced on the front end by disabling a button. A malicious user can bypass this front-end restriction by manually sending a request to the server. Because the server does not check for user permissions before processing the request, the file creation will be successful even if the user's profile restricts this function.

Steps​

  • Introduce an authentication middleware to verify the user's identity before processing the request.
  • Implement an authorization check in the 'createFileHandler' function to verify if the authenticated user has the necessary permissions to create a file.
  • Do not rely solely on the front-end to disable certain functions based on user profiles. Always perform server-side checks to validate user permissions.
  • Consider using role-based access control (RBAC) or similar access control mechanisms to manage user permissions effectively.
  • Ensure that the file creation process is secure and does not allow for arbitrary file creation which could lead to security issues.

Compliant code​

import 'package:shelf/shelf.dart' as shelf;
import 'package:shelf_auth/shelf_auth.dart';

Future<shelf.Response> createFileHandler(shelf.Request request) async {
  var user = request.context['user'] as User;
  if (user == null || !user.canCreateFiles) {
    return shelf.Response.forbidden('You do not have permission to create files');
  }

  var fileName = request.url.queryParameters['fileName'];

  // Create the file after checking user permissions
  var file = File(fileName);
  await file.create();

  return shelf.Response.ok('File created successfully');
}

void main() {
  var authMiddleware = authenticate([new JwtAuthenticator('sharedSecret')]);

  var handler = const shelf.Pipeline()
      .addMiddleware(shelf.logRequests())
      .addMiddleware(authMiddleware)
      .addHandler(createFileHandler);

  io.serve(handler, 'localhost', 8080).then((server) {
    print('Serving at http://${server.address.host}:${server.port}');
  });
}

The updated code introduces an authentication middleware using the shelf_auth package. This middleware authenticates the user before any request is processed. The JwtAuthenticator is used in this case, which authenticates users based on JSON Web Tokens (JWT). The 'sharedSecret' is the secret key used to sign the JWTs.

In the createFileHandler function, we first retrieve the authenticated user from the request context. If the user is not authenticated or does not have the necessary permissions to create files (checked using a hypothetical canCreateFiles property on the User model), a 403 Forbidden response is returned.

If the user is authenticated and has the necessary permissions, the file creation process proceeds as before.

This ensures that only authenticated users with the necessary permissions can create files, addressing the vulnerability in the original code. The server-side checks for user permissions ensure that the function cannot be bypassed by manipulating the front-end.

Please note that this code assumes the existence of a User model with a canCreateFiles property. You will need to replace this with your actual user model and permission checking logic.

References​

Last updated on