Skip to main content

Insecure object reference - Files

Need​

Secure and controlled access to user files

Context​

  • Usage of Dart 2.0 for developing high-performance, cross-platform applications
  • Usage of Shelf for managing and organizing data in a Node.js application
  • Usage of shelf_io for managing and interacting with data storage in Node.js

Description​

Non compliant code​

import 'package:shelf/shelf.dart' as shelf;
import 'package:shelf/shelf_io.dart' as io;

void main() {
  var handler = const shelf.Pipeline().addMiddleware(shelf.logRequests())
      .addHandler(_echoRequest);

  io.serve(handler, 'localhost', 8080);
}

shelf.Response _echoRequest(shelf.Request request) {
  var id = request.url.queryParameters['id'];
  // Fetching file based on the id without any validation
  var file = fetchFile(id);
  return shelf.Response.ok('File: $file');
}

fetchFile(id){
  // Fetches the file based on the id from the database
  // This function is just for representation and does not contain actual implementation
}

In the above code, we are creating a simple server using the Shelf framework in Dart. The _echoRequest function is handling all incoming requests. It is extracting the 'id' from the request's URL query parameters and directly fetching the file related to this 'id' from the database.

The vulnerability here is the insecure direct object reference (IDOR). The application is using the direct object id from the user's request to fetch the file. An attacker can change the 'id' in the URL to any other valid 'id' and get unauthorized access to other user's files.

The application is not checking if the user making the request has the necessary permissions to access the file related to the 'id' from the URL. This could lead to information disclosure as an attacker can potentially access any file just by knowing its 'id'.

To fix this vulnerability, we need to implement an access control check before fetching the file from the database. The access control check should verify if the user making the request has the necessary permissions to access the file related to the 'id' from the URL.

Steps​

  • Implement an authentication mechanism to ensure that the user is logged in before they can access any files.
  • After authentication, implement an authorization check to ensure that the logged-in user has the necessary permissions to access the requested file.
  • Instead of directly using the 'id' from the request to fetch the file, use the user's session information to determine which files they should have access to.
  • Consider using a server-side session management system to store and manage user session information securely.
  • Ensure that the session management system is secure against session hijacking and session fixation attacks.
  • Consider using an indirect object reference map, where the application uses a map that points from a list of random or hashed values to the actual file references. This way, even if an attacker guesses a file's identifier, they cannot access it without the correct mapping value.

Compliant code​

import 'package:shelf/shelf.dart' as shelf;
import 'package:shelf/shelf_io.dart' as io;

void main() {
  var handler = const shelf.Pipeline().addMiddleware(shelf.logRequests())
      .addMiddleware(_authenticationMiddleware)
      .addHandler(_echoRequest);

  io.serve(handler, 'localhost', 8080);
}

shelf.Middleware _authenticationMiddleware() {
  return (shelf.Handler innerHandler) {
    return (shelf.Request request) async {
      var sessionId = request.headers['session-id'];
      if (sessionId == null || !isValidSession(sessionId)) {
        return shelf.Response.forbidden('Invalid session');
      }
      return innerHandler(request.change(context: {'session-id': sessionId}));
    };
  };
}

bool isValidSession(String sessionId) {
  // Validate the session id
  // This function is just for representation and does not contain actual implementation
  return true;
}

shelf.Response _echoRequest(shelf.Request request) {
  var sessionId = request.context['session-id'];
  var id = request.url.queryParameters['id'];
  // Fetching file based on the id and session id
  var file = fetchFile(id, sessionId);
  return shelf.Response.ok('File: $file');
}

fetchFile(id, sessionId){
  // Fetches the file based on the id and session id from the database
  // This function is just for representation and does not contain actual implementation
}

The updated code includes an authentication middleware that checks if the request contains a valid session id in the headers. If the session id is not present or is invalid, the middleware returns a 403 Forbidden response. If the session id is valid, it is added to the request context and passed to the next handler.

In the _echoRequest handler, the session id is retrieved from the request context and used along with the file id to fetch the file. This ensures that the file is only fetched if the user associated with the session id has the necessary permissions to access it.

The isValidSession function is a placeholder for the actual session validation logic. This function should check if the session id is valid, i.e., if it corresponds to a logged-in user and has not expired.

The fetchFile function is also a placeholder for the actual file fetching logic. This function should fetch the file with the given id from the database, but only if the user associated with the session id has the necessary permissions to access it.

This approach ensures that only authenticated and authorized users can access files, thereby fixing the insecure object reference vulnerability.

References​

Last updated on