Skip to main content

Insecure object reference - Data

Need​

Secure access control and validation of user permissions

Context​

  • Usage of Dart 2.0 for building high-performance, cross-platform applications
  • Usage of Shelf for managing data storage and retrieval

Description​

Non compliant code​

import 'package:shelf/shelf.dart' as shelf;

class Store {
  final String id;
  final List<Member> members;

  Store(this.id, this.members);
}

class Member {
  final String id;
  final String name;

  Member(this.id, this.name);
}

Map<String, Store> stores = {
  'store1': Store('store1', [Member('1', 'John Doe'), Member('2', 'Jane Doe')]),
  'store2': Store('store2', [Member('3', 'Jimmy Doe'), Member('4', 'Jenny Doe')]),
};

shelf.Response handleRequest(shelf.Request request) {
  var storeId = request.url.pathSegments.first;
  var memberId = request.url.pathSegments[1];

  var store = stores[storeId];
  var member = store.members.firstWhere((m) => m.id == memberId);

  return shelf.Response.ok('Member: ${member.name}');
}

The above code is an example of a Dart application using the Shelf framework, which is vulnerable to Insecure Direct Object References (IDOR).

The handleRequest function is supposed to handle incoming requests and return information about a member of a store. It does this by taking the first path segment of the URL as the store ID and the second path segment as the member ID. Then, it looks up the store in the stores map and finds the member in the members list of the store.

The vulnerability lies in the fact that no authorization checks are performed. Any user that knows the store ID and member ID can access the member's information, even if they don't have the necessary permissions.

This could potentially allow an attacker to access sensitive information, modify members or add new members to stores that they should not have access to.

In a real-world application, the stores map and Member class would likely be replaced with a database or other persistent storage, and the handleRequest function would be part of a larger routing system. However, the core vulnerability would remain the same.

Steps​

  • Introduce an authentication mechanism to verify the identity of the user making the request.
  • Implement an authorization mechanism to check if the authenticated user has the necessary permissions to access the requested store and member.
  • Ensure that the authorization mechanism checks both the store ID and the member ID against the authenticated user's permissions.
  • If the user does not have the necessary permissions, the request should be denied and an appropriate error message should be returned.
  • Consider using role-based access control (RBAC) or attribute-based access control (ABAC) for implementing the authorization mechanism.
  • Ensure that the authorization checks are performed at every point where sensitive data is accessed, not just at the initial point of entry.

Compliant code​

import 'package:shelf/shelf.dart' as shelf;

class Store {
  final String id;
  final List<Member> members;

  Store(this.id, this.members);
}

class Member {
  final String id;
  final String name;

  Member(this.id, this.name);
}

class User {
  final String id;
  final List<String> storePermissions;

  User(this.id, this.storePermissions);
}

Map<String, Store> stores = {
  'store1': Store('store1', [Member('1', 'John Doe'), Member('2', 'Jane Doe')]),
  'store2': Store('store2', [Member('3', 'Jimmy Doe'), Member('4', 'Jenny Doe')]),
};

Map<String, User> users = {
  'user1': User('user1', ['store1']),
  'user2': User('user2', ['store2']),
};

shelf.Response handleRequest(shelf.Request request) {
  var userId = request.headers['user-id'];
  var user = users[userId];

  if (user == null) {
    return shelf.Response.forbidden('Invalid user');
  }

  var storeId = request.url.pathSegments.first;
  if (!user.storePermissions.contains(storeId)) {
    return shelf.Response.forbidden('Access denied to this store');
  }

  var store = stores[storeId];
  var memberId = request.url.pathSegments[1];
  var member = store.members.firstWhere((m) => m.id == memberId, orElse: () => null);

  if (member == null) {
    return shelf.Response.notFound('Member not found');
  }

  return shelf.Response.ok('Member: ${member.name}');
}

The updated code introduces an authentication and authorization mechanism to prevent insecure object reference.

Firstly, a new User class is introduced. Each user has an id and a list of storePermissions which are the IDs of the stores that the user has access to.

The handleRequest function now first checks the user-id from the request headers. If the user-id is not found in the users map, a 403 Forbidden response is returned.

Next, the function checks if the user has permission to access the requested store by checking if the storeId is in the user's storePermissions. If the user does not have permission, a 403 Forbidden response is returned.

Finally, the function checks if the requested member exists in the store. If the member does not exist, a 404 Not Found response is returned.

This way, the application ensures that only authenticated users with the necessary permissions can access the store and member data, thus fixing the insecure object reference vulnerability.

References​

Last updated on