Insecure functionality - User management

Need

Secure user management and access control

Context

• Usage of Dart for building cross-platform mobile, web, and desktop applications
• Usage of Shelf for managing and organizing data in a Node.js application

Description

Non compliant code

import 'package:shelf/shelf.dart' as shelf;

class UserManagement {
  List<String> users = [];
  List<String> treatmentManagers = [];

  void addUser(String email) {
    users.add(email);
  }

  void removeUser(String email) {
    users.remove(email);
  }

  void assignTreatmentManager(String email) {
    treatmentManagers.add(email);
    sendEmail(email);
  }

  void sendEmail(String email) {
    // code to send email with vulnerability details
  }
}

void main() {
  var userManagement = UserManagement();

  var handler = const shelf.Pipeline().addMiddleware(shelf.logRequests())
      .addHandler((shelf.Request request) {
    if (request.method == 'POST') {
      var email = request.headers['email'];
      userManagement.assignTreatmentManager(email);
    }
    return shelf.Response.ok('Request processed');
  });

  shelf.serve(handler, 'localhost', 8080);
}

The code above is an example of a user management system where it is possible to assign non-users as treatment managers of vulnerabilities. The UserManagement class maintains a list of users and a list of treatment managers. The assignTreatmentManager function allows any email to be assigned as a treatment manager, without checking if the email is registered as a user. This function also sends an email to the treatment manager with the details of the vulnerabilities.

The main function sets up a server that listens for POST requests. If a POST request is received, the server retrieves the email from the request headers and assigns it as a treatment manager, regardless of whether the email is registered as a user.

This code is vulnerable because it allows non-users to be assigned as treatment managers and receive sensitive information about vulnerabilities. In addition, even if a user is removed from the system, they can still receive vulnerability details because their email remains in the treatment managers list.

Steps

• Validate the email before assigning it as a treatment manager. Check if the email is in the list of users.
• When removing a user, also remove them from the treatmentManagers list if they are present there.
• Implement a mechanism to revoke access to vulnerability information for users who have been removed.

Compliant code

import 'package:shelf/shelf.dart' as shelf;

class UserManagement {
  List<String> users = [];
  List<String> treatmentManagers = [];

  void addUser(String email) {
    users.add(email);
  }

  void removeUser(String email) {
    users.remove(email);
    if (treatmentManagers.contains(email)) {
      treatmentManagers.remove(email);
    }
  }

  void assignTreatmentManager(String email) {
    if (users.contains(email)) {
      treatmentManagers.add(email);
      sendEmail(email);
    } else {
      print('Error: User not found');
    }
  }

  void sendEmail(String email) {
    // code to send email with vulnerability details
  }
}

void main() {
  var userManagement = UserManagement();

  var handler = const shelf.Pipeline().addMiddleware(shelf.logRequests())
      .addHandler((shelf.Request request) {
    if (request.method == 'POST') {
      var email = request.headers['email'];
      if (userManagement.users.contains(email)) {
        userManagement.assignTreatmentManager(email);
      }
    }
    return shelf.Response.ok('Request processed');
  });

  shelf.serve(handler, 'localhost', 8080);
}

The updated code now includes a check to ensure that the email being assigned as a treatment manager is in the list of users. This is done in the assignTreatmentManager method of the UserManagement class. If the email is not found in the list of users, an error message is printed and the email is not added to the treatment managers list.

When a user is removed using the removeUser method, the code now also checks if the user is in the treatment managers list. If they are, they are removed from this list as well. This ensures that a user who has been removed from the system no longer has access to vulnerability information.

In the main function, before assigning the treatment manager, the code now checks if the email is in the list of users. This is an additional safeguard to ensure that only valid users can be assigned as treatment managers.

References

• 324.Insecure functionality - User management