Skip to main content

Use of an insecure channel - Telnet

Need​

Secure communication channel for transmitting customer information

Context​

  • Usage of Go 1.16 for building efficient and scalable applications
  • Usage of gin-gonic/gin for building web applications in Go
  • Usage of net for creating network connections and handling network communication

Description​

Non compliant code​

package main

import (
    "github.com/gin-gonic/gin"
    "net"
)

func main() {
    r := gin.Default()

    r.GET("/login", func(c *gin.Context) {
        username := c.Query("username")
        password := c.Query("password")

        conn, err := net.Dial("tcp", "localhost:23")
        if err != nil {
            c.JSON(500, gin.H{
                "message": "Error connecting to Telnet server",
            })
            return
        }
        defer conn.Close()

        conn.Write([]byte(username + "\\n"))
        conn.Write([]byte(password + "\\n"))
        c.JSON(200, gin.H{
            "message": "Credentials sent",
        })
    })

    r.Run()
}

The above code is an example of a Go backend application using the Gin framework. The application has a route /login where it expects a username and password as query parameters.

The vulnerability lies in the way the application handles the login credentials. After receiving the username and password, it attempts to establish a connection to a Telnet server using the net.Dial function. If the connection is successful, it writes the username and password to the connection.

Telnet is a protocol that does not use encryption, meaning all data sent over a Telnet connection is in plain text. This includes the login credentials, which are sent from the application to the Telnet server. As a result, if an attacker is able to intercept the network traffic between the application and the Telnet server, they would be able to see the login credentials in plain text.

This is a significant security vulnerability, as it exposes sensitive user information to potential interception and misuse. It is strongly recommended to avoid using insecure protocols such as Telnet for transmitting sensitive information, and to use secure, encrypted protocols instead.

Steps​

  • Replace the use of Telnet with a secure channel, such as HTTPS.
  • Use a secure communication protocol, such as TLS, to encrypt the data transmitted over the channel.
  • Implement proper authentication and authorization mechanisms to protect sensitive information.
  • Ensure that the server-side code validates and sanitizes user input to prevent injection attacks.
  • Implement secure password storage and handling practices, such as hashing and salting passwords.
  • Regularly update and patch the server and framework to address any security vulnerabilities.
  • Perform regular security audits and penetration testing to identify and address any potential vulnerabilities.

Compliant code​

package main

import (
    "crypto/tls"
    "github.com/gin-gonic/gin"
    "net"
    "net/http"
)

func main() {
    r := gin.Default()

    r.GET("/login", func(c *gin.Context) {
        username := c.Query("username")
        password := c.Query("password")

        conf := &tls.Config{
            InsecureSkipVerify: true, // This should be set to false in production
        }

        conn, err := tls.Dial("tcp", "localhost:443", conf)
        if err != nil {
            c.JSON(500, gin.H{
                "message": "Error connecting to secure server",
            })
            return
        }
        defer conn.Close()

        conn.Write([]byte(username + "\\n"))
        conn.Write([]byte(password + "\\n"))
        c.JSON(200, gin.H{
            "message": "Credentials sent",
        })
    })

    r.RunTLS(":8080", "/path/to/cert.pem", "/path/to/key.pem")
}

The updated code now uses the tls.Dial function instead of net.Dial to establish a secure connection to the server. The tls.Config struct is used to configure the TLS connection. In this case, InsecureSkipVerify is set to true to allow for local testing, but it should be set to false in a production environment to ensure that the server's certificate is verified.

The r.RunTLS function is used to start the server with HTTPS. The paths to the server's certificate and private key files are passed as arguments to this function. These files are used to establish the server's identity and to encrypt the data transmitted over the connection.

The username and password are still sent over the connection, but now they are encrypted and cannot be read in plain text. However, this code still does not implement proper authentication and authorization mechanisms, validate and sanitize user input, or securely store and handle passwords. These are important security practices that should be implemented in a production environment.

References​

Last updated on