Skip to main content

Insecure object reference - Financial information

Need​

Secure access to financial information

Context​

  • Usage of Go 1.15 for building efficient and scalable applications
  • Usage of gin-gonic/gin for building web applications and APIs in Go
  • Usage of net/http for handling HTTP requests and responses in a Node.js server

Description​

Non compliant code​

package main

import (
	"github.com/gin-gonic/gin"
	"net/http"
)

type CreditCard struct {
	Number string
	Expenses float64
	Movements []string
}

var cards = map[string]*CreditCard{
	"123": &CreditCard{
		Number: "123",
		Expenses: 100.0,
		Movements: []string{"Purchase at Amazon", "Purchase at Walmart"},
	},
}

func main() {
	r := gin.Default()
	r.GET("/card/:number", func(c *gin.Context) {
		number := c.Param("number")
		card, ok := cards[number]
		if !ok {
			c.JSON(http.StatusNotFound, gin.H{"status": "card not found"})
			return
		}
		c.JSON(http.StatusOK, gin.H{"status": "ok", "card": card})
	})
	r.Run()
}

This code is a simple backend application written in Go using the Gin framework. It has a single endpoint /card/:number that allows the client to fetch information about a credit card by its number.

The application stores credit card information in a map where the key is the credit card number and the value is a struct containing the number, expenses, and movements associated with the credit card.

The vulnerability lies in the GET handler function for the /card/:number route. The function extracts the credit card number from the URL parameters and uses it to fetch the credit card information from the map. If the card number exists in the map, it returns the card information in the response.

This is an insecure direct object reference (IDOR) vulnerability because it allows any client to fetch the information of any credit card by simply knowing or guessing its number. It does not verify if the client is authorized to access the card information before returning it in the response. Thus, an attacker could potentially access sensitive financial information associated with any credit card.

Steps​

  • Implement proper authentication and authorization mechanisms to ensure that only authorized users can access the credit card information.
  • Associate the credit card information with the user account and validate that the user requesting the information is the owner of the credit card.
  • Use session management to securely store and retrieve the user's session information.
  • Encrypt the credit card number and other sensitive information to protect it from unauthorized access.
  • Implement access controls to restrict access to the credit card information based on user roles and permissions.
  • Regularly review and update the code to address any new vulnerabilities or security risks.

Compliant code​

package main

import (
	"github.com/gin-gonic/gin"
	"net/http"
)

type User struct {
	ID string
	CreditCards map[string]*CreditCard
}

type CreditCard struct {
	Number string
	Expenses float64
	Movements []string
}

var users = map[string]*User{
	"1": &User{
		ID: "1",
		CreditCards: map[string]*CreditCard{
			"123": &CreditCard{
				Number: "123",
				Expenses: 100.0,
				Movements: []string{"Purchase at Amazon", "Purchase at Walmart"},
			},
		},
	},
}

func main() {
	r := gin.Default()
	r.Use(AuthMiddleware())
	r.GET("/user/:id/card/:number", func(c *gin.Context) {
		userID := c.Param("id")
		number := c.Param("number")
		user, ok := users[userID]
		if !ok {
			c.JSON(http.StatusNotFound, gin.H{"status": "user not found"})
			return
		}
		card, ok := user.CreditCards[number]
		if !ok {
			c.JSON(http.StatusNotFound, gin.H{"status": "card not found"})
			return
		}
		c.JSON(http.StatusOK, gin.H{"status": "ok", "card": card})
	})
	r.Run()
}

func AuthMiddleware() gin.HandlerFunc {
	return func(c *gin.Context) {
		// Implement your session validation logic here, for example JWT token validation
		// If session is valid, set the user ID in the context with: c.Set("userID", userID)
		// If session is not valid, return an error with: c.JSON(http.StatusUnauthorized, gin.H{"status": "unauthorized"})
	}
}

The updated code now includes an AuthMiddleware function that is used to validate the user's session. This middleware should contain the logic for validating the user's session, such as JWT token validation. If the session is valid, the user ID is set in the context. If the session is not valid, an error is returned.

The route for getting the credit card information now also includes the user ID. This is used to first check if the user exists, and then if the credit card belongs to the user. If either check fails, an error is returned.

This way, only the user who owns the credit card can access its information, preventing unauthorized access. The credit card information is also associated with the user account, ensuring that it cannot be accessed from a different account.

Please note that this code is a basic example and does not include the encryption of the credit card number or other sensitive information. It is recommended to implement encryption to further protect this information from unauthorized access.

References​

Last updated on