Skip to main content

Insecure object reference

Need​

Secure and robust authorization mechanism to prevent unauthorized access to sensitive data

Context​

  • Usage of Java 8 for developing applications with enhanced features and performance
  • Usage of javax.servlet-api for building Java web applications with Servlets

Description​

Non compliant code​

import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

public class UserServlet extends HttpServlet {

    public void doGet(HttpServletRequest request, HttpServletResponse response) {
        String id = request.getParameter("id");
        User user = Database.getUser(id);
        request.setAttribute("user", user);
        request.getRequestDispatcher("/user.jsp").forward(request, response);
    }
}

The above code is an example of an insecure object reference vulnerability. This servlet is designed to fetch a user's data from the database and display it on a webpage.

The vulnerability lies in the doGet method. The method retrieves the user ID from the request parameter and uses it to fetch the user's data from the database. There is no authorization check to make sure that the user who sent the request has the right to access the data of the user with the given ID.

This means that if an attacker can guess or otherwise obtain a valid user ID, they can simply modify the 'id' parameter in the request to gain access to that user's data. This is a serious security flaw, as it can lead to unauthorized access to sensitive information.

Steps​

  • Implement proper authentication and authorization mechanisms to ensure that users can only access their own data.
  • Avoid using direct object references as identifiers for sensitive data.
  • Use a secure and unique identifier for each user's data, such as a session token or a randomly generated UUID.
  • Validate and sanitize user input to prevent any malicious modification of the identifier.
  • Implement access control checks to verify that the authenticated user has the necessary permissions to access the requested data.
  • Consider implementing a layered architecture with separate components for authentication, authorization, and data access to enforce security measures consistently.

Compliant code​

import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

public class UserServlet extends HttpServlet {

    public void doGet(HttpServletRequest request, HttpServletResponse response) {
        HttpSession session = request.getSession();
        User sessionUser = (User) session.getAttribute("user");
        
        if (sessionUser == null) {
            // redirect to login page
            response.sendRedirect("/login.jsp");
            return;
        }

        String id = request.getParameter("id");

        // Validate and sanitize the input
        if (!isValid(id)) {
            // redirect to error page
            response.sendRedirect("/error.jsp");
            return;
        }

        User user = Database.getUser(id);

        // Check if the authenticated user is the same as the requested user
        if (!sessionUser.getId().equals(user.getId())) {
            // redirect to error page
            response.sendRedirect("/error.jsp");
            return;
        }

        request.setAttribute("user", user);
        request.getRequestDispatcher("/user.jsp").forward(request, response);
    }

    private boolean isValid(String id) {
        // Implement your validation logic here
        return true;
    }
}

The updated code includes several security measures to prevent insecure direct object references:

  1. Session Management: The code retrieves the current user from the session. If there is no user in the session (i.e., the user is not authenticated), it redirects to the login page.

  2. Input Validation: The code validates the id parameter from the request. If the id is not valid, it redirects to an error page. This validation logic should be implemented in the isValid method.

  3. Access Control: The code checks if the authenticated user's ID matches the requested user's ID. If they do not match (i.e., the user is trying to access someone else's data), it redirects to an error page.

These measures ensure that only authenticated users can access their own data, and they prevent users from accessing other users' data by modifying the id parameter.

References​

Last updated on