Skip to main content

Business information leak

Need​

Protection of sensitive business information from unauthorized access or leakage

Context​

  • Usage of Java for building cross-platform applications
  • Usage of javax.servlet for building Java web applications with Servlet technology
  • Usage of java.io for input and output operations in Java

Description​

Non compliant code​

import javax.servlet.*;
import javax.servlet.http.*;
import java.io.*;

public class BusinessInfoServlet extends HttpServlet {
    public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        response.setContentType("text/html");
        PrintWriter out = response.getWriter();

        //This is the sensitive business information
        String[] usernames = {"user1", "user2", "user3"};
        String strategicInfo = "Our new product will be launched next month";
        String[] employees = {"John", "Mike", "Sarah"};
        String[] clients = {"Client1", "Client2", "Client3"};
        String[] providers = {"Provider1", "Provider2", "Provider3"};

        out.println("<html><body>");
        out.println("<h1>Business Information</h1>");
        out.println("<h2>Usernames</h2>");
        for(String username : usernames) {
            out.println("<p>" + username + "</p>");
        }
        out.println("<h2>Strategic Information</h2>");
        out.println("<p>" + strategicInfo + "</p>");
        out.println("<h2>Employees</h2>");
        for(String employee : employees) {
            out.println("<p>" + employee + "</p>");
        }
        out.println("<h2>Clients</h2>");
        for(String client : clients) {
            out.println("<p>" + client + "</p>");
        }
        out.println("<h2>Providers</h2>");
        for(String provider : providers) {
            out.println("<p>" + provider + "</p>");
        }
        out.println("</body></html>");
    }
}

The above code is an example of a servlet that leaks sensitive business information. The servlet responds to GET requests by writing sensitive business information directly to the response's output stream. This information is then sent back to the client and can be viewed by anyone who makes a GET request to the servlet.

The servlet leaks the following types of business information:

  • Usernames: An array of usernames is written to the response. This could potentially allow an attacker to know the usernames of all users in the system, which could be used in further attacks such as brute force password guessing.
  • Strategic Information: Strategic business information is written to the response. This could potentially give competitors or other malicious actors insight into the company's future plans.
  • Employees: An array of employee names is written to the response. This could potentially be used by attackers to target specific employees in social engineering attacks.
  • Clients: An array of client names is written to the response. This could potentially be used by competitors or other malicious actors to target the company's clients.
  • Providers: An array of provider names is written to the response. This could potentially be used by competitors or other malicious actors to target the company's providers.

This code is vulnerable because it does not restrict access to the sensitive business information. Any client that sends a GET request to the servlet can view the information.

Steps​

  • Avoid hardcoding sensitive information in the code
  • Store sensitive information in a secure location, such as a database or encrypted file
  • Implement access control mechanisms to restrict who can access the sensitive information
  • Use proper authentication and authorization techniques to ensure only authorized users can access the sensitive information
  • Implement secure communication protocols, such as HTTPS, to protect the transmission of sensitive information
  • Regularly update and patch the software to fix any known vulnerabilities
  • Perform security testing and code reviews to identify and fix any potential vulnerabilities

Compliant code​

import javax.servlet.*;
import javax.servlet.http.*;
import java.io.*;
import java.sql.*; // Import for database connection

public class BusinessInfoServlet extends HttpServlet {
    public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        response.setContentType("text/html");
        PrintWriter out = response.getWriter();

        // Implement authentication and authorization checks
        HttpSession session = request.getSession();
        if (session.getAttribute("authenticated") == null || !(Boolean) session.getAttribute("authenticated")) {
            out.println("Unauthorized access. Please login to continue.");
            return;
        }

        // Connect to the database to retrieve sensitive business information
        try {
            Class.forName("com.mysql.jdbc.Driver");
            Connection con = DriverManager.getConnection("jdbc:mysql://localhost:3306/mydb", "user", "password");

            Statement stmt = con.createStatement();
            ResultSet rs = stmt.executeQuery("SELECT * FROM BusinessInfo");

            out.println("<html><body>");
            out.println("<h1>Business Information</h1>");

            while (rs.next()) {
                out.println("<h2>Usernames</h2>");
                out.println("<p>" + rs.getString("username") + "</p>");
                out.println("<h2>Strategic Information</h2>");
                out.println("<p>" + rs.getString("strategicInfo") + "</p>");
                out.println("<h2>Employees</h2>");
                out.println("<p>" + rs.getString("employee") + "</p>");
                out.println("<h2>Clients</h2>");
                out.println("<p>" + rs.getString("client") + "</p>");
                out.println("<h2>Providers</h2>");
                out.println("<p>" + rs.getString("provider") + "</p>");
            }

            out.println("</body></html>");

            con.close();
        } catch (Exception e) {
            out.println(e);
        }
    }
}

The updated code now includes an authentication check at the beginning of the doGet method. If the user is not authenticated, the method returns an error message and does not proceed to display any business information.

Sensitive business information is no longer hardcoded in the servlet. Instead, the servlet connects to a MySQL database to retrieve the business information. This is a more secure approach as the information is not exposed in the code and can be securely managed in the database.

The database connection is established using the DriverManager.getConnection method with the database URL, username, and password. The Statement and ResultSet objects are used to execute a SQL query to retrieve the business information and iterate through the results.

Each piece of business information is retrieved from the ResultSet using the getString method and the name of the column in the database. The information is then printed to the response.

Finally, the database connection is closed using the con.close() method.

This code should be used over HTTPS to ensure the transmission of sensitive information is secure. Regular updates, patches, security testing, and code reviews should also be performed to maintain the security of the application.

References​

Last updated on