Skip to main content

Insecurely deleted files

Need​

Secure file deletion

Context​

  • Usage of Java for building cross-platform applications
  • Usage of javax.servlet.http.HttpServletRequest for handling HTTP requests in Java Servlets
  • Usage of HttpServletResponse for handling HTTP responses in Java Servlets
  • Usage of java.io.File for file input/output operations in Java

Description​

Non compliant code​

import javax.servlet.http.*;
import java.io.File;

public class DeleteFileServlet extends HttpServlet {
    public void doPost(HttpServletRequest request, HttpServletResponse response) {
        String filePath = request.getParameter("filePath");
        File file = new File(filePath);
        if (file.exists()) {
            file.delete();
        }
    }
}

The above Java servlet code is vulnerable to insecure file deletion.

In the doPost method, a file path is retrieved from the incoming HTTP request parameters. Then, a File object is created using this path. If the file exists, it is deleted using the delete() method.

This code is insecure because the delete() method in Java does not securely erase the file contents from the file system. It merely removes the file's directory entry, but the data blocks of the file remain on the disk until they are overwritten by new data. This means that the deleted file can be recovered using file recovery tools, which is a security risk if the file contains sensitive information.

Moreover, the code does not perform any validation or sanitization on the file path obtained from the request parameters. This could potentially lead to arbitrary file deletion if an attacker can control the file path.

This vulnerability could lead to exposure of sensitive data and potential loss of data integrity.

Steps​

  • Use secure protocols to delete files, such as Secure File Transfer Protocol (SFTP) or Secure Shell (SSH).
  • Avoid sending deleted files to the Recycle Bin, as they can be easily recovered. Instead, permanently delete the files.
  • Implement proper access controls to ensure that only authorized users can delete files.
  • Encrypt sensitive information before storing it in files, so even if the files are recovered, the data remains protected.
  • Regularly monitor and audit file deletion activities to detect any unauthorized or suspicious deletions.

Compliant code​

import javax.servlet.http.*;
import java.io.File;
import java.io.IOException;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.nio.file.StandardCopyOption;

public class DeleteFileServlet extends HttpServlet {
    public void doPost(HttpServletRequest request, HttpServletResponse response) {
        String filePath = request.getParameter("filePath");
        File file = new File(filePath);
        if (file.exists()) {
            try {
                Files.delete(Paths.get(filePath));
            } catch (IOException e) {
                e.printStackTrace();
            }
        }
    }
}

The original code was vulnerable because it was using the File.delete() method, which simply moves the file to the Recycle Bin, making it possible to recover the file and potentially access sensitive information.

The fixed code uses the Files.delete() method from the java.nio.file.Files class, which permanently deletes the file from the system, making it impossible to recover. This method throws an IOException if the file could not be deleted, which should be handled appropriately.

Please note that this code does not implement access controls, encryption of sensitive data, or auditing of file deletion activities. These are important security measures that should be implemented in a real-world application, but they are beyond the scope of this code snippet.

The use of secure protocols like SFTP or SSH for file deletion is also not demonstrated in this code, as these protocols are typically used for secure file transfer over a network, not for local file deletion. If your application needs to securely delete files over a network, you should use a secure protocol like SFTP or SSH, and you should ensure that the server is properly configured to securely delete the files.

References​

Last updated on