Skip to main content

Security controls bypass or absence

Need​

Implementation of robust security controls

Context​

  • Usage of Java 8 for developing applications with enhanced features and performance improvements
  • Usage of javax.servlet-api for building Java web applications with Servlets

Description​

Non compliant code​

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

public class UnsafeServlet extends HttpServlet {
    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String adminPanel = request.getParameter("adminPanel");
        
        if (adminPanel != null && adminPanel.equals("true")) {
            // admin panel access without any security controls
            RequestDispatcher dispatcher = request.getRequestDispatcher("/adminPanel.jsp");
            dispatcher.forward(request, response);
        } else {
            // normal user access
            RequestDispatcher dispatcher = request.getRequestDispatcher("/userPanel.jsp");
            dispatcher.forward(request, response);
        }
    }
}

The above Java code uses the Java Servlet API to create an HTTP servlet. This servlet is vulnerable because it allows for the bypass of security controls.

In the doGet method, the servlet receives an HTTP request and sends an HTTP response. The method retrieves the adminPanel parameter from the HTTP request. If the adminPanel parameter exists and equals "true", then the servlet forwards the request and response to the adminPanel.jsp. This means that any user can access the admin panel by simply adding the adminPanel=true parameter to the URL.

This is a serious security vulnerability because it allows unauthorized users to bypass security controls and gain access to sensitive administrative functions. The correct approach would be to implement proper authentication and authorization checks before allowing access to the admin panel.

Steps​

  • Implement proper authentication and authorization mechanisms to control access to the admin panel.
  • Use a secure session management mechanism to ensure that only authenticated users can access the admin panel.
  • Apply input validation and sanitization techniques to prevent malicious input from bypassing security controls.
  • Implement role-based access control to restrict access to the admin panel to authorized users only.
  • Regularly update and patch the system to address any known security vulnerabilities.
  • Conduct security testing and code reviews to identify and fix any other potential security issues.

Compliant code​

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

public class SafeServlet extends HttpServlet {
    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        HttpSession session = request.getSession();
        String role = (String) session.getAttribute("role");
        String adminPanel = request.getParameter("adminPanel");

        if (adminPanel != null && adminPanel.equals("true")) {
            if (role != null && role.equals("admin")) {
                // admin panel access with security controls
                RequestDispatcher dispatcher = request.getRequestDispatcher("/adminPanel.jsp");
                dispatcher.forward(request, response);
            } else {
                // access denied
                response.sendError(HttpServletResponse.SC_FORBIDDEN, "Access denied");
            }
        } else {
            // normal user access
            RequestDispatcher dispatcher = request.getRequestDispatcher("/userPanel.jsp");
            dispatcher.forward(request, response);
        }
    }
}

The updated code now includes a session management mechanism that checks the role of the user before granting access to the admin panel.

In the doGet method, we first retrieve the current session using request.getSession(). Then, we get the role of the user from the session attributes.

If the adminPanel parameter is set to true, we check if the user's role is admin. If it is, we forward the request to the admin panel. If the user's role is not admin, we deny access by sending an HTTP 403 Forbidden status code and an "Access denied" message.

This way, we ensure that only authenticated users with the correct role can access the admin panel, effectively preventing the bypass of security controls.

Remember to validate and sanitize all inputs, regularly update and patch the system, and conduct security testing and code reviews to further enhance the security of your application.

References​

Last updated on