Skip to main content

Business information leak - Users

Need​

Protection of business information and user data confidentiality

Context​

  • Usage of Java for building cross-platform applications
  • Usage of javax.servlet for building Java web applications
  • Usage of java.io for input/output operations in Java

Description​

Non compliant code​

import javax.servlet.*;
import javax.servlet.http.*;
import java.io.*;

public class UserServlet extends HttpServlet {
    public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        response.setContentType("text/html");
        PrintWriter out = response.getWriter();
        out.println("<h1> List of Valid Users </h1>");
        
        // Assume UserDB.getUsers() returns a list of all valid users
        List<User> users = UserDB.getUsers();
        
        for(User user : users) {
            out.println("<p>" + user.getUsername() + "</p>");
        }
    }
}

In the above code, the doGet() method of UserServlet class is used to display a list of all valid users. This is done by calling the getUsers() method of UserDB class which returns a list of all valid users. This list is then iterated over and each username is printed out in the response.

This code is vulnerable because it exposes a list of all valid users to anyone who can access the URL mapped to this servlet. This can lead to business information leakage as it gives potential attackers a list of valid usernames that they can use for further attacks such as brute force or password guessing attacks.

In addition, it also violates the principle of least privilege, which states that a user should be given the least amount of privileges necessary to perform his/her job function. In this case, displaying a list of all valid users is more information than a typical user needs to use the system.

Steps​

  • Implement proper access control mechanisms to restrict unauthorized access to sensitive information.
  • Ensure that only authenticated and authorized users can access the list of valid users.
  • Use secure communication protocols (e.g., HTTPS) to protect the transmission of sensitive information.
  • Implement server-side validation and sanitization of user input to prevent any potential injection attacks.
  • Store sensitive information, such as the list of valid users, securely in a protected location.
  • Regularly update and patch the software to address any known vulnerabilities.
  • Perform security testing and code reviews to identify and fix any potential security issues.
  • Educate developers about secure coding practices to prevent similar vulnerabilities in the future.

Compliant code​

import javax.servlet.*;
import javax.servlet.http.*;
import java.io.*;
import java.security.Principal;

public class UserServlet extends HttpServlet {
    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        response.setContentType("text/html");
        PrintWriter out = response.getWriter();

        // Check if the user is authenticated
        Principal principal = request.getUserPrincipal();
        if (principal == null) {
            out.println("<h1>Unauthorized access</h1>");
            return;
        }

        // Check if the user is authorized to view the list of users
        if (request.isUserInRole("admin")) {
            out.println("<h1> List of Valid Users </h1>");

            // Assume UserDB.getUsers() returns a list of all valid users
            List<User> users = UserDB.getUsers();

            for(User user : users) {
                out.println("<p>" + user.getUsername() + "</p>");
            }
        } else {
            out.println("<h1>Unauthorized access</h1>");
        }
    }
}

The updated code now includes an access control mechanism to prevent unauthorized access to the list of valid users. This is done by checking if the user is authenticated and if they have the necessary authorization to view the list of users.

The request.getUserPrincipal() method is used to check if the user is authenticated. If the user is not authenticated, the method returns null and the server responds with an "Unauthorized access" message.

The request.isUserInRole("admin") method is used to check if the authenticated user has the necessary authorization to view the list of users. If the user is not in the "admin" role, the server responds with an "Unauthorized access" message.

This way, only authenticated users with the necessary authorization can access the list of valid users, preventing business information leaks.

Please note that this code assumes that you have set up authentication and authorization on your server. If you haven't, you will need to do so for this code to work. Also, remember to use secure communication protocols (e.g., HTTPS) to protect the transmission of sensitive information.

References​

Last updated on