Skip to main content

Insecure functionality - Masking

Need​

Secure data masking and protection

Context​

  • Usage of Java for building cross-platform applications
  • Usage of javax.servlet for building Java web applications
  • Usage of javax.servlet.http for handling HTTP requests and responses in Java web applications

Description​

Non compliant code​

import javax.servlet.*;
import javax.servlet.http.*;

public class UnmaskedServlet extends HttpServlet {
    public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String username = request.getParameter("username");
        String password = request.getParameter("password");

        // process the username and password
        // ...

        // send back the response
        PrintWriter out = response.getWriter();
        out.println("Username: " + username + ", Password: " + password);
    }
}

The above code is an example of a servlet that handles a POST request. This servlet is used to process a login form where users input their username and password.

The vulnerability lies in the doPost method. The method retrieves the username and password from the request parameters, processes them, and then sends back a response containing the username and password.

The problem is that the response is not masked or encrypted in any way. This means that if an attacker is able to intercept the response (for example, by sniffing the network traffic), they will be able to see the username and password in plain text. This is a serious security risk as it could potentially allow an attacker to gain unauthorized access to the system.

In addition, sending back the password in the response is generally a bad practice as it could potentially expose the password to the user or anyone else who might be looking at the user's screen.

To prevent this vulnerability, it's important to mask or encrypt sensitive data like passwords before sending them over the network. This can be done using various techniques such as hashing or encryption.

Steps​

  • Use secure communication protocols such as HTTPS to protect the data in transit.
  • Implement input validation and sanitization to ensure that only valid and expected data is accepted.
  • Use secure storage mechanisms such as hashing and encryption to protect sensitive data at rest.
  • Implement proper access controls to restrict unauthorized access to sensitive data.
  • Implement data masking techniques to hide sensitive information in logs, error messages, and responses.
  • Follow secure coding practices and avoid logging or printing sensitive data.
  • Regularly update and patch the software libraries and frameworks used in the application to address any known vulnerabilities.

Compliant code​

import javax.servlet.*;
import javax.servlet.http.*;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.util.Base64;

public class MaskedServlet extends HttpServlet {
    public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String username = request.getParameter("username");
        String password = request.getParameter("password");

        // process the username and password
        // ...

        // Hash the password before sending it back in the response
        String hashedPassword = hashPassword(password);

        // send back the response
        PrintWriter out = response.getWriter();
        out.println("Username: " + username + ", Password: " + hashedPassword);
    }

    private String hashPassword(String password) {
        try {
            MessageDigest md = MessageDigest.getInstance("SHA-256");
            byte[] hashedBytes = md.digest(password.getBytes(StandardCharsets.UTF_8));
            return Base64.getEncoder().encodeToString(hashedBytes);
        } catch (NoSuchAlgorithmException e) {
            throw new RuntimeException("Error hashing password", e);
        }
    }
}

The updated code now masks the password by hashing it before sending it back in the response. This is done in the hashPassword method, which uses the SHA-256 algorithm to create a hash of the password. The hashed password is then encoded in Base64 format to ensure it can be safely transmitted in the response.

This approach ensures that even if the response is intercepted, the actual password will not be exposed. Instead, only the hashed version of the password will be visible, which cannot be used to derive the original password.

Please note that this is just one part of securing sensitive data. Other measures should also be taken, such as using secure communication protocols (HTTPS), implementing input validation and sanitization, using secure storage mechanisms for sensitive data at rest, implementing proper access controls, and regularly updating and patching software libraries and frameworks.

References​

Last updated on