Business information leak - Financial Information

Need

Protection of sensitive financial information from unauthorized access or disclosure

Context

Usage of Java 8 for developing applications with enhanced features and performance improvements
Usage of javax.servlet for building Java web applications with Servlets
Usage of javax.servlet.http for handling HTTP requests and responses in Java Servlet applications

Description

Non compliant code

import javax.servlet.*;
import javax.servlet.http.*;

public class BusinessInfoServlet extends HttpServlet {

  protected void doPost(HttpServletRequest request, HttpServletResponse response)
      throws ServletException, IOException {
    String email = request.getParameter("email");
    String paymentReference = request.getParameter("paymentReference");
    String totalValue = request.getParameter("totalValue");
    String productInfo = request.getParameter("productInfo");
    String businessLine = request.getParameter("businessLine");
    String payerRole = request.getParameter("payerRole");

    // Business Information is directly obtained from the request without any validation or encryption
    BusinessInformation businessInformation = new BusinessInformation(email, paymentReference, totalValue, productInfo, businessLine, payerRole);

    // Process the business information
    processBusinessInformation(businessInformation);
  }

  private void processBusinessInformation(BusinessInformation businessInformation) {
    // Process the business information
  }
}

The above code is a simple Servlet that processes a POST request to obtain business information. The information includes email, payment reference, total value, product information, business line, and payer role.

The vulnerability lies in the fact that the business information is directly obtained from the request parameters without any form of validation or encryption. This means that an attacker could potentially inject malicious data or retrieve sensitive business information.

For instance, if an attacker is able to intercept the request, they could view or modify the payment reference, total value, or any other business information. This could lead to Business Information Leak, which is a serious security vulnerability.

Additionally, the business information is processed directly without any checks. This could potentially lead to other vulnerabilities such as SQL Injection, if the processing involves database operations.

In order to mitigate this vulnerability, it is recommended to validate and sanitize all input data, use encryption for sensitive data, and use secure methods for processing the data.

Steps

Implement input validation to ensure that the business information received is valid and expected.
Encrypt sensitive business information before storing or transmitting it.
Use secure communication protocols (e.g., HTTPS) to protect the transmission of business information.
Implement access controls to restrict who can access the business information.
Consider implementing data masking or tokenization techniques to further protect sensitive business information.
Regularly update and patch the software to address any known vulnerabilities.
Perform regular security assessments and penetration testing to identify and address any potential vulnerabilities.
Train developers and users on secure coding practices and the importance of protecting business information.

Compliant code

import javax.servlet.*;
import javax.servlet.http.*;
import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
import java.security.Key;
import java.util.Base64;

public class BusinessInfoServlet extends HttpServlet {

  private static final String ALGORITHM = "AES";
  private static final byte[] keyValue = 
    new byte[] { 'T', 'h', 'i', 's', 'I', 's', 'A', 'S', 'e', 'c', 'r', 'e', 't', 'K', 'e', 'y' };

  protected void doPost(HttpServletRequest request, HttpServletResponse response)
      throws ServletException, IOException {
    String email = request.getParameter("email");
    String paymentReference = request.getParameter("paymentReference");
    String totalValue = request.getParameter("totalValue");
    String productInfo = request.getParameter("productInfo");
    String businessLine = request.getParameter("businessLine");
    String payerRole = request.getParameter("payerRole");

    // Input validation
    if (!isValid(email, paymentReference, totalValue, productInfo, businessLine, payerRole)) {
      throw new ServletException("Invalid input");
    }

    // Encrypt sensitive business information
    paymentReference = encrypt(paymentReference);
    totalValue = encrypt(totalValue);

    BusinessInformation businessInformation = new BusinessInformation(email, paymentReference, totalValue, productInfo, businessLine, payerRole);

    // Process the business information
    processBusinessInformation(businessInformation);
  }

  private boolean isValid(String... inputs) {
    // Implement your validation logic here
    return true;
  }

  private String encrypt(String Data) throws Exception {
    Key key = generateKey();
    Cipher c = Cipher.getInstance(ALGORITHM);
    c.init(Cipher.ENCRYPT_MODE, key);
    byte[] encVal = c.doFinal(Data.getBytes());
    String encryptedValue = Base64.getEncoder().encodeToString(encVal);
    return encryptedValue;
  }

  private Key generateKey() throws Exception {
    Key key = new SecretKeySpec(keyValue, ALGORITHM);
    return key;
  }

  private void processBusinessInformation(BusinessInformation businessInformation) {
    // Process the business information
  }
}

The updated code includes several security measures to protect business information:

Input Validation: The isValid method is used to validate the input parameters. This method should be implemented with the appropriate validation logic to ensure that the business information received is valid and expected.
Encryption: The encrypt method is used to encrypt sensitive business information (in this case, payment reference and total value) using AES encryption before storing or transmitting it. The encryption key is generated by the generateKey method.
Secure Communication Protocols: Although not shown in the code, it is recommended to use secure communication protocols (e.g., HTTPS) to protect the transmission of business information.
Access Controls: Implement access controls to restrict who can access the business information. This can be done at the application level or at the network level.
Data Masking or Tokenization: Consider implementing data masking or tokenization techniques to further protect sensitive business information. This is not shown in the code but can be implemented depending on the specific requirements.
Regular Updates and Patches: Regularly update and patch the software to address any known vulnerabilities. This is a general good practice and not specific to the code.
Security Assessments and Penetration Testing: Perform regular security assessments and penetration testing to identify and address any potential vulnerabilities. This is a general good practice and not specific to the code.
Training: Train developers and users on secure coding practices and the importance of protecting business information. This is a general good practice and not specific to the code.

References

291.Business information leak - Financial Information

Need​

Context​

Description​

Non compliant code​

Steps​

Compliant code​

References​