Skip to main content

Security controls bypass or absence - Data creation

Need​

Enforcement of proper security controls for data creation

Context​

  • Usage of Java for building scalable and robust applications
  • Usage of javax.servlet for handling HTTP requests and responses in Java web applications
  • Usage of java.io for input and output operations in Java programming
  • Usage of java.util.ArrayList for creating and manipulating dynamic lists in Java

Description​

Non compliant code​

import javax.servlet.*;
import javax.servlet.http.*;
import java.io.*;
import java.util.ArrayList;

public class PolicyServlet extends HttpServlet {

    private ArrayList<Beneficiary> beneficiaries;

    public void init() {
        beneficiaries = new ArrayList<>();
    }

    public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String name = request.getParameter("name");
        int age = Integer.parseInt(request.getParameter("age"));
        String relationship = request.getParameter("relationship");
        String policyId = request.getParameter("policyId");

        Beneficiary beneficiary = new Beneficiary(name, age, relationship, policyId);
        beneficiaries.add(beneficiary);

        // No control to limit the number of beneficiaries
    }
}

class Beneficiary {
    private String name;
    private int age;
    private String relationship;
    private String policyId;

    public Beneficiary(String name, int age, String relationship, String policyId) {
        this.name = name;
        this.age = age;
        this.relationship = relationship;
        this.policyId = policyId;
    }
}

The above code represents a servlet that handles HTTP POST requests to create a new beneficiary associated with a policy. The servlet gets the beneficiary details such as name, age, relationship, and policyId from the request parameters and creates a new Beneficiary object. This object is then added to the beneficiaries list.

The vulnerability lies in the absence of a control mechanism to limit the number of beneficiaries that can be associated with a policy. The doPost method does not check the number of beneficiaries before adding a new one. Therefore, it is possible to bypass the restriction that only allows the creation of four beneficiaries per policy, resulting in the potential creation of multiple beneficiaries associated with a single policy request.

This lack of control affects the integrity of the data sent, as it allows the creation of more beneficiaries than intended. This could lead to unexpected behavior in the system and potential data integrity issues, as policies could end up with more beneficiaries than they should have.

Steps​

  • Implement a security control to limit the number of beneficiaries that can be created.
  • Add validation checks to ensure that the number of beneficiaries does not exceed the allowed limit.
  • Consider using a configuration parameter to define the maximum number of beneficiaries allowed.
  • Display an error message or return an appropriate response when the maximum number of beneficiaries is exceeded.
  • Consider implementing authentication and authorization mechanisms to ensure that only authorized users can create beneficiaries.
  • Regularly review and update the security controls to adapt to changing requirements and potential vulnerabilities.

Compliant code​

import javax.servlet.*;
import javax.servlet.http.*;
import java.io.*;
import java.util.ArrayList;

public class PolicyServlet extends HttpServlet {

    private ArrayList<Beneficiary> beneficiaries;
    private static final int MAX_BENEFICIARIES = 4; // Configuration parameter for maximum beneficiaries

    public void init() {
        beneficiaries = new ArrayList<>();
    }

    public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        if(beneficiaries.size() >= MAX_BENEFICIARIES) {
            response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Maximum number of beneficiaries exceeded");
            return;
        }

        String name = request.getParameter("name");
        int age = Integer.parseInt(request.getParameter("age"));
        String relationship = request.getParameter("relationship");
        String policyId = request.getParameter("policyId");

        Beneficiary beneficiary = new Beneficiary(name, age, relationship, policyId);
        beneficiaries.add(beneficiary);
    }
}

class Beneficiary {
    private String name;
    private int age;
    private String relationship;
    private String policyId;

    public Beneficiary(String name, int age, String relationship, String policyId) {
        this.name = name;
        this.age = age;
        this.relationship = relationship;
        this.policyId = policyId;
    }
}

The updated code now includes a security control to limit the number of beneficiaries that can be created. A constant MAX_BENEFICIARIES is defined to set the maximum number of beneficiaries allowed.

In the doPost method, before creating a new beneficiary, the code checks if the current number of beneficiaries is less than the maximum allowed. If the limit is exceeded, it sends an error response with the status code SC_BAD_REQUEST and a message "Maximum number of beneficiaries exceeded", and then returns without adding a new beneficiary.

This way, the integrity of the data is maintained as the number of beneficiaries associated with a request cannot exceed the defined limit.

For further security, consider implementing authentication and authorization mechanisms to ensure that only authorized users can create beneficiaries. Regularly review and update the security controls to adapt to changing requirements and potential vulnerabilities.

References​

Last updated on