Skip to main content

Insecure object reference - User deletion

Need​

Secure user deletion process and session management

Context​

  • Usage of Java 8 for developing applications with enhanced features and performance improvements.
  • Usage of javax.servlet-api for Java Servlet development

Description​

Non compliant code​

import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.ServletException;
import java.io.IOException;

public class DeleteUserServlet extends HttpServlet {
    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String userId = request.getParameter("userId");

        // User deletion without any checks
        Database.deleteUser(userId);
    }
}

The above code represents a servlet that handles the deletion of a user in a web application. The servlet receives a POST request containing the id of the user to be deleted.

The vulnerability lies in the fact that the servlet does not perform any sort of authorization or validation checks before deleting the user. This means that any user (or even an unauthenticated individual) can send a POST request to this servlet with any user id, and the corresponding user will be deleted from the database.

Furthermore, after the user is deleted, their session is not invalidated. This means that if a user is deleted while they are still logged in, their session will continue to exist and they will still be able to interact with the application until their session expires naturally. This could lead to various issues, such as the user being able to perform actions as a nonexistent user.

This vulnerability could be exploited to delete arbitrary users from the application, which could disrupt its operation and compromise its integrity.

Steps​

  • Implement authentication and authorization mechanisms to ensure that only authorized users can delete other users.
  • Validate the user's identity before allowing the deletion of a user account.
  • Use a secure session management mechanism to invalidate the session of a deleted user.
  • Implement access control checks to prevent unauthorized access to sensitive operations like user deletion.
  • Implement a soft delete mechanism instead of directly deleting the user from the database, allowing for recovery if needed.
  • Implement logging and monitoring to detect and respond to any suspicious or unauthorized user deletion attempts.

Compliant code​

import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.ServletException;
import java.io.IOException;

public class DeleteUserServlet extends HttpServlet {
    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String userId = request.getParameter("userId");
        String sessionId = request.getSession().getId();

        // Check if the user is authenticated and authorized
        if (Authentication.isAuthenticated(sessionId) && Authorization.isAuthorized(sessionId, "deleteUser")) {
            // Validate the user's identity before allowing the deletion of a user account
            if (UserValidation.isValidUser(userId)) {
                // Implement a soft delete mechanism instead of directly deleting the user from the database
                Database.softDeleteUser(userId);

                // Invalidate the session of a deleted user
                request.getSession().invalidate();

                // Log the user deletion event
                Logger.logEvent("User " + userId + " was deleted.");
            } else {
                response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Invalid user ID");
            }
        } else {
            response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized access");
        }
    }
}

The updated code now includes several security measures to prevent insecure object reference vulnerabilities.

Firstly, it checks if the user is authenticated and authorized to delete users. This is done by calling Authentication.isAuthenticated(sessionId) and Authorization.isAuthorized(sessionId, "deleteUser"). If the user is not authenticated or authorized, an HTTP 401 Unauthorized error is returned.

Next, it validates the user's identity before allowing the deletion of a user account. This is done by calling UserValidation.isValidUser(userId). If the user ID is invalid, an HTTP 400 Bad Request error is returned.

Instead of directly deleting the user from the database, a soft delete mechanism is implemented. This is done by calling Database.softDeleteUser(userId). This allows for recovery if needed.

After a user is deleted, the session is invalidated by calling request.getSession().invalidate(). This prevents the deleted user from continuing to browse.

Finally, the user deletion event is logged. This is done by calling Logger.logEvent("User " + userId + " was deleted."). This allows for monitoring and detection of any suspicious or unauthorized user deletion attempts.

References​

Last updated on