Skip to main content

Use of an insecure channel - HTTP

Need​

Secure transmission of client information

Context​

  • Usage of Java for building cross-platform applications
  • Usage of javax.servlet for building Java web applications with servlet technology
  • Usage of java.io for input and output operations in Java

Description​

Non compliant code​

import javax.servlet.*;
import javax.servlet.http.*;
import java.io.*;

public class InsecureServlet extends HttpServlet {

    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String username = request.getParameter("username");
        String password = request.getParameter("password");

        // ... Authentication code here

        PrintWriter out = response.getWriter();
        out.println("Welcome, " + username);
    }
}

This Java Servlet code is vulnerable to the "Use of an insecure channel - HTTP" vulnerability. This vulnerability occurs because the client information is being transmitted over HTTP, which is an insecure channel that does not use encryption.

In the above code, the doPost method is used to handle POST requests from the client. The HttpServletRequest object request is used to get the parameters "username" and "password" from the client's request. These credentials are then used for some authentication process (which is not shown in this code snippet).

The problem is that all this data is transmitted over HTTP (port 80), which is not secure. This means that anyone who is able to intercept the traffic between the client and the server would be able to see the username and password in plain text. This could lead to unauthorized access to user accounts, data breaches, and other serious security issues.

Steps​

  • Use HTTPS instead of HTTP to transmit client information.
  • Implement SSL/TLS encryption to secure the communication channel.
  • Configure the web server to redirect HTTP requests to HTTPS.
  • Use secure protocols and algorithms for encryption.
  • Implement proper authentication and authorization mechanisms to protect sensitive information.
  • Avoid storing sensitive information in plain text.
  • Regularly update and patch the server and application software to address any security vulnerabilities.

Compliant code​

import javax.net.ssl.HttpsURLConnection;
import javax.servlet.*;
import javax.servlet.http.*;
import java.io.*;

public class SecureServlet extends HttpServlet {

    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        request.setAttribute("scheme", "https");
        String username = request.getParameter("username");
        String password = request.getParameter("password");

        // ... Authentication code here

        PrintWriter out = response.getWriter();
        out.println("Welcome, " + username);
    }
}

The above code is a revised version of the original servlet that now uses HTTPS instead of HTTP for transmitting client information. This is achieved by setting the "scheme" attribute of the request to "https".

Please note that this code is just a part of the solution. To fully secure your application, you need to:

  1. Implement SSL/TLS encryption: This is done at the server level. You need to obtain a certificate from a Certificate Authority (CA) and install it on your server. Then, configure your server to use this certificate for SSL/TLS encryption.

  2. Configure the web server to redirect HTTP requests to HTTPS: This is also done at the server level. The exact steps depend on the type of web server you are using.

  3. Use secure protocols and algorithms for encryption: This is a broad topic that includes using up-to-date and secure versions of SSL/TLS, using secure cipher suites, etc.

  4. Implement proper authentication and authorization mechanisms: This includes things like using secure password hashing algorithms, implementing two-factor authentication, managing session cookies securely, etc.

  5. Avoid storing sensitive information in plain text: This includes not only passwords but also other sensitive information like credit card numbers, social security numbers, etc.

  6. Regularly update and patch the server and application software: This is a general good practice to keep your application secure. Regularly check for updates and patches for your server software, JVM, libraries that your application uses, etc., and apply them as soon as possible.

References​

Last updated on