Skip to main content

Security controls bypass or absence - Tampering Protection

Need​

Enforcement of tampering protection controls

Context​

  • Usage of Java 8 for developing applications with enhanced features and performance
  • Usage of javax.servlet-api for developing Java web applications with Servlets

Description​

Non compliant code​

import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

public class RootUserServlet extends HttpServlet {
    protected void doPost(HttpServletRequest request, HttpServletResponse response) {
        String rootUser = request.getParameter("rootUser");
        if (rootUser != null && rootUser.equals("true")) {
            // Perform some privileged action
        }
    }
}

The above code snippet is an example of a servlet that handles a POST request. It checks if a parameter named rootUser is present in the request and if its value is "true". If these conditions are met, the servlet performs some privileged action.

The vulnerability lies in the fact that there are no security mechanisms in place to prevent a third party from modifying and recompiling the application. This means that a malicious actor could potentially modify the application to always treat the rootUser parameter as "true", even if it's not present in the request or its value is different. This would allow the actor to consistently perform privileged actions, bypassing the intended security control.

In addition, the application does not check if the rootUser parameter is being sent by a root user. This means that any user, regardless of their permissions, could potentially send a request with the rootUser parameter set to "true" and perform privileged actions.

This lack of tampering protection and absence of security controls can lead to serious security issues, such as unauthorized access and privilege escalation.

Steps​

  • Implement code integrity checks to ensure that the application has not been modified or tampered with.
  • Use secure coding practices to prevent unauthorized modifications to the application.
  • Implement strong authentication and authorization mechanisms to prevent unauthorized access to privileged actions.
  • Regularly update and patch the application to address any known vulnerabilities.
  • Implement secure communication channels to protect sensitive data transmitted between the client and server.
  • Implement input validation and sanitization to prevent injection attacks and ensure the integrity of user-supplied data.
  • Implement logging and monitoring mechanisms to detect and respond to any suspicious activities or unauthorized access attempts.
  • Conduct regular security assessments and penetration testing to identify and address any vulnerabilities in the application.

Compliant code​

import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.security.SignatureException;
import java.security.NoSuchAlgorithmException;
import java.security.InvalidKeyException;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.util.Base64;

public class RootUserServlet extends HttpServlet {
    private static final String HMAC_ALGO = "HmacSHA256";
    private static final String SECRET_KEY = "your-secret-key";

    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws SignatureException {
        String rootUser = request.getParameter("rootUser");
        String signature = request.getParameter("signature");

        if (rootUser != null && signature != null && verifySignature(rootUser, signature)) {
            // Perform some privileged action
        }
    }

    private boolean verifySignature(String data, String signature) throws SignatureException {
        try {
            Mac sha256_HMAC = Mac.getInstance(HMAC_ALGO);
            SecretKeySpec secret_key = new SecretKeySpec(SECRET_KEY.getBytes(), HMAC_ALGO);
            sha256_HMAC.init(secret_key);

            String checkSignature = Base64.getEncoder().encodeToString(sha256_HMAC.doFinal(data.getBytes()));

            return checkSignature.equals(signature);
        } catch (NoSuchAlgorithmException | InvalidKeyException e) {
            throw new SignatureException("Failed to verify signature", e);
        }
    }
}

The updated code now includes a method to verify the integrity of the application. This is done by using a HMAC (Hash-based Message Authentication Code) algorithm, which combines a secret key with the incoming data (in this case, the rootUser parameter) to generate a unique signature. This signature is then compared with the signature sent with the request. If the two signatures match, it means that the data has not been tampered with and the request is authentic.

The doPost method now checks not only if the rootUser parameter is present, but also if the signature parameter is present and if the signature is valid. If all these conditions are met, the privileged action is performed.

This way, even if an attacker manages to modify and recompile the application, they would not be able to generate a valid signature without knowing the secret key, thus preventing them from bypassing the root user check.

Please note that the secret key is hardcoded in this example for simplicity, but in a real-world application, it should be securely stored and managed, for example, using a secure vault service.

This solution also assumes that the client-side of the application is responsible for generating the signature and sending it with the request. This would typically be done in a secure environment, such as a server or a secure element in a mobile device.

References​

Last updated on