Skip to main content

Non-encrypted confidential information - Hexadecimal

Need​

Secure encryption of confidential information

Context​

  • Usage of Java for building cross-platform applications
  • Usage of javax.servlet for building Java web applications
  • Usage of java.io for input and output operations in Java programming

Description​

Non compliant code​

import javax.servlet.*;
import javax.servlet.http.*;
import java.io.*;

public class VulnerableServlet extends HttpServlet {

    public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String confidentialInfo = "74657374696E67"; // "testing" in hexadecimal
        PrintWriter out = response.getWriter();
        out.println("Confidential Information: " + confidentialInfo);
    }
}

This code represents a servlet in a Java web application that handles HTTP GET requests. It contains a vulnerability related to non-encrypted confidential information.

The doGet method is responsible for handling the HTTP GET requests. Inside this method, we have a string variable confidentialInfo that stores confidential information. In this case, the confidential information is the string "testing" which is encoded in hexadecimal format ("74657374696E67").

The problem lies in the fact that this confidential information, although encoded in hexadecimal, is not encrypted. This means that if an attacker intercepts the HTTP response, they can easily decode the hexadecimal string back to its original plain text form.

The information is then written to the HTTP response using a PrintWriter. This means that the confidential information is sent back to the client in the HTTP response body. If the HTTP response is intercepted by an attacker, they can view the confidential information in plain text by decoding the hexadecimal string.

This represents a serious security vulnerability because it exposes confidential information to potential attackers. The confidentiality of the information is compromised because it is not encrypted, making it easy for attackers to decode and read.

Steps​

  • Use encryption to protect the confidential information
  • Choose a strong encryption algorithm
  • Generate a secure encryption key
  • Encrypt the confidential information using the encryption key
  • Store the encrypted information instead of the plain text
  • Ensure that the encryption key is securely managed and protected
  • Implement proper access controls to restrict unauthorized access to the encrypted information
  • Use secure communication protocols (e.g., HTTPS) to transmit the encrypted information
  • Implement secure coding practices to prevent other vulnerabilities that could compromise the confidentiality of the information

Compliant code​

import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
import javax.servlet.*;
import javax.servlet.http.*;
import java.io.*;
import java.security.Key;
import java.util.Base64;

public class SecureServlet extends HttpServlet {

    private static final String ALGORITHM = "AES";
    private static final byte[] KEY = "MySuperSecretKey".getBytes();

    public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String confidentialInfo = "74657374696E67"; // "testing" in hexadecimal
        String encryptedInfo = encrypt(confidentialInfo, KEY);
        PrintWriter out = response.getWriter();
        out.println("Confidential Information: " + encryptedInfo);
    }

    private static String encrypt(String data, byte[] key) {
        try {
            Key secretKey = new SecretKeySpec(key, ALGORITHM);
            Cipher cipher = Cipher.getInstance(ALGORITHM);
            cipher.init(Cipher.ENCRYPT_MODE, secretKey);
            byte[] encryptedData = cipher.doFinal(data.getBytes());
            return Base64.getEncoder().encodeToString(encryptedData);
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
    }
}

The above code fixes the vulnerability by encrypting the confidential information using the AES encryption algorithm before sending it to the client.

The encrypt method takes the confidential data and a secret key as parameters. It uses the Cipher class from the javax.crypto package to perform the encryption. The Cipher instance is initialized with the secret key in ENCRYPT_MODE. Then, the confidential data is encrypted using the doFinal method of the Cipher class. The encrypted data is then encoded into a string using Base64 encoding before being returned.

The secret key is defined as a constant byte array. In a real-world application, this key should be securely managed and protected, for example, by storing it in a secure key vault.

The encrypted confidential information is then printed to the response writer instead of the plain text confidential information. This ensures that even if an attacker intercepts the communication, they will not be able to understand the confidential information without the encryption key.

Please note that this code should be served over HTTPS to ensure that the communication between the server and the client is secure. Also, proper access controls should be implemented to restrict unauthorized access to the encrypted information.

References​

Last updated on