Skip to main content

ViewState not encrypted

Need​

Secure encryption of ViewState data

Context​

  • Usage of PHP 7.0 for server-side scripting and web development
  • Usage of Illuminate\Http\Request for handling HTTP requests in Laravel
  • Usage of Session facade in Laravel's Illuminate\Support\Facades package
  • Usage of Illuminate\Routing\Controller for handling routing and controller logic in Laravel

Description​

Non compliant code​

<?php

namespace App\\Http\\Controllers;

use Illuminate\\Http\\Request;

class TestController extends Controller
{
    public function store(Request $request)
    {
        $viewState = $request->input('viewState');
        
        // Storing viewState in session without encryption
        $request->session()->put('viewState', $viewState);
        
        return response()->json(['message' => 'View state stored in session']);
    }
}

This code is part of a Laravel-based PHP application. It represents a controller named TestController that has a method store.

The store method receives a HTTP request and retrieves a 'viewState' from the request input. This 'viewState' represents the state information of application forms. The method then stores this 'viewState' directly into the session using $request->session()->put('viewState', $viewState);.

The vulnerability here is that the 'viewState' is stored in the session without any form of encryption, meaning that if an attacker gains access to the session data, they can directly read and potentially manipulate the 'viewState' data. This can lead to various forms of attacks, such as unauthorized actions or data leakage.

Steps​

  • Use Laravel's encryption functions to encrypt the ViewState before storing it in the session.
  • Replace the line where the ViewState is stored in the session with a line that first encrypts the ViewState using Laravel's encrypt function, then stores the encrypted ViewState in the session.
  • Ensure that the encryption key is securely stored and not accessible to unauthorized users.

Compliant code​

<?php

namespace App\\Http\\Controllers;

use Illuminate\\Http\\Request;
use Illuminate\\Support\\Facades\\Crypt;

class TestController extends Controller
{
    public function store(Request $request)
    {
        $viewState = $request->input('viewState');
        
        // Encrypting and storing viewState in session
        $encryptedViewState = Crypt::encryptString($viewState);
        $request->session()->put('viewState', $encryptedViewState);
        
        return response()->json(['message' => 'View state stored in session']);
    }
}

The updated code now uses Laravel's built-in encryption functions to encrypt the ViewState before storing it in the session. This is done by using the Crypt::encryptString() function, which encrypts a string using Laravel's encryption settings.

The Crypt::encryptString() function uses Laravel's encryption settings, which are defined in the config/app.php file. The encryption key is stored in the .env file as APP_KEY. Laravel uses AES-256-CBC encryption and the key should be 32 characters long.

The encrypted ViewState is then stored in the session using the session()->put() function. This ensures that even if an attacker is able to access the session data, they will not be able to understand the ViewState data without the encryption key.

It's important to ensure that the .env file is not accessible to unauthorized users, as it contains the encryption key. This can be done by setting proper file permissions and not including the .env file in version control systems.

References​

Last updated on