Skip to main content

Business information leak - Customers or providers

Need​

Protection of sensitive business information from unauthorized access or leakage

Context​

  • Usage of PHP 7.0+ for developing web applications
  • Usage of Illuminate\Http\Request for handling HTTP requests in Laravel
  • Usage of the Customer model in the App\Models namespace

Description​

Non compliant code​

namespace App\\Http\\Controllers;

use Illuminate\\Http\\Request;
use App\\Models\\Customer;

class CustomerController extends Controller
{
    public function index()
    {
        $customers = Customer::all();
        return view('customers.index', compact('customers'));
    }
}

The above code is a part of a Laravel-based backend application. It is a controller that handles requests related to customers. The index method retrieves all records from the 'customers' table in the database and passes them to the 'customers.index' view.

The vulnerability here lies in the fact that all customer data is being retrieved and potentially displayed without any checks or limitations. This means that sensitive information such as customer names, email addresses, and phone numbers could potentially be exposed to unauthorized users. If an attacker were to gain access to the 'customers.index' view, they would have access to all of this sensitive information, leading to a business information leak.

This vulnerability can be exploited if the view displays the sensitive information or the application has another weakness that can be used to gain access to the data passed to the view.

To prevent this, it's important to implement proper access control measures to ensure that only authorized users can access the 'customers.index' view. Furthermore, sensitive information should be properly protected or even excluded when passing data to views.

Steps​

  • Implement authentication and authorization checks to ensure only authorized users can access the customer data.
  • Use pagination to limit the amount of data that can be retrieved at once.
  • Avoid exposing all customer fields. Only return the necessary data.
  • Encrypt sensitive data in the database.
  • Implement rate limiting to prevent data scraping.
  • Log and monitor access to sensitive data to detect any unusual activity.

Compliant code​

namespace App\\Http\\Controllers;

use Illuminate\\Http\\Request;
use App\\Models\\Customer;
use Illuminate\\Support\\Facades\\Auth;
use Illuminate\\Support\\Facades\\Log;

class CustomerController extends Controller
{
    public function __construct()
    {
        $this->middleware('auth');
    }

    public function index(Request $request)
    {
        $user = Auth::user();

        if($user->can('view', Customer::class)){
            Log::info('User '.$user->id.' accessed customer data.');

            $customers = Customer::paginate(10);
            $customers->makeHidden(['email', 'phone_number']); // hide sensitive data

            return view('customers.index', compact('customers'));
        } else {
            abort(403, 'Unauthorized action.');
        }
    }
}

The updated code now includes several security measures to prevent unauthorized access and data leaks.

  1. Authentication: The __construct method now includes a middleware that checks if the user is authenticated before allowing access to any methods in the controller.

  2. Authorization: The index method now checks if the authenticated user has the necessary permissions to view the customer data. This is done using Laravel's built-in authorization system.

  3. Logging: An entry is added to the log every time a user accesses the customer data. This can be used to monitor who is accessing the data and when.

  4. Data Limitation: The paginate method is used to limit the amount of data that can be retrieved at once. This prevents an attacker from obtaining all the data in a single request.

  5. Data Hiding: The makeHidden method is used to hide sensitive data from the response. This ensures that even if an attacker can access the data, they won't be able to see sensitive information like email addresses and phone numbers.

Remember to set up the necessary permissions in your Customer model and to encrypt sensitive data in your database. Also, consider implementing rate limiting to further protect against data scraping.

References​

Last updated on