Skip to main content

Insecure service configuration - Backdoor

Need​

Secure service configuration to prevent unauthorized access and backdoor installation

Context​

  • Usage of PHP 7.0 for server-side scripting and web development
  • Usage of Illuminate/Http for handling HTTP requests and responses in Laravel
  • Usage of Illuminate Routing for handling routes in a PHP application
  • Usage of Illuminate/Support for providing foundational support classes and utilities in Laravel framework
  • Usage of Illuminate/View for Templating and Rendering Views

Description​

Non compliant code​

Route::get('/upload', function () {
    return view('upload');
});

Route::post('/upload', function (Request $request) {
    $request->file('file')->store('public');
    return redirect('/');
});

The above code is a part of a Laravel application that handles file uploads. The get route renders a view with a form for file upload, and the post route handles the file upload.

The vulnerability lies in the fact that there is no validation or restriction on what files can be uploaded. This means that a malicious user could potentially upload a PHP file with malicious code (a "backdoor") that, once uploaded, can be accessed publicly and executed on the server. This backdoor can then be used to gain unauthorized access to the server or to execute unauthorized commands.

Furthermore, the uploaded files are stored in the 'public' directory which means they are accessible by anyone who knows the file's direct URL. This could lead to sensitive data exposure if a user was to upload a file containing sensitive information.

In a secure configuration, the application would validate the type and content of the file being uploaded, only allowing safe file types, and would store uploaded files in a directory that is not publicly accessible.

Steps​

  • Validate the file type and size before storing it. Only allow specific file types and limit the file size to prevent large or potentially harmful files from being uploaded.
  • Implement an authentication mechanism to restrict file upload functionality to authorized users only. This will prevent unauthorized users from uploading potentially harmful files.
  • Store the uploaded files in a non-public directory to prevent them from being directly accessible via the web. This will prevent potential attackers from accessing the uploaded files directly.
  • Scan the uploaded files for malware or any other potential threats before storing them. This will help to detect and remove any potential backdoors or other threats.
  • Regularly update and patch the server and its software to protect against known vulnerabilities. This will help to prevent potential attackers from exploiting known vulnerabilities to install backdoors or gain unauthorized access.
  • Implement a strong access control policy for the server and its services. This will help to prevent potential attackers from gaining unauthorized access to the server or its services.

Compliant code​

use Illuminate\\Http\\Request;
use Illuminate\\Support\\Facades\\Storage;
use Illuminate\\Support\\Facades\\Auth;

Route::get('/upload', function () {
    if (Auth::check()) {
        return view('upload');
    } else {
        return redirect('/login');
    }
});

Route::post('/upload', function (Request $request) {
    if (Auth::check()) {
        $file = $request->file('file');
        $allowedFileTypes = ['jpg', 'png', 'txt', 'pdf'];
        $maxFileSize = 2048; // 2MB

        if ($file->getSize() > $maxFileSize * 1024) {
            return redirect('/upload')->with('error', 'File size exceeds the maximum limit of 2MB');
        }

        if (!in_array($file->getClientOriginalExtension(), $allowedFileTypes)) {
            return redirect('/upload')->with('error', 'Invalid file type');
        }

        // Store the file in a non-public directory
        $file->store('private');

        return redirect('/');
    } else {
        return redirect('/login');
    }
});

The updated code now includes an authentication check to ensure that only logged-in users can access the file upload functionality. This is done using Laravel's built-in Auth::check() function.

The file upload functionality now includes validation for both file type and size. The allowed file types are defined in the $allowedFileTypes array and the maximum file size is defined in the $maxFileSize variable. If the uploaded file does not meet these criteria, the user is redirected back to the upload page with an appropriate error message.

The uploaded file is now stored in a non-public directory (private) to prevent direct access via the web. This is done using Laravel's built-in store() function.

Please note that this code does not include malware scanning functionality. This would require a third-party service or software and is beyond the scope of this code sample. However, it is highly recommended to implement such a feature in a production environment.

Also, remember to regularly update and patch your server and its software, and implement a strong access control policy for the server and its services. These measures will help to further protect your application from potential threats.

References​

Last updated on