Skip to main content

Business information leak - Credit Cards

Need​

Protection of sensitive business information and customer credit card data

Context​

  • Usage of PHP 7.0 for server-side scripting and web development
  • Usage of Request for making HTTP requests
  • Usage of CreditCard for handling credit card information and transactions

Description​

Non compliant code​

public function getCreditCardDetails(Request $request){
    $creditcardId = $request->get('creditcardId');
    $creditcard = CreditCard::find($creditcardId);
    return response()->json($creditcard);
}

The above code is a method in a Laravel controller that returns the details of a credit card. The credit card ID is taken from the request and used to find the corresponding credit card in the database.

The problem with this code is that it directly exposes sensitive credit card information in the response. This is because the CreditCard::find($creditcardId) function returns all the details of the credit card, including sensitive information such as the card number, CVV, and expiration date.

When this response is sent back to the client, anyone who can intercept this response can see and potentially misuse this sensitive information. This can lead to serious business information leaks, including strategic information and customer information.

The vulnerability is caused by a lack of proper access controls and data filtering. The code does not check if the user making the request has the necessary permissions to view the credit card details. Furthermore, it does not filter out sensitive information before sending the response.

Steps​

  • Validate the request to ensure only authorized users can access the credit card details.
  • Implement an authentication and authorization mechanism to verify the identity of the user making the request.
  • Encrypt sensitive data such as credit card information in the database.
  • Instead of returning the entire credit card object, return only the necessary information.
  • Use secure communication protocols like HTTPS to protect data in transit.
  • Implement proper error handling to avoid revealing sensitive information in error messages.

Compliant code​

public function getCreditCardDetails(Request $request){
    // Validate the request
    $validatedData = $request->validate([
        'creditcardId' => 'required|integer',
    ]);

    // Check if the user is authenticated
    if (Auth::check()) {
        $creditcardId = $request->get('creditcardId');
        $creditcard = CreditCard::find($creditcardId);

        // Check if the user is authorized to access the credit card details
        if (Auth::user()->can('view', $creditcard)) {
            // Return only the necessary information
            return response()->json([
                'cardholderName' => $creditcard->cardholderName,
                'expirationDate' => $creditcard->expirationDate,
            ]);
        } else {
            return response()->json(['error' => 'Unauthorized'], 403);
        }
    } else {
        return response()->json(['error' => 'Unauthenticated'], 401);
    }
}

The updated code includes several security measures to prevent the leakage of credit card information:

  1. Request Validation: The request is validated to ensure that the 'creditcardId' is present and is an integer. This prevents SQL injection attacks.

  2. Authentication Check: The Auth::check() function is used to verify if the user is authenticated.

  3. Authorization Check: The Auth::user()->can('view', $creditcard) function is used to check if the authenticated user has the necessary permissions to view the credit card details.

  4. Limited Information Disclosure: Instead of returning the entire credit card object, only the cardholder's name and the card's expiration date are returned. This prevents the leakage of sensitive information like the credit card number.

  5. Error Handling: Proper error messages are returned in case the user is unauthenticated or unauthorized. This prevents revealing sensitive information in error messages.

Remember to use secure communication protocols like HTTPS to protect data in transit and encrypt sensitive data such as credit card information in the database.

References​

Last updated on