Skip to main content

Business information leak - Users

Need​

Protection of business information and user data confidentiality

Context​

  • Usage of PHP for server-side web development
  • Usage of a database for storing and retrieving data

Description​

Non compliant code​

public function getUsers() {
    $users = DB::table('users')->get();
    return response()->json($users);
}

The above code is a function in a Laravel controller that retrieves all the users from the 'users' table in the database and returns them as a JSON response.

The vulnerability lies in the fact that it does not implement any form of access control. This means that any user, authenticated or not, can access this endpoint and retrieve a list of all users in the system.

The user data can contain sensitive information like usernames, email addresses, and other personal information which should not be publicly accessible. This exposes the application to a business information leak vulnerability.

A malicious user could use this information for various nefarious activities such as phishing, spamming, or even brute-force attacks. Therefore, it's crucial to ensure that only authorized users have access to such sensitive information.

Steps​

  • Implement authentication and authorization checks to ensure only authorized users can access the user list.
  • Limit the information returned by the getUsers function. Do not return sensitive data like passwords, email addresses, etc.
  • Implement rate limiting to prevent brute force attacks.
  • Log and monitor unusual activities like multiple failed login attempts, requests from new locations, etc.
  • Encrypt sensitive data in the database.

Compliant code​

public function getUsers(Request $request) {
    // Check if the user is authenticated
    if (!Auth::check()) {
        return response()->json(['error' => 'Unauthorized'], 401);
    }

    // Check if the user has the necessary permissions
    if (!Auth::user()->hasPermission('view_users')) {
        return response()->json(['error' => 'Forbidden'], 403);
    }

    // Get the users but limit the information returned
    $users = DB::table('users')->select('id', 'name', 'username')->get();

    return response()->json($users);
}

The updated code now includes checks to ensure that only authenticated users with the necessary permissions can access the user list. This is done using Laravel's built-in Auth facade.

First, we check if the user is authenticated with Auth::check(). If they are not, we return a 401 Unauthorized error.

Next, we check if the authenticated user has the necessary permissions to view the user list. This is done with Auth::user()->hasPermission('view_users'). If they do not have the necessary permissions, we return a 403 Forbidden error.

Finally, when retrieving the user list from the database, we limit the information returned to only the user's id, name, and username. This is done with the select method on the query builder.

This updated code helps to prevent unauthorized access to the user list and limits the information that can be obtained from it, helping to prevent business information leaks.

References​

Last updated on