Skip to main content

Insecure functionality - File Creation

Need​

Secure functionality - File Creation

Context​

  • Usage of PHP 7.0 for server-side scripting and web development
  • Usage of Request for making HTTP requests
  • Usage of Auth for implementing authentication and authorization in an application
  • Usage of Storage for managing and persisting data

Description​

Non compliant code​

public function createFile(Request $request) {
    $user = Auth::user();
    $fileName = $request->input('filename');
    $fileContent = $request->input('content');

    if ($user->canCreateFiles()) {
        // Create the file
        Storage::disk('local')->put($fileName, $fileContent);
        return response()->json(['status' => 'success', 'message' => 'File created successfully']);
    } else {
        return response()->json(['status' => 'error', 'message' => 'You do not have permission to create files']);
    }
}

The above code is a function in a Laravel controller that creates a file with the given name and content. The function first retrieves the authenticated user and then checks if the user has the permission to create files by calling the canCreateFiles() method on the user object.

The vulnerability lies in the fact that the permission check is only performed on the frontend by disabling the button for creating files. This means that if a malicious user were to bypass the frontend and send a direct HTTP request to the server, the server would still process the request and create the file, even though the user does not have the necessary permissions.

This is a serious security vulnerability as it allows unauthorized file creation, which can lead to various risks such as data leakage, corruption, or even system compromise if the created file is executable.

The root cause of this vulnerability is the lack of proper access control enforcement on the backend. The backend should always verify the permissions of a user before performing any action on their behalf, regardless of what the frontend is doing.

Steps​

  • Validate the user's permissions on the server side, not just on the client side.
  • Implement server-side checks to ensure that the user has the necessary permissions to create a file before processing the request.
  • Use middleware to handle authorization and restrict access to certain routes based on user permissions.
  • Ensure that the 'canCreateFiles' function is secure and correctly checks the user's permissions.
  • Consider using a secure, server-side language or framework that automatically handles these types of security issues.

Compliant code​

public function __construct()
{
    $this->middleware('can:create,App\\File');
}

public function createFile(Request $request) {
    $user = Auth::user();
    $fileName = $request->input('filename');
    $fileContent = $request->input('content');

    // Create the file
    Storage::disk('local')->put($fileName, $fileContent);
    return response()->json(['status' => 'success', 'message' => 'File created successfully']);
}

The updated code now includes a middleware check in the constructor of the controller. This middleware check uses Laravel's built-in authorization system to ensure that the authenticated user has the necessary permissions to create a file before the createFile method is even called.

The can:create,App\\File middleware will call the create method on the FilePolicy associated with the File model. This method should return true if the user is authorized to create files, and false otherwise. If the user is not authorized, Laravel will automatically return a 403 HTTP response.

This way, we ensure that the server-side is also validating the user's permissions, not just the client-side. This makes it impossible for a user to bypass the restrictions by simply enabling a disabled button on the front-end.

The actual file creation process remains the same. If the user is authorized, the file will be created and a success message will be returned. If not, the user will receive a 403 error response.

This solution is more secure because it relies on server-side validation, which cannot be manipulated by the user. It also makes use of Laravel's built-in authorization system, which is designed to handle these types of security issues.

References​

Last updated on