Skip to main content

Restricted fields manipulation

Need​

Prevention of unauthorized access and manipulation of restricted fields

Context​

  • Usage of PHP 7.0 for server-side scripting and web development
  • Usage of Request for making HTTP requests in Node.js
  • Usage of the Employee package for managing employee data and operations

Description​

Non compliant code​

public function registerEmployee(Request $request) {
    $employee = Employee::where('dni', $request->input('dni'))->first();
    
    if($employee) {
        $employee->name = $request->input('name');
        $employee->email = $request->input('email');
        $employee->dob = $request->input('dob');
        $employee->address = $request->input('address');
        $employee->phone = $request->input('phone');
        $employee->save();
    }
}

In the above code, the registerEmployee function takes a Request object as a parameter. The function retrieves an employee record from the database using the 'dni' field from the request input.

If an employee with the specified 'dni' exists, the function then updates the employee's information with the data from the request input. This includes the employee's name, email, date of birth, address, and phone number.

The vulnerability in this code is that it does not check if the authenticated user has the necessary permissions to update the employee's information. This means that any authenticated user can send a request with any 'dni' and update the information of any employee.

An attacker can exploit this vulnerability by sending a request with a different 'dni' to replace the existing data for different employees. This can lead to unauthorized access and manipulation of sensitive employee data.

Steps​

  • Add an authentication layer to ensure that the user making the request has the necessary permissions to update the employee data.
  • Implement a role-based access control (RBAC) system to restrict the ability to update employee data to only certain roles (e.g., HR managers).
  • Check the employee's company ID before updating the data to ensure that the user can only update data for employees in their own company.
  • Use input validation to ensure that the DNI value provided in the request is valid and belongs to an existing employee.
  • Log all attempts to update employee data, including the user who made the request and the data they attempted to change. This will help to identify any malicious activity.

Compliant code​

public function registerEmployee(Request $request) {
    // Authenticate the user
    $user = Auth::user();

    // Check if the user has the necessary permissions
    if($user->hasRole('HR Manager')) {
        $employee = Employee::where('dni', $request->input('dni'))->first();

        // Check if the employee belongs to the same company as the user
        if($employee && $employee->company_id == $user->company_id) {
            $employee->name = $request->input('name');
            $employee->email = $request->input('email');
            $employee->dob = $request->input('dob');
            $employee->address = $request->input('address');
            $employee->phone = $request->input('phone');
            $employee->save();

            // Log the update
            Log::info('Employee data updated by user: '.$user->id, $request->all());
        } else {
            // Log the failed attempt
            Log::warning('Unauthorized attempt to update employee data by user: '.$user->id, $request->all());
        }
    } else {
        // Log the failed attempt
        Log::warning('Unauthorized attempt to update employee data by user: '.$user->id, $request->all());
    }
}

The updated code now includes an authentication layer that checks if the user making the request is authenticated and has the necessary permissions to update the employee data. This is done using Laravel's built-in Auth facade and a hypothetical hasRole method on the User model, which checks if the user has a specific role (in this case, 'HR Manager').

The code also checks if the employee whose data is being updated belongs to the same company as the user. This is done by comparing the company_id of the employee and the user.

Input validation is assumed to be handled by Laravel's request validation, which should be implemented in the code calling this method.

Finally, all attempts to update employee data are logged, including both successful updates and failed attempts. The logs include the ID of the user who made the request and the data they attempted to change. This can help to identify any malicious activity.

References​

Last updated on