Skip to main content

Automatic information enumeration - Personal Information

Need​

Protection of user privacy and prevention of unauthorized access to personal information

Context​

  • Requirement of PHP 7.0 or higher for running the application
  • Usage of the User dependency for user-related operations or functionality

Description​

Non compliant code​

public function getUserData($id)
{
    $user = User::find($id);
    return response()->json($user);
}

In the above code, the function getUserData takes an $id as a parameter and fetches the user data associated with this $id. Here, the $id is directly passed to the find method of the User model. This find method is used to retrieve the user data from the database.

The vulnerability lies in the fact that there is no authorization mechanism in place to check if the requester has the right to access the data of the user with the provided $id. This means that any user can pass any $id and get the data of any other user. This is a serious security flaw as it leads to unauthorized access to user data, which is a violation of privacy and can lead to further attacks such as identity theft.

This vulnerability is known as Automatic Information Enumeration. In this case, an attacker can easily enumerate through different $id values and collect the data of all the users in the system. This is possible because the application does not use a token or any other form of authentication to verify if the requester has the right to access the requested user data.

Steps​

  • Authenticate the request to ensure it's coming from a valid user.
  • Implement an authorization check to ensure the user has the right to access the requested data.
  • Use a token-based authentication system, such as JWT, to secure the API endpoint.
  • Ensure the token is associated with the account and is required to consult the information.
  • Limit the data returned by the API to only what is necessary, reducing the risk of exposing sensitive information.
  • Implement rate limiting to prevent brute force attacks.

Compliant code​

public function getUserData(Request $request, $id)
{
    $user = Auth::user();
    if ($user->id != $id) {
        return response()->json(['error' => 'Unauthorized'], 401);
    }
    $userData = User::find($id)->makeHidden(['password', 'email']);
    return response()->json($userData);
}

The updated code now includes a check to ensure that the user making the request is authenticated and is the same user as the one whose data is being requested. This is done by comparing the id of the authenticated user with the id provided in the request.

The Auth::user() function is used to get the currently authenticated user. If the id of the authenticated user does not match the id provided in the request, an error response with a 401 status code (Unauthorized) is returned.

The makeHidden method is used to hide the password and email fields from the JSON response. This is to prevent sensitive information from being exposed.

This solution assumes that you have implemented a token-based authentication system, such as JWT, and that the Auth::user() function is able to retrieve the authenticated user from the token included in the request.

Remember to also implement rate limiting on your API endpoints to prevent brute force attacks. This can be done using Laravel's built-in rate limiting features.

References​

Last updated on