Skip to main content

Insecure object reference - Financial information

Need​

Secure access to financial information

Context​

  • Usage of PHP 7.0 for server-side scripting and web development
  • Usage of Illuminate\Http\Request for handling HTTP requests in Laravel
  • Usage of Crypt facade from Illuminate\Support\Facades for data encryption and decryption
  • Usage of the CreditCard model in the App\Models namespace

Description​

Non compliant code​

public function getCreditCardDetails(Request $request)
{
    $creditCardId = decrypt($request->input('credit_card_id'));
    $creditCard = CreditCard::find($creditCardId);
    
    if($creditCard){
        return response()->json(['credit_card' => $creditCard]);
    }
    else{
        return response()->json(['error' => 'Credit card not found'], 404);
    }
}

The above code is a function in Laravel that is used to get the details of a credit card. The function takes a request as input, which contains an encrypted credit card id. This id is decrypted and then used to find the respective credit card in the database.

The vulnerability lies in the fact that there is no check to verify if the user requesting the credit card details is indeed the owner of the credit card or if they have the necessary permissions to view this data. This means that if a user can guess or otherwise obtain the encrypted id of a credit card, they can view the details of that credit card even if they are not the owner. This is a classic example of an Insecure Direct Object Reference (IDOR) vulnerability.

In the context of a financial application, this vulnerability can have serious implications as it can potentially expose sensitive financial data of users to unauthorized individuals.

Steps​

  • Add an authentication check at the beginning of the function to ensure that the user is logged in.
  • After the credit card is found, add a check to verify that the logged-in user is the owner of the credit card. This can be done by comparing the user ID of the session with the user ID associated with the credit card.
  • If the user is not the owner of the credit card, return an error message indicating that the user does not have permission to view the details of the credit card.
  • Ensure that all error messages do not reveal sensitive information about the system or the data it holds.

Compliant code​

public function getCreditCardDetails(Request $request)
{
    // Check if user is authenticated
    if (!Auth::check()) {
        return response()->json(['error' => 'User not authenticated'], 401);
    }

    $creditCardId = decrypt($request->input('credit_card_id'));
    $creditCard = CreditCard::find($creditCardId);

    // Check if credit card exists
    if(!$creditCard){
        return response()->json(['error' => 'Credit card not found'], 404);
    }

    // Check if the authenticated user is the owner of the credit card
    if(Auth::user()->id != $creditCard->user_id){
        return response()->json(['error' => 'User not authorized to access this credit card details'], 403);
    }

    return response()->json(['credit_card' => $creditCard]);
}

The updated code now includes an authentication check at the beginning of the function to ensure that the user is logged in. This is done using Laravel's built-in Auth::check() function. If the user is not authenticated, the function will return a 401 error with a message indicating that the user is not authenticated.

After the credit card is found, a check is added to verify that the logged-in user is the owner of the credit card. This is done by comparing the user ID of the session (retrieved using Auth::user()->id) with the user ID associated with the credit card ($creditCard->user_id). If the user is not the owner of the credit card, the function will return a 403 error with a message indicating that the user does not have permission to view the details of the credit card.

This updated code ensures that only the owner of the credit card can view its details, thereby fixing the insecure object reference vulnerability.

References​

Last updated on