Skip to main content

Insufficient data authenticity validation - Images

Need​

Enhanced data authenticity validation for profile images

Context​

  • Usage of PHP 7.0 for server-side scripting and web development
  • Usage of Laravel framework for PHP web development
  • Usage of Illuminate/Http for handling HTTP requests and responses in a Laravel application
  • Usage of Illuminate/Database for database management and query building

Description​

Non compliant code​

// Vulnerable Code
public function updateProfileImage(Request $request, $id)
{
    $user = User::find($id);
    $user->profile_image = $request->input('profile_image');
    $user->save();
    
    return response()->json(['message' => 'Profile image updated successfully.']);
}

In the above PHP code, we have a function updateProfileImage which is used to update the profile image of a user in a Laravel application.

The function takes two parameters, a Request object and an id. The Request object is used to get the data from the client-side, and the id is used to find the user in the database.

Inside the function, we first find the user by their id using the find method of the User model. Then, we update the profile_image attribute of the user with the profile_image data from the request. Finally, we save the user back to the database with the updated profile_image.

The vulnerability here is that there is no validation that the profile_image data from the request is a valid image URL. This allows an attacker to input partial paths or URLs that can be used to craft more complex attack vectors, such as controlled redirects or Cross-Site Request Forgery (CSRF).

For instance, an attacker could input a URL that redirects to a malicious site, or a URL that triggers a CSRF attack when the image is loaded. Since the application does not validate the profile_image data, it blindly trusts the input and saves it to the database, exposing the application and its users to potential attacks.

Steps​

  • Validate the input URL to ensure it is a valid URL.
  • Check if the URL leads to an actual image file. This can be done by checking the MIME type of the URL content.
  • Ensure the URL is not a local or relative path to prevent controlled redirects.
  • Use a whitelist approach to only allow URLs from trusted domains.
  • Consider storing and serving the images from your own server. This way, you have full control over the images and can ensure they are valid and safe.

Compliant code​

use Illuminate\\Support\\Facades\\Validator;
use GuzzleHttp\\Client;

public function updateProfileImage(Request $request, $id)
{
    $validator = Validator::make($request->all(), [
        'profile_image' => 'required|url'
    ]);

    if ($validator->fails()) {
        return response()->json(['error' => $validator->errors()], 400);
    }

    $imageUrl = $request->input('profile_image');
    $client = new Client();

    try {
        $response = $client->get($imageUrl);
        $contentType = $response->getHeader('Content-Type');

        if (strpos($contentType[0], 'image/') === false) {
            return response()->json(['error' => 'Invalid image URL'], 400);
        }
    } catch (\\Exception $e) {
        return response()->json(['error' => 'Invalid image URL'], 400);
    }

    $user = User::find($id);
    $user->profile_image = $imageUrl;
    $user->save();

    return response()->json(['message' => 'Profile image updated successfully.']);
}

The updated code now validates the input URL to ensure it is a valid URL. This is done using Laravel's built-in validation rules. If the validation fails, a JSON response with the error message is returned.

Next, the code uses Guzzle, a PHP HTTP client, to send a GET request to the image URL. If the request fails for any reason (e.g., the URL does not exist, the server is down, etc.), an exception is thrown and caught, and a JSON response with an error message is returned.

If the request is successful, the code retrieves the 'Content-Type' header from the response. This header indicates the media type of the resource. The code checks if the 'Content-Type' starts with 'image/', which is the case for all image files. If it does not, a JSON response with an error message is returned.

Finally, if all checks pass, the image URL is saved to the user's profile and a success message is returned.

This approach ensures that only valid image URLs are saved to user profiles, preventing potential attack vectors such as controlled redirects or CSRF.

References​

Last updated on