Skip to main content

Security controls bypass or absence - Session Invalidation

Need​

Enforce proper session invalidation and remove debugging code

Context​

  • Usage of PHP 7.0 for server-side scripting and web development
  • Usage of Illuminate\Http\Request for handling HTTP requests in Laravel
  • Usage of Session facade from the Illuminate\Support\Facades package for managing session data in Laravel
  • Usage of Illuminate\Routing\Controller for handling routes and requests in Laravel

Description​

Non compliant code​

<?php

namespace App\\Http\\Controllers;

use Illuminate\\Http\\Request;

class UserController extends Controller
{
    public function getMainFromSession(Request $request)
    {
        $sessionCode = $request->session()->get('code');

        if($sessionCode == 'auto')
        {
            return view('main');
        }
        else
        {
            return redirect()->back();
        }
    }
}

In the above code, we have a controller named UserController with a function getMainFromSession(). This function retrieves the session code from the current session and checks if it equals 'auto'. If it does, the function returns the 'main' view, effectively bypassing any other security controls that might be in place.

The vulnerability lies in the fact that during the debugging phase, the developers implemented a bypass using the session code 'auto'. This bypass is still present in the code, and could potentially be exploited by an attacker. If an attacker were to become aware of this bypass, they could gain access to the 'main' view simply by setting their session code to 'auto', regardless of whether they are authenticated or have the necessary permissions.

This represents a serious security risk, as it effectively allows for a complete bypass of the application's security controls. To fix this vulnerability, the check for 'auto' should be removed from the getMainFromSession() function.

Steps​

  • Remove the condition that checks if the session code is 'auto'. This condition allows any user with a session code of 'auto' to bypass security controls.
  • Implement a proper session validation mechanism. This could involve checking if the session code matches with a valid user in the database.
  • Ensure that the session code is invalidated after a certain period of inactivity or when the user logs out.
  • Consider using a secure, built-in session management feature of your framework or language, if available.
  • Always ensure that debug or test code is removed or disabled in the production environment.

Compliant code​

<?php

namespace App\\Http\\Controllers;

use Illuminate\\Http\\Request;
use Illuminate\\Support\\Facades\\Auth;

class UserController extends Controller
{
    public function getMainFromSession(Request $request)
    {
        $sessionCode = $request->session()->get('code');

        // Check if the session code matches with a valid user in the database
        $user = Auth::user();
        if($user && $sessionCode == $user->session_code)
        {
            return view('main');
        }
        else
        {
            // Invalidate the session code after a certain period of inactivity or when the user logs out
            $request->session()->invalidate();
            return redirect()->back();
        }
    }
}

The updated code now includes a proper session validation mechanism. Instead of checking if the session code is 'auto', it checks if the session code matches with a valid user in the database. This is done using the Auth::user() method provided by Laravel, which retrieves the currently authenticated user.

If the session code matches with the authenticated user's session code, the main view is returned. If not, the session is invalidated using the invalidate() method, and the user is redirected back to the previous page. This ensures that the session code is invalidated after a certain period of inactivity or when the user logs out.

The debug code that allowed any user with a session code of 'auto' to bypass security controls has been removed. This ensures that debug or test code is not present in the production environment, thereby enhancing the security of the application.

References​

Last updated on