Skip to main content

Security controls bypass or absence - Facial Recognition

Need​

Implementation of robust security controls for facial recognition

Context​

  • Usage of Python 3.0+ for developing Python applications
  • Usage of Django for building web applications in Python

Description​

Non compliant code​

from django.contrib.auth.decorators import login_required
from django.http import HttpResponse

@login_required
def process_transaction(request):
    if request.method == 'POST':
        # process the transaction
        return HttpResponse('Transaction Processed')
    else:
        return HttpResponse('Invalid Request')

def facial_recognition(request):
    if request.method == 'POST':
        token = request.POST.get('token')
        if token == 'F015':
            # bypass facial recognition
            return process_transaction(request)
        else:
            return HttpResponse('Invalid Token')
    else:
        return HttpResponse('Invalid Request')

The above code is a simple Django view that processes a transaction. It uses the @login_required decorator to ensure that the user is authenticated before the transaction can be processed.

However, there's a serious security vulnerability in the facial_recognition view. This view is supposed to handle facial recognition but it can be easily bypassed.

If the HTTP POST request includes a token with the value 'F015', the facial recognition step is bypassed completely, and the process_transaction view is called directly. This means that anyone who knows this token can bypass the facial recognition system, which is a serious security issue.

This flaw is an example of a Security Control Bypass vulnerability. The facial recognition system is a security control that is meant to protect the application from unauthorized access. But due to the implementation of the facial_recognition view, this control can be bypassed using the 'F015' token.

Steps​

  • Remove the token bypass in the facial_recognition function. The token should not allow bypassing of the facial recognition.
  • Implement a proper facial recognition check in the facial_recognition function. This could involve checking a database of authorized faces, or calling an external facial recognition API.
  • Ensure that the facial_recognition function is called before process_transaction. This could be done by adding a call to facial_recognition in the process_transaction function, or by using a middleware to ensure that facial_recognition is called for all relevant requests.
  • Add error handling to the facial_recognition function to handle cases where the facial recognition check fails. This could involve returning an error response, or redirecting the user to a page where they can try again.

Compliant code​

from django.contrib.auth.decorators import login_required
from django.http import HttpResponse

@login_required
def process_transaction(request):
    if request.method == 'POST':
        # Check if facial recognition is successful
        if not facial_recognition(request):
            return HttpResponse('Facial Recognition Failed')
        # process the transaction
        return HttpResponse('Transaction Processed')
    else:
        return HttpResponse('Invalid Request')

def facial_recognition(request):
    if request.method == 'POST':
        # Remove token bypass
        # token = request.POST.get('token')
        # if token == 'F015':
        #     # bypass facial recognition
        #     return True

        # Implement facial recognition check
        # This is a placeholder, replace with actual facial recognition code
        face = request.POST.get('face')
        if face in authorized_faces:
            return True
        else:
            return False
    else:
        return HttpResponse('Invalid Request')

The updated code removes the token bypass in the facial_recognition function. The token should not allow bypassing of the facial recognition.

The facial_recognition function now checks if the face is in a list of authorized faces. This is a placeholder, and should be replaced with actual facial recognition code. This could involve checking a database of authorized faces, or calling an external facial recognition API.

The process_transaction function now calls facial_recognition before processing the transaction. If facial recognition fails, it returns an error response.

This ensures that the facial recognition check is performed for all relevant requests, and handles cases where the facial recognition check fails.

References​

Last updated on