Skip to main content

Business information leak - Users

Need​

Protection of business information and user data confidentiality

Context​

  • Usage of Python 3 for writing and executing Python code
  • Usage of Django for web application development

Description​

Non compliant code​

from django.http import JsonResponse
from django.contrib.auth.models import User

def get_users(request):
    users = User.objects.values()
    return JsonResponse(list(users), safe=False)

In the above code, we have a Django view function get_users that fetches all the users from the database and returns them as a JSON response. This function is vulnerable as it exposes sensitive business information - the list of all valid users.

The User.objects.values() call fetches all fields of all User instances from the database. The resulting QuerySet is then converted into a list, which is returned as a JSON response. This means that anyone who can access this endpoint can get a list of all users in the system, including their usernames, email addresses, and potentially other sensitive information depending on the User model's fields.

This is a serious vulnerability as it can lead to information leakage. Attackers can use this information to perform further attacks, such as spear phishing, brute force attacks, or even identity theft.

Steps​

  • Remove the endpoint that exposes the list of users. If it's necessary for some reason, restrict access to it.
  • Implement proper authentication and authorization checks to ensure only authorized users can access sensitive data.
  • Limit the information returned by the endpoint. Do not return sensitive data like email addresses, passwords, etc.
  • Consider using a more secure way to identify users in your system, such as using a UUID instead of sequential IDs or usernames.
  • Log and monitor access to sensitive data to detect and respond to suspicious activities.

Compliant code​

from django.http import JsonResponse
from django.contrib.auth.models import User
from django.contrib.auth.decorators import login_required
from django.core.exceptions import PermissionDenied

@login_required
def get_users(request):
    if not request.user.is_staff:
        raise PermissionDenied
    users = User.objects.values('id', 'username')
    return JsonResponse(list(users), safe=False)

The updated code includes several changes to address the vulnerability:

  1. Authentication Check: The @login_required decorator is added before the get_users function. This ensures that only authenticated users can access the function. If a user is not authenticated, they will be redirected to the login page.

  2. Authorization Check: Inside the get_users function, there is a check to see if the authenticated user is a staff member (request.user.is_staff). If they are not a staff member, a PermissionDenied exception is raised. This ensures that only users with the appropriate permissions can access the list of users.

  3. Limited Data Exposure: The User.objects.values('id', 'username') line has been updated to only return the 'id' and 'username' of each user, rather than all user information. This limits the amount of data that can be accessed, reducing the risk of a data leak.

Remember to set up logging and monitoring for this endpoint to track any suspicious activities. Also, consider using UUIDs for user identification to further enhance security.

References​

Last updated on