Skip to main content

Authentication mechanism absence or evasion - Response tampering

Need​

Implementation of a secure and robust authentication mechanism

Context​

  • Usage of Python 3.6 for developing Python applications
  • Usage of Django for building web applications in Python

Description​

Non compliant code​

from django.http import JsonResponse
from django.views.decorators.csrf import csrf_exempt
from .models import User

@csrf_exempt
def validate_otp(request):
    if request.method == "POST":
        otp = request.POST.get('otp')
        user = User.objects.get(username=request.user)

        if otp == user.otp:
            user.is_verified = True
            user.save()
            return JsonResponse({'status': 'success'}, status=200)
        else:
            return JsonResponse({'status': 'failure'}, status=400)

This code is an example of a Django view function that is used to validate OTP (One Time Password). It is vulnerable to response tampering because it doesn't have any mechanism in place to verify the integrity of the response.

Here's how the code works:

  • It first checks if the request method is POST.
  • Then, it gets the otp from the POST data and retrieves the user object from the database.
  • It checks if the otp sent in the request matches the otp stored in the user object. If it does, it sets the is_verified attribute of the user object to True and saves the user object back to the database.
  • It then sends a JSON response with the status 'success' if the OTP is correct or 'failure' if it's not.

The vulnerability lies in the fact that there's no mechanism in place to prevent an attacker from tampering with the response. An attacker can intercept the response and modify it to include the success message, thus bypassing the OTP validation. This could allow an attacker to gain unauthorized access to the system.

Steps​

  • Implement server-side session management to store the OTP. This way, the OTP is not exposed to the client side and cannot be tampered with.
  • Use HTTPS to ensure that the data transmitted between the client and the server is encrypted and cannot be intercepted or altered.
  • Add additional checks to ensure that the user making the request is the same user that the OTP was sent to. This can be done by checking the session or token associated with the user.
  • Implement rate limiting to prevent brute force attacks. This can limit the number of OTP attempts a user can make within a certain time period.
  • Consider using a more secure method of two-factor authentication, such as hardware tokens or biometric authentication.

Compliant code​

from django.http import JsonResponse
from django.views.decorators.csrf import csrf_exempt
from django.contrib.sessions.models import Session
from .models import User
from django.core.cache import cache
from django.views.decorators.cache import cache_page
from django.views.decorators.vary import vary_on_cookie

@csrf_exempt
@vary_on_cookie
@cache_page(60 * 15) # Cache page for 15 minutes
def validate_otp(request):
    if request.method == "POST":
        otp = request.POST.get('otp')
        user = User.objects.get(username=request.user)

        # Check if the OTP in the session is the same as the one provided by the user
        if 'otp' in request.session and otp == request.session['otp']:
            # Check if the user making the request is the same user that the OTP was sent to
            if user == request.user:
                user.is_verified = True
                user.save()
                return JsonResponse({'status': 'success'}, status=200)
            else:
                return JsonResponse({'status': 'failure'}, status=400)
        else:
            return JsonResponse({'status': 'failure'}, status=400)

The updated code now includes server-side session management to store the OTP. This prevents the OTP from being exposed to the client side and prevents tampering.

The @vary_on_cookie decorator is used to ensure that the cached page varies depending on the user's session cookie. This means that each user will have their own cached version of the page, preventing one user from seeing another user's OTP.

The @cache_page decorator is used to cache the page for 15 minutes. This can help to prevent brute force attacks by limiting the number of OTP attempts a user can make within a certain time period.

The code also includes additional checks to ensure that the user making the request is the same user that the OTP was sent to. This is done by comparing the user associated with the request to the user associated with the session.

Finally, the code uses HTTPS to ensure that the data transmitted between the client and the server is encrypted and cannot be intercepted or altered. This is done by Django's settings and not shown in the code snippet.

References​

Last updated on