Skip to main content

Automatic information enumeration - Credit Cards

Need​

Implementation of proper credit card validation and security measures

Context​

  • Usage of Ruby 2.7 for developing Ruby applications
  • Usage of Rails framework for building web applications

Description​

Non compliant code​

class CreditCardController < ApplicationController
  def show
    @credit_card = CreditCard.find(params[:id])
  end

  def update
    @credit_card = CreditCard.find(params[:id])
    if @credit_card.update(credit_card_params)
      redirect_to @credit_card
    else
      render 'edit'
    end
  end

  private

  def credit_card_params
    params.require(:credit_card).permit(:number, :expiry_date, :cvv)
  end
end

The code above represents a controller in a Ruby on Rails application that is handling credit card information. The show method retrieves a credit card by its ID and the update method allows for updating the credit card details.

The vulnerability lies in the credit_card_params method. This method is using strong parameters to whitelist the attributes that can be updated. However, it is allowing the expiry_date and cvv (Card Verification Value) to be updated without any validation.

This means that an attacker could potentially pass in any value for these fields and the application would accept them. This could lead to the exposure of sensitive credit card information, as well as the possibility of making unauthorized transactions.

In addition, the show method is directly exposing all the credit card details which include the number, expiry_date, and cvv. This is a serious security concern as these details should never be exposed.

This vulnerability is known as Automatic Information Enumeration, as it allows an attacker to automatically list and modify credit card information without any checks or validations.

Steps​

  • Implement validation for the credit card number, expiry date, and CVV.
  • Use a secure encryption algorithm to store credit card information.
  • Implement rate limiting to prevent automated enumeration of credit card information.
  • Implement strong access controls to restrict access to credit card information.
  • Regularly update and patch the Ruby on Rails framework and its dependencies to address any security vulnerabilities.

Compliant code​

class CreditCardController < ApplicationController
  before_action :set_credit_card, only: [:show, :update]
  before_action :check_rate_limit, only: [:show, :update]

  def show
  end

  def update
    if @credit_card.update(credit_card_params)
      redirect_to @credit_card
    else
      render 'edit'
    end
  end

  private

  def set_credit_card
    @credit_card = CreditCard.find(params[:id])
    authorize @credit_card
  end

  def check_rate_limit
    # Implement your rate limiting logic here
  end

  def credit_card_params
    params.require(:credit_card).permit(:number, :expiry_date, :cvv)
    validate_card_params
  end

  def validate_card_params
    # Implement your validation logic here
  end
end

The updated code includes several security measures to prevent automatic information enumeration of credit card data.

  1. Validation: The validate_card_params method should contain the logic to validate the credit card number, expiry date, and CVV. This ensures that only valid credit card information is processed.

  2. Rate Limiting: The check_rate_limit method should contain the logic to limit the number of requests a user can make within a certain time frame. This prevents automated scripts from rapidly enumerating through possible credit card information.

  3. Access Control: The authorize method in the set_credit_card method should contain the logic to check if the current user has the necessary permissions to access the requested credit card information. This prevents unauthorized access to sensitive data.

  4. Encryption: Although not shown in the code, it is recommended to use a secure encryption algorithm when storing credit card information in your database. This ensures that even if an attacker gains access to your database, they cannot read the sensitive credit card information.

  5. Regular Updates and Patches: Regularly update and patch the Ruby on Rails framework and its dependencies to address any security vulnerabilities. This ensures that your application is protected against known vulnerabilities in the software it uses.

References​

Last updated on