Skip to main content

Insecure object reference - Personal information

Need​

Secure access control and user data protection

Context​

  • Usage of Ruby 2.7.2 as the programming language for development
  • Usage of Ruby for building dynamic and object-oriented applications
  • Usage of Rails framework for building web applications

Description​

Non compliant code​

class UsersController < ApplicationController
  def show
    @user = User.find(params[:id])
  end

  def edit
    @user = User.find(params[:id])
  end

  def update
    @user = User.find(params[:id])
    @user.update(user_params)
    redirect_to @user
  end

  private

  def user_params
    params.require(:user).permit(:name, :email)
  end
end

The code above represents the UserController of a Ruby on Rails application. This controller is responsible for handling the user's profile page and the actions related to it such as displaying, editing and updating user information.

The vulnerability lies in the show, edit and update methods where the application fetches the user object based on the id parameter passed in the request. Insecure Direct Object References (IDOR) occur when an application provides direct access to objects based on user-supplied input. As a result, attackers can bypass authorization and directly access resources in the system.

In this case, an attacker can simply modify the id parameter in the URL to access and potentially modify other users' information. For instance, if the URL of the edit page is http://example.com/users/1/edit, changing the 1 to 2 allows the attacker to edit the information of the user with an id of 2.

The update method is also vulnerable as it uses the user-supplied id to find the user and update its information based on the submitted form data. This means an attacker can modify the id in the URL and the form data to update another user's information.

This is a significant security issue as it can lead to unauthorized access and modification of user data.

Steps​

  • Implement proper authentication mechanisms to ensure that only authorized users can access and modify user information.
  • Use session-based authentication or token-based authentication to securely identify and authenticate users.
  • Ensure that the user making the request is authorized to access and modify the specified user's information.
  • Do not rely solely on the unique identifier (params[:id]) to determine the user to be modified. Instead, validate the user's identity using the authenticated user's session or token.
  • Implement authorization checks to verify that the authenticated user has the necessary permissions to perform the requested action.
  • Consider implementing role-based access control (RBAC) or attribute-based access control (ABAC) to manage user permissions.
  • Regularly update and patch the Ruby on Rails framework and its dependencies to benefit from the latest security fixes and enhancements.
  • Follow secure coding practices and guidelines to prevent other common vulnerabilities.

Compliant code​

class UsersController < ApplicationController
  before_action :authenticate_user!
  before_action :correct_user, only: [:edit, :update]

  def show
    @user = User.find(params[:id])
  end

  def edit
  end

  def update
    if @user.update(user_params)
      redirect_to @user
    else
      render 'edit'
    end
  end

  private

  def user_params
    params.require(:user).permit(:name, :email)
  end

  def correct_user
    @user = User.find(params[:id])
    redirect_to(root_url) unless current_user?(@user)
  end

  def current_user?(user)
    user == current_user
  end
end

The updated code now includes two before_action filters at the top of the UsersController class. The authenticate_user! method is a Devise helper method that ensures a user is signed in before they can access the actions in this controller. If a user is not signed in, they will be redirected to the sign-in page.

The correct_user method is called before the edit and update actions. This method retrieves the user from the database using the id parameter and checks if this user matches the currently signed-in user (using the current_user? method). If they do not match, the user is redirected to the root URL. This ensures that users can only edit and update their own information.

The current_user? method is a helper method that checks if the given user matches the currently signed-in user. This method is used in the correct_user method to prevent users from editing or updating other users' information.

The update action now checks if the update was successful before redirecting to the user's show page. If the update was not successful (for example, because the user tried to update information they are not authorized to change), the edit page is re-rendered with the current information.

This code fixes the insecure direct object reference vulnerability by ensuring that only authenticated users can access the UsersController actions and that users can only edit and update their own information.

References​

Last updated on