Skip to main content

Insecure object reference - Corporate information

Need​

Secure handling of object references and access control for corporate information

Context​

  • Usage of Ruby for building web applications and scripting
  • Usage of ExcelParser for parsing and reading Excel files
  • Usage of the Employee package for managing employee data and operations

Description​

Non compliant code​

class EmployeesController < ApplicationController
  def upload
    file = params[:file]
    company_id = params[:company_id]

    # Parse the Excel file and get the rows
    rows = ExcelParser.new(file.path).parse

    # For each row in the rows array, create or update the employee
    rows.each do |row|
      employee = Employee.find_or_initialize_by(payroll_number: row['payrollNumber'])
      employee.update(
        name: row['name'],
        position: row['position'],
        salary: row['salary'],
        company_id: company_id
      )
    end

    redirect_to employees_path, notice: 'Employees information was successfully uploaded.'
  end
end

The above code presents an insecure object reference vulnerability. The upload method in the EmployeesController is responsible for handling the upload of an Excel file that contains employee data. This data is then used to either create new employee records or update existing ones.

The vulnerability lies in the fact that the company_id parameter, which is supposed to be the identifier of the company to which the employees belong, is directly taken from the request parameters without any form of validation or authorization checks. This means that an attacker can manipulate this parameter and associate the uploaded employees to any company, even those to which he does not have access.

Furthermore, the payroll_number which is used to find or initialize an employee is also taken directly from the uploaded Excel file. This allows an attacker to create or update employee records of any company by simply including the desired payroll_number in the Excel file.

This vulnerability could lead to unauthorized access to sensitive employee data, data corruption, and potential legal issues due to privacy law violations.

Steps​

  • Implement proper authorization and authentication mechanisms to ensure that only authorized users can access the upload functionality.
  • Validate the company_id parameter to ensure that the user has permission to upload employees for the specified company.
  • Implement input validation and sanitization to prevent any malicious input from being processed.
  • Use a secure file upload mechanism that includes file type validation and restricts the file size to prevent potential attacks.
  • Implement server-side validation of the uploaded Excel file to ensure that it contains the expected columns and data format.
  • Use a whitelist approach to validate and sanitize the data before updating the employee records.
  • Consider implementing a separate process for reviewing and approving the uploaded employee data before it is persisted to the database.
  • Regularly monitor and review the access logs and audit trails to detect any suspicious activities related to the employee upload functionality.

Compliant code​

class EmployeesController < ApplicationController
  before_action :authenticate_user!
  before_action :validate_company_id, only: [:upload]

  def upload
    file = params[:file]
    company_id = params[:company_id]

    # Parse the Excel file and get the rows
    rows = ExcelParser.new(file.path).parse

    # For each row in the rows array, create or update the employee
    rows.each do |row|
      employee = Employee.find_or_initialize_by(payroll_number: row['payrollNumber'], company_id: company_id)
      employee.update(
        name: row['name'],
        position: row['position'],
        salary: row['salary']
      )
    end

    redirect_to employees_path, notice: 'Employees information was successfully uploaded.'
  end

  private

  def validate_company_id
    company_id = params[:company_id]
    unless current_user.companies.pluck(:id).include?(company_id.to_i)
      redirect_to root_path, alert: 'You do not have permission to upload employees for this company.'
    end
  end
end

The updated code now includes a before_action filter to authenticate the user and validate the company_id parameter. The authenticate_user! method is a Devise helper that ensures the user is signed in before they can access the upload action.

The validate_company_id method checks if the current user has permission to upload employees for the specified company. It does this by checking if the company_id is included in the list of company IDs associated with the current user. If the user does not have permission, they are redirected to the root path with an alert message.

In the upload action, the find_or_initialize_by method now also checks the company_id in addition to the payroll_number. This ensures that an employee record can only be updated if it belongs to the company specified in the company_id parameter.

The update method no longer includes the company_id parameter. This prevents the company ID from being changed through the Excel file upload.

These changes help to mitigate the insecure object reference vulnerability by ensuring that only authorized users can upload employee data for companies they have permission to access.

References​

Last updated on