Skip to main content

Insecure object reference - Files

Need​

Secure access control for files to prevent unauthorized access and manipulation

Context​

  • Usage of Ruby 2.5.0 as the programming language for development
  • Usage of Rails framework for building web applications

Description​

Non compliant code​

class FilesController < ApplicationController
  def show
    @file = File.find(params[:id])
    send_file @file.file_path
  end
end

In the above code, we have a FilesController which has a show method. This method retrieves a file based on an id parameter from the HTTP request.

The problem with this code is that it does not check if the user trying to access the file is actually authorized to do so. If an attacker knows or guesses the id of a file, they can access or manipulate it without any restrictions.

This is a classic example of an Insecure Direct Object Reference (IDOR) vulnerability, where the application exposes a reference to an internal implementation object, such as a file, directory, or database key without any access control checks or other protection. This can lead to unauthorized access to sensitive data or even data manipulation.

Steps​

  • Implement proper authorization checks to ensure that only authorized users can access the files.
  • Validate the user's permissions before retrieving and sending the file.
  • Use a secure file storage mechanism that prevents unauthorized access to the files.
  • Consider implementing access control mechanisms such as role-based access control (RBAC) to manage user permissions.
  • Regularly review and update the access control mechanisms to ensure they are effective and up-to-date.

Compliant code​

class FilesController < ApplicationController
  before_action :authenticate_user!
  before_action :set_file, only: [:show]
  before_action :check_permission, only: [:show]

  def show
    send_file @file.file_path
  end

  private

  def set_file
    @file = File.find(params[:id])
  end

  def check_permission
    unless @file.user == current_user
      redirect_to root_path, alert: 'You do not have permission to access this file.'
    end
  end
end

The updated code now includes a before_action filter to authenticate the user before any action is performed. This ensures that only logged-in users can access the files.

The set_file method is used to find the file based on the id parameter. This method is called before the show action is executed.

The check_permission method is used to check if the current user is the owner of the file. If not, the user is redirected to the root path with an alert message. This method is also called before the show action is executed.

This way, we ensure that only the owner of the file can access it, preventing unauthorized access or manipulation of information.

References​

Last updated on