Skip to main content

Security controls bypass or absence - Session Invalidation

Need​

Implementation of proper session invalidation mechanisms

Context​

  • Requirement of Ruby 2.0 or higher for running the application
  • Usage of Rails framework for building web applications

Description​

Non compliant code​

class UsersController < ApplicationController
  def get_main
    session_code = params[:session_code]
    if session_code.include? 'auto'
      @user = User.find_by_session_code(session_code)
    else
      authenticate_user!
      @user = current_user
    end
    render json: @user.main
  end
end

In the above code, we have a method get_main in the UsersController. This method is used to fetch the main of the user based on the session_code provided in the parameters.

The vulnerability lies in the if condition where it checks if the session_code includes the word 'auto'. If it does, it allows access to the user's main without any authentication. This is a security control bypass vulnerability as it allows unauthorized access to user data if the session code contains the word 'auto'.

This can lead to serious data privacy issues as any malicious user can craft a session code with the word 'auto' and can gain access to the user's main without needing to authenticate.

The code was probably used for debugging purposes to bypass authentication and should have been removed before deployment to a production environment. However, it was not, leaving a potential security hole in the application.

Steps​

  • Remove the debugging code from the get_main function.
  • Implement proper session invalidation logic to ensure that sessions are invalidated after logout or a certain period of inactivity.
  • Avoid using session codes that can be easily guessed or manipulated.
  • Implement strong authentication mechanisms to prevent unauthorized access to sensitive resources.
  • Regularly update and patch the Ruby on Rails framework and its dependencies to address any security vulnerabilities.

Compliant code​

class UsersController < ApplicationController
  before_action :authenticate_user!

  def get_main
    @user = current_user
    render json: @user.main
  end
end

The updated code now includes a before_action filter that calls the authenticate_user! method before executing the get_main method. This ensures that only authenticated users can access the get_main method.

The debugging code that allowed access if a session code containing the word 'auto' was used has been removed. This was a security vulnerability as it allowed unauthorized access to the user's main.

The get_main method now only returns the main of the currently authenticated user (current_user). This ensures that users can only access their own data, preventing unauthorized access to other users' data.

Remember to implement proper session invalidation logic to ensure that sessions are invalidated after logout or a certain period of inactivity. Avoid using session codes that can be easily guessed or manipulated. Regularly update and patch the Ruby on Rails framework and its dependencies to address any security vulnerabilities.

References​

Last updated on