Skip to main content

Improper authorization control for web services - RDS

Need​

Enhanced authorization control for web services - RDS

Context​

  • Usage of Scala for building scalable and high-performance applications
  • Usage of Play Framework's Json library for JSON parsing and serialization
  • Usage of play.api.mvc._ for handling HTTP requests and responses in Play Framework
  • Usage of play.api.db._ for database operations in Play Framework
  • Usage of anorm._ for database access and query execution in Scala

Description​

Non compliant code​

import play.api.libs.json.Json
import play.api.mvc._
import play.api.db._
import anorm._

object RDSController extends Controller {

  def getRDSInstanceData(instanceId: String) = Action { implicit request =>
    DB.withConnection { implicit connection =>
      val result = SQL("SELECT * FROM rds_instances WHERE id = {id}")
        .on('id -> instanceId)
        .executeQuery()
        .as(RDSInstance.parser.*)

      Ok(Json.toJson(result))
    }
  }
}

The above Scala code is an example of a Play Framework controller that fetches data from an RDS instance without proper authorization control. Here's a breakdown of the vulnerability:

  1. The getRDSInstanceData method is publicly accessible and takes an RDS instance ID as parameter. It retrieves all data from the RDS instance with that ID.

  2. There is no authorization or authentication check before the data is fetched from the RDS instance. Any user, authenticated or not, can access this endpoint and retrieve data.

  3. The data from the RDS instance is directly returned to the user in JSON format. This means that potentially sensitive information can be exposed to any user who can access this endpoint.

This vulnerability can lead to unauthorized access to sensitive data stored in the RDS instances. It can be exploited by any malicious user who discovers the endpoint and can lead to data breaches.

Steps​

  • Implement proper authentication and authorization mechanisms for the web service.
  • Ensure that the RDS instances are not publicly accessible.
  • Use secure connection protocols (e.g., SSL/TLS) to communicate with the RDS instances.
  • Implement input validation and parameterized queries to prevent SQL injection attacks.
  • Regularly update and patch the RDS instances to address any security vulnerabilities.
  • Monitor and log access to the RDS instances to detect any unauthorized access attempts.

Compliant code​

import play.api.libs.json.Json
import play.api.mvc._
import play.api.db._
import anorm._
import play.api.mvc.Security.Authenticated

object RDSController extends Controller {

  def getRDSInstanceData(instanceId: String) = Authenticated { implicit request =>
    DB.withConnection { implicit connection =>
      val result = SQL("SELECT * FROM rds_instances WHERE id = {id}")
        .on('id -> instanceId)
        .executeQuery()
        .as(RDSInstance.parser.*)

      Ok(Json.toJson(result))
    }
  }
}

The updated code now includes an Authenticated wrapper around the Action in the getRDSInstanceData method. This ensures that only authenticated users can access the RDS instance data.

The Authenticated wrapper is a built-in feature of the Play framework that provides a simple way to authenticate users. It checks if the user is authenticated before executing the action. If the user is not authenticated, it will redirect them to the login page.

In addition to this, it's important to ensure that the RDS instances are not publicly accessible. This can be done by configuring the security groups of the RDS instances to only allow connections from trusted IP addresses.

Also, use secure connection protocols (e.g., SSL/TLS) to communicate with the RDS instances. This ensures that the data transmitted between the application and the RDS instances is encrypted and cannot be intercepted by attackers.

Implement input validation and parameterized queries to prevent SQL injection attacks. This can be done by using prepared statements or ORM libraries that automatically escape special characters in SQL queries.

Regularly update and patch the RDS instances to address any security vulnerabilities. This can be done by enabling automatic updates in the RDS instance settings or manually applying patches when they are released.

Finally, monitor and log access to the RDS instances to detect any unauthorized access attempts. This can be done by enabling logging in the RDS instance settings and regularly reviewing the logs for any suspicious activity.

References​

Last updated on