Skip to main content

Unauthorized access to files

Need​

Prevention of unauthorized access to files and functionalities

Context​

  • Usage of Scala for building scalable and high-performance applications
  • Usage of play.api.mvc for handling HTTP requests and responses in Play Framework

Description​

Non compliant code​

import play.api.mvc._

class UserController @Inject()(cc: ControllerComponents) extends AbstractController(cc) {

  def updateUser(id: String) = Action { request =>
    val body: AnyContent = request.body
    val jsonBody: Option[JsValue] = body.asJson

    // parsing json and getting value
    val name: String = (jsonBody.get \\ "name").as[String]
    val email: String = (jsonBody.get \\ "email").as[String]

    // directly using user input to update the user
    val result = SQL(s"UPDATE users SET name = $name, email = $email WHERE id = $id").executeUpdate()

    Ok("User updated successfully")
  }
}

The above code is an example of a vulnerability in a Scala backend application using the Play framework. The vulnerability lies within the updateUser function, which directly uses user input to update the user details.

In this function, the application receives a JSON payload from the client, which includes the name and email of the user. These values are directly taken from the payload without any sanitization or validation, and are used in an SQL query to update the user details in the database.

This poses a severe security risk as it allows for SQL Injection attacks. An attacker could potentially inject malicious SQL commands in the name or email fields, which would then be executed by the database. This could lead to unauthorized access to files and data, data loss, data corruption, and other serious issues.

Moreover, if the application is connected to Sharepoint, the malicious user could potentially gain access to functionalities and files without authorization, as described in the vulnerability context.

To fix this vulnerability, the application should never directly use user input in SQL queries. Instead, it should use prepared statements, parameterized queries, or ORM libraries, which automatically escape user input and prevent SQL Injection attacks. Furthermore, the application should implement proper access control mechanisms to prevent unauthorized access to files and functionalities.

Steps​

  • Sanitize and validate user input before using it in SQL queries.
  • Use parameterized queries or prepared statements to prevent SQL injection attacks.
  • Implement proper access control mechanisms to ensure that only authorized users can update user data.
  • Use proper authentication and authorization mechanisms to prevent unauthorized access to files and functionalities.
  • Regularly update and patch the application and its dependencies to address any known security vulnerabilities.

Compliant code​

import play.api.mvc._
import anorm._
import play.api.db.Database

class UserController @Inject()(cc: ControllerComponents, db: Database) extends AbstractController(cc) {

  def updateUser(id: String) = Action { request =>
    val body: AnyContent = request.body
    val jsonBody: Option[JsValue] = body.asJson

    // parsing json and getting value
    val name: String = (jsonBody.get \\ "name").as[String]
    val email: String = (jsonBody.get \\ "email").as[String]

    // sanitize and validate user input
    if (isValidInput(name) && isValidInput(email)) {
      db.withConnection { implicit c =>
        // using parameterized queries to prevent SQL injection
        SQL("UPDATE users SET name = {name}, email = {email} WHERE id = {id}")
          .on('name -> name, 'email -> email, 'id -> id)
          .executeUpdate()
      }

      Ok("User updated successfully")
    } else {
      BadRequest("Invalid input")
    }
  }

  // function to validate user input
  def isValidInput(input: String): Boolean = {
    // add your validation logic here
    true
  }
}

The updated code now includes a function isValidInput to sanitize and validate user input before using it in SQL queries. This function should contain the logic to check if the input is valid and safe to use in a SQL query.

The SQL query to update the user data is now a parameterized query. This means that the values of name, email, and id are passed as parameters to the query, which prevents SQL injection attacks. The parameters are passed using the .on method, which takes a symbol and a value. The symbol corresponds to the placeholder in the SQL query, and the value is the actual value that should be used in the query.

The if statement checks if the user input is valid before executing the SQL query. If the input is not valid, a BadRequest response is returned.

The db.withConnection block is used to execute the SQL query. This ensures that the connection to the database is properly managed, and that the connection is closed after the query is executed.

This code also assumes that proper access control mechanisms are in place to ensure that only authorized users can update user data, and that proper authentication and authorization mechanisms are in place to prevent unauthorized access to files and functionalities.

References​

Last updated on