Skip to main content

Insufficient data authenticity validation

Need​

Enhanced data authenticity validation and verification

Context​

  • Usage of Scala for functional and object-oriented programming in the JVM environment
  • Usage of play.api.mvc._ for handling HTTP requests and responses in Play Framework
  • Usage of play.api.libs.json for JSON parsing and serialization

Description​

Non compliant code​

import play.api.mvc._
import play.api.libs.json._

class UserController @Inject()(cc: ControllerComponents) extends AbstractController(cc) {

  def updateUser = Action(parse.json) { request =>
    val userResult = request.body.validate[User]
    userResult.fold(
      errors => {
        BadRequest(Json.obj("status" ->"KO", "message" -> JsError.toJson(errors)))
      },
      user => {
        UserService.updateUser(user)
        Ok(Json.obj("status" ->"OK", "message" -> ("User '"+user.name+"' saved.")))
      }
    )
  }
}

The above code snippet represents a controller in a Scala backend application using the Play framework. The controller has a method updateUser that accepts JSON input and attempts to parse it into a User object. If the parsing is successful, it passes the User object to the UserService.updateUser method for updating.

The vulnerability lies in the lack of data authenticity validation. The application does not check if the user has the permission to modify certain fields. For example, a user might be able to change another user's data, which is a serious security issue.

Moreover, the application does not validate if the data provided is valid. For example, a user can provide a non-existing name, and the application will accept it without any checks. This can lead to data inconsistency and potential application crashes.

To fix this vulnerability, the application should implement proper access control checks to ensure that the user has the permission to modify the data. It should also validate the data before updating it to prevent invalid data from being saved.

Steps​

  • Implement server-side validation to ensure that the user has permission to modify the specified fields.
  • Validate the data received in the request against the expected format and values.
  • Check if the names provided in the request actually exist before allowing the update.
  • Consider implementing authentication and authorization mechanisms to control access to the updateUser endpoint.
  • Use a secure communication protocol (e.g., HTTPS) to protect the integrity and confidentiality of the data exchanged between the client and the server.

Compliant code​

import play.api.mvc._
import play.api.libs.json._

class UserController @Inject()(cc: ControllerComponents, userService: UserService) extends AbstractController(cc) {

  def updateUser = Action(parse.json) { request =>
    val userResult = request.body.validate[User]
    userResult.fold(
      errors => {
        BadRequest(Json.obj("status" ->"KO", "message" -> JsError.toJson(errors)))
      },
      user => {
        if(userService.userExists(user.name) && userService.userHasPermission(request.headers.get("auth"), user.name)) {
          UserService.updateUser(user)
          Ok(Json.obj("status" ->"OK", "message" -> ("User '"+user.name+"' saved.")))
        } else {
          Unauthorized(Json.obj("status" ->"KO", "message" -> "Unauthorized access or invalid user"))
        }
      }
    )
  }
}

The updated code now includes server-side validation to ensure that the user has permission to modify the specified fields and that the user exists.

The userService.userExists(user.name) method checks if the user exists in the system. If the user does not exist, the server responds with an "Unauthorized access or invalid user" message.

The userService.userHasPermission(request.headers.get("auth"), user.name) method checks if the authenticated user has permission to modify the specified fields. The request.headers.get("auth") retrieves the authentication token from the request headers. If the user does not have the necessary permissions, the server responds with an "Unauthorized access or invalid user" message.

These changes help to ensure that only valid and authorized requests are processed by the server, thereby mitigating the risk of unauthorized data modification.

In addition to these changes, it is recommended to use a secure communication protocol (e.g., HTTPS) to protect the integrity and confidentiality of the data exchanged between the client and the server.

References​

Last updated on