Skip to main content

Security controls bypass or absence - Facial Recognition

Need​

Implementation of robust security controls for facial recognition processes

Context​

  • Usage of Scala for functional and object-oriented programming in the JVM environment
  • Usage of play.api.mvc for handling HTTP requests and responses in Play Framework
  • Usage of play.api.libs.json for JSON parsing and manipulation in Play Framework

Description​

Non compliant code​

import play.api.mvc._
import play.api.libs.json._

class ApplicationController extends Controller {
  def verifyFace = Action(parse.json) { request =>
    val tokenOpt = (request.body \\ "token").asOpt[String]
    tokenOpt match {
      case Some(token) => {
        // Assume that the token is valid and bypass facial recognition
        Ok(Json.obj("status" -> "success", "message" -> "Face verified"))
      }
      case None => BadRequest(Json.obj("status" -> "error", "message" -> "Missing token"))
    }
  }
}

This Scala code uses the Play framework to define an ApplicationController with a verifyFace action. This action is supposed to verify the face of a user before allowing them to proceed. However, it contains a security vulnerability that allows bypassing the facial recognition process.

The verifyFace action expects a JSON request body with a token field. If the token field is present, it assumes that the token is valid and immediately returns a success message, bypassing any facial recognition.

This means that an attacker could potentially bypass the facial recognition process simply by providing a token in the request, even if the token is not valid or associated with a different user.

This vulnerability could be exploited to impersonate a user and perform actions on their behalf, such as accepting or denying authorizations. This could lead to unauthorized access to sensitive information or functionality.

Steps​

  • Implement a proper facial recognition process to validate the user's identity
  • Do not rely solely on a token for authentication
  • Use a secure and reliable facial recognition library or service
  • Ensure that the facial recognition process is performed before granting access to application transactions
  • Handle authentication and authorization separately from the facial recognition process
  • Implement proper error handling and logging for any failures in the facial recognition process

Compliant code​

import play.api.mvc._
import play.api.libs.json._
import play.api.libs.ws._
import scala.concurrent.ExecutionContext.Implicits.global

class ApplicationController(ws: WSClient) extends Controller {
  def verifyFace = Action.async(parse.json) { request =>
    val tokenOpt = (request.body \\ "token").asOpt[String]
    val faceOpt = (request.body \\ "face").asOpt[String]
    (tokenOpt, faceOpt) match {
      case (Some(token), Some(face)) => {
        // Call to external service for facial recognition
        ws.url("https://facial-recognition-service/verify").post(Json.obj("token" -> token, "face" -> face)).map { response =>
          if ((response.json \\ "status").as[String] == "success") {
            Ok(Json.obj("status" -> "success", "message" -> "Face verified"))
          } else {
            Unauthorized(Json.obj("status" -> "error", "message" -> "Face not recognized"))
          }
        }
      }
      case _ => Future.successful(BadRequest(Json.obj("status" -> "error", "message" -> "Missing token or face data")))
    }
  }
}

The updated code now includes a call to an external facial recognition service to verify the user's face. This is done by sending a POST request to the service with the token and face data. The service is expected to return a JSON response with a "status" field that indicates whether the face was successfully recognized or not.

The token and face data are both extracted from the request body. If either of these is missing, a "BadRequest" response is returned with an error message indicating that the token or face data is missing.

The call to the facial recognition service is done asynchronously using the Play Framework's WSClient, which allows for non-blocking I/O operations. This means that the server can handle other requests while waiting for the response from the facial recognition service.

If the facial recognition service successfully recognizes the face, a "success" response is returned. If the face is not recognized, an "Unauthorized" response is returned.

This approach ensures that the facial recognition process is performed before granting access to application transactions, and that authentication and authorization are handled separately from the facial recognition process. It also provides proper error handling and logging for any failures in the facial recognition process.

References​

Last updated on