Skip to main content

Automatic information enumeration - Credit Cards

Need​

Enhancement of credit card validation and security measures

Context​

  • Usage of Scala 2.12 for building scalable and high-performance applications
  • Usage of play.api.mvc for handling HTTP requests and responses in Play Framework
  • Usage of play.api.libs.json for JSON parsing and manipulation in Play Framework

Description​

Non compliant code​

import play.api.mvc._

class CreditCardController extends Controller {

  def getCreditCardInfo(id: String) = Action { implicit request: Request[AnyContent] =>
    val creditCard = CreditCard.find(id)
    Ok(Json.toJson(creditCard))
  }
}

case class CreditCard(id: String, number: String, expDate: String, cvv: String)

object CreditCard {
  def find(id: String): CreditCard = {
    // fetch credit card info from database
  }
}

In the above code, we have a CreditCardController which handles HTTP requests. There is a method getCreditCardInfo(id: String) that takes a credit card id as a parameter and returns all the details of the credit card including the card number, expiration date and CVV.

The problem here is that there is no validation or checks to ensure that the requester has the right to access this information. This means that anyone who knows the id of a credit card can get all the details of the credit card.

Also, the CreditCard case class includes sensitive information like the card number, expiration date and CVV. This data should never be exposed.

This vulnerability allows an attacker to enumerate credit card information, hence it's a case of Automatic Information Enumeration vulnerability.

To fix this, we should never return sensitive information like the card number, expiration date and CVV. Also, we need to add authentication and authorization checks to ensure that the requester has the right to access the information.

Steps​

  • Implement validation for the credit card expiration date and security code.
  • Use a secure method to store credit card information in the database.
  • Limit access to the getCreditCardInfo endpoint to authorized users only.
  • Implement rate limiting and request throttling to prevent automated enumeration of credit card information.
  • Regularly update and patch the Play framework and its dependencies to ensure the latest security fixes are applied.

Compliant code​

import play.api.mvc._
import play.api.libs.json._
import play.api.libs.functional.syntax._

class CreditCardController extends Controller {

  def getCreditCardInfo(id: String) = Action { implicit request: Request[AnyContent] =>
    val creditCard = CreditCard.find(id)
    creditCard match {
      case Some(card) if card.isValid => Ok(Json.toJson(card))
      case _ => Unauthorized("Invalid credit card information or unauthorized access.")
    }
  }
}

case class CreditCard(id: String, number: String, expDate: String, cvv: String) {
  def isValid: Boolean = {
    // Implement validation for expiration date and CVV here
  }
}

object CreditCard {
  def find(id: String): Option[CreditCard] = {
    // fetch credit card info from database
    // return None if not found or invalid
  }
}

The updated code includes several changes to address the vulnerability:

  1. The CreditCard case class now includes a isValid method that should be used to validate the expiration date and CVV of the credit card. This method should return true if the credit card is valid and false otherwise.

  2. The getCreditCardInfo method in the CreditCardController class now checks if the credit card is valid before returning it. If the credit card is not valid or not found, it returns an Unauthorized response.

  3. The find method in the CreditCard object now returns an Option[CreditCard]. This allows the method to return None if the credit card is not found or invalid, which can then be handled appropriately in the getCreditCardInfo method.

  4. The getCreditCardInfo method should be protected by authentication and authorization mechanisms to ensure that only authorized users can access it. This is not shown in the code, but it is an important part of securing the endpoint.

  5. Implement rate limiting and request throttling to prevent automated enumeration of credit card information. This is not shown in the code, but it is an important part of securing the endpoint.

  6. Regularly update and patch the Play framework and its dependencies to ensure the latest security fixes are applied. This is not shown in the code, but it is an important part of maintaining the security of the application.

References​

Last updated on