Skip to main content

Use of an insecure channel - HTTP

Need​

Secure channel for transmitting client information

Context​

  • Usage of Scala for building scalable and functional applications
  • Usage of play.api.mvc for handling HTTP requests and responses in Play Framework
  • Usage of global execution context for Scala concurrent programming

Description​

Non compliant code​

import play.api.mvc._
import scala.concurrent.ExecutionContext.Implicits.global

class HomeController @Inject()(val controllerComponents: ControllerComponents) extends BaseController {

  def index() = Action.async { implicit request: Request[AnyContent] =>
    Future {
      Ok("Welcome to our insecure website").withHeaders("Content-Type" -> "text/html")
    }
  }
}

The above Scala code represents a basic Play Framework web application that is vulnerable to the use of an insecure channel - HTTP.

The HomeController class is a simple controller that responds to HTTP requests with a welcome message. The index method is asynchronous and returns a Future that contains the result of the HTTP request.

The Server object starts the application on port 80, which is the standard port for HTTP. The ServerConfig method is used to configure the server and start it.

The vulnerability lies in the fact that this application is using HTTP, which is an insecure protocol. Any data transmitted over HTTP is not encrypted and can be intercepted by attackers. This includes sensitive information like usernames, passwords, and credit card numbers.

To exploit this vulnerability, an attacker could simply capture the traffic between the client and the server and read any sensitive information that is transmitted. This is often done using a technique called packet sniffing.

The application should be modified to use HTTPS, which is a secure version of HTTP that encrypts all data transmitted between the client and the server. This would prevent attackers from being able to read any intercepted data.

Steps​

  • Enable HTTPS for the application
  • Redirect HTTP requests to HTTPS
  • Configure TLS/SSL certificates for secure communication
  • Ensure all sensitive data is transmitted over secure channels
  • Implement secure authentication mechanisms
  • Encrypt sensitive data at rest and in transit
  • Regularly update and patch the application and its dependencies

Compliant code​

import play.api.mvc._
import play.api.mvc.Results._
import scala.concurrent.ExecutionContext.Implicits.global

class HomeController @Inject()(val controllerComponents: ControllerComponents) extends BaseController {

  def index() = Action.async { implicit request: Request[AnyContent] =>
    Future {
      MovedPermanently("https://yourdomain.com" + request.uri).withHeaders("Content-Type" -> "text/html")
    }
  }
}

The above code is a fixed version of the original vulnerable code. The vulnerability was that the application was using HTTP, an insecure channel, to transmit client information. This could potentially allow an attacker to capture credentials and confidential information in plain text.

To fix this vulnerability, we have made the following changes:

  1. Enable HTTPS for the application: We have changed the application to use HTTPS instead of HTTP. HTTPS is a secure protocol that encrypts all data sent between the client and the server, preventing attackers from reading or modifying the data.

  2. Redirect HTTP requests to HTTPS: We have added a MovedPermanently response that redirects all HTTP requests to HTTPS. This ensures that even if a client initially connects to the application over HTTP, they will be immediately redirected to the secure HTTPS version of the application.

  3. Configure TLS/SSL certificates for secure communication: This is not shown in the code, but it is an important step in securing your application. You will need to obtain a TLS/SSL certificate from a trusted certificate authority and configure your server to use this certificate for HTTPS connections.

  4. Ensure all sensitive data is transmitted over secure channels: By using HTTPS and redirecting all HTTP requests to HTTPS, we ensure that all data is transmitted over secure channels.

  5. Implement secure authentication mechanisms: This is not shown in the code, but it is an important step in securing your application. You should implement secure authentication mechanisms, such as two-factor authentication or password hashing, to protect user accounts.

  6. Encrypt sensitive data at rest and in transit: By using HTTPS, we encrypt all data in transit. You should also encrypt sensitive data at rest, such as in your database, to further protect it.

  7. Regularly update and patch the application and its dependencies: This is not shown in the code, but it is an important step in securing your application. Regularly updating and patching your application and its dependencies can help protect against known vulnerabilities.

References​

Last updated on