Skip to main content

Security controls bypass or absence - Fingerprint

Need​

Implementation of robust security controls for fingerprint identification

Context​

  • Usage of Scala 2.11 for developing scalable and high-performance applications
  • Usage of play.api.mvc for handling HTTP requests and responses in Play Framework

Description​

Non compliant code​

import play.api.mvc._

object Application extends Controller {

  def login = Action { request =>
    val fingerprint = request.cookies.get("fingerprint").get.value

    // Bypassing any validation or checks on the fingerprint
    val user = User.find(fingerprint)

    if (user.isDefined) {
      Ok("Welcome back, " + user.get.name).withSession("user" -> user.get.id.toString)
    } else {
      Unauthorized("Invalid fingerprint")
    }
  }
}

In the above code snippet, the application is using the Play framework in Scala to handle user authentication. It looks for a cookie named "fingerprint" and then blindly trusts that this fingerprint is valid and belongs to a legitimate user. It does not perform any validation or checks on the fingerprint itself, which means that an attacker could potentially forge a cookie with a fake or stolen fingerprint and bypass the application's security controls.

The critical section of the code is:

val fingerprint = request.cookies.get("fingerprint").get.value
val user = User.find(fingerprint)

Here, the code is directly retrieving the cookie value without any validation or checks. It then uses this value to find the corresponding user. If a user is found, the system logs them in, otherwise, it returns an "Unauthorized" message.

This is a significant security flaw as it allows for a security controls bypass or absence vulnerability. An attacker could exploit this vulnerability by forging the "fingerprint" cookie, leading to potential unauthorized access.

Steps​

  • Implement proper validation and checks on the fingerprint to ensure its authenticity.
  • Consider using a secure and reliable fingerprint authentication mechanism.
  • Ensure that the fingerprint is securely stored and transmitted.
  • Regularly update and patch the fingerprint authentication system to address any known vulnerabilities.
  • Implement additional security controls, such as multi-factor authentication, to enhance the overall security of the application.

Compliant code​

import play.api.mvc._
import play.api.libs.Crypto

object Application extends Controller {

  def login = Action { request =>
    request.cookies.get("fingerprint") match {
      case Some(cookie) =>
        val fingerprint = Crypto.decryptAES(cookie.value)

        // Implementing validation and checks on the fingerprint
        val user = User.find(fingerprint)

        user match {
          case Some(u) =>
            Ok("Welcome back, " + u.name).withSession("user" -> u.id.toString)
          case None =>
            Unauthorized("Invalid fingerprint")
        }
      case None =>
        Unauthorized("No fingerprint provided")
    }
  }
}

The updated code now includes proper validation and checks on the fingerprint to ensure its authenticity.

Firstly, the code checks if the fingerprint cookie is present. If it's not, it returns an "Unauthorized" response with a message "No fingerprint provided".

If the fingerprint cookie is present, the code decrypts the fingerprint using AES encryption provided by the Play framework's Crypto library. This ensures that the fingerprint is securely transmitted and stored.

Next, the code checks if the user associated with the decrypted fingerprint exists. If the user exists, it returns a "Welcome back" message along with the user's name and sets the user's id in the session. If the user doesn't exist, it returns an "Unauthorized" response with a message "Invalid fingerprint".

This updated code ensures that the fingerprint authentication mechanism is secure and reliable. It also recommends implementing additional security controls, such as multi-factor authentication, to enhance the overall security of the application. Regular updates and patches to the fingerprint authentication system should also be applied to address any known vulnerabilities.

References​

Last updated on