Skip to main content

Insecure object reference

Need​

Secure and robust authorization mechanism to prevent unauthorized access to sensitive data

Context​

  • Usage of Swift 5.0 for iOS app development
  • Usage of UIKit for building modern and responsive user interfaces
  • Usage of Foundation for building responsive and accessible web interfaces

Description​

Non compliant code​

import UIKit

class ViewController: UIViewController {
    var userID: String?

    override func viewDidLoad() {
        super.viewDidLoad()
        // Do any additional setup after loading the view.
        userID = UserDefaults.standard.string(forKey: "userID")
    }
    
    func getUserData() {
        let url = URL(string: "https://example.com/user/\\(userID!)")!
        let task = URLSession.shared.dataTask(with: url) {(data, response, error) in
            guard let data = data else { return }
            print(String(data: data, encoding: .utf8)!)
        }
        task.resume()
    }
}

This Swift code for an iOS application shows a ViewController class that fetches user data from a server. The user ID is stored in UserDefaults and is used to construct a URL for the data request. When the getUserData() function is called, it makes a network request to https://example.com/user/(userID).

The vulnerability here is that the user ID is fetched from UserDefaults and is not properly secured. An attacker could potentially modify the user ID in UserDefaults, and the application would then fetch another user's data when getUserData() is called. This is an insecure direct object reference (IDOR) vulnerability because the application does not verify if the user is authorized to access the data for the given user ID. This could lead to unauthorized access to sensitive user data.

Steps​

  • Implement proper authentication and authorization mechanisms to ensure that users can only access their own data.
  • Do not rely solely on client-side data storage (e.g., UserDefaults) for sensitive information like user IDs.
  • Use server-side session management and authentication tokens to securely identify and authenticate users.
  • Validate user permissions and ownership before allowing access to sensitive data.
  • Implement access control checks on the server-side to ensure that users can only access their own data.
  • Avoid exposing sensitive data in URLs or query parameters.
  • Consider using a secure communication protocol (e.g., HTTPS) to protect data transmission between the client and server.
  • Regularly update and patch the application to address any security vulnerabilities.

Compliant code​

import UIKit

class ViewController: UIViewController {
    var userID: String?
    var userToken: String?

    override func viewDidLoad() {
        super.viewDidLoad()
        // Do any additional setup after loading the view.
        userID = UserDefaults.standard.string(forKey: "userID")
        userToken = UserDefaults.standard.string(forKey: "userToken")
    }
    
    func getUserData() {
        guard let userID = userID, let userToken = userToken else { return }
        let url = URL(string: "https://example.com/user")!
        var request = URLRequest(url: url)
        request.httpMethod = "POST"
        request.addValue("Bearer \\(userToken)", forHTTPHeaderField: "Authorization")
        let postString = "id=\\(userID)"
        request.httpBody = postString.data(using: .utf8)
        let task = URLSession.shared.dataTask(with: request) {(data, response, error) in
            guard let data = data else { return }
            print(String(data: data, encoding: .utf8)!)
        }
        task.resume()
    }
}

The updated code now includes an authentication token (userToken) along with the user ID (userID). This token is used to authenticate the user on the server-side before any data is accessed or modified. This ensures that only the authenticated user can access their own data.

The getUserData() function has been updated to send a POST request instead of a GET request. The user ID is now sent in the body of the request, rather than in the URL. This prevents the user ID from being exposed in the URL or in any logs that might record the URL.

The Authorization header is set with the value of Bearer \\(userToken). This is a common scheme for passing a token for user authentication. The server should verify this token and ensure it is valid and corresponds to the user ID provided in the request body.

The user ID and token are retrieved from UserDefaults in the viewDidLoad() function. However, it's important to note that storing sensitive information like user IDs and tokens in UserDefaults can be risky, as this data is not encrypted and can be accessed if the device is compromised. Consider using more secure methods of storage for sensitive data.

Finally, the server-side application should also implement proper access control checks to ensure that the authenticated user has the necessary permissions to access the requested data. This includes validating the user ID and token, and checking that the user ID in the request matches the authenticated user.

References​

Last updated on