Insecure functionality - Password management

Need

Secure password management

Context

• Usage of Swift for iOS and macOS app development
• Usage of UIKit for building modern and responsive user interfaces

Description

Non compliant code

import UIKit

class ChangePasswordViewController: UIViewController {

    @IBOutlet weak var newPasswordTextField: UITextField!
    var userID: String?

    override func viewDidLoad() {
        super.viewDidLoad()
    }

    @IBAction func changePasswordTapped(_ sender: Any) {
        let newPassword = newPasswordTextField.text
        changePassword(userID: userID!, newPassword: newPassword!)
    }

    func changePassword(userID: String, newPassword: String){
        // Assume this function sends a request to the server to change the password
        // The server changes the password for the user with the given userID
    }
}

The code above represents a view controller for a screen that allows users to change their password. The userID is a variable that is set somewhere else in the application, and it's used here to tell the server which user's password should be changed.

However, there is a serious security vulnerability here. The userID is not securely checked to confirm that the current session belongs to the user whose userID is being used. This means that if a malicious user can manage to set userID to another user's ID, they can change that user's password and gain unauthorized access to their account.

The changePassword function is particularly vulnerable. It takes a userID and a newPassword, and it sends these straight to the server to change the password. There's no check to ensure that the userID passed to this function corresponds to the user who is currently logged in. This means that an attacker could potentially call this function with someone else's userID and change their password.

This insecure functionality could lead to unauthorized access and potential data breaches, making it a critical issue that needs to be addressed.

Steps

• Implement proper authentication and session management to ensure that only the authenticated user can change their own password.
• Do not rely solely on client-side validation. Perform server-side validation to verify the user's identity and authorization before changing the password.
• Use secure communication protocols (e.g., HTTPS) to transmit sensitive data, such as passwords, between the client and the server.
• Implement strong password policies, including requirements for minimum length, complexity, and expiration.
• Store passwords securely by using strong hashing algorithms (e.g., bcrypt) and salting to protect against password cracking attacks.
• Implement rate limiting and account lockout mechanisms to prevent brute-force attacks on the password change functionality.
• Regularly update and patch the application and server to address any known security vulnerabilities.
• Conduct regular security assessments and penetration testing to identify and address any potential vulnerabilities in the password management functionality.

Compliant code

import UIKit

class ChangePasswordViewController: UIViewController {

    @IBOutlet weak var newPasswordTextField: UITextField!
    var userID: String?

    override func viewDidLoad() {
        super.viewDidLoad()
    }

    @IBAction func changePasswordTapped(_ sender: Any) {
        guard let userID = userID, let newPassword = newPasswordTextField.text else {
            return
        }
        // Add authentication check before changing password
        if isAuthenticatedUser(userID: userID) {
            changePassword(userID: userID, newPassword: newPassword)
        } else {
            // Handle unauthorized access attempt
            print("Unauthorized access attempt")
        }
    }

    func isAuthenticatedUser(userID: String) -> Bool {
        // Implement authentication check
        // This is a placeholder and should be replaced with actual authentication logic
        return true
    }

    func changePassword(userID: String, newPassword: String){
        // Assume this function sends a request to the server to change the password
        // The server changes the password for the user with the given userID
        // Add server-side validation to verify user's identity and authorization
    }
}

The updated code includes an authentication check before changing the password. The isAuthenticatedUser function is used to verify if the user is authenticated. This function should be replaced with actual authentication logic.

In the changePasswordTapped function, we first check if the userID and newPassword are not nil using the guard let statement. If either of them is nil, we return from the function without doing anything.

Next, we check if the user is authenticated by calling the isAuthenticatedUser function. If the user is authenticated, we proceed to change the password. If the user is not authenticated, we handle the unauthorized access attempt. In this example, we simply print a message to the console, but in a real application, you would want to handle this situation more appropriately, for example, by showing an error message to the user or logging the unauthorized access attempt for further investigation.

The changePassword function is assumed to send a request to the server to change the password. This function should include server-side validation to verify the user's identity and authorization before changing the password.

This code update helps to ensure that only the authenticated user can change their own password, addressing the identified security vulnerability.

References

• 271.Insecure functionality - Password management