Use of insecure channel - Source code

Need

Secure transmission of customer information

Context

• Usage of TypeScript for type-checking and compiling JavaScript code
• Usage of Express for building web applications and APIs

Description

Non compliant code

import express from 'express';

const app = express();
const port = 3000;

app.get('/customer', (req, res) => {
  const customerId = req.query.id;
  const customerData = {
    id: customerId,
    name: 'John Doe',
    email: '[email protected]',
    address: '123 Main St',
    phone: '555-1234'
  };

  res.json(customerData);
});

app.listen(port, () => {
  console.log(`Server running on port ${port}`);
});

The vulnerability in this code is the use of an insecure channel for transmitting customer information. The code is using the Express framework to create a server that listens on port 3000. It exposes a GET endpoint at '/customer' which returns customer data in JSON format.

However, the code does not implement any encryption or secure communication protocols. The customer data is transmitted over an insecure channel, which means that it can be intercepted and read by attackers. This exposes sensitive information such as customer names, email addresses, addresses, and phone numbers.

An attacker could potentially capture this information and use it for malicious purposes, such as identity theft or unauthorized access to customer accounts. They could also intercept the communication and modify the requests or responses, leading to potential data manipulation or unauthorized actions.

To mitigate this vulnerability, it is recommended to deploy the application over an encrypted communication channel, such as HTTPS using TLS. This would ensure that the customer data is encrypted during transmission, making it much more difficult for attackers to intercept and read the information.

Steps

• Install a TLS/SSL certificate on your server
• Update the code to use HTTPS instead of HTTP
• Redirect HTTP requests to HTTPS
• Verify that the server is using the correct port for HTTPS
• Test the application to ensure that it is now using an encrypted communication channel

Compliant code

import express from 'express';
import https from 'https';
import fs from 'fs';

const app = express();
const port = 3000;

const options = {
  key: fs.readFileSync('path/to/private.key'),
  cert: fs.readFileSync('path/to/certificate.crt')
};

app.get('/customer', (req, res) => {
  const customerId = req.query.id;
  const customerData = {
    id: customerId,
    name: 'John Doe',
    email: '[email protected]',
    address: '123 Main St',
    phone: '555-1234'
  };

  res.json(customerData);
});

// Redirect HTTP requests to HTTPS
app.use((req, res, next) => {
  if (req.secure) {
    next();
  } else {
    res.redirect(`https://${req.headers.host}${req.url}`);
  }
});

https.createServer(options, app).listen(port, () => {
  console.log(`Server running on port ${port}`);
});

The fixed code addresses the vulnerability by implementing secure communication using HTTPS with TLS encryption.

First, the code imports the necessary modules: express for creating the server, https for creating an HTTPS server, and fs for reading the private key and certificate files.

The code then initializes an Express application and sets the port to 3000.

Next, the code defines the options object that contains the private key and certificate paths. These paths should be replaced with the actual paths to the private key and certificate files.

The code sets up a route for handling GET requests to '/customer'. Inside the route handler, it retrieves the customer ID from the query parameters and creates a sample customer data object.

The response is sent back to the client as JSON containing the customer data.

To enforce secure communication, the code adds a middleware function using app.use(). This function checks if the request is secure (i.e., made over HTTPS). If it is, the next middleware or route handler is called. Otherwise, the function redirects the request to the corresponding HTTPS URL.

Finally, the code creates an HTTPS server using https.createServer() and passes in the options and the Express app. The server listens on the specified port (3000 in this case) and logs a message to the console when it starts running.

By deploying this code, the application ensures that customer information is transmitted securely over an encrypted channel, mitigating the risk of sensitive information interception or unauthorized access.

References

• 332.Use of insecure channel - Source code