Skip to main content

Non-encrypted confidential information - Hexadecimal

Need​

Protection of confidential information through encryption

Context​

  • Usage of Node.js v14.0.0 for server-side JavaScript development
  • Usage of Express for building web applications and APIs

Description​

Non compliant code​

import express from 'express';

const app = express();

app.get('/confidential', (req, res) => {
  const confidentialInfo = '54686973206973206120636f6e666964656e7469616c20696e666f726d6174696f6e2e'; // Hexadecimal encoded confidential information
  const decodedInfo = Buffer.from(confidentialInfo, 'hex').toString('utf-8');

  res.send(decodedInfo);
});

app.listen(3000, () => {
  console.log('Server is running on port 3000');
});

The vulnerability in this code lies in the way the confidential information is handled. The confidential information is stored as a hexadecimal string in the variable confidentialInfo. It is then decoded using the Buffer.from() method and converted to plain text using the toString() method.

The problem is that the confidential information is not encrypted or protected in any way. It is simply encoded in hexadecimal, which is easily reversible. This means that if an attacker gains access to the decoded information, they can easily view it in plain text by decoding the hexadecimal string.

This vulnerability allows an attacker to obtain sensitive information by decoding the hexadecimal string. This could include personally identifiable information, passwords, financial data, or any other type of confidential information.

To fix this vulnerability, it is recommended to use secure encryption methods to encrypt any sensitive information. This ensures that even if an attacker gains access to the encoded data, they will not be able to view it without the proper decryption key.

Steps​

  • Replace the use of hexadecimal encoding with a secure encryption method, such as AES or RSA.
  • Generate a secret key or use a public key for encryption.
  • Encrypt the confidential information using the chosen encryption method and the secret/public key.
  • Store the encrypted information securely, such as in a database or a secure file system.
  • When retrieving the confidential information, decrypt it using the secret/private key.
  • Ensure that the decrypted information is only accessible to authorized users and is not exposed in plain text.

Compliant code​

import express from 'express';
import crypto from 'crypto';

const app = express();

const secretKey = 'mySecretKey'; // Replace with a secure secret key

app.get('/confidential', (req, res) => {
  const confidentialInfo = 'This is a confidential information.'; // Replace with the actual confidential information

  const encryptedInfo = encrypt(confidentialInfo, secretKey);
  const decryptedInfo = decrypt(encryptedInfo, secretKey);

  res.send(decryptedInfo);
});

function encrypt(data: string, key: string): string {
  const cipher = crypto.createCipher('aes-256-cbc', key);
  let encrypted = cipher.update(data, 'utf-8', 'hex');
  encrypted += cipher.final('hex');
  return encrypted;
}

function decrypt(data: string, key: string): string {
  const decipher = crypto.createDecipher('aes-256-cbc', key);
  let decrypted = decipher.update(data, 'hex', 'utf-8');
  decrypted += decipher.final('utf-8');
  return decrypted;
}

app.listen(3000, () => {
  console.log('Server is running on port 3000');
});

The fixed code addresses the vulnerability by implementing secure encryption methods to protect confidential information. Here's an explanation of the changes made:

  1. The code imports the required modules, 'express' and 'crypto', for creating the server and performing encryption operations, respectively.

  2. A secret key is defined and stored securely. It is recommended to replace the 'mySecretKey' value with a strong and unique secret key.

  3. The server is created using the 'express' module.

  4. An endpoint '/confidential' is defined to handle GET requests. Inside the endpoint, a sample confidential information is defined. In a real scenario, this should be replaced with the actual confidential information.

  5. The 'encrypt' function is implemented to encrypt the confidential information using the AES-256-CBC encryption algorithm. It takes the data to be encrypted and the secret key as parameters. The 'crypto.createCipher' method is used to create a cipher object with the specified algorithm and key. The 'update' method is used to update the cipher with the data to be encrypted, and the 'final' method is used to retrieve the final encrypted data in hexadecimal format.

  6. The 'decrypt' function is implemented to decrypt the encrypted information. It takes the encrypted data and the secret key as parameters. The 'crypto.createDecipher' method is used to create a decipher object with the same algorithm and key. The 'update' method is used to update the decipher with the encrypted data in hexadecimal format, and the 'final' method is used to retrieve the final decrypted data in UTF-8 format.

  7. Inside the '/confidential' endpoint, the confidential information is encrypted using the 'encrypt' function and the secret key. Then, the encrypted information is decrypted using the 'decrypt' function and the same secret key.

  8. The decrypted information is sent as the response to the client.

  9. The server is set to listen on port 3000, and a console log message is displayed to indicate that the server is running.

By using the AES-256-CBC encryption algorithm and securely storing the secret key, the fixed code ensures that the confidential information is encrypted and protected from unauthorized access.

References​

Last updated on