Skip to main content

Lack of data validation - URL

Description​

Any user on the Internet can obtain information on users who have sent their documents through the portal by sending as a parameter in the URL the date on which the document was sent.

Impact​

Obtain information of the platform users.

Recommendation​

Validate the right permissions to access user information.

Threat​

External attacker with valid values for the radicadoHours parameter.

Expected Remediation Time​

⌚ 60 minutes.

Score​

Default score using CVSS 3.1. It may change depending on the context of the vulnerability.

Base​

  • Attack vector: N
  • Attack complexity: L
  • Privileges required: N
  • User interaction: N
  • Scope: U
  • Confidentiality: L
  • Integrity: N
  • Availability: N

Temporal​

  • Exploit code madurity: X
  • Remediation level: W
  • Report confidence: X

Result​

  • Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:W/RC:X
  • Score:
    • Base: 5.3
    • Temporal: 5.2
  • Severity:
    • Base: Medium
    • Temporal: Medium

Code Examples​

Compliant code​

Only authorized users can get access to sensitive information

Authentication auth = SecurityContextHolder.getContext().getAuthentication();
if (auth != null && auth.getAuthorities().stream().anyMatch(a -> a.getAuthority().equals("ADMIN"))) {
  //Code to access user information only to authorized users
}

Non compliant code​

The application only verifies a valid token to allow access to users sensitive information

//Improper authorization requests
if (user != null && user.token == "VALID_TOKEN") {
  const usersInfo = getInfobyDate(user.req.date)
  //Code to display users information
}

Requirements​