Insecure functionality - File Creation
Description
For an authenticated user with a profile that restricts certain functions, the restriction is performed on the front end by disabling the corresponding button, which can be bypassed and the query is processed when it is sent.
Impact
Access customer information on a massive scale.
Recommendation
Verify on the server side that the user making the request has sufficient permissions.
Threat
Authenticated user from the Internet.
Expected Remediation Time
⌚ 30 minutes.
Score
Default score using CVSS 3.1. It may change depending on the context of the vulnerability.
Base
- Attack vector: N
- Attack complexity: L
- Privileges required: L
- User interaction: N
- Scope: U
- Confidentiality: H
- Integrity: N
- Availability: N
Temporal
- Exploit code madurity: X
- Remediation level: X
- Report confidence: X
Result
- Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:X/RL:X/RC:X
- Score:
- Base: 6.5
- Temporal: 6.5
- Severity:
- Base: Medium
- Temporal: Medium
Code Examples
Compliant code
Always perform both front end and server side validation of a users credentials
const createFile = (req, res) => {
if (isValidUser(req.body.user)) {
const fileToDelete = req.body.filePath;
if (!db.has(fileToDelete) && req.body.userId.role == "ADMIN"){
db.createFile(fileToDelete);
}esle{
//Code to handle unauthorized users trying to create files
}
}
}
Non compliant code
The server side of the application does not validate user permissions before creating a file
const createFile = (req, res) => {
if (isValidUser(req.body.user)) {
const fileToDelete = req.body.filePath;
if (!db.has(fileToDelete)){
db.createFile(fileToDelete);
}
}
}
Requirements
Search for vulnerabilities in your apps for free with our automated security testing! Start your 21-day free trial and discover the benefits of our Continuous Hacking Machine Plan. If you prefer a full service that includes the expertise of our ethical hackers, don't hesitate to contact us for our Continuous Hacking Squad Plan.