Need

Protection of sensitive business information from unauthorized access or disclosure

Context

• Usage of C# for developing robust and efficient applications
• Usage of Microsoft.AspNetCore.Mvc for building web applications using the ASP.NET Core MVC framework
• Usage of Microsoft.Extensions.Logging for logging in .NET applications

Description

Non compliant code

        using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Logging;

namespace VulnerableApp.Controllers
{
    [ApiController]
    [Route("[controller]")]
    public class CustomerController : ControllerBase
    {
        private static readonly List Customers = new List
        {
            "John Doe, johndoe@gmail.com, +1 123 456 7890, ID: 123",
            "Jane Doe, janedoe@gmail.com, +1 987 654 3210, ID: 456",
            // ...
        };

        private readonly ILogger _logger;

        public CustomerController(ILogger logger)
        {
            _logger = logger;
        }

        [HttpGet]
        public IEnumerable Get()
        {
            return Customers;
        }
    }
}
        
        

In the above code snippet, an ASP.NET Core controller named CustomerController is defined. This controller exposes a GET endpoint that returns a list of customers. Each customer's details are stored as a string in the list Customers, which includes sensitive information such as their name, email, phone number, and ID.

The vulnerability lies in the Get() method. This method is decorated with the [HttpGet] attribute, which means it responds to HTTP GET requests. When this endpoint is hit, it returns the entire Customers list, leaking sensitive customer information.

This is a severe vulnerability as it exposes sensitive data to anyone who can access the endpoint. This could potentially include unauthorized users, leading to a significant data breach.

Steps

• Remove sensitive information from the code, such as customer or provider lists, emails, phone numbers, or identifiers.
• Implement proper authentication and authorization mechanisms to control access to sensitive information.
• Store sensitive information securely, such as in a database with proper encryption and access controls.
• Implement input validation and sanitization to prevent unauthorized access to sensitive information.
• Implement logging and monitoring mechanisms to detect and respond to any unauthorized access attempts.

Compliant code

        using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Logging;
using Microsoft.AspNetCore.Authorization;

namespace VulnerableApp.Controllers
{
    [ApiController]
    [Route("[controller]")]
    [Authorize] // Add this line to implement authorization
    public class CustomerController : ControllerBase
    {
        // Remove sensitive information from the code
        // Replace with a service that fetches data from a secure database
        private readonly ICustomerService _customerService;
        private readonly ILogger _logger;

        public CustomerController(ILogger logger, ICustomerService customerService)
        {
            _logger = logger;
            _customerService = customerService;
        }

        [HttpGet]
        public async Task> Get()
        {
            // Fetch data from a secure database through the service
            var customers = await _customerService.GetCustomersAsync();
            return customers;
        }
    }
}
        
        

The original code had a list of customers with sensitive information hardcoded into the application. This is a major security vulnerability as it exposes sensitive customer information to anyone who has access to the codebase.

The fixed code removes this hardcoded list and replaces it with a service that fetches customer data from a secure database. This service, ICustomerService, is injected into the controller through dependency injection. The Get method is updated to use this service to fetch customer data.

Additionally, an [Authorize] attribute is added to the controller. This attribute is part of the ASP.NET Core's built-in authorization system. It ensures that only authenticated users can access the methods in the controller.

This fix addresses the vulnerability by removing sensitive information from the code, implementing proper authentication and authorization mechanisms, and ensuring sensitive information is stored securely in a database.

References

• 080. Business information leak - Customers or providers