Need

Prevention of unauthorized manipulation of hidden fields

Context

• Usage of C# 7.0 for modern language features and improved programming capabilities
• Usage of _userManager for user management and authentication
• Usage of UserModel for managing user data and operations
• Usage of Controller for handling and managing application logic and data flow
• Usage of IActionResult for defining and returning action results in a web application
• Usage of ModelState for managing and validating the state of data models
• Usage of RedirectToActionResult for redirecting to a specific action or URL in a web application
• Usage of ViewResult for rendering views in a web application

Description

Non compliant code

        public class AccountController : Controller
{
    [HttpPost]
    public async Task Edit(UserModel model)
    {
        if (ModelState.IsValid)
        {
            var user = await _userManager.FindByIdAsync(model.Id);

            user.UserName = model.UserName;
            user.Email = model.Email;
            user.PasswordHash = _userManager.PasswordHasher.HashPassword(user, model.Password);

            var result = await _userManager.UpdateAsync(user);

            if (result.Succeeded)
            {
                return RedirectToAction("Index", "Home");
            }
            foreach (var error in result.Errors)
            {
                ModelState.AddModelError("", error.Description);
            }
            return View(model);
        }
        return View(model);
    }
}
        
        

In the above code, we are allowing the user to edit their account details through a POST request to the Edit action in AccountController. The UserModel object that is passed to the action contains the user's ID, username, email, and password.

The vulnerability here is that the user's ID is passed from the client side in a hidden field. This means that an attacker can manipulate this hidden field to change the details of another user. This is because the server-side code blindly trusts the user ID that is passed from the client side without validating whether the current authenticated user is allowed to modify the details of the user with the passed ID.

This vulnerability is known as Hidden fields manipulation. It can lead to unauthorized access or modification of other users' data.

Steps

• Avoid using hidden fields to store sensitive information.
• Validate and sanitize all user input before processing or storing it.
• Use server-side validation to ensure that only valid and expected values are accepted.
• Implement proper access controls to restrict unauthorized access to sensitive functionality or data.
• Implement secure session management to prevent session hijacking or session fixation attacks.
• Implement secure authentication mechanisms, such as using strong password hashing algorithms and enforcing password complexity requirements.
• Regularly update and patch the application and its dependencies to address any known security vulnerabilities.
• Conduct regular security assessments and penetration testing to identify and address any potential vulnerabilities.

Compliant code

        public class AccountController : Controller
{
    [HttpPost]
    public async Task Edit(UserModel model)
    {
        if (ModelState.IsValid)
        {
            var user = await _userManager.FindByIdAsync(User.FindFirstValue(ClaimTypes.NameIdentifier));

            if (user == null)
            {
                return Unauthorized();
            }

            user.UserName = model.UserName;
            user.Email = model.Email;

            if (!string.IsNullOrEmpty(model.Password))
            {
                user.PasswordHash = _userManager.PasswordHasher.HashPassword(user, model.Password);
            }

            var result = await _userManager.UpdateAsync(user);

            if (result.Succeeded)
            {
                return RedirectToAction("Index", "Home");
            }
            foreach (var error in result.Errors)
            {
                ModelState.AddModelError("", error.Description);
            }
            return View(model);
        }
        return View(model);
    }
}
        
        

The updated code now includes a check to ensure that the user making the request is the same user that is being updated. This is done by comparing the user ID from the incoming request with the user ID stored in the session. If they do not match, the request is unauthorized.

The password update is now only performed if the password field in the incoming request is not empty. This prevents an attacker from setting the password to an empty string by manipulating the hidden fields.

These changes help to mitigate the risk of hidden field manipulation by ensuring that only authorized users can update their own information and that password updates cannot be performed without providing a new password.

Remember, it's always important to validate and sanitize all user input before processing or storing it, implement proper access controls, secure session management, and secure authentication mechanisms. Regularly update and patch the application and its dependencies to address any known security vulnerabilities, and conduct regular security assessments and penetration testing to identify and address any potential vulnerabilities.

References

• 093. Hidden fields manipulation