Need

Ensure data authenticity through proper checksum verification

Context

• Usage of C# for developing robust and efficient applications
• Usage of System.Net.Http for making HTTP requests in .NET development
• Usage of System.Threading.Tasks for asynchronous programming in .NET
• Usage of System for low-level operating system interactions and utilities

Description

Non compliant code

        public class ExternalResourceLoader
{
    private readonly HttpClient _httpClient;

    public ExternalResourceLoader(HttpClient httpClient)
    {
        _httpClient = httpClient;
    }

    public async Task LoadResource(string url)
    {
        var response = await _httpClient.GetAsync(url);

        if (response.IsSuccessStatusCode)
        {
            var resource = await response.Content.ReadAsStringAsync();
            return resource;
        }

        throw new Exception($"Failed to load resource from {url}");
    }
}
        
        

The above code is an example of a class that loads resources from external servers in an ASP.NET Core application. The LoadResource method makes a GET request to a given URL using an instance of HttpClient, reads the response content as a string, and returns it.

The vulnerability lies in the fact that the method does not validate the integrity of the loaded resource. In other words, it does not perform any checksum verification to ensure that the resource has not been tampered with during transit.

This can lead to a variety of security issues. For example, if an attacker is able to modify the resource during transit (e.g., by performing a man-in-the-middle attack), they could insert malicious code that could compromise the application or the data it processes.

Without checksum verification, the application has no way of detecting this kind of tampering. As such, it is critical to add integrity checks to any code that loads resources from external servers.

Steps

• Implement data authenticity validation by verifying the checksum of the loaded resource.
• Generate a checksum for the resource before loading it.
• Compare the generated checksum with a trusted checksum to ensure data integrity.
• Use a secure hashing algorithm, such as SHA-256, to generate the checksum.
• Store the trusted checksum securely, such as in a configuration file or database.
• Update the 'LoadResource' method to include the checksum validation logic.
• If the checksums do not match, consider the resource as compromised and handle accordingly.
• Handle any exceptions or errors that may occur during the checksum validation process.

Compliant code

        public class ExternalResourceLoader
{
    private readonly HttpClient _httpClient;
    private readonly IConfiguration _configuration;

    public ExternalResourceLoader(HttpClient httpClient, IConfiguration configuration)
    {
        _httpClient = httpClient;
        _configuration = configuration;
    }

    public async Task LoadResource(string url)
    {
        var response = await _httpClient.GetAsync(url);

        if (response.IsSuccessStatusCode)
        {
            var resource = await response.Content.ReadAsStringAsync();
            var resourceChecksum = ComputeSha256Hash(resource);
            var trustedChecksum = _configuration["TrustedChecksums:" + url];

            if (resourceChecksum != trustedChecksum)
            {
                throw new Exception($"Resource from {url} is compromised");
            }

            return resource;
        }

        throw new Exception($"Failed to load resource from {url}");
    }

    private static string ComputeSha256Hash(string rawData)
    {
        using (SHA256 sha256Hash = SHA256.Create())
        {
            byte[] bytes = sha256Hash.ComputeHash(Encoding.UTF8.GetBytes(rawData));
            StringBuilder builder = new StringBuilder();
            for (int i = 0; i < bytes.Length; i++)
            {
                builder.Append(bytes[i].ToString("x2"));
            }
            return builder.ToString();
        }
    }
}
        
        

The updated code now includes a checksum validation process to ensure the integrity of the loaded resource.

The LoadResource method now computes a SHA-256 checksum of the loaded resource and compares it with a trusted checksum. The trusted checksum is retrieved from the application's configuration using the resource's URL as the key.

If the computed checksum does not match the trusted checksum, an exception is thrown indicating that the resource is compromised. This ensures that any tampering with the resource is detected and handled appropriately.

The ComputeSha256Hash method is a helper method that generates a SHA-256 hash from a string. It uses the SHA256 class from the System.Security.Cryptography namespace to compute the hash, and then converts the resulting byte array into a hexadecimal string.

The ExternalResourceLoader constructor now also takes an IConfiguration parameter, which is used to access the application's configuration. This allows the trusted checksums to be stored securely in a configuration file or database.

This approach ensures that the application only processes resources that have been verified to be authentic, thereby mitigating the risk of loading compromised resources.

References

• 355. Insufficient data authenticity validation - Checksum verification