Need

Secure default configuration

Context

• Usage of Dart for building cross-platform mobile, web, and desktop applications
• Usage of Shelf for managing and organizing data in a Node.js application
• Usage of shelf_io for handling input/output operations in a Shelf application

Description

Non compliant code

        import 'package:shelf/shelf.dart' as shelf;
import 'package:shelf/shelf_io.dart' as io;

void main() {
  var handler = const shelf.Pipeline()
      .addMiddleware(shelf.logRequests())
      .addHandler(_echoRequest);

  io.serve(handler, 'localhost', 8080);
}

shelf.Response _echoRequest(shelf.Request request) {
  return shelf.Response.ok('Hello, World!\\n');
}
        
        

The above Dart code is a simple server application using the Shelf framework. The server listens on localhost at port 8080 and responds with Hello, World! to all incoming requests.

The vulnerability here is the enabled default configuration. The server has a default page ( Hello, World!) that is enabled and accessible to anyone who sends a request to the server. This default page can reveal technical information about the server to an attacker.

An attacker can send a request to the server and, by analyzing the response, can gain insights into the server's configuration, the technologies used (in this case, Dart and Shelf), and potentially other sensitive information. This information can be used for further attacks on the server.

The vulnerability can be fixed by disabling the default page and implementing proper request handling that does not reveal unnecessary information about the server.

Steps

• Disable the default page or replace it with a custom page.
• Configure the server to not reveal any technical information about itself.
• Ensure that the server only serves the necessary resources and nothing more.
• Regularly update and patch the server to prevent any known vulnerabilities.
• Implement access controls to restrict who can access the server information.

Compliant code

        import 'package:shelf/shelf.dart' as shelf;
import 'package:shelf/shelf_io.dart' as io;

void main() {
  var handler = const shelf.Pipeline()
      .addMiddleware(shelf.logRequests())
      .addHandler(_customPage);

  io.serve(handler, 'localhost', 8080);
}

shelf.Response _customPage(shelf.Request request) {
  return shelf.Response.ok('This is a custom page. No technical details here.\\n');
}
        
        

The original code was vulnerable because it was serving a default page that could potentially reveal technical information about the server. This could be exploited by an attacker to gain insights about the server and find potential vulnerabilities.

The updated code now serves a custom page instead of the default one. This custom page does not reveal any technical information about the server, thus mitigating the risk of an attacker gaining insights about the server.

In addition to this, it's important to regularly update and patch the server to prevent any known vulnerabilities. Access controls should also be implemented to restrict who can access the server information. This is not shown in the code, but it's a crucial part of securing the server.

Remember, security is not a one-time task but a continuous process. Always keep your server and its dependencies up-to-date, and regularly audit your server for any potential vulnerabilities.

References

• 308. Enabled default configuration