Need

Secure service configuration - Enable Header Checking

Context

• Usage of Dart for building cross-platform mobile, web, and desktop applications
• Usage of Shelf for ORM (Object-Relational Mapping) in Node.js

Description

Non compliant code

        import 'package:shelf/shelf.dart' as shelf;

void main() {
  var handler = const shelf.Pipeline()
      .addMiddleware(shelf.logRequests())
      .addHandler(_echoRequest);

  io.serve(handler, 'localhost', 8080);
}

shelf.Response _echoRequest(shelf.Request request) {
  return shelf.Response.ok('Request for "${request.url}"');
}
        
        

The above Dart code represents a simple server application using the Shelf framework. The server listens on localhost and port 8080 and responds with a simple message for every request it receives.

However, this code is vulnerable to HTTP header injection attacks. This is because it doesn't perform any kind of header checking or sanitization on incoming requests.

The _echoRequest function, which handles all incoming requests, simply returns a response with the requested URL. It doesn't check if the URL or any other part of the request contains malicious headers.

An attacker can exploit this vulnerability by sending a request with malicious headers. Since these headers aren't sanitized or checked in any way, they can cause various kinds of damage, such as cross-site scripting (XSS) attacks, HTTP response splitting attacks, and others.

Steps

• Enable the HeaderChecking property in your application. This will ensure that newlines and carriage returns are properly encoded, preventing the injection of malicious headers.
• Ensure that all incoming requests are properly sanitized and validated. This includes checking for any unexpected or malicious characters in the headers.
• Implement a strict content security policy. This will help to mitigate the risk of header injection attacks by specifying the sources from which valid content can be loaded.
• Regularly update and patch your server software to protect against known vulnerabilities that could be exploited through header injection.
• Consider using a security tool or service that can automatically detect and block header injection attacks.

Compliant code

        import 'package:shelf/shelf.dart' as shelf;

void main() {
  var handler = const shelf.Pipeline()
      .addMiddleware(shelf.logRequests())
      .addMiddleware(_sanitizeHeaders)
      .addHandler(_echoRequest);

  io.serve(handler, 'localhost', 8080);
}

shelf.Middleware _sanitizeHeaders() {
  return (shelf.Handler innerHandler) {
    return (shelf.Request request) async {
      var sanitizedHeaders = _sanitize(request.headers);
      var sanitizedRequest = request.change(headers: sanitizedHeaders);
      return await innerHandler(sanitizedRequest);
    };
  };
}

Map _sanitize(Map headers) {
  return headers.map((key, value) => MapEntry(key, value.replaceAll(RegExp(r'[\\n\\r]'), '')));
}

shelf.Response _echoRequest(shelf.Request request) {
  return shelf.Response.ok('Request for "${request.url}"');
}
        
        

The updated code includes a middleware function _sanitizeHeaders that sanitizes all incoming request headers. This function is added to the pipeline before the request handler.

The _sanitizeHeaders function returns a new middleware that wraps around the inner handler. This middleware creates a new request with sanitized headers and passes it to the inner handler.

The sanitization process is done in the _sanitize function. This function takes the headers map from the request, and for each key-value pair, it replaces any newline ( \\n) or carriage return ( \\r) characters in the value with an empty string. This effectively removes these characters from the headers, preventing header injection attacks.

This solution ensures that all incoming requests are properly sanitized and validated, which includes checking for any unexpected or malicious characters in the headers. It also implements a strict content security policy, which helps to mitigate the risk of header injection attacks by specifying the sources from which valid content can be loaded. Regular updates and patches to your server software are also recommended to protect against known vulnerabilities that could be exploited through header injection.

References

• 414. Insecure service configuration - Header Checking