Need

Protection of sensitive business information from unauthorized access or disclosure

Context

• Usage of Go 1.16 for building high-performance and scalable applications
• Usage of gin-gonic/gin for building web applications and APIs in Go
• Usage of net/http for building HTTP servers in a Node.js application

Description

Non compliant code

        package main

import (
	"github.com/gin-gonic/gin"
	"net/http"
)

func main() {
	r := gin.Default()

	r.GET("/info", func(c *gin.Context) {
		c.JSON(http.StatusOK, gin.H{
			"serverInfo": "Server running on localhost:8080",
			"dbInfo": "Database connected on localhost:5432",
		})
	})

	r.Run()
}
        
        

The vulnerable code above is a simple server written in Go using the Gin framework. It has an endpoint /info that returns some information about the server and the database.

The vulnerability lies in the /info endpoint. This endpoint is exposing sensitive business information, such as server and database details, to anyone who can access this endpoint. This information can be used by an attacker to gain more understanding about the internal structure of the business network and can lead to more targeted attacks.

This vulnerability is a type of "Information Disclosure" vulnerability. The application is disclosing information that should be kept private, which can aid an attacker in further attacks.

The issue arises from the lack of proper access control on the /info endpoint. The endpoint should either be removed if it's not needed, or protected with proper authentication and authorization mechanisms to ensure only authorized users can access this information.

This vulnerability is a serious concern as it directly exposes sensitive business information to potential attackers. It should be addressed and fixed immediately to prevent any potential breaches.

Steps

• Remove sensitive information from the response body
• Implement proper access control to restrict unauthorized access to sensitive information
• Consider using environment variables or configuration files to store sensitive information
• Encrypt sensitive information at rest and in transit
• Regularly update and patch the application and its dependencies to address any known vulnerabilities

Compliant code

        package main

import (
	"github.com/gin-gonic/gin"
	"net/http"
	"os"
)

func main() {
	r := gin.Default()

	r.GET("/info", func(c *gin.Context) {
		c.JSON(http.StatusOK, gin.H{
			"serverInfo": "Server running on localhost:8080",
		})
	})

	r.Run()
}
        
        

The updated code removes the sensitive database information from the response body of the "/info" endpoint. This prevents potential business information leak vulnerability.

The database connection information should not be exposed in the API response. Instead, it should be stored securely using environment variables or configuration files that are not accessible through the application's endpoints.

In the updated code, the "dbInfo" field has been removed from the JSON response. This ensures that the database connection information is not leaked to the client.

Additionally, it's recommended to implement proper access control to restrict unauthorized access to sensitive information. This could be done by adding authentication and authorization middleware to the Gin router.

Also, consider encrypting sensitive information at rest and in transit to further enhance the security of your application. Regularly updating and patching the application and its dependencies is also crucial to address any known vulnerabilities.

Remember, security is not a one-time task but an ongoing process. Always follow the best practices and keep your application's security up to date.

References

• 218. Business information leak - Network Unit