Need

Implementation of proper authorization control for web services

Context

• Usage of Java 8 for developing applications with enhanced features and performance improvements.
• Usage of javax.servlet-api for building Java web applications with servlets

Description

Non compliant code

        import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.ServletException;
import java.io.IOException;

public class VulnerableServlet extends javax.servlet.http.HttpServlet {
    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String user = request.getParameter("user");
        String password = request.getParameter("password");
        if(user.equals("admin") && password.equals("admin")){
            response.getWriter().println("Admin Access Granted!");
        } else {
            response.getWriter().println("Access Denied!");
        }
    }
}
        
        

This is a simple servlet that accepts HTTP POST requests. It retrieves the "user" and "password" parameters from the request and checks if they match the hardcoded "admin" username and password. If they match, it responds with "Admin Access Granted!", otherwise it responds with "Access Denied!".

The vulnerability here is that there is no proper authorization control mechanism in place. The servlet is directly granting access based on the user input without any form of authentication or authorization. Moreover, the hardcoded "admin" username and password can be easily discovered and exploited by an attacker.

Furthermore, there is no session management in place. This means that even if the user is authenticated once, the same level of access is granted for all subsequent requests without any further checks. This can be exploited to gain unauthorized access to the system's web services.

In addition, the servlet does not sanitize or validate the user input, which makes it susceptible to other types of attacks such as SQL Injection or Cross-Site Scripting (XSS).

Steps

• Implement an authorization control mechanism for the web service
• Ensure that only authorized users have access to the sensitive functionality
• Use a secure authentication mechanism to verify the identity of the user
• Implement role-based access control to restrict access based on user roles
• Enforce strong password policies to prevent brute-force attacks
• Regularly review and update the authorization control mechanism to address any new vulnerabilities

Compliant code

        import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.ServletException;
import java.io.IOException;
import java.security.Principal;

public class SecureServlet extends javax.servlet.http.HttpServlet {
    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        Principal userPrincipal = request.getUserPrincipal();
        if(userPrincipal == null){
            response.getWriter().println("Unauthorized Access!");
            return;
        }
        String role = getRoleFromUserPrincipal(userPrincipal);
        if(role.equals("admin")){
            response.getWriter().println("Admin Access Granted!");
        } else {
            response.getWriter().println("Access Denied!");
        }
    }

    private String getRoleFromUserPrincipal(Principal userPrincipal){
        // Implement your logic to get user role from Principal object
        // This could be a database lookup or any other mechanism your application uses to assign roles to users
        return "user";
    }
}
        
        

The updated code now uses the Principal object to identify the user making the request. The Principal object represents the user in a Java security context and can be used to retrieve the user's name and other details.

The doPost method first checks if the Principal object is null. If it is null, this means that the user is not authenticated, and the method returns an "Unauthorized Access!" message.

If the Principal object is not null, the method retrieves the user's role by calling the getRoleFromUserPrincipal method. This method should be implemented to return the role of the user based on the Principal object. This could involve a database lookup or any other mechanism your application uses to assign roles to users.

The doPost method then checks if the user's role is "admin". If it is, the method returns an "Admin Access Granted!" message. If the user's role is not "admin", the method returns an "Access Denied!" message.

This code implements an authorization control mechanism that ensures only authenticated users with the "admin" role can access the sensitive functionality. It uses a secure authentication mechanism (the Principal object) to verify the user's identity and implements role-based access control to restrict access based on user roles.

References

• 039. Improper authorization control for web services