Need

Enhanced password security and stronger credential storage

Context

• Usage of Java for building cross-platform applications
• Usage of javax.servlet.http.HttpServletRequest for handling HTTP requests in Java Servlets
• Usage of HttpServletResponse for handling HTTP responses in Java Servlets
• Usage of javax.servlet.ServletException for handling servlet exceptions in Java web applications
• Usage of java.io.IOException for handling input/output errors in Java

Description

Non compliant code

        import javax.servlet.http.*;
import javax.servlet.*;
import java.io.*;

public class LoginServlet extends HttpServlet {

    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String username = request.getParameter("username");
        String password = request.getParameter("password");
        
        if (username.equals("admin") && password.equals("12345")) {
            // User is authenticated
        } else {
            // User is not authenticated
        }
    }
}
        
        

In the above code, we have a simple servlet that handles user login. The doPost method takes a username and password from the request parameters and checks if they match a predefined username and password ("admin" and "12345", respectively).

The vulnerability here lies in the use of weak credentials. The username and password are not only weak but also hardcoded into the application, making it even easier for an attacker to crack them.

Furthermore, the password is stored in plaintext. This means that if an attacker can gain access to the application's code or memory, they can see the password directly.

In a real-world application, usernames and passwords would be stored in a database and would be hashed to protect them if the database were compromised. The hashes would ideally be of high complexity and use a salt to further increase their security.

This code does not follow these practices, leaving it vulnerable to attacks where an attacker could easily crack the weak, unsalted password hash.

Steps

• Use a strong hashing algorithm to store passwords in the database.
• Implement salted hashing to further enhance password security.
• Use a secure password policy to enforce strong passwords.
• Implement account lockout mechanisms to prevent brute-force attacks.
• Use multi-factor authentication to add an extra layer of security.
• Regularly update and patch the software to fix any security vulnerabilities.
• Educate users about the importance of using strong and unique passwords.

Compliant code

        import javax.servlet.http.*;
import javax.servlet.*;
import java.io.*;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.security.SecureRandom;
import java.math.BigInteger;

public class LoginServlet extends HttpServlet {

    private static final String SALT = "random-salt-value";

    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String username = request.getParameter("username");
        String password = request.getParameter("password");
        
        String hashedPassword = get_SHA_512_SecurePassword(password, SALT);

        // Here, you should retrieve the hashed password from the database using the username
        String storedPasswordHash = retrieveHashedPasswordFromDatabase(username);

        if (username.equals("admin") && hashedPassword.equals(storedPasswordHash)) {
            // User is authenticated
        } else {
            // User is not authenticated
        }
    }

    private static String get_SHA_512_SecurePassword(String passwordToHash, String salt){
        String generatedPassword = null;
        try {
            MessageDigest md = MessageDigest.getInstance("SHA-512");
            md.update(salt.getBytes("UTF-8"));
            byte[] bytes = md.digest(passwordToHash.getBytes("UTF-8"));
            BigInteger no = new BigInteger(1, bytes);
            generatedPassword = no.toString(16);
        } 
        catch (NoSuchAlgorithmException e) {
            e.printStackTrace();
        }
        return generatedPassword;
    }

    private String retrieveHashedPasswordFromDatabase(String username) {
        // Implement your database access here
        return "";
    }
}
        
        

The updated code now uses a strong hashing algorithm (SHA-512) to hash the password entered by the user. This hashed password is then compared with the hashed password stored in the database.

The get_SHA_512_SecurePassword method is used to hash the password with a salt value. The salt is a random value that is added to the password before hashing to make it more secure. This makes it much more difficult for an attacker to crack the password using a rainbow table (a precomputed table for reversing cryptographic hash functions).

The retrieveHashedPasswordFromDatabase method is a placeholder for the code that would retrieve the hashed password from the database using the username. This method should be implemented according to the specific database being used.

This code does not implement all the steps mentioned in the fix, such as account lockout mechanisms, multi-factor authentication, and user education. These would require additional code and infrastructure, and are beyond the scope of this simple example. However, they are important considerations for a secure system.

References

• 051. Cracked weak credentials