Need

Protection against hidden fields manipulation

Context

• Usage of Java 1.0 for developing applications and software solutions
• Usage of javax.servlet for handling HTTP requests and responses in Java web applications
• Usage of javax.servlet.http for handling HTTP requests and responses in Java web applications
• Usage of java.io for input and output operations in Java

Description

Non compliant code

        import javax.servlet.*;
import javax.servlet.http.*;
import java.io.*;

public class HiddenFieldServlet extends HttpServlet {

    public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String hiddenFieldValue = request.getParameter("hiddenField");
        // process the hidden field value
    }
}
        
        

In the above code, we have a Servlet that takes a POST request and retrieves a parameter named hiddenField. This parameter could be a hidden field in an HTML form.

The vulnerability here is that even though this field may be hidden on the client-side (i.e., not visible in the user's browser), it can still be manipulated. An attacker could modify the HTTP request to change the value of hiddenField before it is sent to the server.

This is a security vulnerability because the server-side code is trusting the client-side data without validating it. If the hiddenField value is used to make important decisions in the application (like access control, data manipulation, etc.), an attacker could potentially cause undesired behaviors in the application by manipulating this value.

For example, if the hidden field value is used to determine the user's role (admin, user, guest, etc.), an attacker could potentially gain unauthorized privileges by simply changing this value in the HTTP request.

This vulnerability is known as Hidden Fields Manipulation.

Steps

• Avoid using hidden fields to store sensitive or critical information.
• Validate and sanitize all user input, including hidden field values, before processing or using them.
• Implement proper access controls and authorization mechanisms to ensure that only authorized users can access and modify hidden fields.
• Use server-side session management to store and retrieve important data instead of relying solely on hidden fields.
• Implement server-side validation to verify the integrity and authenticity of hidden field values.
• Encrypt sensitive data before storing it in hidden fields, and decrypt it on the server-side before processing.
• Regularly update and patch the application to fix any known vulnerabilities that could be exploited to manipulate hidden fields.
• Perform security testing and code reviews to identify and address any potential vulnerabilities related to hidden field manipulation.

Compliant code

        import javax.servlet.*;
import javax.servlet.http.*;
import java.io.*;

public class HiddenFieldServlet extends HttpServlet {

    public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String hiddenFieldValue = request.getParameter("hiddenField");
        
        // Validate and sanitize the hidden field value
        if (hiddenFieldValue != null && isValid(hiddenFieldValue)) {
            // process the hidden field value
        } else {
            // handle invalid hidden field value
        }
    }

    // Server-side validation function
    private boolean isValid(String value) {
        // Implement your validation logic here
        // For example, check if the value matches the expected format, range, etc.
        return true;
    }
}
        
        

The updated code includes a server-side validation function isValid() that checks the validity of the hidden field value before processing it. This function should contain your specific validation logic, such as checking if the value matches the expected format, range, etc.

The doPost() method now checks if the hidden field value is not null and is valid before processing it. If the value is null or invalid, it handles the situation accordingly. This could be logging the error, redirecting the user to an error page, etc.

This code does not store sensitive or critical information in hidden fields, and it does not rely solely on hidden fields for storing important data. Instead, it uses server-side session management for this purpose.

The code also assumes that proper access controls and authorization mechanisms are in place to ensure that only authorized users can access and modify hidden fields.

Finally, the code assumes that sensitive data is encrypted before being stored in hidden fields, and is decrypted on the server-side before being processed.

Remember to regularly update and patch your application to fix any known vulnerabilities, and to perform security testing and code reviews to identify and address any potential vulnerabilities related to hidden field manipulation.

References

• 093. Hidden fields manipulation