Need

Implementation of a strong password policy

Context

• Usage of Java for building scalable and robust applications
• Usage of javax.servlet for building Java web applications
• Usage of javax.servlet.http for handling HTTP requests and responses in Java Servlets

Description

Non compliant code

        import javax.servlet.*;
import javax.servlet.http.*;

public class WeakPasswordServlet extends HttpServlet {

    public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String username = request.getParameter("username");
        String password = request.getParameter("password");

        if (isValidPassword(password)) {
            // Code to create user with the given username and password
        } else {
            response.sendRedirect("register.jsp");
        }
    }

    private boolean isValidPassword(String password) {
        // Password only needs to be at least 4 characters long
        return password.length() >= 4;
    }
}
        
        

In the above code, we have a servlet WeakPasswordServlet that handles the POST request for user registration. It fetches the username and password from the request parameters and checks if the password is valid by calling the isValidPassword method.

The vulnerability lies in the isValidPassword method. This method only checks if the password length is at least 4 characters long. This is a weak credential policy as it does not enforce any complexity requirements for the password such as:

- The use of both lowercase and uppercase characters
- The use of numeric digits
- The use of special characters
- A minimum length greater than 4

Such a weak credential policy makes the system susceptible to brute force attacks, where an attacker can systematically check all possible passwords until the correct one is found. The lack of complexity requirements means the total number of possible passwords is significantly reduced, making the brute force attack faster and more likely to succeed.

To fix this vulnerability, the isValidPassword method should be updated to enforce a strong credential policy.

Steps

• Implement a stronger password policy
• Enforce a minimum password length
• Require a combination of uppercase and lowercase letters, numbers, and special characters
• Implement password complexity rules
• Consider using a password strength meter to provide real-time feedback to users
• Educate users about the importance of strong passwords and provide guidelines for creating them
• Consider implementing multi-factor authentication for added security

Compliant code

        import javax.servlet.*;
import javax.servlet.http.*;
import java.util.regex.*;

public class StrongPasswordServlet extends HttpServlet {

    public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String username = request.getParameter("username");
        String password = request.getParameter("password");

        if (isValidPassword(password)) {
            // Code to create user with the given username and password
        } else {
            response.sendRedirect("register.jsp");
        }
    }

    private boolean isValidPassword(String password) {
        // Password needs to be at least 8 characters long
        // Password needs to contain at least one uppercase letter, one lowercase letter, one digit and one special character
        String passwordPattern = "^(?=.*[0-9])(?=.*[a-z])(?=.*[A-Z])(?=.*[@#$%^&+=])(?=\\\\S+$).{8,}$";
        Pattern pattern = Pattern.compile(passwordPattern);
        Matcher matcher = pattern.matcher(password);

        return matcher.matches();
    }
}
        
        

The updated code now enforces a stronger password policy. The isValidPassword method checks if the password meets the following criteria:

- At least 8 characters long
- Contains at least one uppercase letter
- Contains at least one lowercase letter
- Contains at least one digit
- Contains at least one special character (e.g., @, #, $, %, ^, &, +, =)
- Does not contain whitespace

The password pattern is defined using a regular expression (regex). The Pattern.compile method compiles the regex into a pattern, and the Matcher.matches method checks if the password matches the pattern.

This stronger password policy helps protect against brute force attacks by increasing the number of possible combinations, making it harder for an attacker to guess the password. It also helps protect against dictionary attacks by preventing the use of common words and phrases.

In addition to implementing a stronger password policy, consider educating users about the importance of strong passwords and providing guidelines for creating them. Also consider implementing multi-factor authentication for added security.

References

• 363. Weak credential policy - Password strength