Need

Secure storage of administrative credentials

Context

• Usage of PHP 7.0 for server-side scripting and web development
• Usage of Illuminate\\Http\\Request for handling HTTP requests in Laravel
• Usage of Illuminate\\Support\\Facades\\Cache for caching data in Laravel
• Usage of Illuminate\\Routing\\Controller for handling route controllers in Laravel

Description

Non compliant code

        input('username');
        $password = $request->input('password');

        if ($username == 'admin' && $password == 'admin') {
            Cache::put('admin_credentials', ['username' => $username, 'password' => $password], 60);
            return redirect()->route('admin.dashboard');
        }

        return redirect()->route('admin.login')->with('error', 'Invalid Credentials');
    }
}
        
        

The above code is a simple representation of an admin login function in a Laravel backend application.

When the admin user logs in, their credentials are stored in the cache memory using the Cache::put method. This method takes three parameters: the key to store the data under, the data to be stored, and the number of minutes the data should remain in the cache.

In this case, the key is 'admin_credentials', the data is an array containing the username and password, and the data is set to remain in the cache for 60 minutes.

The vulnerability here is that the admin credentials are being stored in plain text in the cache memory. If an attacker gains access to the cache, they could retrieve these credentials and gain administrative access to the system.

Steps

• Remove the line of code that stores the admin credentials in the cache.
• Instead of storing the credentials in cache, use session variables to store the login status of the user.
• Ensure that the session variables are properly sanitized and encrypted to prevent session hijacking or session sidejacking attacks.
• Implement a strong password hashing mechanism like bcrypt or Argon2 to store passwords securely.
• Use HTTPS to ensure that all data transmitted between the client and server is encrypted.

Compliant code

        input('username');
        $password = $request->input('password');

        if (Auth::attempt(['username' => $username, 'password' => $password])) {
            return redirect()->route('admin.dashboard');
        }

        return redirect()->route('admin.login')->with('error', 'Invalid Credentials');
    }
}
        
        

The updated code no longer stores the admin credentials in the cache. Instead, it uses Laravel's built-in Auth::attempt method to handle the authentication process. This method will automatically hash the password and compare it with the hashed password stored in the database. If the credentials are valid, the user will be logged in and redirected to the admin dashboard.

The Auth::attempt method also takes care of creating a session for the authenticated user, so there's no need to manually store the login status in a session variable. This reduces the risk of session hijacking or session sidejacking attacks.

In addition, it's recommended to use HTTPS to ensure that all data transmitted between the client and server is encrypted. This can be configured in the server settings.

Remember, storing sensitive information like passwords in the cache or session is a bad practice as it can lead to serious security vulnerabilities. Always use a secure method like password hashing and built-in authentication methods to handle user login.

References

• 019. Administrative credentials stored in cache memory