Need

Protection of sensitive financial information

Context

• Requirement of PHP 7.0 or higher for running the application
• Usage of Laravel framework for PHP web development
• Usage of Illuminate/Database for database management and query building

Description

Non compliant code

        public function show($id)
{
    $transaction = Transaction::find($id);
    return response()->json($transaction);
}
        
        

In the above PHP code, we have a Laravel backend application where a show method is defined in a controller. This method accepts an id as a parameter and uses it to find a specific Transaction record from the database. It then returns the entire Transaction object as a JSON response.

This is a classic example of a business information leak vulnerability. Here, sensitive information related to a transaction is being exposed without any checks or validations. The information includes:

- Mail
- Payment reference and description
- Total value
- Product information
- Collectors line of business
- Payers role

Anyone who can guess or brute-force the id can access all the confidential business information related to that transaction. This can lead to serious security breaches, including financial fraud, identity theft, and other business-related risks.

Steps

• Implement an authorization check to ensure that the user requesting the transaction information has the necessary permissions to view it.
• Use data filtering to exclude sensitive business information from the response. Only return the necessary data to the client.
• Encrypt sensitive data in the database. This way, even if unauthorized access occurs, the data will be unreadable.
• Implement rate limiting to prevent data scraping and brute force attacks.
• Log and monitor all access to sensitive data to detect and respond to suspicious activities quickly.

Compliant code

        public function show($id)
{
    $transaction = Transaction::find($id);

    // Check if the user has the necessary permissions to view the transaction
    if (Auth::user()->cannot('view', $transaction)) {
        return response()->json(['error' => 'Unauthorized'], 403);
    }

    // Filter out sensitive data
    $safeTransactionData = $transaction->only(['id', 'product', 'total_value']);

    return response()->json($safeTransactionData);
}
        
        

The updated code includes an authorization check to ensure that the user requesting the transaction information has the necessary permissions to view it. This is done using Laravel's built-in authorization system. If the user does not have the necessary permissions, a JSON response with an error message and a 403 status code is returned.

The code also filters out sensitive data from the transaction before returning it in the response. This is done using the only method on the transaction model, which only includes the specified fields in the resulting array. In this case, only the 'id', 'product', and 'total_value' fields are included in the response.

Please note that this code assumes that you have already set up the necessary authorization rules and that the 'view' rule checks if the user has the necessary permissions to view a transaction. It also assumes that you have encrypted sensitive data in your database and implemented rate limiting and logging/monitoring of access to sensitive data.

Remember to always keep your business information secure and only expose the necessary data to your users.

References

• 291. Business information leak - Financial Information