Need

Enforcement of proper security controls for data creation

Context

• Usage of PHP 7.0 for server-side scripting and web development
• Usage of Request for making HTTP requests
• Usage of Auth for user authentication and authorization
• Usage of Policy for defining and enforcing rules or restrictions
• Usage of Beneficiary for managing and processing beneficiary information

Description

Non compliant code

        public function createPolicy(Request $request) {
    $beneficiaries = $request->input('beneficiaries');

    $policy = new Policy();
    $policy->user_id = Auth::user()->id;
    $policy->save();

    foreach($beneficiaries as $beneficiary) {
        $newBeneficiary = new Beneficiary();
        $newBeneficiary->policy_id = $policy->id;
        $newBeneficiary->name = $beneficiary['name'];
        $newBeneficiary->save();
    }

    return response()->json(['message' => 'Policy created successfully'], 200);
}
        
        

The above code is a simple Laravel function that creates a new policy and associates beneficiaries to that policy. The function first creates a new policy, then loops through the beneficiaries array from the request input, creating a new beneficiary for each one and associating it with the policy.

The vulnerability lies in the fact that there are no checks to limit the number of beneficiaries that can be associated with a policy. This allows an attacker to bypass the restriction of only having four beneficiaries per policy.

The code assumes that the client will only send four beneficiaries in the beneficiaries array. However, if an attacker sends a request with more than four beneficiaries in the beneficiaries array, the application will create all of them and associate them with the policy.

This vulnerability can lead to a violation of the integrity of the data sent, as the application is not enforcing the business rule that a policy should only have up to four beneficiaries. This could potentially lead to unexpected behavior in other parts of the application that assume this rule is being enforced.

Steps

• Add a validation check to ensure that the number of beneficiaries does not exceed the allowed limit before creating the policy.
• If the number of beneficiaries exceeds the limit, return an error response indicating that the maximum number of beneficiaries has been exceeded.
• Only proceed with the creation of the policy and beneficiaries if the validation check passes.

Compliant code

        public function createPolicy(Request $request) {
    $beneficiaries = $request->input('beneficiaries');

    // Check if the number of beneficiaries exceeds the limit
    if(count($beneficiaries) > 4) {
        return response()->json(['message' => 'Exceeded the maximum number of beneficiaries allowed'], 400);
    }

    $policy = new Policy();
    $policy->user_id = Auth::user()->id;
    $policy->save();

    foreach($beneficiaries as $beneficiary) {
        $newBeneficiary = new Beneficiary();
        $newBeneficiary->policy_id = $policy->id;
        $newBeneficiary->name = $beneficiary['name'];
        $newBeneficiary->save();
    }

    return response()->json(['message' => 'Policy created successfully'], 200);
}
        
        

The updated code now includes a validation check at the beginning of the createPolicy function. This check uses the count function to determine the number of beneficiaries that are included in the request. If the number of beneficiaries is more than 4, the function immediately returns a response with a 400 status code and a message indicating that the maximum number of beneficiaries has been exceeded.

This validation check ensures that the restriction on the number of beneficiaries is enforced before the policy is created and before any beneficiaries are saved to the database. As a result, it is no longer possible to bypass this restriction by including more than four beneficiaries in the request.

If the validation check passes (i.e., the number of beneficiaries is four or less), the function proceeds as before, creating the policy and saving each beneficiary to the database. The function then returns a response indicating that the policy was created successfully.

References

• 305. Security controls bypass or absence - Data creation