Need

Secure storage of administrative credentials

Context

• Usage of Ruby 2.7 for Ruby programming and development
• Usage of Rails framework for building web applications
• Usage of bcrypt for password hashing and encryption

Description

Non compliant code

        class AdminController < ApplicationController
  def login
    if params[:username] && params[:password]
      admin = Admin.find_by_username(params[:username])
      if admin && admin.authenticate(params[:password])
        session[:admin_id] = admin.id
        session[:admin_username] = admin.username
        session[:admin_password] = admin.password
        redirect_to '/admin/dashboard'
      else
        flash[:error] = 'Username or password is invalid'
        redirect_to '/admin/login'
      end
    end
  end
end
        
        

This code represents a login function for an admin user in a Ruby on Rails application. The function checks if the username and password parameters are provided, and if they are, it tries to find an admin user with the provided username. If such a user is found and the password is correct, the function stores the admin's id, username, and password in the session and redirects the user to the admin dashboard.

The vulnerability lies in the fact that the admin's password is stored in the session. The session data is stored on the server and can be accessed from the memory cache. If an attacker gains access to the server's memory, they can retrieve the admin's password from the session data. This is a serious security issue because it can allow an attacker to gain administrative privileges in the application.

Steps

• Do not store sensitive information such as passwords in session variables.
• Use a secure method to store and retrieve administrative credentials.
• Consider using a secure authentication mechanism such as Devise gem in Ruby on Rails.
• Implement secure password hashing and salting techniques.
• Ensure that the cache memory is properly cleared after the session ends.

Compliant code

        class AdminController < ApplicationController
  def login
    if params[:username] && params[:password]
      admin = Admin.find_by_username(params[:username])
      if admin && admin.authenticate(params[:password])
        session[:admin_id] = admin.id
        redirect_to '/admin/dashboard'
      else
        flash[:error] = 'Username or password is invalid'
        redirect_to '/admin/login'
      end
    end
  end
end
        
        

The updated code removes the storage of administrative credentials in session variables, which was a security vulnerability. Storing sensitive information such as passwords in session variables can lead to potential security risks as attackers might gain access to these details.

In the updated code, when the admin user logs in, the application checks if the username and password parameters are present. If they are, it finds the admin user by the username. If the admin user exists and the password is authenticated, the application stores the admin user's ID in the session variable and redirects the user to the admin dashboard. If the admin user does not exist or the password is not authenticated, the application flashes an error message and redirects the user to the admin login page.

This code does not store the admin user's username or password in the session variables, which mitigates the risk of these details being retrieved from the system's cache memory.

For further security, consider using a secure authentication mechanism such as the Devise gem in Ruby on Rails, which provides a robust and secure way to manage user authentication. Also, implement secure password hashing and salting techniques to protect passwords in your database.

Finally, ensure that the cache memory is properly cleared after the session ends to prevent any residual data from being accessed.

References

• 019. Administrative credentials stored in cache memory