Need

Secure access control for financial information

Context

• Requirement of Ruby 2.0 or later for running the application
• Usage of Ruby on Rails for building web applications

Description

Non compliant code

        class CreditCardController < ApplicationController
  before_action :authenticate_user!

  def show
    @credit_card = CreditCard.find_by(encrypted_product_number: params[:encrypted_product_number])
  end
end
        
        

The above code is vulnerable due to Insecure Direct Object Reference (IDOR). In this case, the show action in the CreditCardController is fetching credit card information based on the encrypted_product_number received from the parameters of the request.

The vulnerability lies in the fact that there is no check to ensure that the current user is authorized to view the fetched credit_card data. This means that if an attacker can guess or obtain the encrypted_product_number of another user's credit card, they can send a request to the show action and view that user's credit card information, potentially leading to unauthorized access to sensitive financial information.

This is a serious vulnerability as it could lead to unauthorized disclosure of sensitive information and potential financial loss to the users.

Steps

• Implement authorization checks to ensure that the user accessing the credit card information is the owner of the account associated with the credit card.
• Validate the user's session and ensure that the user is authenticated before allowing access to the credit card information.
• Use a secure identifier, such as the user's account ID, instead of the encrypted product number to retrieve the credit card information.
• Encrypt and securely store the credit card information to protect it from unauthorized access.
• Regularly review and update the authentication and authorization mechanisms to address any potential vulnerabilities.

Compliant code

        class CreditCardController < ApplicationController
  before_action :authenticate_user!
  before_action :authorize_user!

  def show
    @credit_card = current_user.credit_cards.find_by(encrypted_product_number: params[:encrypted_product_number])
  end

  private

  def authorize_user!
    unless current_user.credit_cards.find_by(encrypted_product_number: params[:encrypted_product_number])
      redirect_to root_path, alert: "You are not authorized to view this information."
    end
  end
end
        
        

The updated code includes an additional before_action filter, authorize_user!, which checks if the current user is authorized to access the requested credit card information. This is done by checking if the credit card with the given encrypted product number belongs to the current user.

In the show action, the credit card is retrieved from the current user's credit cards instead of directly from the CreditCard model. This ensures that only the credit cards associated with the current user can be accessed.

The authorize_user! method checks if the credit card with the given encrypted product number belongs to the current user. If it doesn't, the user is redirected to the root path with an alert message indicating that they are not authorized to view the information. This prevents users from accessing credit card information associated with other users' accounts.

This solution ensures that only authenticated and authorized users can access the credit card information, thereby fixing the insecure object reference vulnerability.

References

• 288. Insecure object reference - Financial information