Need

Secure storage of administrative credentials

Context

• Usage of Scala for building scalable and functional applications
• Usage of SyncCacheApi for caching data in Play Framework applications
• Usage of play.api.mvc.Controller for handling HTTP requests and responses in Play Framework
• Usage of play.api.mvc.Action for handling HTTP requests in Play Framework
• Usage of play.api.mvc.Request for handling HTTP requests in Play Framework
• Usage of play.api.mvc.AnyContent for handling any type of content in Play Framework

Description

Non compliant code

        import play.api.cache._

class AdminController @Inject() (cache: SyncCacheApi) extends Controller {
  def login = Action { implicit request: Request[AnyContent] =>
    val adminUser = request.body.asFormUrlEncoded.get("username").head
    val adminPass = request.body.asFormUrlEncoded.get("password").head

    // Storing admin credentials in cache
    cache.set("adminUser", adminUser)
    cache.set("adminPass", adminPass)
    
    Ok("Logged in")
  }
}
        
        

This code represents a controller in a Scala Play Framework application which is handling an admin login action. The AdminController receives the username and password from the request body and stores them in the cache memory using cache.set() method.

The vulnerability lies in the fact that sensitive data, such as administrative credentials (username and password), are being stored in the cache memory. This can potentially allow an attacker to retrieve these credentials from the cache memory, leading to a breach of security.

It's also important to note that the credentials are being stored in plaintext which is another security concern. They should be hashed or encrypted before being stored, even if it's just in memory.

This is a high-risk vulnerability because it can lead to unauthorized access to the system with administrative privileges. This can potentially allow an attacker to perform any action on the system, such as data manipulation or deletion, configuration changes, etc.

Steps

• Avoid storing sensitive information, such as administrative credentials, in cache memory.
• Instead, securely store the administrative credentials in a secure database or a secure configuration file.
• When handling user input, ensure that proper validation and sanitization are performed to prevent any malicious input.
• Use secure protocols, such as HTTPS, for transmitting sensitive information over the network.
• Implement strong authentication mechanisms, such as multi-factor authentication, to protect administrative credentials.
• Regularly review and update the application's security practices to address any potential vulnerabilities.

Compliant code

        import play.api.mvc._
import play.api.data._
import play.api.data.Forms._

class AdminController @Inject() (cache: SyncCacheApi) extends Controller {
  val loginForm: Form[LoginForm] = Form(
    mapping(
      "username" -> nonEmptyText,
      "password" -> nonEmptyText
    )(LoginForm.apply)(LoginForm.unapply)
  )

  def login = Action { implicit request: Request[AnyContent] =>
    val formValidationResult = loginForm.bindFromRequest
    formValidationResult.fold(
      formWithErrors => {
        // This is the bad case, where the form had validation errors.
        BadRequest
      },
      loginData => {
        // This is the good case, where the form was successfully parsed as a LoginForm.
        Ok("Logged in")
      }
    )
  }
}

case class LoginForm(username: String, password: String)
        
        

The updated code no longer stores administrative credentials in cache memory, which was a major security vulnerability. Instead, it uses Play Framework's form handling to validate the input data.

The LoginForm case class is used to bind the form data. The loginForm is a Form[LoginForm] that maps the form data to the LoginForm case class. The nonEmptyText constraint ensures that the username and password fields are not empty.

In the login action, the loginForm is bound to the request data. If the form data is invalid (e.g., the username or password field is empty), the BadRequest result is returned. If the form data is valid, the Ok result is returned, indicating that the user is logged in.

This approach ensures that administrative credentials are not stored in cache memory, thereby mitigating the risk of credential theft. It also validates the form data, preventing malicious input.

Remember, the actual authentication process (e.g., checking the username and password against a database) is not shown in this code. This process should be implemented securely in the login action, using secure protocols and strong authentication mechanisms.

References

• 019. Administrative credentials stored in cache memory