Need

Secure password management

Context

• Usage of Scala 2.12 for developing scalable and high-performance applications
• Usage of play.api.mvc._ for handling HTTP requests and responses in Play Framework
• Usage of play.api.libs.json for JSON parsing and manipulation in Play Framework
• Usage of play.api.libs.functional.syntax for functional programming and JSON manipulation in Play Framework

Description

Non compliant code

        def changePassword = Action { implicit request =>
  val newPassword = request.body.asFormUrlEncoded.get("newPassword").head
  val username = request.body.asFormUrlEncoded.get("username").head
  userService.changePassword(username, newPassword)
  Ok("Password changed successfully")
}
        
        

The above Scala code represents a function within the Play framework that changes a user's password.

The function changePassword is an action that retrieves the new password and username from the request body. It then calls the userService's changePassword function with the username and new password as parameters.

The vulnerability here lies in the fact that the function does not check whether the logged-in user is the same as the user whose password is being changed. This means that a user can change another user's password if they know their username. This is a serious security flaw as it can lead to unauthorized access and potential data breaches.

The code does not validate the session of the user making the request, and as a result, it allows any user to change the password of any other user. This is a clear violation of the principle of least privilege, which states that a user should only be able to perform actions that they are authorized to do.

In this case, only the user themselves or an admin (under special circumstances) should be able to change a user's password. Therefore, the code needs to be modified to implement this check.

Steps

• Implement proper authentication and authorization mechanisms to ensure that only authenticated and authorized users can access the change password functionality.
• Use secure password storage mechanisms such as hashing and salting to protect user passwords.
• Implement strong password policies to enforce password complexity requirements.
• Implement session management to ensure that each user has their own session and cannot modify other users' passwords.
• Validate and sanitize user input to prevent any potential injection attacks.
• Implement secure communication protocols (e.g., HTTPS) to protect sensitive data during transmission.
• Regularly update and patch the application and its dependencies to address any known security vulnerabilities.

Compliant code

        def changePassword = Action { implicit request =>
  val newPassword = request.body.asFormUrlEncoded.get("newPassword").head
  val username = request.body.asFormUrlEncoded.get("username").head
  val sessionUsername = request.session.get("username")

  sessionUsername match {
    case Some(u) if u == username =>
      userService.changePassword(username, newPassword)
      Ok("Password changed successfully")
    case _ =>
      Unauthorized("You are not authorized to change this user's password")
  }
}
        
        

The original code allowed any user to change the password of any other user. This is a serious security vulnerability as it could allow an attacker to gain unauthorized access to other users' accounts.

The fixed code adds a check to ensure that the user who is trying to change the password is the same user who is logged in. This is done by comparing the username from the session with the username for which the password change is being requested.

If the usernames match, the password change is allowed. If they do not match, the server responds with an "Unauthorized" message, preventing the password change.

This fix addresses the immediate vulnerability, but it is also recommended to implement further security measures such as secure password storage mechanisms (hashing and salting), strong password policies, session management, input validation and sanitization, secure communication protocols (HTTPS), and regular updates and patches.

References

• 271. Insecure functionality - Password management