Need

Protection of sensitive corporate information from unauthorized access

Context

• Usage of Scala for building scalable and high-performance applications
• Usage of play.api.mvc for handling HTTP requests and building web applications in Play Framework
• Usage of global execution context for Scala concurrent programming

Description

Non compliant code

        import play.api.mvc._
import scala.concurrent.ExecutionContext.Implicits.global

class EmployeeController @Inject()(cc: ControllerComponents) extends AbstractController(cc) {

  def getEmployeeDetails(id: String) = Action.async { implicit request: Request[AnyContent] =>
    EmployeeModel.find(id).map { employeeOpt =>
      employeeOpt.map { employee =>
        Ok(Json.obj("id" -> employee.id, "name" -> employee.name, "role" -> employee.role, "email" -> employee.email))
      }.getOrElse(NotFound)
    }
  }
}
        
        

This code defines a controller in a Play framework application that exposes an endpoint to fetch details about an employee based on their ID. The getEmployeeDetails function takes an employee ID as a parameter and returns a JSON object containing the employee's ID, name, role, and email.

The vulnerability here is that there is no authentication or authorization mechanism in place to verify the identity of the user making the request or to check whether they have the necessary permissions to access this information. This means that anyone who knows the URL of this endpoint and an employee's ID can access potentially sensitive information about that employee. This is a serious security issue as it could lead to a business information leak.

Steps

• Implement access control to restrict unauthorized access to employee details.
• Ensure that only authenticated and authorized users can access the employee details.
• Use role-based access control to determine the level of access each user has to employee details.
• Encrypt sensitive employee information, such as contact information, to protect it from unauthorized access.
• Regularly review and update access control policies to ensure they are effective and up to date.
• Implement logging and monitoring mechanisms to detect and respond to any unauthorized access attempts.

Compliant code

        import play.api.mvc._
import scala.concurrent.ExecutionContext.Implicits.global

class EmployeeController @Inject()(cc: ControllerComponents, authService: AuthService) extends AbstractController(cc) {

  def getEmployeeDetails(id: String) = Action.async { implicit request: Request[AnyContent] =>
    authService.authenticate(request).flatMap { user =>
      if (authService.authorize(user, "Employee")) {
        EmployeeModel.find(id).map { employeeOpt =>
          employeeOpt.map { employee =>
            Ok(Json.obj("id" -> employee.id, "name" -> employee.name, "role" -> employee.role, "email" -> employee.email))
          }.getOrElse(NotFound)
        }
      } else {
        Future.successful(Forbidden)
      }
    }
  }
}
        
        

The updated code now includes an AuthService which is used to authenticate and authorize users. The AuthService is injected into the EmployeeController and used in the getEmployeeDetails method.

The authenticate method of the AuthService is used to authenticate the user making the request. If the user is not authenticated, the authenticate method will throw an exception and the request will be rejected.

If the user is authenticated, the authorize method of the AuthService is used to check if the user has the necessary permissions to access the employee details. In this case, the user must have the "Employee" role. If the user does not have the necessary permissions, a Forbidden response is returned.

If the user is authenticated and has the necessary permissions, the employee details are retrieved and returned in the response. The employee details are still returned as a JSON object, but now only authorized users can access this information.

This updated code helps to prevent unauthorized access to employee details, addressing the identified vulnerability.

References

• 336. Business information leak - Corporate information