Need

Protection of sensitive business information in source code

Context

• Usage of TypeScript for statically typed JavaScript development
• Usage of Express for building web applications and handling HTTP requests

Description

Non compliant code

        import express from 'express';

const app = express();

app.get('/employee', (req, res) => {
  const employeeData = {
    name: 'John Doe',
    position: 'Manager',
    salary: 5000,
  };

  res.json(employeeData);
});

app.get('/customer', (req, res) => {
  const customerData = {
    name: 'Jane Smith',
    email: 'jane@example.com',
    address: '123 Main St',
  };

  res.json(customerData);
});

app.listen(3000, () => {
  console.log('Server is running on port 3000');
});
        
        

The vulnerability in this code is a business information leak. The code exposes sensitive business information, including employee and customer data, through two API endpoints /employee and /customer.

In the /employee endpoint, the code creates an object employeeData containing employee information such as name, position, and salary. This data is then sent as a JSON response to the client when the endpoint is accessed.

Similarly, in the /customer endpoint, the code creates an object customerData containing customer information such as name, email, and address. This data is also sent as a JSON response to the client when the endpoint is accessed.

The impact of this vulnerability is that an attacker can easily obtain sensitive business information by accessing these endpoints. This information can be used to generate new attack vectors, such as targeted phishing attacks or identity theft.

To mitigate this vulnerability, it is recommended to establish controls to ensure that the information is only accessible to authorized individuals. This can be done by implementing authentication and authorization mechanisms to restrict access to these endpoints based on user roles or permissions.

Steps

• Identify the sensitive information that is being exposed in the code (employee and customer data).
• Implement access controls to ensure that the sensitive information is only accessible to authorized individuals.
• Consider using authentication and authorization mechanisms to restrict access to the sensitive endpoints (/employee and /customer).
• Implement proper data encryption techniques to protect the sensitive information in transit and at rest.
• Regularly review and update the access controls and encryption mechanisms to ensure they are effective and up to date.
• Consider implementing logging and monitoring mechanisms to detect and respond to any unauthorized access attempts or suspicious activities.

Compliant code

        import express from 'express';

const app = express();

// Implement access controls
function authenticate(req, res, next) {
  // Implement authentication logic here
  // Redirect or return an error response if authentication fails
  next();
}

// Implement authorization controls
function authorize(req, res, next) {
  // Implement authorization logic here
  // Redirect or return an error response if authorization fails
  next();
}

app.get('/employee', authenticate, authorize, (req, res) => {
  const employeeData = {
    name: 'John Doe',
    position: 'Manager',
    salary: 5000,
  };

  res.json(employeeData);
});

app.get('/customer', authenticate, authorize, (req, res) => {
  const customerData = {
    name: 'Jane Smith',
    email: 'jane@example.com',
    address: '123 Main St',
  };

  res.json(customerData);
});

app.listen(3000, () => {
  console.log('Server is running on port 3000');
});
        
        

The fixed code addresses the vulnerability by implementing access controls to ensure that only authorized individuals can access the business information.

The code uses the Express framework to create a server. Two middleware functions, authenticate and authorize, are implemented to enforce authentication and authorization controls.

The authenticate function is called before accessing the /employee and /customer routes. It is responsible for authenticating the user. The specific authentication logic is not provided in the code and should be implemented separately. If authentication fails, the function can redirect the user or return an error response.

The authorize function is also called before accessing the /employee and /customer routes. It is responsible for authorizing the user based on their role or permissions. Again, the specific authorization logic is not provided in the code and should be implemented separately. If authorization fails, the function can redirect the user or return an error response.

The /employee route handler returns employee information in JSON format. However, before accessing this route, the user must pass the authentication and authorization checks.

Similarly, the /customer route handler returns customer information in JSON format, but only if the user is authenticated and authorized.

The server listens on port 3000, and a message is logged to the console when the server starts running.

By implementing authentication and authorization controls, the fixed code ensures that only authorized individuals can access the business information, mitigating the risk of a business information leak.

References

• 216. Business information leak - Source Code