Need

Protection of sensitive corporate information from unauthorized access or leakage

Context

• Usage of TypeScript for type-checking and compiling JavaScript code
• Usage of Express for building web applications and APIs

Description

Non compliant code

        import express from 'express';

const app = express();

app.get('/employees', (req, res) => {
  const employees = [
    { name: 'John Doe', role: 'Manager', contact: 'john.doe@example.com' },
    { name: 'Jane Smith', role: 'Developer', contact: 'jane.smith@example.com' },
    { name: 'Mike Johnson', role: 'Sales', contact: 'mike.johnson@example.com' },
  ];

  res.json(employees);
});

app.listen(3000, () => {
  console.log('Server is running on port 3000');
});
        
        

The vulnerability in this code is that it exposes sensitive information about company employees to anyone who accesses the '/employees' endpoint. The code creates an Express server and defines a route for the '/employees' endpoint. When a request is made to this endpoint, the server responds with a JSON array containing information about the employees, including their names, roles, and contact information.

This vulnerability allows an attacker to easily obtain information about the roles and contact details of company employees. This information can be used for various malicious purposes, such as targeted phishing attacks, social engineering, or even selling the information to third parties.

To address this vulnerability, access to the employee information should be restricted to authorized users only. This can be achieved by implementing authentication and authorization mechanisms, such as requiring users to log in and verifying their permissions before allowing access to the employee information. Additionally, sensitive information like contact details should be encrypted or obfuscated to further protect it from unauthorized access.

Steps

• Remove the '/employees' route from the application
• Implement authentication and authorization mechanisms to restrict access to sensitive information
• Store sensitive information, such as employee roles and contact information, in a secure database
• Retrieve employee information from the database based on authenticated user's permissions
• Encrypt sensitive information in the database to protect it from unauthorized access

Compliant code

        import express from 'express';

const app = express();

app.listen(3000, () => {
  console.log('Server is running on port 3000');
});
        
        

The fixed code is a simple Express.js server that listens on port 3000. It uses the express module to create an instance of the Express application.

The code does not contain any specific logic related to the vulnerability mentioned. However, it is important to note that this code alone does not address the vulnerability. It is just a basic setup for an Express server.

To address the vulnerability, additional measures need to be implemented. Here are some recommendations:

1. Access Control: Implement proper access controls to restrict unauthorized access to sensitive information. This can be done by implementing authentication and authorization mechanisms.

2. Role-Based Access Control (RBAC): Define roles and permissions for different users within the system. Only authorized users with the necessary roles should be able to access sensitive information.

3. Secure API Endpoints: Ensure that the API endpoints that expose sensitive information are properly secured. This can be done by implementing authentication and authorization checks before allowing access to the data.

4. Input Validation: Implement input validation to prevent any malicious input from being processed. This can help prevent attacks like SQL injection or other forms of code injection.

5. Secure Data Storage: Ensure that sensitive information is stored securely, using appropriate encryption and access controls.

It is important to note that the code provided is just a starting point and additional security measures need to be implemented to address the vulnerability.

References

• 336. Business information leak - Corporate information