security in nodejs applications
TRANSCRIPT
SECURE CODING WITH NODE.JS
OBJECTIVE
▸ The purpose of the following micro-course is learning by examples the major security flaws in code in NodeJS, possible solutions and good security practices.
SECURE CODING WITH NODE.JS
VULNERABLE NODE.JS PROJECT
▸ https://github.com/cr0hn/vulnerable-node
A1 - INJECTION:INJECTION FLAWS, SUCH AS SQL, OS, AND LDAP INJECTION OCCUR WHEN UNTRUSTED DATA IS SENT TO AN INTERPRETER AS PART OF A COMMAND OR QUERY. THE ATTACKER’S HOSTILE DATA CAN TRICK THE INTERPRETER INTO EXECUTING UNINTENDED COMMANDS OR ACCESSING DATA WITHOUT PROPER AUTHORIZATION. OWASP TOP 10
A1 - INJECTION
TEXTO
CODE INJECTION: DEFINITION▸ Those application points with input information, usually
from the user, which must be treated as untrusted by default.
▸ Assimilate and understand the expression: This code smells injection
A1 - INJECTION :: SQL INJECTION (1/5)
SQL INJECTION
function do_auth(username, password) { var db = pgp(config.db.connectionString);
var q = "SELECT * FROM users WHERE name = '" + username + "' AND password ='" + password + "';";
return db.one(q);}
/model/auth.js:4
A1 - INJECTION :: SQL INJECTION (2/5)
SQL INJECTION
function do_auth(username, password) { var db = pgp(config.db.connectionString);
var q = "SELECT * FROM users WHERE name = '" + username + "' AND password ='" + password + "';";
return db.one(q);}
/model/auth.js:4
A1 - INJECTION :: LOG INJECTION (1/3)
LOG INJECTION
router.post('/login/auth', function(req, res) {
var user = req.body.username; var password = req.body.password; var returnurl = req.body.returnurl;
logger.error("Tried to login attempt from user = " + user);
/model/login.js:25
A1 - INJECTION :: LOG INJECTION (1/3)
LOG INJECTION
router.post('/login/auth', function(req, res) {
var user = req.body.username; var password = req.body.password; var returnurl = req.body.returnurl;
logger.error("Tried to login attempt from user = " + user);
/model/login.js:25
A1 - INJECTION :: LOG INJECTION (1/3)
LOG INJECTION - SOLUTION
Use a logging framework, adding variables as parametersIf you can’t use a framework, remove CR & LR
A1 - INJECTION :: EVIL REGEX (2/4)
EVIL REGEX
var re = /^([a-zA-Z0-9])(([\-.]|[_]+)?([a-zA-Z0-9]+))*(@){1}[a-z0-9]+[.]{1}(([a-z]{2,3})|([a-z]{2,3}[.]{1}[a-z]{2,3}))$/
if (!re.test(cart.mail)){ throw new Error("Invalid mail format");}
/routers/products.js:120
▸ https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS
A1 - INJECTION :: EVIL REGEX (4/4)
EVIL REGEX - SOLUTION
Use regex as simple as you can
Check each regex before go to production
A2 - BROKEN AUTHENTICATION AND SESSION MANAGEMENT:APPLICATION FUNCTIONS RELATED TO AUTHENTICATION AND SESSION MANAGEMENT ARE OFTEN NOT IMPLEMENTED CORRECTLY, ALLOWING ATTACKERS TO COMPROMISE PASSWORDS, KEYS, OR SESSION TOKENS, OR TO EXPLOIT OTHER IMPLEMENTATION FLAWS TO ASSUME OTHER USERS’ IDENTITIES.
OWASP TOP 10
A2 - BROKEN AUTHENTICATION AND SESSION MANAGEMENT
A2 - BROKEN AUTHENTICATION AND SESSION MANAGEMENT :: COOKIES (1/3)
COOKIES
app.use(session({ secret: 'ñasddfilhpaf78h78032h780g780fg780asg780dsbovncubuyvqy', cookie: { secure: false, maxAge: 99999999999 }}));
/model/app.js:43
A2 - BROKEN AUTHENTICATION AND SESSION MANAGEMENT :: COOKIES (3/3)
COOKIES - SOLUTION
Enable HTTP-Only
Limite expire time of cookie
A3 - CROSS-SITE SCRIPTINGXSS FLAWS OCCUR WHENEVER AN APPLICATION TAKES UNTRUSTED DATA AND SENDS IT TO A WEB BROWSER WITHOUT PROPER VALIDATION OR ESCAPING. XSS ALLOWS ATTACKERS TO EXECUTE SCRIPTS IN THE VICTIM’S BROWSER WHICH CAN HIJACK USER SESSIONS, DEFACE WEB SITES, OR REDIRECT THE USER TO MALICIOUS SITES.OWASP TOP 10
A3 - CROSS-SITE SCRIPTING
A3 - CROSS-SITE SCRIPTING (1/4)
XSS
router.get('/products/search', function(req, res, next) {
var url_params = url.parse(req.url, true).query; var query = url_params.q;
db_products.search(query) .then(function (data) {
res.render('search', { in_query: query, products: data }); })
/routers/products.js:62
A3 - CROSS-SITE SCRIPTING (2/4)
XSS
router.get('/products/search', function(req, res, next) {
var url_params = url.parse(req.url, true).query; var query = url_params.q;
db_products.search(query) .then(function (data) {
res.render('search', { in_query: query, products: data }); })
/routers/products.js:62
A3 - CROSS-SITE SCRIPTING (4/4)
XSS - SOLUTION
▸ https://github.com/mdevils/node-html-entities
HTML Entities
A4 - INSECURE DIRECT OBJECT REFERENCESA DIRECT OBJECT REFERENCE OCCURS WHEN A DEVELOPER EXPOSES A REFERENCE TO AN INTERNAL IMPLEMENTATION OBJECT, SUCH AS A FILE, DIRECTORY, OR DATABASE KEY. WITHOUT AN ACCESS CONTROL CHECK OR OTHER PROTECTION, ATTACKERS CAN MANIPULATE THESE REFERENCES TO ACCESS UNAUTHORIZED DATA.
OWASP TOP 10
A4 - INSECURE DIRECT OBJECT REFERENCES
A4 - INSECURE DIRECT OBJECT REFERENCES
INSECURE DIRECT OBJECT REFERENCES (1/2)
router.all('/products/buy', function(req, res, next) { cart = { mail: params.mail, address: params.address, ship_date: params.ship_date, phone: params.phone, product_id: params.product_id, product_name: params.product_name, username: req.session.user_name, price: params.price.substr(0, params.price.length - 1)} db_products.purchase(cart)
/routers/products.js:108
A4 - INSECURE DIRECT OBJECT REFERENCES
INSECURE DIRECT OBJECT REFERENCES (2/2)
function purchase(cart) { var db = pgp(config.db.connectionString); var q = "INSERT INTO purchases(mail, product_name, user_name, product_id, address, phone, ship_date, price) VALUES('" + cart.mail + "', '" + cart.product_name + "', '" + cart.username + "', '" + cart.product_id + "', '" + cart.address + "', '" + cart.ship_date + "', '" + cart.phone + "', '" + cart.price + "');"; return db.one(q);}
/model/products.js:34
• User ownership check?• Price check?
A4 - INSECURE DIRECT OBJECT REFERENCES
INSECURE DIRECT OBJECT REFERENCES - SOLUTION
Check database & object references
A6 - SENSITIVE DATA EXPOSUREMANY WEB APPLICATIONS DO NOT PROPERLY PROTECT SENSITIVE DATA, SUCH AS CREDIT CARDS, TAX IDS, AND AUTHENTICATION CREDENTIALS. ATTACKERS MAY STEAL OR MODIFY SUCH WEAKLY PROTECTED DATA TO CONDUCT CREDIT CARD FRAUD, IDENTITY THEFT, OR OTHER CRIMES. SENSITIVE DATA DESERVES EXTRA PROTECTION SUCH AS ENCRYPTION AT REST OR IN TRANSIT, AS WELL AS SPECIAL PRECAUTIONS WHEN EXCHANGED WITH THE BROWSER. OWASP TOP 10
A6 - SENSITIVE DATA EXPOSURE
A6 - SENSITIVE DATA EXPOSURE (1/4)
SENSITIVE DATA EXPOSURE
router.post('/login/auth', function(req, res) { var returnurl = req.body.returnurl;
auth(user, password)
}) .catch(function (err) { res.redirect("/login?returnurl=" + returnurl + "&error=" + err.message); });
/routers/login:39
A8 - CROSS-SITE REQUEST FORGERYA CSRF ATTACK FORCES A LOGGED-ON VICTIM’S BROWSER TO SEND A FORGED HTTP REQUEST, INCLUDING THE VICTIM’S SESSION COOKIE AND ANY OTHER AUTOMATICALLY INCLUDED AUTHENTICATION INFORMATION, TO A VULNERABLE WEB APPLICATION. THIS ALLOWS THE ATTACKER TO FORCE THE VICTIM’S BROWSER TO GENERATE REQUESTS THE VULNERABLE APPLICATION THINKS ARE LEGITIMATE REQUESTS FROM THE VICTIM.OWASP TOP 10
A8 - CROSS-SITE REQUEST FORGERY
A8 - CROSS-SITE REQUEST FORGERY (1/6)
CROSS-SITE REQUEST FORGERY
router.all('/products/buy', function(req, res, next) { cart = { mail: params.mail, address: params.address, ship_date: params.ship_date, phone: params.phone, product_id: params.product_id, product_name: params.product_name, username: req.session.user_name, price: params.price.substr(0, params.price.length - 1) } db_products.purchase(cart) .catch(function (err) { return res.json({message: "Product purchased correctly"}); });
/routers/products:89
A8 - CROSS-SITE REQUEST FORGERY (2/6)
CROSS-SITE REQUEST FORGERY
router.all('/products/buy', function(req, res, next) { cart = { mail: params.mail, address: params.address, ship_date: params.ship_date, phone: params.phone, product_id: params.product_id, product_name: params.product_name, username: req.session.user_name, price: params.price.substr(0, params.price.length - 1) } db_products.purchase(cart) .catch(function (err) { return res.json({message: "Product purchased correctly"}); });
/routers/products:89
Token?
A8 - CROSS-SITE REQUEST FORGERY (6/6)
CROSS-SITE REQUEST FORGERY - SOLUTION
Use POST requests for actions that modifies the system.
Use a unique token (CSRF Token) for each requests that modify the system.
A10 - UNVALIDATED REDIRECTS AND FORWARDSWEB APPLICATIONS FREQUENTLY REDIRECT AND FORWARD USERS TO OTHER PAGES AND WEBSITES, AND USE UNTRUSTED DATA TO DETERMINE THE DESTINATION PAGES. WITHOUT PROPER VALIDATION, ATTACKERS CAN REDIRECT VICTIMS TO PHISHING OR MALWARE SITES, OR USE FORWARDS TO ACCESS UNAUTHORIZED PAGES.
OWASP TOP 10
A10 - UNVALIDATED REDIRECTS AND FORWARDS
A10 - UNVALIDATED REDIRECTS AND FORWARDS (1/4)
UNVALIDATED REDIRECTS AND FORWARDS
router.post('/login/auth', function(req, res) { var returnurl = req.body.returnurl;
auth(user, password) .then(function (data) { if (returnurl == undefined || returnurl == ""){ returnurl = "/"; }
res.redirect(returnurl); })
/routers/login.js:36
A10 - UNVALIDATED REDIRECTS AND FORWARDS (2/4)
UNVALIDATED REDIRECTS AND FORWARDS
router.post('/login/auth', function(req, res) { var returnurl = req.body.returnurl;
auth(user, password) .then(function (data) { if (returnurl == undefined || returnurl == ""){ returnurl = "/"; }
res.redirect(returnurl); })
/routers/login.js:36
A10 - UNVALIDATED REDIRECTS AND FORWARDS (4/4)
UNVALIDATED REDIRECTS AND FORWARDS - SOLUTION
Only allow relative to domain redirection
White list for redirections
SECURE CODING WITH NODE.JS
REFERENCIAS▸ OWASP Top 10: https://www.owasp.org/index.php/Top_10_2013-Top_10 ▸ NodeJS Security check list:
https://blog.risingstack.com/node-js-security-checklist/ ▸ Evil regex:
https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS
▸ Detect potentially evil regex: https://github.com/substack/safe-regex