diff --git a/docs/labs/insecure-deserialization.html b/docs/labs/insecure-deserialization.html new file mode 100644 index 00000000..6aeb3a8b --- /dev/null +++ b/docs/labs/insecure-deserialization.html @@ -0,0 +1,151 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + +
+

Lab Exercise Insecure Deserialization

+

+This is a lab exercise on developing secure software. +For more information, see the introduction to +the labs. + +

+

Task

+

+Please change the code below to prevent insecure deserialization vulnerability. + +

+

Background

+

+Insecure Deserialization happens when the application’s deserialization process is exploited, allowing an attacker to manipulate the serialized data and pass harmful data into the application code. +

+The safest way to prevent this vulnerability is to not accept serialized objects from untrusted sources (user-controllable data). However, if you must accept them, there are some mitigations you can implement. In this lab, we will apply a couple of them. + +

+

Task Information

+

+ +

+The code below is called after an application login page. After login, a cookie is set up with the user profile, then in the homepage the cookie is deserialized and uses the username in a greeting message. +

+If you take a closer look at this code, you’ll see that it’s using eval() to deserialize the data from the cookie. This can be very dangerous as eval() evaluates a string as JavaScript code, which means any code inside that string will be executed, opening the possibility of Remote Code Execution (RCE) and Code Injection attacks. +

+For this lab we want to fix this by using an approach that prevents code execution, we will also add input validation to make sure the data we receive is what we are expecting and nothing more than that. +

    +
  1. + Replace eval() with JSON.parse(). JSON.parse( ) does not execute any JavaScript code like functions or methods, making it safer than some other serialization libraries. +
    2. +
  2. Besides checking if data.username exists, also check that the username is a string and not bigger than 20 characters.
    3. +
+ + +

+Use the “hint” and “give up” buttons if necessary. + +

+

Interactive Lab ()

+

+

+Change the code below, adding the mitigation steps to prevent Insecure Deserialization: +

    +
  1. Use a deserialization approach that prevents code execution.
    2. +
  2. Validate the username making sure it is used only if it's a string and no longer than 20 characters.
    3. +
+
+ +

+const express = require('express');
+const cookieParser = require('cookie-parser');
+
+const app = express();
+
+app.use(express.json());
+app.use(cookieParser());
+
+app.get('/', (req, res) => {
+  if (req.cookies.profile) {
+    try {
+      const base64Decoded = Buffer.from(req.cookies.profile, 'base64').toString('utf8');
+      
+
+      
+        res.send(`Hello ${data.username}`);
+      }
+
+    } catch (err) {
+      res.send('An error occurred: ' + err.message);
+    }
+  } else {
+    res.send("Please Login");
+  }
+});
+
+ + + + + +

+

+This lab was developed by Camila Vilarinho. +

+

+ +

+
+ +