Solution apps a1 tictactoe - Broken Access Token

[briggetteroman]

This solution refers to which of the apps?

A/M# - Broken Access Token - A1 - TicTacToe

What did you do to mitigate the vulnerability?

The SecDevLab reports that the TicTacToe application presents some vulnerabilities.
To mitigate these vulnerabilities, we add a function called verifyCurrentUser to control the user's access to their information and statistics. The function verifyCurrentUser verifies the information about the user from the JWT token ( username in the section payload, as we see in the image below) and compares the value username of the JWT token with the information filled in the parameter user from the request.

Did you test your changes? What commands did you run?

First, we reproduce the proof of concept of the attack. Then, we add a function to control access to users' information.

Reproduce the attack

To reproduce the attack, we start to create two users (user1 and user2) in the TicTacToe application. Then, I login to generate a JWT token for the user1 stored in the cookie with name tictacsession. Now, we copy the cookie value tictacsession=<JWT-token>.
.

After that, we use the cookie value to execute the command to get statistics information, as we can see in the image below.

But, if I change the value of user parameter for user2 using the JWT token of the user1, we get statistics information of user2.

In the same way, we can update the results of each game using the cookie value.

Also, we can update the game results of other users using the cookies of user1.

Solution

We add the function verifyCurrentUser to check if the current user can execute the request.
Getting statistic information, we execute the command asking for user1 information using the user1 JWT token.

But, if we try to get user2 information with the user1 JWT token, we do have not authorization to get this information.

Updating the results of the game, we execute the command to update user1 game information using the user1 JWT token.

But, if we try to update user2 game information with the user1 JWT token, we do have not authorization to get this information

[gustavocovas]

Good work, @briggetteroman!

Checking that the request user matches the session user fixes the broken access control. 🚀

I would like to suggest you to try and simplify the code further. Do we really need to supply the user as a parameter?