Programming with HTML, PHP and javascript. Backend source code o

How effective is secure code review for discovering vulnerabilities?

Tim

10th November 2021

8 min read

We’ve recently discussed application security and the trend we’re seeing in which companies are increasingly implementing security early on in the Software Development Life Cycle (SDLC).

In our blog post exploring the impact of adopting application security, we described a common scenario involving assessing an application that was ready for release. Through the assessment, critical vulnerabilities were identified, such as an SQL injection, close to the go-live deadline.

This time, we’re covering how a secure code review early on in the SDLC can identify this vulnerability. This would give developers time to make changes without delaying the project, and understand the importance of security best practices when coding secure applications.

In this similar scenario, the company contacted us during the early stages of development – the adoption of “Shift-Left”.

The scenario

An application software development company contacts us for a secure code review. The application consists of a Bootstrap frontend, a search form for querying critical business information, and is supported by an API that queries the business-critical database.

Up to here, everything is the same as the previous scenario which stated that “During the application assessment, a consultant identifies a potential SQL injection vulnerability in the search functionality with an apostrophe (‘). A database syntax error is returned. ”

 

What if?

However, what if the application doesn’t provide a syntax error message? Instead, it handles the error and returns a generic message. Would the vulnerability still be found?

To explain this, we’ve developed a basic application to simulate the identification of the vulnerability. Within the application, we have admin functionality to search for users:

We attempt to cause a database error by inserting an apostrophe (‘) into the search field. But this time, no error is returned, and we’re told that a user couldn’t be found.

It doesn’t take much to expand the test further and use an SQL command to confirm the existence of the vulnerability. However, this is simply a simulation to show the differences between a code review and an application review.

 

An alternative approach

We review the basic code that handles the request from the user and the database query that’s performed.

try:
# SQL Query

result = db.session.execute(‘SELECT * FROM users WHERE id = ‘ + str(Id))

# Return the user object

return jsonify({‘user’: [dict(row) for row in result]})

except Exception as e:

# Error handled here

return jsonify({‘error’: ‘Could not find a user!’}), 200

 

We can see that a database query is performed on the ‘users’ table, where the ‘id’ equals the string value of the variable ‘Id’. If this ‘Id’ variable contains a value that is user-controlled, we can easily inject this statement and execute our own SQL.

try:# Get the id of the issue from the request argument

Id = request.args.get(‘id’, None)

 

We’ve confirmed that the ‘Id’ variable is the value passed in the GET parameter, and can inject potentially malicious SQL statements.

Heading back to the application frontend, we continue to insert a typical 1 or 1 = 1; statement. This is used to bypass authentication or return all records from a table.

What happens next?

As per an application assessment, the consultant continues the code review in the hunt for more vulnerabilities. In this scenario, the client requested a secure code review. A vulnerability was identified which is the same vulnerability as identified in the application assessment.

However, this time, the client had a secure code review performed at an earlier stage in the SDLC. This gives them a chance to remediate issues long before the application is released into production.

Further to this, the interaction between our security consultants and the development team means the client gains a deeper understanding of what it takes to develop applications securely. The client can now continue to develop the application securely from the ground up with security taking precedence.

 

Final thoughts

With the rapid development of applications, multiple updates, feature upgrades, fixes and improvements, there’s always the potential that vulnerabilities are introduced at multiple stages of the SDLC.

From this example, we can see that a code review can lead to a greater level of assurance during the development phases and should be routinely performed.

There shouldn’t be a compromise between rapid development cycles and best practice security. When an organisation adopts security early on, both can be achieved. This will improve security posture and reduce costs of security integration while maintaining fast delivery which ultimately leads to business success.

In our next blog post, we’ll take this example and shift it even further left. Before any code is written, we can start to map out how an application functions; documenting its inputs and outputs, user roles, external dependencies and service, in what is known as threat-modelling. If you need require any assistance, please get in touch with us today and find out how we can help you.

Resources

  • Insights
  • Labs
White box penetration testing

Uncovering vulnerabilities with white box penetration testing

As a business owner or IT professional, you understand the importance of protecting your company’s sensitive data, systems and reputation from cyber threats. One of…

API penetration testing

Securing APIs through penetration testing

APIs (Application Programming Interfaces) have become the backbone of many modern applications, and indeed the foundation of some businesses services. APIs enable seamless communication between…

The importance of a post-penetration test action plan

The importance of a post-penetration test action plan

As cyber threats continue to evolve and become more sophisticated, businesses must stay one step ahead in protecting their sensitive data and network infrastructure. Penetration…

How to choose the right penetration testing partner

How to choose the right penetration testing partner for your business

In today’s digital landscape, cybersecurity threats are evolving at an alarming rate. With the growing number of cyber-attacks and data breaches, businesses must prioritise their…

IoT device security, penetration testing

Securing the Internet of Things: Penetration testing’s role in IoT device security

The world is witnessing a remarkable transformation as more devices become interconnected, forming what’s known as the Internet of Things (IoT). From smart refrigerators and…

Man working as a junior penetration tester

My first month working as a junior penetration tester

Entering the world of cyber security as a junior penetration tester has been an eye-opening experience for me. In my first month, I’ve encountered challenges,…

Password cracking: How to crack a password

An introduction to password security: How to crack a password

Online Password Cracking An online attack is performed in real-time, against live services or applications to compromise active user accounts. Such attacks typically occur when…

Application Security 101 – HTTP headers

Application Security 101 – HTTP Headers Information Disclosure

Server Header Information Disclosure The most common HTTP header that is enabled by default in most web servers is the ‘Server’ header, which can lead…

SPF, DKIM, DMARC and BIMI for Email Security

SPF, DKIM, DMARC and BIMI for Email Security

Sender Policy Framework Sender Policy Framework (SPF) is a DNS TXT record that is added to a domain that tells email recipients which IP addresses…

Terraform security best practices

Terraform security best practices (2022)

The following sections discuss our most important Terraform security best practices: The importance of Terraform State Terraform must keep track of the resources created. When…

Security vulnerability in Follina exploit

Preventing exploitation of the Follina vulnerability in MSDT

The Follina Exploit A zero-click Remote Code Execution (RCE) vulnerability has started making the rounds which is leveraging functionality within applications such as Microsoft Word.…

Application Security 101 – HTTP headers

Application Security 101 – HTTP headers

1. Strict-Transport-Security The HTTP Strict Transport Security (HSTS) header forces browsers and other agents to interact with web servers over the encrypted HTTPS protocol, which…