Security issues

[circle-aloychan]

General

1. Missing SECURITY.md file
2. JS Dependencies are not locked via a lock file, nor within the package.json file

   • nextJSGraphQLapp_sanitized/package.json

     Lines 11 to 25 in 0b341a6

     	"dependencies": {
     	"next": "latest",
     	"next-auth": "latest",
     	"react": "^18.2.0",
     	"react-dom": "^18.2.0",
     	"apollo-server-micro": "^3.7.0",
     	"graphql": "^16.6.0",
     	"jsonwebtoken": "^9.0.0",
     	"@apollo/client": "^3.7.0"
     	},
     	"devDependencies": {
     	"typescript": "^4.9.4",
     	"@types/node": "^18.11.9",
     	"@types/react": "^18.0.24"
     	},

3. Public repository

Backend

1. 3P dependencies used -- unsure if the deps are reviewed
2. Unsanitized logs

   • nextJSGraphQLapp_sanitized/backend/FinancialAccountManager.java

     Line 24 in 0b341a6

     logger.info("user Info" + DB_USER + ", " + API_KEY);

   • nextJSGraphQLapp_sanitized/backend/FinancialAccountManager.java

     Line 33 in 0b341a6

     System.out.println("Connecting to DB with user: " + DB_USER);

   • nextJSGraphQLapp_sanitized/backend/FinancialAccountManager.java

     Line 43 in 0b341a6

     System.out.printf("%s: $%.2f%n", name, balance)

3. Non atomic amount transfer

   • nextJSGraphQLapp_sanitized/backend/FinancialAccountManager.java

     Lines 58 to 69 in 0b341a6

     	if (!balances.containsKey(from) || !balances.containsKey(to)) {
     	logger.warning("Invalid transaction: Account not found for " + from + " or " + to);
     	throw new Exception("Invalid transaction: Account not found for " + from + " or " + to);
     	}
     	if (balances.get(from) < amount) {
     	logger.warning("Transaction failed: Insufficient funds in account: " + from);
     	throw new Exception("Insufficient funds in account: " + from);
     	}
     	balances.put(from, balances.get(from) - amount);
     	balances.put(to, balances.get(to) + amount);

4. API keys stored in plain text

   • nextJSGraphQLapp_sanitized/config/config.yaml

     Lines 9 to 11 in 0b341a6

     	api:
     	paymentGatewayKey: "Fg7H2yLdM8VpQz3N6RbXtPWaK4CsJ9T5"
     	smsProviderKey: "X1Y2Z3A4B5C6D7E8F9G0H1I2J3K4L5M6"

Frontend

1. Too permissive perms for the User role

   • nextJSGraphQLapp_sanitized/permissions/check.ts

     Line 18 in 0b341a6

     CAN_VIEW_SENSITIVE_DATA: true,

2. UserId passed in as params, allow any users to view any other user's data

   • nextJSGraphQLapp_sanitized/pages/profile/[userId].tsx

     Line 26 in 0b341a6

     const { userId } = context.params;

3. Able to view any user's loans

   • nextJSGraphQLapp_sanitized/components/Loan.tsx

     Line 11 in 0b341a6

     const Loan = ({ username }: { username: string }) => {

4. Able to read all users' transaction history

   • nextJSGraphQLapp_sanitized/components/Transactions.tsx

     Lines 5 to 14 in 0b341a6

     	const FETCH_TRANSACTION_HISTORY = gql`
     	query fetchTransactionHistory {
     	fetchTransactionHistory {
     	transactionId
     	sender
     	receiver
     	amount
     	}
     	}
     	`;

5. APIs are public? / do not have authentication schemes?

   • nextJSGraphQLapp_sanitized/graphql/dataSources.ts

     Lines 9 to 14 in 0b341a6

     	const response = await fetch(`https://circle-api.com/user/${userId}/details`, {
     	method: 'GET',
     	headers: {
     	'Content-Type': 'application/json'
     	}
     	});