2

I'm setting up a simple system that is using an HTTP server which is writing incoming data to JSON files in a specific directory. This is functioning as a very simple pseudo-database. For simplicity, assume Java and no direct exploits on the server software itself - users can send JSON, it is written to a specific file, and they can request the contents of all those files.

Am I missing a major security issue here? Can the users somehow abuse this design to get access in any way?

If you would call this a database, my fear is an attack vector similar to SQL injection.

If the OS is important (which I guess it would be), a focus on Windows and Linux/Unix would be nice.

  • 1
    Is there any kind of authentication, i.e. can a user read the content written by any other user? – A. Darwin Mar 28 '16 at 18:31
3

If I understand what you are doing correctly this is a database implemented as services. If the data is sensitive a lack of authentication can lead to significant security issues. Users could read each others data, overwrite important data, and possibly copy all the data in some massive security breach.

In addition to the authentication issues you may have issues if someone wants to perform a Denial of Service attack on your site. Without proper controls a flood of data could be written and fill up a disk that the server relies on.

Depending on how the data is retrieved (if the requests aren't sanitized) the user could use constructs such as path seperators to downloads important files on the Operating System (/etc/password for example). If the user is in control of the name of the file being written in anyway they could also use path exploits to overwrite sensitive files allowing them access.

  • you raise very valid points. DoS seems to be a great danger here, so I decided to require authentication for writes. Paths to files are now using hash-functions (in base 32, to meet filesystem standards of most operating systems). Thank you for that answer. – 5-to-9 Mar 29 '16 at 7:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.