PRB: Potential Security Vulnerability When Class Overrides Internal or Private Virtual Method (313499)

MORE INFORMATION

Consider the following JScript library file, MyLibrary.js:

import System;
package MyLibrary
{
    public class DatabaseAccessor
    {
        public function FetchLatestData() : String
        {
            var username : String = FetchUserNameFromEncryptedStore();
            var password : String = FetchPasswordFromEncryptedStore();
            return GetDataFromDatabase(username, password);
        }
        private function FetchUserNameFromEncryptedStore() : String
        { /* Retrieve User Name here. */ }
        private function FetchPasswordFromEncryptedStore() : String
        { /* Retrieve Password here. */ }        
        private function GetDataFromDatabase(username : String, password : String)
        { /* Use the earlier User Name and Password to retrieve data from database. */ }
    }
}
				

The preceding code appears to keep the user name and the password private. However, the user name and the password are not private. An attacker might use the IL assembler to write a derived class that overrides the GetDataFromDatabase method. When the attacker creates an instance of the derived class and calls the public base class FetchLatestData method, the FetchLatestData method calls the derived GetDataFromDatabase method. This call passes the user name and the password to the code of the attacker. In other words, the preceding code does not keep the strings private.

The preceding code also does not guarantee that the user name and the password that are passed to GetDataFromDatabase are, in fact, those from the encrypted store. The attacking class might also use this same attack to substitute other user names and passwords and to bypass the code that points to the encrypted store. The attacker might override the FetchUserNameFromEncryptedStore and the FetchPasswordFromEncryptedStore methods and have these methods return strings that the attacker chooses. This data manipulation in code might have negative results if the attacker reads or substitutes the user name or the password string.