{"id":16015591,"url":"https://github.com/laojala/cybersecuritybase-project-1","last_synced_at":"2026-05-17T15:39:11.913Z","repository":{"id":102712347,"uuid":"115659179","full_name":"laojala/cybersecuritybase-project-1","owner":"laojala","description":"Project for the course: https://cybersecuritybase.github.io/","archived":false,"fork":false,"pushed_at":"2017-12-28T21:18:42.000Z","size":37,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-10-06T00:41:13.462Z","etag":null,"topics":["owasp-top-10","security-flaws","spring-boot"],"latest_commit_sha":null,"homepage":"","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/laojala.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2017-12-28T21:00:59.000Z","updated_at":"2020-10-08T15:51:39.000Z","dependencies_parsed_at":null,"dependency_job_id":"962eeca9-51be-4bc3-84a0-01e48f498909","html_url":"https://github.com/laojala/cybersecuritybase-project-1","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/laojala/cybersecuritybase-project-1","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/laojala%2Fcybersecuritybase-project-1","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/laojala%2Fcybersecuritybase-project-1/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/laojala%2Fcybersecuritybase-project-1/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/laojala%2Fcybersecuritybase-project-1/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/laojala","download_url":"https://codeload.github.com/laojala/cybersecuritybase-project-1/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/laojala%2Fcybersecuritybase-project-1/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33143646,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-17T09:28:26.183Z","status":"ssl_error","status_checked_at":"2026-05-17T09:27:52.702Z","response_time":107,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["owasp-top-10","security-flaws","spring-boot"],"created_at":"2024-10-08T15:40:56.498Z","updated_at":"2026-05-17T15:39:11.890Z","avatar_url":"https://github.com/laojala.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Cyber Security Base - Course Project I\n\nWeb application that contains five different security flaws from the [OWASP top ten list](https://www.owasp.org/index.php/Top_10_2013-Top_10). Project is done for the course https://cybersecuritybase.github.io/ \n\nIt is recommended not to reuse this code, because it contains security issues.\n\n\n## Getting Started\n\n### Users\n\nApplication has two users:\n\n```\nsam/salasana\nadmin/password\n```\n\nAfter login user can sign in to a event and logout. Admin user can also see list of all signees.\n\n###  Running\n\nPrerequisite is that Maven is installed. Application can be run using:\n```\nmvn spring-boot:run\n```\n\n\n\n## Security flaws and suggested fixes\n\n\n### A1 - SQL Injection:\n\n#### A1 Steps to reproduce:\n\n1. Login using admin/password or sam/salasana\n2. Fill in any input to the first field\n3. Fill in this (or similar sql statement) to a message field:\n```\nSecond'); UPDATE Signup set message='EVIL MESSAGE'; -- -\n```\n4. **Issue:** All messages are updated to “EVIL MESSAGE”. Messages are visible at page http://localhost:8080/admin/admin\n\n#### A1 Suggested fix:\n\nIt is recommended to use JPA’s standard methods instead of custom code for the database connection.\n\nClass _SignupController_ includes suggested fixes that are currently commented out. Fix is done by removing these two lines `db_injection.addSignupToDb(name, message);` and `List\u003cSignup\u003e allSignups = db_injection.readSignupsFromDb();` and commenting in lines that use Spring Security's and JPA's standard methods. Class _CustomDbHelpers_ becomes obsolete and it can be removed completely. After fix code looks like this:\n\n    @RequestMapping(value = \"/form\", method = RequestMethod.POST)\n    public String submitForm(@RequestParam String name, @RequestParam String message) {\n        signupRepository.save(new Signup(name, message, null));\n        return \"done\";\n    }\n    \n    @RequestMapping(value = \"/admin/admin\", method = RequestMethod.GET)\n    public String loadAdmin(Model model) {\n        List\u003cSignup\u003e allSignups = signupRepository.findAll();\n        model.addAttribute(\"signups\", allSignups);\n        return \"admin/admin\";\n    }\n\n\n### A6 - Sensitive Data Exposure\n\n#### A6 Steps to reproduce:\n1. Log in\n2. Fill this to a name field (message can be empty):\n```\nevil',(select username,password from Users where userid=1))-- -\n```\n3. **Issue:** Message field of a latest signup contains username and password for the user id 1. Open page http://localhost:8080/admin/admin to view login details.\n\n#### A6 Suggested fix:\n\nIt is recommended that route to the SQL injection is fixed similarly as in the previous issue A1. In addition, passwords should be hashed. \n\nClass _SecurityConfiguration_ includes fix that is currently commented out. When this line is commented in, password encryption is enabled: `auth.userDetailsService(userDetailsService).passwordEncoder(passwordencoder());`\n\nAfter fix, hashed passwords need to be updated to the database for the default users.\n\n### A3 - XSS attack\n\n#### A3 Steps to reproduce:\n\n1. Login as admin user\n2. Fill in any name\n3. Fill in this (or similar html) to the Message field:\n```\n\u003cscript\u003ealert(\"Evil Message!\");\u003c/script\u003e\n```\n4. Open admin page http://localhost:8080/admin/admin\n5. **Issue:** Page displays alert dialog\n\n#### A3 Suggested fix:\n\nScript becomes visible because admin view displays message as unescaped text. Fix can be done by changing `data-th-utext` to `data-th-text` in the file _admin.html_.\n\n\n### A7 - Missing Function Level Access Control\n\n#### A7 - Steps to reproduce:\n\n1. Login as non-admin user: sam/salasana\n2. Notice that form page does not display link to the admin page. This link is visible when admin user (admin/password) logs in.\n3. Navigate to the admin page using direct address: http://localhost:8080/admin/admin\n4. **Issue:** Basic level user has access to the admin page\n\n#### A6 - Suggested fix:\n\nClass _SecurityConfiguration_ contains suggested fix, where admin user level is required to access requests in the folder admin. When fix is commented in, code looks like this:\n\n```\n@Override\nprotected void configure(HttpSecurity http) throws Exception {\n\thttp\n    \t.authorizeRequests()\n        \t.antMatchers(\"/admin/**\").hasAuthority(\"ROLE_ADMIN\")\n           \t.anyRequest().authenticated().and()\n           \t.formLogin().permitAll();\n}\n```\n\nIt is important to notice, that authorization in the html template does not include backend validation. In other words, this line in the html template restricts only link visibility for the admin role.\n\n```\n\u003cdiv sec:authorize=\"hasAuthority('ROLE_ADMIN')\"\u003e\u003ca href=\"/admin/admin\"\u003eAdmin page\u003c/a\u003e\u003c/div\u003e\n```\n\n\n### A9 - Using Components with Known Vulnerabilities\n\n#### A9 Steps to reproduce:\n\n1. Open command line and navigate to a project folder\n2. Run  OWASP Dependency Check using command \n```\nmvn dependency-check:check\n```\n3. Open a dependency-check report when scan is finished. Report is located in the target folder.\n4. **Issue:*** As writing this, scanner found 16 vulnerabilities and 5 vulnerable dependencies.\n\n#### A9 Suggested fix:\n\nOpen pom.xml and update version number of a spring-boot-starter-parent to the last stable release `1.5.9.RELEASE`. Less vulnerabilities are expected when scan is re-run.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flaojala%2Fcybersecuritybase-project-1","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Flaojala%2Fcybersecuritybase-project-1","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flaojala%2Fcybersecuritybase-project-1/lists"}