Block unauthorized users from accessing sensitive data

These updates are applicable for releases - 2021.04, 2021.07, 2021.10, 2022.07, 2022.10, 2023.01, 2023.07, 2023.10.

Description

This document provides a solution to prevent any unauthenticated user from accessing and downloading sensitive information.

The application transmits sensitive data in the GET request which allows any unauthenticated user to download the sensitive files. It was possible for an unauthenticated user to download transaction report by accessing the affected URL directly in the browser.

Affected API

/services/data/v1/DocumentManagement/objects/CombinedStatements?fileType=pdf&fileName=Combined_Statement_pdf_26052023.pdf&id=5896124170 
 

GET /services/data/v1/DocumentManagement/objects/DownloadTransactions?fileId=3753122498&fileType=csv (File is getting downloaded once even when the user session is not active)

The fix should be provided to all the download flows in the application.

Recommendation

The application must have a robust authorization mechanism wherein the privileges of the logged in user (whose identity is ascertained using the session ID) is ascertained at the server end prior to granting access to the privileged functionalities. Also, the application must process sensitive information using POST requests only.

Solution

Path:

Fabric/java/DocManagementApi-Services/src/main/java/com/temenos/infinity/api/docmanagement/acctstatement/javaservices/DownloadCombinedStatementFile.java 
 

Fabric/java/DocManagementApi-Services/src/main/java/com/temenos/infinity/api/docmanagement/acctstatement/javaservices/ GetCombinedStatementsDownloaded.java

Package: com.temenos.infinity.api.docmanagement.acctstatement.javaservices.impl

Class: DownloadCombinedStatementFile.java

Method: Invoke

In the snippets, red indicates removed or modified content, while green indicates added or replaced content.

Package: com.temenos.infinity.api.docmanagement.acctstatement.javaservices.impl

Class: GetCombinedStatementsDownloaded.java

Method: Invoke

 

Package: com.temenos.infinity.api.docmanagement.acctstatement.javaservices.impl

Class: GetCombinedStatementsDownloaded.java

Method: getSHA

Package: com.temenos.infinity.api.docmanagement.acctstatement.javaservices.impl

Class: GetCombinedStatementsDownloaded.java

Method: toHexString