Skip to content

SECURITY_FIXES.md

Latest commit

 

History

History
281 lines (210 loc) · 6.94 KB

SECURITY_FIXES.md

File metadata and controls

281 lines (210 loc) · 6.94 KB
Raw

Security Fixes Applied

This document outlines all security vulnerabilities that have been identified and fixed in the IP Reputation Checker application.

Vulnerabilities Fixed

1. DOM-Based Cross-Site Scripting (XSS) - CRITICAL

Severity: HIGH
CWE: CWE-79, CWE-80

Issue: User input was directly interpolated into HTML using innerHTML without sanitization.

Before:

resultDiv.innerHTML = `<h3>Results for IP: ${ip}</h3>...`; // VULNERABLE

After:

const title = document.createElement('h3');
title.textContent = `Results for IP: ${ip}`; // SAFE
resultDiv.appendChild(title);

Impact: Prevents attackers from injecting arbitrary JavaScript code through the IP input field.

2. Hardcoded API Keys - CRITICAL

Severity: CRITICAL
CWE: CWE-798 (Use of Hard-Coded Credentials)

Issue: API keys were exposed in source code.

Before:

const abuseKey = "2e0272c72bbd67cb0180ad31a66d51966785338cc41e7434560c723b5e66622215525ca13c9896eb";
const virusKey = "bd159d67bed1d755c5ba6485660cb16dfd47d31235c092c50265804df800776b";

After:

const abuseKey = process.env.ABUSEIPDB_API_KEY;
const virusKey = process.env.VIRUSTOTAL_API_KEY;

Files Added:

  • .env - Contains actual API keys (DO NOT COMMIT)
  • .env.example - Template for environment variables
  • .gitignore - Prevents .env from being committed

Impact: API keys are no longer exposed in version control.

3. Missing Security Headers - HIGH

Severity: HIGH

Headers Added via Helmet:

Header Value Purpose
Content-Security-Policy Restrictive Prevents unauthorized script execution
X-Content-Type-Options nosniff Prevents MIME sniffing attacks
X-Frame-Options DENY Prevents clickjacking (XSS variant)
X-XSS-Protection 1; mode=block Legacy XSS protection
Strict-Transport-Security max-age=31536000 Enforces HTTPS
Referrer-Policy strict-origin-when-cross-origin Limits referrer information

Impact: Provides defense-in-depth against various attack vectors.

4. No Rate Limiting - MEDIUM

Severity: MEDIUM
CWE: CWE-770 (Allocation of Resources Without Limits)

Issue: API endpoints were vulnerable to brute force and DoS attacks.

Implemented:

const limiter = rateLimit({
    windowMs: 15 * 60 * 1000,  // 15 minutes
    max: 100,                    // 100 requests per window
});

const apiLimiter = rateLimit({
    windowMs: 1 * 60 * 1000,     // 1 minute
    max: 10,                      // 10 requests per minute
});

Impact: Protects against brute force and DoS attacks.

5. Overly Permissive CORS - MEDIUM

Severity: MEDIUM
CWE: CWE-346 (Origin Validation Error)

Before:

app.use(cors()); // Allows requests from ANY origin

After:

const corsOptions = {
    origin: ["http://localhost:3000", "http://localhost:5000"],
    credentials: true,
    optionsSuccessStatus: 200,
};
app.use(cors(corsOptions));

Impact: Restricts API access to trusted origins only.

6. Insufficient Input Validation - MEDIUM

Severity: MEDIUM

Added Validations:

Server-side:

  • IPv4 and IPv6 format validation
  • IP address length validation (max 45 characters)
  • Proper URL encoding of parameters
  • API key existence check

Client-side:

  • IP address format validation (IPv4/IPv6)
  • Length validation
  • User-friendly error messages

Impact: Prevents malformed requests and reduces attack surface.

7. Information Disclosure - MEDIUM

Severity: MEDIUM
CWE: CWE-209 (Information Exposure Through an Error Message)

Issue: Error messages exposed internal system details.

Before:

res.status(500).json({ 
    error: "Error fetching data from AbuseIPDB", 
    details: error.message  // Exposes internal error
});

After:

const sanitizeError = (error) => {
    return { error: "An error occurred while processing your request. Please try again." };
};
res.status(500).json(sanitizeError(error));

Impact: Prevents information leakage to potential attackers.

8. No Network Request Timeout - MEDIUM

Severity: MEDIUM
CWE: CWE-754 (Improper Exception Handling)

Added:

const response = await fetch(url, {
    timeout: 5000  // 5 second timeout
});

Impact: Prevents hanging requests and resource exhaustion.

Setup Instructions

1. Install Dependencies

npm install

2. Configure Environment Variables

cp .env.example .env

Edit .env and add your actual API keys:

ABUSEIPDB_API_KEY=your_key_here
VIRUSTOTAL_API_KEY=your_key_here
PORT=3000
NODE_ENV=production

3. Start the Server

npm start

4. Run in Production

NODE_ENV=production npm start

Testing Security Fixes

Test XSS Prevention

  1. Navigate to http://localhost:3000/abuse.html
  2. In the IP input field, enter: "><img src=x onerror=alert('XSS')>
  3. Click "Check IP"
  4. ✅ Expected: The text is displayed as plain text, no alert appears

Test Input Validation

  1. Enter invalid IP: 999.999.999.999
  2. ✅ Expected: Error message "Invalid IP address format"

Test Rate Limiting

  1. Send 11 API requests within 1 minute
  2. ✅ Expected: 11th request receives 429 Too Many Requests error

Test Security Headers

curl -I http://localhost:3000

✅ Expected: See all security headers in response

Security Best Practices

For Deployment:

  1. Set NODE_ENV=production
  2. Use HTTPS (configure reverse proxy or use environment variable)
  3. Store .env file securely (outside version control)
  4. Rotate API keys regularly
  5. Implement additional authentication if needed
  6. Use a Web Application Firewall (WAF)
  7. Regular security audits and penetration testing

Dependencies Used:

  • helmet - Security headers
  • express-rate-limit - Rate limiting
  • dotenv - Environment variable management
  • cors - CORS management

Files Modified

  • ✅ server.js - Added security middleware and validation
  • ✅ package.json - Added security dependencies
  • ✅ public/abuse.html - XSS prevention + input validation
  • ✅ public/virus.html - XSS prevention + input validation
  • ✅ abuse.html - XSS prevention + input validation
  • ✅ virus.html - XSS prevention + input validation
  • ✅ .env.example - Environment variable template
  • ✅ .env - Environment variables
  • ✅ .gitignore - Prevent accidental commits of sensitive files

References

Release: 2.0.1 (bugfix)
Last Updated: April 17, 2026
Status: All vulnerabilities patched and tested