mark-j / dapper-identity

ASP.NET Core Identity with Dapper instead of Entity Framework

dapper-identity

This sample application demonstrates how to use ASP.NET Core Identity with your own code instead of Entity Framework to handle data storage.

Dapper

I used Dapper, the super lightweight micro-ORM from the brilliant folks at Stack Exchange, to access the underlying database.

But you can easily replace that with your own code if you'd rather use ADO.NET or any other data access mechanism.

More Information

Take a look at this blog post for more detailed infomation on using ASP.NET Core Identity without Entity Framework.

License

MIT License

Copyright (c) 2017 Mark Johnson

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

dapper-identity's Issues

Potential Security Vulnerabilities

While it is obvious that this is a demo project for https://markjohnson.io/articles/asp-net-core-identity-without-entity-framework/ it is quite popular and may be used as a template for a real project.

Summary

dapper-identity is vulnerable to Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) that may lead to the elevation of privileges and per-user denial of service (DoS).

Details

Issue 1: XSS (CVE-2018-0784)

The application doesn't have the fix for CVE-2018-0784 that was found in ASP.NET Core templates. It is vulnerable to XSS if the logged-in user is tricked into clicking a malicious link like https://localhost:44315/manage/EnableAuthenticator?AuthenticatorUri=%22%3E%3C/div%3E%00%00%00%00%00%00%00%3Cscript%3Ealert(%22XSS%22)%3C/script%3E and enters an invalid verification code. Mode details are available in the blog post.

Impact

This issue may lead to the elevation of privileges.

Remediation

Modify the code according to the instructions from the advisory.

Issue 2: CSRF (CVE-2018-0785)

The application doesn't have the fix for CVE-2018-0785 that was found in ASP.NET Core templates. It is vulnerable to CSRF. A logged-in user with enabled Second Factor Authentication (2FA) may lose their recovery codes if they are tricked into clicking a link like https://localhost:44315/manage/GenerateRecoveryCodes or visit a malicious site that makes the request without the user's consent. As a result the user may be permanently locked out of their account after loosing access to their 2FA device, as the initial recovery codes would no longer be valid.

Impact

This issue may lead to the per-user DoS.

Remediation

Modify the code according to the instructions from the advisory.

ASP.Net 2.1 Breaks Roles

It appears that roles are no longer populated as of ASP.Net Core 2.1.

Security contact?

Hi, how could I report a potential security vulnerability in the project?

Upgrade to ASP.NET Core 2.1

Would anyone be able to update the project to the latest asp.net core 2.1?

UserStore bug

This doesn't look right:

UserStore.cs

                if (!roleId.HasValue)
                    roleId = await connection.ExecuteAsync($"INSERT INTO [ApplicationRole]([Name], [NormalizedName]) VALUES(@{nameof(roleName)}, @{nameof(normalizedName)})",
                        new { roleName, normalizedName });

This will return the number of affected records.

You should use an output param with the newly inserted id instead.