FUSE: Finding File Upload Bugs via Penetration Testing Taekjin Lee, - - PowerPoint PPT Presentation

▶
fuse finding file upload bugs via penetration testing
SMART_READER_LITE
LIVE PREVIEW

FUSE: Finding File Upload Bugs via Penetration Testing Taekjin Lee, - - PowerPoint PPT Presentation

Jul 24, 2023 378 likes •999 views

FUSE: Finding File Upload Bugs via Penetration Testing Taekjin Lee, Seongil Wi , Suyoung Lee, Sooel Son KAIST Upload Functionality Sharing user-provided content has become a de facto standard feature of modern web applications 2 File

slide-1
SLIDE 1

FUSE: Finding File Upload Bugs via Penetration Testing

Taekjin Lee, Seongil Wi, Suyoung Lee, Sooel Son KAIST

slide-2
SLIDE 2

Upload Functionality

  • Sharing user-provided content has become a de facto

standard feature of modern web applications

2

slide-3
SLIDE 3

File Uploading Procedure

3

NDSS.png Upload request PHP interpreter File Web application

Web server

NDSS.png Content-filtering checks [HTTP(S) POST]

Disable uploading specified file types

Extractor User A

slide-4
SLIDE 4

File Uploading Procedure

4

User B Access

https://wsplab.com/NDSS.png

Download

https://wsplab.com/NDSS.png

User A NDSS.png Upload request PHP interpreter File Web application

Web server

NDSS.png Extractor Content-filtering checks

slide-5
SLIDE 5

Disable Uploading Malicious Files

5

Attacker Upload request

5

PHP interpreter File Web application

Web server

Extractor Content-filtering checks Discard webshell.php

webshell.php <?php system(‘ls’); ?>

slide-6
SLIDE 6

6

<?php $black_list = array(‘js’,‘php’,‘html’,...) if (!in_array(ext($file_name), $black_list)) { move($file_name, $upload_path); } else { message('Error: forbidden file type'); } ?>

Content-filtering checks

php

Content-filtering Checks

webshell.php <?php system(‘ls’); ?> PHP interpreter Error: forbidden file type

slide-7
SLIDE 7

File Upload Vulnerabilities - Server Side

7

Attacker Upload request

7

PHP interpreter File Web application

Web server

Extractor Content-filtering checks

webshell.php <?php system(‘ls’); ?> webshell.php <?php system(‘ls’); ?>

What will be happening?

Discard webshell.php

Potential code execution Unrestricted File Upload (UFU)

slide-8
SLIDE 8

File Upload Vulnerabilities - Server Side

8

PHP interpreter File Web application

Web server

Extractor Content-filtering checks

webshell.php <?php system(‘ls’); ?>

Potential code execution Unrestricted File Upload (UFU)

Attacker Access

https://wsplab.com/webshell.php

Arbitrary code execution via a URL Unrestricted Executable File Upload (UEFU)

slide-9
SLIDE 9

File Upload Vulnerabilities - Client Side

9

PHP interpreter File Web application

Web server

Extractor Content-filtering checks

xss.html <html> <script> alert(‘xss’); </script> </html> <html> <script> alert(‘xss’); </script> </html> xss.html

Victim Access

https://wsplab.com/xss.html

https://wsplab.com/xss.html

Attacker Upload request

Arbitrary code execution via a URL Unrestricted Executable File Upload (UEFU) Unrestricted File Upload (UFU)

slide-10
SLIDE 10

How to Find UEFU Vulnerabilities?

10

Attacker Upload request

10

PHP interpreter File Web application

Web server

Extractor Content-filtering checks

#1: Bypassing application-specific checks

Executable

slide-11
SLIDE 11

How to Find UEFU Vulnerabilities?

11

Attacker Upload request

11

PHP interpreter File Web application

Web server

Extractor Content-filtering checks

#1: Bypassing application-specific checks

Executable

Victim

https://wsplab.com/Executable

#2: Preserving the execution semantic

slide-12
SLIDE 12

#2: Preserving the Execution Semantic

12

Attacker Upload request

12

PHP interpreter File Web application

Web server

Extractor Content-filtering checks

webshell.foo <?php system(‘ls’); ?> webshell.foo <?php system(‘ls’); ?>

php → foo

#1: Bypassing application-specific checks

slide-13
SLIDE 13

#2: Preserving the Execution Semantic

13 13

PHP interpreter File Web application

Web server

Extractor Content-filtering checks

webshell.foo <?php system(‘ls’); ?>

Potential code execution

#1: Bypassing application-specific checks

13

Attacker Access

https://wsplab.com/webshell.foo

A web server does not execute webshell.foo (Not a php-style extension) #2: Preserving the execution semantic

slide-14
SLIDE 14

Summary

14

Attacker Upload request

14

PHP interpreter File Web application

Web server

Extractor Content-filtering checks

#1: Bypassing application-specific checks

Executable

Victim

https://wsplab.com/Executable

#2: Preserving the execution semantic

slide-15
SLIDE 15

Previous Studies

  • Static analysis

− Pixy, Oakland ’06 − Merlin, PLDI ’09

  • Dynamic analysis

− Saner, Oakland ’08 − Riding out DOMsday, NDSS ’18

  • Symbolic execution

− NAVEX, USENIX ’18 − SAFERPHP, PLAS ’11

15

Few studies have addressed finding U(E)FU vulnerabilities!

slide-16
SLIDE 16

16

How we address all the challenges?

slide-17
SLIDE 17

17

We propose

FUSE

slide-18
SLIDE 18

Our Approach

18 18

PHP interpreter File Web application

Web server

Extractor Content-filtering checks Initial upload request

FUSE

Rejected

slide-19
SLIDE 19

Our Approach - Mutate Upload Request

19 19

PHP interpreter File Web application

Web server

Extractor Content-filtering checks

FUSE

Rejected Mutated upload request UEFU vulnerability

slide-20
SLIDE 20

Our Approach

20 20

PHP interpreter File Web application

Web server

Extractor Content-filtering checks Initial upload request

FUSE

Executable

#1: Bypassing application-specific checks #2: Preserving the execution semantic

Victim

https://wsplab.com/Executable

Investigate root causes

  • f U(E)FU bugs

Analyze web servers and browsers

slide-21
SLIDE 21

Our Approach

21 21

PHP interpreter File Web application

Web server

Extractor Content-filtering checks Initial upload request

FUSE

Executable

Victim

https://wsplab.com/Executable

Analyze web servers and browsers Investigate root causes

  • f U(E)FU bugs

Analyze web servers and browsers

Web server

slide-22
SLIDE 22

Mutate Upload Request

22 22

Initial upload request

FUSE

Investigate root causes

  • f U(E)FU bugs

Analyze web servers and browsers

Web server

Design 13 mutation operations

Mutate

slide-23
SLIDE 23

Our Goal: Finding U(E)FU Bugs

23

Uploader

Mutated upload request

Mutator

slide-24
SLIDE 24

Our Goal: Finding U(E)FU Bugs

24

Uploader

UFU and UEFU vulnerabilities

Mutated upload request Upload information

Mutator Validator

slide-25
SLIDE 25

Upload Request

25

FUSE

Web server

filename content-type content

Upload request

slide-26
SLIDE 26

Upload Request

26

xss.html

<html> <script> alert(‘xss’); </script> </html> Upload request

filename content-type content

xss.html <html><script>al ert(‘xss’)</scri pt></html> text/html

slide-27
SLIDE 27

Mutation Objectives

27

if (finfo_file(content) not in expected_type) reject(file); if (ext(file_name) not in expected_ext) reject(file); if (expected_keyword in content) reject(file); if (content_type not in expected_type) reject(file); accept(file)

Content-filtering checks Five objectives that trigger common mistakes in implementing checks

filename content-type content

xss.html <html><script>al ert(‘xss’)</scri pt></html> text/html Upload request

slide-28
SLIDE 28

if (finfo_file(content) == ‘text/html’) reject(file); if (ext(file_name) == ‘php’) reject(file); if (‘<?php’ in content) reject(file); if (content_type == ‘text/html’) reject(file); accept(file)

Content-filtering checks

Mutation Objectives #1

28

Exploiting the absence of content-filtering checks

No mutation

filename content-type content

xss.html <html><script>al ert(‘xss’)</scri pt></html> text/html Upload request

slide-29
SLIDE 29

if (finfo_file(content) == ‘text/html’) reject(file); if (ext(file_name) == ‘php’) reject(file); if (‘<?php’ in content) reject(file); if (content_type == ‘text/html’) reject(file); accept(file)

Content-filtering checks

Mutation Objectives #2

29

Causing incorrect type inferences based on content

M1: Prepending a resource header

‘image/png’

filename content-type content

xss.html <html><script>al ert(‘xss’)</scri pt></html> text/html \x89\x50\x4e\x47 \x0d\x0a\x1a... <html><script>al ert(‘xss’)</scri pt></html>

PNG header

Upload request

slide-30
SLIDE 30

webshell.php webshell.php5

application/x-php

if (finfo_file(content) == ‘text/html’) reject(file); if (ext(file_name) == ‘php’) reject(file); if (‘<?php’ in content) reject(file); if (content_type == ‘text/html’) reject(file); accept(file)

Mutation Objectives #3

30

Content-filtering checks

Exploiting incomplete blacklist based on extension

M4: Changing a file extension

‘php5’

filename content-type content

<?php system(‘ls’); ?> Upload request

slide-31
SLIDE 31

if (finfo_file(content) == ‘text/html’) reject(file); if (ext(file_name) == ‘php’) reject(file); if (‘<?php’ in content) reject(file); if (content_type == ‘text/html’) reject(file); accept(file)

Mutation Objectives #4

31

Content-filtering checks

Bypassing keyword checks based on content

M5: Replace PHP tags with short tags

‘<?’

application/x-php filename content-type content

webshell.php <?php system(‘ls’); ?> <? system(‘ls’); ?> Upload request

slide-32
SLIDE 32

Mutation Objectives #5

32

if (finfo_file(content) == ‘text/html’) reject(file); if (ext(file_name) == ‘php’) reject(file); if (‘<?php’ in content) reject(file); if (content_type == ‘text/html’) reject(file); accept(file)

Content-filtering checks

Bypassing filtering logic based on content-type

M3: Changing the content-type of an upload request

‘image/png’

filename content-type content

xss.html <html><script>al ert(‘xss’)</scri pt></html> text/html image/png Upload request

slide-33
SLIDE 33

Combinations of Mutation Operations

33

if (finfo_file(content) == ‘text/html’) reject(file); if (ext(file_name) == ‘php’) reject(file); if (‘<?php’ in content) reject(file); if (content_type == ‘text/html’) reject(file); accept(file)

Content-filtering checks

co

filename content-type content

xss.html <html><script>al ert(‘xss’)</scri pt></html> text/html \x89\x50\x4e\x47 \x0d\x0a\x1a... <html><script>al ert(‘xss’)</scri pt></html>

+

image/png

‘image/png’ ‘image/png’

M1: Prepending a resource header M3: Changing the content-type of an upload request Upload request

slide-34
SLIDE 34

More in the Paper

  • M2: Inserting a seed into metadata
  • M6: Converting HTML into EML
  • M7: Removing a file extension
  • M8: Converting a file in SVG
  • M9: Prepending an HTML comment
  • M10: Changing a file extension to an arbitrary string
  • M11: Converting a file extension to uppercase
  • M12: Prepending a file extension
  • M13: Appending a resource header

34

slide-35
SLIDE 35

Evaluation

35

Uploader

UFU and UEFU vulnerabilities

Mutated upload request Upload information

Mutator Validator

slide-36
SLIDE 36

Experimental Setup

  • 33 popular PHP web applications
  • Web server: Apache 2.4
  • PHP engine: PHP 5.6, 7.0, 7.1

36

WordPress Joomla Concrete5 OsCommerce2 Monstra Drupal ZenCart Bludit Textpattern CMSMadeSimple Pagekit Backdrop CMSimple Composr OctoberCMS phpBB3 Elgg Microweber XE SilverStripe ECCube3 GetSimpleCMS DotPlant2 MyBB HotCRP Subrion SymphonyCMS AnchorCMS WeBid Collabtive X2engine ClipperCMS Codiad

slide-37
SLIDE 37

Real-World UEFU Finding

  • Found 30 UEFU vulnerabilities in 23 applications with 176

distinct upload request −WordPress, Concrete5, OsCommerce2, ZenCart, …

  • Reported all the vulnerabilities

−15 CVEs from 9 applications

  • 8 bugs have been patched
  • 5 bugs are being patched

37

slide-38
SLIDE 38

<?php system(‘ls’); ?>

Case Study - Microweber

38

if (finfo_file(content) == ‘application/x-php’) reject(file); if (ext(file_name) == ‘php’) reject(file); if (‘<?php’ in content) reject(file); if (content_type == ‘text/html’) reject(file); accept(file)

Content-filtering checks

co

M13: Appending a resource header + M4: Changing a file extension

application/x-php filename content-type content

webshell.php <?php system(‘ls’); ?> \xff\xd8\xff\xee \x00\x10JF webshell.pht

‘application/octet-stream’ ‘pht’

8 bytes header

  • f a JPG file

Upload request

slide-39
SLIDE 39
  • vs. State-of-the-Arts
  • Fuxploider: open-source upload vulnerability scanning tool
  • UploadScanner: an extension for Burp Suit Pro, a commercial

platform for web application security testing

  • Ran on the same benchmarks and counted vulnerabilities

39

Vulnerability (Seed) FUSE Fuxploider UploadScanner UEFU (PHP) 12 7 5 UEFU (HTML) 23 N/A 14 UFU (JS) 26 N/A 21

slide-40
SLIDE 40

Why FUSE found more bug than the others?

40

Vulnerability (Seed) FUSE Fuxploider UploadScanner UEFU (PHP) 12 7 5 UEFU (HTML) 23 N/A 14 UFU (JS) 26 N/A 21

  • Better extension coverage (pht, php7, …)
  • Better mutation operation coverage
  • M9: Prepending an HTML comment
  • M13: Appending a resource header
  • Combination: M4+M13
  • …
  • Implementational Issues
  • Retrieving URLs
slide-41
SLIDE 41

Vulnerability Causes

41

Causes Description UFU + UEFU Bugs Found #1 Exploiting the absence of checks 27 #2 Causing incorrect type inferences based on content 5 #3 Exploiting incomplete blacklist based on extension 35 #4 Bypassing keyword checks based on content 6 #5 Bypassing checks based on content-type 5 #2+#3 Combined Operation 6 #2+#3+#4 Combined Operation 1 Inferring upload file types based on user-provided extensions opens a door for further attacks

slide-42
SLIDE 42

Limitation

  • There may exist other mutation operations that we didn’t

consider

  • Manually examined the execution constraints of browsers and

PHP interpreters

42

slide-43
SLIDE 43

Conclusion

  • Propose FUSE, a penetration testing tool designed to find

U(E)FU vulnerabilities

  • Present 13 operations that mutate upload request to bypass

content-filtering checks, but to remain executable in target execution environments

  • Found 30 UEFU vulnerabilities including 15 CVEs from 33 PHP

applications

43

slide-44
SLIDE 44

Open Science

44

https://github.com/WSP-LAB/FUSE

slide-45
SLIDE 45

45

Question?

slide-46
SLIDE 46

Previous Work: UChecker, DSN ’2019

46

Attacker Upload request

46

PHP interpreter File Web application

Web server

Extractor Content-filtering checks

Conducting symbolic execution

Executable PHP

slide-47
SLIDE 47

Previous Work: UChecker, DSN ’2019

47

Attacker Upload request

47

PHP interpreter File Web application

Web server

Extractor Content-filtering checks

Executable PHP

#1: Bypassing application-specific checks

#2: Preserving the execution semantic Reachability constraint Extension constraint

slide-48
SLIDE 48

Challenges in UChecker

48

Attacker Upload request

48

PHP interpreter File Web application

Web server

Extractor Content-filtering checks

Executable PHP

Reachability constraint Extension constraint Require deep understanding Limited search space

Found only 3 bugs from 9,160 WordPress plugins

slide-49
SLIDE 49

Seed Files

  • We selected these file types because they are directly involved

in code executions (CEs) or potential code executions (PCEs) in Web execution environments.

49

slide-50
SLIDE 50

Why XHTML Seed File?

  • More structural
  • More strict for grammar – Mutation is different
  • MIME type is different with html

50

slide-51
SLIDE 51
  • vs. State-of-the-Arts
  • First attempts to find UEFU vulnerabilities by leveraging

penetration testing

  • Baseline for further research
  • More comprehensive mutation operation
  • M5: Replacing PHP tags with short tags
  • M7: Removing a file extension
  • M9: Prepending an HTML comment
  • M10: Changing a file extension to an arbitrary string
  • M13: Appending a resource header
  • Comprehensive combination of mutation operation
  • File monitoring system

51

slide-52
SLIDE 52
  • vs. Symbolic Execution
  • Modeling the relationships of the symbol for various PHP built-in

function is different

  • Hard to pinpoint reachable sink from the source
  • Path explosion
  • Penetration testing is more efficient

52

slide-53
SLIDE 53

Admin Required

  • Among the 30 UEFU vulnerabilities, 14 bugs required an

administrator-level privilege for their exploitation

  • Web hosting administrator often separates application

administrators from the host management

  • CSRF…,

53

slide-54
SLIDE 54

Execution Constraints

  • We manually analyzed the source code of Chrome 74, Firefox

68, eight different versions of Apache mod_php modules, and PHP 5.6 interpreter engines

54

slide-55
SLIDE 55

Execution Constraints

  • A PHP interpreter executes a PHP file that contains the PHP

start tag (i.e., <?php or <?)

  • An Apache mod_php module requires an executable PHP file to

have one of the seven PHP-style file extensions (e.g., php3, phar) for its execution via direct URL invocations

  • In the Chrome and Firefox browsers, we also identified that an

executable HTML file must start with pre-defined start tags within its first 512 bytes with subsequent valid HTML code

  • An executable XHTML file shares the same constraints as the

HTML case but requires the presence of xmlns tags

  • …

55

slide-56
SLIDE 56

56

slide-57
SLIDE 57

Chain Length

57

slide-58
SLIDE 58

CVEs

58

slide-59
SLIDE 59

Mutation Conflicts

  • For a given operation (M1), we defined a conflicting mutation

(M2) as when

  • 1. both M1 and M2 revise the same portion of a mutation

vector, or

  • 2. M1 combined with M2 causes a CE failure, thus rendering

M2 unnecessary.

59

slide-60
SLIDE 60

60

slide-61
SLIDE 61

How Validator Works?

  • 1. Check uploading
  • 2. Extract URL

− Common prefix of URLs − Upload response and summary webpage − File Monitor

  • 3. Validate Bugs

− PHP: Sting checking − HTML, JS, XHTML: Checks whether the Content-Type header in the response is among our selections of 10 MIME types

61