Top Overlooked Security Threats to Node.js Web Applications

JavaScript Summit 2014 (http://environmentsforhumans.com/2014/javascript-summit/)
Fluent Conference 2014 (http://fluentconf.com/fluent2014/public/schedule/detail/32664)

Transcript

1. JavaScript Summit 2014 November 20, 2014 Battling Top Overlooked Security Threats to Node.js Web Applications Chetan Karande, Omgeo, OWASP Twitter: karande_c GitHub: ckarande
2. Overview 1.  Fortify Our Defenses Addressing Overlooked Environment Configuration Issues 2.  Engage in Warfare Mitigating Overlooked Security Attacks PAGE 2 of 70
3. PAGE 3 of 70 Know thy self, know thy enemy. A thousand battles, a thousand victories. - Sun Tzu, The Art of War
4. Quiz Identify the weakest area in a web application, where an attacker is most likely to find vulnerabilities? A.  Data Encryption B.  Environment Configuration C.  Input Validation D.  Error Handling PAGE 4 of 70
5. PAGE 5 of 70 Source: HP 2013 cyber risk report Year 2013 Vulnerabilities Sampling by Category
6. PAGE 6 of 70 1.  Fortify Our Defenses Addressing Overlooked Environment Configuration Issues
7. PAGE 7 of 70 FORTIFY OUR DEFENSES Addressing Overlooked Environment Configuration Issues Preventing Internal Implementation Disclosure
8.   The X-Powered-By header can be extremely useful to an attacker for building site’s risk profile. PAGE 8 of 70 PREVENTING INTERNAL IMPLEMENTATION DISCLOSURE HTTP Response Headers
9.   X-Powered-By header has no functional value. It can be removed safely. var express = require("express"); var app = express(); … app.disable("x-powered-by"); PAGE 9 of 70 PREVENTING INTERNAL IMPLEMENTATION DISCLOSURE server.js
10.   Other ways to remove X-Powered-By – … app.use(helmet.hidePoweredBy()); PAGE 10 of 70 PREVENTING INTERNAL IMPLEMENTATION DISCLOSURE server.js
11.   Other ways to remove X-Powered-By – … app.use(helmet.hidePoweredBy({ setTo: "PHP 4.2.0" })); PAGE 11 of 70 PREVENTING INTERNAL IMPLEMENTATION DISCLOSURE server.js
12.   Another source of implementation disclosure - default session cookie name PAGE 12 of 70 PREVENTING INTERNAL IMPLEMENTATION DISCLOSURE HTTP Response Headers
13.   Use generic cookie names var session = require("express-session"); app.use(session({ secret: "s3Cur3", key: "sessionId", … })); PAGE 13 of 70 PREVENTING INTERNAL IMPLEMENTATION DISCLOSURE server.js
14. PAGE 14 of 70 Configuring Protection against CSRF FORTIFY OUR DEFENSES Addressing Overlooked Environment Configuration Issues
15. var csrf= require("csurf"); app.use(csrf()); PAGE 15 of 70 CONFIGURING CSRF PROTECTION   Enable CSRF Protection server.js
16. var csrf= require("csurf"); app.use(csrf()); … app.use(function(req, res, next) { res.locals.csrftoken = req.csrfToken(); next(); }); PAGE 16 of 70   Enable CSRF Protection server.js CONFIGURING CSRF PROTECTION
17. var csrf= require("csurf"); app.use(csrf()); … app.use(function(req, res, next) { res.locals.csrftoken = req.csrfToken(); next(); }); PAGE 17 of 70   Enable CSRF Protection server.js … <input type="hidden" name="_csrf" value="{{csrftoken}}"> Form Template CONFIGURING CSRF PROTECTION
18.   Express CSRF middleware ignores verifying tokens on HTTP GET, OPTIONS, and HEAD requests (which is a correct behavior)   Ensure GET APIs are coded not to mutate states. PAGE 18 of 70 CONFIGURING CSRF PROTECTION
19. var methodOverride = require("method-override"); var csrf= require("csurf"); app.use(methodOverride("X-HTTP-Method-Override")); app.use(csrf()); PAGE 19 of 70   Use method-override module before CSRF server.js CONFIGURING CSRF PROTECTION
20. PAGE 20 of 70 Using Secure Version of Software Dependencies FORTIFY OUR DEFENSES Addressing Overlooked Environment Configuration Issues
21.   Use the latest stable version of Node.js and frameworks. Node.js security vulnerabilities Express security updates PAGE 21 of 70 USING SECURE DEPENDENCIES
22.   Stay up to date on npm module versions and known vulnerbailities   Useful tools: npm outdated Node Security Project Retire.js PAGE 22 of 70 USING SECURE DEPENDENCIES
23. PAGE 23 of 70 2. Engaging in Warfare Mitigating Overlooked Security Attacks
24. Cross Site Scripting (XSS) Attack PAGE 24 of 70 ENGAGE IN WARFARE Mitigating Overlooked Security Attacks
25. An attacker can exploit XSS vulnerability to -   Steal session cookies, and then impersonate the user.   Redirect user to malicious sites. PAGE 25 of 70 XSS
26.   Myth: Template libraries handle output encoding by default, making application safe against XSS attacks XSS PAGE 26 of 70 XSS
27.   Myth: Template libraries handle output encoding by default, making application safe against XSS attacks XSS PAGE 27 of 70   Encode untrusted data for correct context depending on where it will be placed XSS
28. <div> </div>   Encode for HTML Body Untrusted Data & à &amp; < à &lt; > à &gt; " à &quot; ' à &#x27; / à &#x2F; PAGE 28 of 70 XSS
29. <input type="text" name="firstname" value=" ">   Encode for HTML Attributes Untrusted Data Non-alphanumeric characters à &#xHH; format Enclose attribute value in quotes PAGE 29 of 70 XSS
30. <div style="width= ;">contents</div>   Encode for CSS Untrusted Data Untrusted data à CSS Hex Encoding (\HH or \HHHHHH) XSS PAGE 30 of 70 XSS
31. <script> var firstName=" "; </script>   Encode for JavaScript Untrusted Data Non-alphanumeric characters à \uXXXX; unicode format PAGE 31 of 70 XSS
32.   Encode for URL Untrusted data à encodeURI() <a href=" ">Show Details</a> Untrusted Data PAGE 32 of 70 XSS
33. PAGE 33 of 70   Encode for URL Parameter Untrusted data à encodeURIComponent() <a href="/account?id= ">Show Details</a> Untrusted Data XSS
34. PAGE 34 of 70 <a href="/reviews# ">Movie Reviews</a> Untrusted Data <script> document.write("<h1>"+ document.location.hash +"</h1>"); </script>   DOM Based XSS: Encode on both server and client XSS
35. PAGE 35 of 70   Use proven utilities for encoding (e.g. OWASP ESAPI) XSS
36.   Add HTTPOnly, Secure attributes on Session Cookie var session = require("express-session"); app.use(session({ secret: "s3Cur3", key: "sessionId", cookie: { httpOnly: true, secure: true } })); server.js PAGE 36 of 70 XSS
37.   Add Content Security Policy header var policy = { defaultPolicy: { "default-src": ["'self'"], "img-src": ["static.example.com"] } } helmet.csp.policy(policy); server.js PAGE 37 of 70 XSS
38. Regular Expression Denial of Service (ReDoS) Attack PAGE 38 of 70 ENGAGE IN WARFARE Mitigating Overlooked Security Attacks
39.   Evil regex can take exponential execution time when applied to certain non-matching inputs. PAGE 39 of 70 REGULAR EXPRESSION DENIAL OF SERVICE (ReDoS)
40.   Evil regex can take exponential execution time when applied to certain non-matching inputs.   By default, regex gets executed in event loop thread, so could be exploited for DoS attack. PAGE 40 of 70 REGULAR EXPRESSION DENIAL OF SERVICE (ReDoS)
41.   Evil regex pattern requirements: ( )+ 1.  Grouping with repetition, and 2.  Inside repeated group, repeatation or alternation with operlapping PAGE 41 of 70 REGULAR EXPRESSION DENIAL OF SERVICE (ReDoS)
42.   Evil regex pattern requirements: ( a+ )+ 1.  Grouping with repetition, and 2.  Inside repeated group, repeatation or alternation with operlapping PAGE 42 of 70 REGULAR EXPRESSION DENIAL OF SERVICE (ReDoS)
43.   Evil regex pattern requirements: ( a|aa )+ 1.  Grouping with repetition, and 2.  Inside repeated group, repeatation or alternation with overlapping PAGE 43 of 70 REGULAR EXPRESSION DENIAL OF SERVICE (ReDoS)
44. PAGE 44 of 70   Example: Commonly used URL validator regex /^(?!mailto:)(?:(?:https?|ftp):\/\/)?(?:\S+(?::\S*)?@)?(?:(?:(?:[1-9]\d?|1\d \d|2[01]\d|22[0-3])(?:\.(?:1?\d{1,2}|2[0-4]\d|25[0-5])){2}(?:\.(?: [0-9]\d?|1\d\d|2[0-4]\d|25[0-4]))|(?:(?:[a-z\u00a1- \uffff0-9]+-?)*[a-z\u00a1-\uffff0-9]+)(?:\.(?:[a-z\u00a1- \uffff0-9]+-?)*[a-z\u00a1-\uffff0-9]+)*(?:\.(?:[a-z\u00a1-\uffff]{2,})))| localhost)(?::\d{2,5})?(?:\/[^\s]*)?$/i Input pattern: aaaaaaaaaaaaaaaa! REGULAR EXPRESSION DENIAL OF SERVICE (ReDoS)
45. PAGE 45 of 70   Example: Commonly used URL validator regex # of Input Characters Execution Time 30 6 sec 35 3min 36 6 min 37 13 min 38 25 min 39 1hr 28 min 40 3 hr 46 min REGULAR EXPRESSION DENIAL OF SERVICE (ReDoS)
46.   Review regex in our own or external code for evil pattern Tools: RXRR, SDL Regex Fuzzer PAGE 46 of 70 REGULAR EXPRESSION DENIAL OF SERVICE (ReDoS)
47.   Review regex in our own or external code for evil pattern Tools: RXRR, SDL Regex Fuzzer   Do not use user supplied inputs as regex PAGE 47 of 70 REGULAR EXPRESSION DENIAL OF SERVICE (ReDoS)
48. HTTP Parameter Pollution (HPP) PAGE 48 of 70 ENGAGE IN WARFARE Mitigating Overlooked Security Attacks
49. // GET /search?firstname=John&firstname=John req.query.firstname //=> PAGE 49 of 70 HTTP PARAMETER POLLUTION Quiz
50. PAGE 50 of 70 HTTP PARAMETER POLLUTION // GET /search?firstname=John&firstname=John req.query.firstname //=> [“John”, “John”]
51. PAGE 51 of 70 HTTP PARAMETER POLLUTION // POST firstname=John&firstname=John
52. PAGE 52 of 70 HTTP PARAMETER POLLUTION // POST firstname=John&firstname=John req.body.firstname //=> [“John”, “John”]
53. PAGE 53 of 70 HTTP PARAMETER POLLUTION Express populates HTTP request parameters with same name in an array
54. PAGE 54 of 70 HTTP PARAMETER POLLUTION Express populates HTTP request parameters with same name in an array Attacker can intentionally pollute request parameters to exploit this mechanism
55. An attacker can exploit HPP to:   Trigger Type Errors in application PAGE 55 of 70 HTTP PARAMETER POLLUTION Server Console
56.   Any uncaught errors in async code could crash the HTTP server causing DoS. PAGE 56 of 70 HTTP PARAMETER POLLUTION
57. An attacker can exploit HPP to:   Modify application behavior PAGE 57 of 70 HTTP PARAMETER POLLUTION DB Shell
58. PAGE 58 of 70 An attacker can exploit HPP to:   Bypass input validations applied on strings in our own code, WAF, browser filters. HTTP PARAMETER POLLUTION
59. PAGE 59 of 70 An attacker can exploit HPP to:   Bypass input validations applied on strings in our own code, WAF, browser filters. HTTP PARAMETER POLLUTION
60.   Check expected type as part of the input validation PAGE 60 of 70 HTTP PARAMETER POLLUTION
61.   Check expected type as part of the input validation   Implement robust error handling mechanism using try/catch, domain, and cluster. PAGE 61 of 70 HTTP PARAMETER POLLUTION
62. OWASP Top 10 PAGE 62 of 70 ENGAGE IN WARFARE Mitigating Overlooked Security Attacks
63. PAGE 63 of 70   Educate developers about OWASP Top 10 Risks OWASP NODEGOAT
64. PAGE 64 of 70   Educate developers about OWASP Top 10 risks OWASP Node Goat Project OWASP NODEGOAT
65. PAGE 65 of 70 Quick Recap
66.   Remove X-Powered-By response header and use generic session cookie names   Keep watch on security vulnerabilities in dependencies PAGE 66 of 70 QUICK RECAP
67.   Ensure HTTP GET requests are idempotent   Include method-override module before any module that depends on method of the request PAGE 67 of 70 QUICK RECAP
68.   Encode for all contexts on both server and client to protect against XSS attack.   Use HTTPOnly and Secure attributes on session cookie, include CSP headers. PAGE 68 of 70 QUICK RECAP
69.   Review regex for evil pattern to mitigate ReDoS attack.   Verify input types as part of the validation PAGE 69 of 70 QUICK RECAP
70. May Victory Be Yours. Twitter:@ karande_c
71. Links HP 2013 cyber risk report (http://www8.hp.com/h20195/v2/GetPDF.aspx/4AA5-0858ENW.pdf) Node.js security vulnerabilities (http://blog.nodejs.org/vulnerability/) Express security updates (http://expressjs.com/advanced/security-updates.html) npm outdated (https://www.npmjs.org/doc/cli/npm-outdated.html) Node Security Project (https://nodesecurity.io/advisories) Retire.js(http://open.bekk.no/retire-js-what-you-require-you-must-also-retire) RXRR (http://www.cs.bham.ac.uk/~hxt/research/rxxr-download.shtml) SDL Regex Fuzzer (http://www.microsoft.com/en-us/download/details.aspx?id=20095) OWASP ESAPI (https://www.owasp.org/index.php/Category:OWASP _Enterprise_Security_API) OWASP Node Goat Project (https://www.owasp.org/index.php/Projects/OWASP _Node_js_Goat_Project)
72. Image Credits http://www.shutterstock.com/pic.mhtml?id=93406768 http://www.shutterstock.com/pic.mhtml?id=67916401 http://www.shutterstock.com/pic.mhtml?id=97398575 http://www.bigstockphoto.com/image-36498607 http://openclipart.org/detail/169260/medieval-cannon-by-helm42