Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Top Overlooked Security Threats to Node.js Web Applications

Top Overlooked Security Threats to Node.js Web Applications

Chetan Karande

November 20, 2014
Tweet

More Decks by Chetan Karande

Other Decks in Programming

Transcript

  1. JavaScript Summit 2014 November 20, 2014 Battling Top Overlooked Security

    Threats to Node.js Web Applications Chetan Karande, Omgeo, OWASP Twitter: karande_c GitHub: ckarande
  2. Overview 1.  Fortify Our Defenses Addressing Overlooked Environment Configuration Issues

    2.  Engage in Warfare Mitigating Overlooked Security Attacks PAGE 2 of 70
  3. PAGE 3 of 70 Know thy self, know thy enemy.

    A thousand battles, a thousand victories. - Sun Tzu, The Art of War
  4. Quiz Identify the weakest area in a web application, where

    an attacker is most likely to find vulnerabilities? A.  Data Encryption B.  Environment Configuration C.  Input Validation D.  Error Handling PAGE 4 of 70
  5. PAGE 5 of 70 Source: HP 2013 cyber risk report

    Year 2013 Vulnerabilities Sampling by Category
  6. PAGE 7 of 70 FORTIFY OUR DEFENSES Addressing Overlooked Environment

    Configuration Issues Preventing Internal Implementation Disclosure
  7.   The X-Powered-By header can be extremely useful to an

    attacker for building site’s risk profile. PAGE 8 of 70 PREVENTING INTERNAL IMPLEMENTATION DISCLOSURE HTTP Response Headers
  8.   X-Powered-By header has no functional value. It can be

    removed safely. var express = require("express"); var app = express(); … app.disable("x-powered-by"); PAGE 9 of 70 PREVENTING INTERNAL IMPLEMENTATION DISCLOSURE server.js
  9.   Other ways to remove X-Powered-By – … app.use(helmet.hidePoweredBy()); PAGE

    10 of 70 PREVENTING INTERNAL IMPLEMENTATION DISCLOSURE server.js
  10.   Other ways to remove X-Powered-By – … app.use(helmet.hidePoweredBy({ setTo:

    "PHP 4.2.0" })); PAGE 11 of 70 PREVENTING INTERNAL IMPLEMENTATION DISCLOSURE server.js
  11.   Another source of implementation disclosure - default session cookie

    name PAGE 12 of 70 PREVENTING INTERNAL IMPLEMENTATION DISCLOSURE HTTP Response Headers
  12.   Use generic cookie names var session = require("express-session"); app.use(session({

    secret: "s3Cur3", key: "sessionId", … })); PAGE 13 of 70 PREVENTING INTERNAL IMPLEMENTATION DISCLOSURE server.js
  13. PAGE 14 of 70 Configuring Protection against CSRF FORTIFY OUR

    DEFENSES Addressing Overlooked Environment Configuration Issues
  14. var csrf= require("csurf"); app.use(csrf()); PAGE 15 of 70 CONFIGURING CSRF

    PROTECTION   Enable CSRF Protection server.js
  15. var csrf= require("csurf"); app.use(csrf()); … app.use(function(req, res, next) { res.locals.csrftoken

    = req.csrfToken(); next(); }); PAGE 16 of 70   Enable CSRF Protection server.js CONFIGURING CSRF PROTECTION
  16. var csrf= require("csurf"); app.use(csrf()); … app.use(function(req, res, next) { res.locals.csrftoken

    = req.csrfToken(); next(); }); PAGE 17 of 70   Enable CSRF Protection server.js … <input type="hidden" name="_csrf" value="{{csrftoken}}"> Form Template CONFIGURING CSRF PROTECTION
  17.   Express CSRF middleware ignores verifying tokens on HTTP GET,

    OPTIONS, and HEAD requests (which is a correct behavior)   Ensure GET APIs are coded not to mutate states. PAGE 18 of 70 CONFIGURING CSRF PROTECTION
  18. PAGE 20 of 70 Using Secure Version of Software Dependencies

    FORTIFY OUR DEFENSES Addressing Overlooked Environment Configuration Issues
  19.   Use the latest stable version of Node.js and frameworks.

    Node.js security vulnerabilities Express security updates PAGE 21 of 70 USING SECURE DEPENDENCIES
  20.   Stay up to date on npm module versions and

    known vulnerbailities   Useful tools: npm outdated Node Security Project Retire.js PAGE 22 of 70 USING SECURE DEPENDENCIES
  21. Cross Site Scripting (XSS) Attack PAGE 24 of 70 ENGAGE

    IN WARFARE Mitigating Overlooked Security Attacks
  22. An attacker can exploit XSS vulnerability to -   Steal

    session cookies, and then impersonate the user.   Redirect user to malicious sites. PAGE 25 of 70 XSS
  23.   Myth: Template libraries handle output encoding by default, making

    application safe against XSS attacks XSS PAGE 26 of 70 XSS
  24.   Myth: Template libraries handle output encoding by default, making

    application safe against XSS attacks XSS PAGE 27 of 70   Encode untrusted data for correct context depending on where it will be placed XSS
  25. <div> </div>   Encode for HTML Body Untrusted Data &

    à &amp; < à &lt; > à &gt; " à &quot; ' à &#x27; / à &#x2F; PAGE 28 of 70 XSS
  26. <input type="text" name="firstname" value=" ">   Encode for HTML Attributes

    Untrusted Data Non-alphanumeric characters à &#xHH; format Enclose attribute value in quotes PAGE 29 of 70 XSS
  27. <div style="width= ;">contents</div>   Encode for CSS Untrusted Data Untrusted

    data à CSS Hex Encoding (\HH or \HHHHHH) XSS PAGE 30 of 70 XSS
  28. <script> var firstName=" "; </script>   Encode for JavaScript Untrusted

    Data Non-alphanumeric characters à \uXXXX; unicode format PAGE 31 of 70 XSS
  29.   Encode for URL Untrusted data à encodeURI() <a href="

    ">Show Details</a> Untrusted Data PAGE 32 of 70 XSS
  30. PAGE 33 of 70   Encode for URL Parameter Untrusted

    data à encodeURIComponent() <a href="/account?id= ">Show Details</a> Untrusted Data XSS
  31. PAGE 34 of 70 <a href="/reviews# ">Movie Reviews</a> Untrusted Data

    <script> document.write("<h1>"+ document.location.hash +"</h1>"); </script>   DOM Based XSS: Encode on both server and client XSS
  32.   Add HTTPOnly, Secure attributes on Session Cookie var session

    = require("express-session"); app.use(session({ secret: "s3Cur3", key: "sessionId", cookie: { httpOnly: true, secure: true } })); server.js PAGE 36 of 70 XSS
  33.   Add Content Security Policy header var policy = {

    defaultPolicy: { "default-src": ["'self'"], "img-src": ["static.example.com"] } } helmet.csp.policy(policy); server.js PAGE 37 of 70 XSS
  34. Regular Expression Denial of Service (ReDoS) Attack PAGE 38 of

    70 ENGAGE IN WARFARE Mitigating Overlooked Security Attacks
  35.   Evil regex can take exponential execution time when applied

    to certain non-matching inputs. PAGE 39 of 70 REGULAR EXPRESSION DENIAL OF SERVICE (ReDoS)
  36.   Evil regex can take exponential execution time when applied

    to certain non-matching inputs.   By default, regex gets executed in event loop thread, so could be exploited for DoS attack. PAGE 40 of 70 REGULAR EXPRESSION DENIAL OF SERVICE (ReDoS)
  37.   Evil regex pattern requirements: ( )+ 1.  Grouping with

    repetition, and 2.  Inside repeated group, repeatation or alternation with operlapping PAGE 41 of 70 REGULAR EXPRESSION DENIAL OF SERVICE (ReDoS)
  38.   Evil regex pattern requirements: ( a+ )+ 1.  Grouping

    with repetition, and 2.  Inside repeated group, repeatation or alternation with operlapping PAGE 42 of 70 REGULAR EXPRESSION DENIAL OF SERVICE (ReDoS)
  39.   Evil regex pattern requirements: ( a|aa )+ 1.  Grouping

    with repetition, and 2.  Inside repeated group, repeatation or alternation with overlapping PAGE 43 of 70 REGULAR EXPRESSION DENIAL OF SERVICE (ReDoS)
  40. PAGE 44 of 70   Example: Commonly used URL validator

    regex /^(?!mailto:)(?:(?:https?|ftp):\/\/)?(?:\S+(?::\S*)?@)?(?:(?:(?:[1-9]\d?|1\d \d|2[01]\d|22[0-3])(?:\.(?:1?\d{1,2}|2[0-4]\d|25[0-5])){2}(?:\.(?: [0-9]\d?|1\d\d|2[0-4]\d|25[0-4]))|(?:(?:[a-z\u00a1- \uffff0-9]+-?)*[a-z\u00a1-\uffff0-9]+)(?:\.(?:[a-z\u00a1- \uffff0-9]+-?)*[a-z\u00a1-\uffff0-9]+)*(?:\.(?:[a-z\u00a1-\uffff]{2,})))| localhost)(?::\d{2,5})?(?:\/[^\s]*)?$/i Input pattern: aaaaaaaaaaaaaaaa! REGULAR EXPRESSION DENIAL OF SERVICE (ReDoS)
  41. PAGE 45 of 70   Example: Commonly used URL validator

    regex # of Input Characters Execution Time 30 6 sec 35 3min 36 6 min 37 13 min 38 25 min 39 1hr 28 min 40 3 hr 46 min REGULAR EXPRESSION DENIAL OF SERVICE (ReDoS)
  42.   Review regex in our own or external code for

    evil pattern Tools: RXRR, SDL Regex Fuzzer PAGE 46 of 70 REGULAR EXPRESSION DENIAL OF SERVICE (ReDoS)
  43.   Review regex in our own or external code for

    evil pattern Tools: RXRR, SDL Regex Fuzzer   Do not use user supplied inputs as regex PAGE 47 of 70 REGULAR EXPRESSION DENIAL OF SERVICE (ReDoS)
  44. HTTP Parameter Pollution (HPP) PAGE 48 of 70 ENGAGE IN

    WARFARE Mitigating Overlooked Security Attacks
  45. PAGE 52 of 70 HTTP PARAMETER POLLUTION // POST firstname=John&firstname=John

    req.body.firstname //=> [“John”, “John”]
  46. PAGE 53 of 70 HTTP PARAMETER POLLUTION Express populates HTTP

    request parameters with same name in an array
  47. PAGE 54 of 70 HTTP PARAMETER POLLUTION Express populates HTTP

    request parameters with same name in an array Attacker can intentionally pollute request parameters to exploit this mechanism
  48. An attacker can exploit HPP to:   Trigger Type Errors

    in application PAGE 55 of 70 HTTP PARAMETER POLLUTION Server Console
  49.   Any uncaught errors in async code could crash the

    HTTP server causing DoS. PAGE 56 of 70 HTTP PARAMETER POLLUTION
  50. An attacker can exploit HPP to:   Modify application behavior

    PAGE 57 of 70 HTTP PARAMETER POLLUTION DB Shell
  51. PAGE 58 of 70 An attacker can exploit HPP to:

      Bypass input validations applied on strings in our own code, WAF, browser filters. HTTP PARAMETER POLLUTION
  52. PAGE 59 of 70 An attacker can exploit HPP to:

      Bypass input validations applied on strings in our own code, WAF, browser filters. HTTP PARAMETER POLLUTION
  53.   Check expected type as part of the input validation

    PAGE 60 of 70 HTTP PARAMETER POLLUTION
  54.   Check expected type as part of the input validation

      Implement robust error handling mechanism using try/catch, domain, and cluster. PAGE 61 of 70 HTTP PARAMETER POLLUTION
  55. OWASP Top 10 PAGE 62 of 70 ENGAGE IN WARFARE

    Mitigating Overlooked Security Attacks
  56. PAGE 64 of 70   Educate developers about OWASP Top

    10 risks OWASP Node Goat Project OWASP NODEGOAT
  57.   Remove X-Powered-By response header and use generic session cookie

    names   Keep watch on security vulnerabilities in dependencies PAGE 66 of 70 QUICK RECAP
  58.   Ensure HTTP GET requests are idempotent   Include method-override

    module before any module that depends on method of the request PAGE 67 of 70 QUICK RECAP
  59.   Encode for all contexts on both server and client

    to protect against XSS attack.   Use HTTPOnly and Secure attributes on session cookie, include CSP headers. PAGE 68 of 70 QUICK RECAP
  60.   Review regex for evil pattern to mitigate ReDoS attack.

      Verify input types as part of the validation PAGE 69 of 70 QUICK RECAP
  61. Links HP 2013 cyber risk report (http://www8.hp.com/h20195/v2/GetPDF.aspx/4AA5-0858ENW.pdf) Node.js security vulnerabilities

    (http://blog.nodejs.org/vulnerability/) Express security updates (http://expressjs.com/advanced/security-updates.html) npm outdated (https://www.npmjs.org/doc/cli/npm-outdated.html) Node Security Project (https://nodesecurity.io/advisories) Retire.js(http://open.bekk.no/retire-js-what-you-require-you-must-also-retire) RXRR (http://www.cs.bham.ac.uk/~hxt/research/rxxr-download.shtml) SDL Regex Fuzzer (http://www.microsoft.com/en-us/download/details.aspx?id=20095) OWASP ESAPI (https://www.owasp.org/index.php/Category:OWASP _Enterprise_Security_API) OWASP Node Goat Project (https://www.owasp.org/index.php/Projects/OWASP _Node_js_Goat_Project)