Upgrade to Pro — share decks privately, control downloads, hide ads and more …

XSS using dirty Content Type in cloud era

XSS using dirty Content Type in cloud era

2024/3/31(土)開催のコミュニティイベント「Bsides Tokyo 2024」でのAzara、eiによるセッション資料です。
https://bsides.tokyo/2024/#xss-using-dirty-content-type-in-cloud-era

Flatt Security

April 04, 2024
Tweet

More Decks by Flatt Security

Other Decks in Technology

Transcript

  1.  UFYUIUNM B JNBHFUFYUIUNM JNBHFQOHYB UFYUIUNM YZ YZ YZ YZ

    YZ YZ YZ UFYUIUNM JNBHF UFYUaIUNMQOH 🤔 ....?
  2.  UFYUIUNM B JNBHFUFYUIUNM JNBHFQOHYB UFYUIUNM YZ YZ YZ YZ

    YZ YZ YZ UFYUIUNM JNBHF UFYUaIUNMQOH 🤔)5.-GJMF
  3.  UFYUIUNM B JNBHFUFYUIUNM JNBHFQOHYB UFYUIUNM YZ YZ YZ YZ

    YZ YZ YZ UFYUIUNM JNBHF UFYUaIUNMQOH 🤔)5.-GJMF ⭕
  4.  UFYUIUNM B JNBHFUFYUIUNM JNBHFQOHYB UFYUIUNM YZ YZ YZ YZ

    YZ YZ YZ UFYUIUNM JNBHF UFYUaIUNMQOH 😱
  5. ◦ 3FTFBSDITVSSPVOEJOH$POUFOU5ZQFBOE944 ◦ /FXBUUBDLWFDUPSTFNFSHFXJUIUIFBEWFOUPGUIFDMPVE ◦ 4QFDJGJDBUJPOPG$POUFOU5ZQFBOE7BMJEBUJPO#ZQBTT5FDI ◦ &YBNQMFPGDBSSJFSXBWF3VCZMJCSBSZ ◦ $7&BOE$7&

    ◦ 4FDVSJUZNFBTVSFTJOJNQMFNFOUBUJPO ◦ 4JEF4UPSZʜ  -FUTUBMLBCPVUUIFSFBMBOEJNNFEJBUFUISFBUTXFGBDF BGUFS#4JEFT5PLZP PWFSESJOLTBUUIFBGUFSQBSUZ 5PQJDT 
  6. /PSJIJEF4BJUPB[BSB !B@[BSB@O ɹ೥ʹגࣜձࣾ'MBUU4FDVSJUZʹೖࣾ ͠ɺ8FCΞϓϦέʔγϣϯ΍ύϒϦοΫΫϥ ΢υΛର৅ͱͨ͠ϓϩϑΣογϣφϧαʔϏ εۀ຿ʹैࣄɻ ɹ*40(+8(ͳͲͷ֎෦ஂମͰͷ׆ಈ΍ɺ +4"$  ɺ"84%FW%BZ

     ɺ 4FDVSJUZ+"84%":4  Ͱͷొஃɾϫʔ Ϋγϣοϓ։࠵ͳͲΛ௨͠ɺύϒϦοΫΫϥ ΢υͱ8FCΞϓϦέʔγϣϯʹ͓͚ΔηΩϡ ϦςΟʹؔ͢Δܒ໤ͳͲͷ׆ಈΛߦ͏ɻ 4FMGJOUSPEVDUJPO  &JKJ.PSJFJ !FJ ɹࣛࣇౡେֶେֶӃमྃޙɺ೥݄ʹג ࣜձࣾ'MBUU4FDVSJUZʹೖࣾɻηΩϡϦςΟ ΤϯδχΞͱͯ͠ɺओʹ8FCΞϓϦέʔγϣ ϯ਍அͱεϚʔτϑΥϯΞϓϦέʔγϣϯ਍ அΛ୲౰͍ͯ͠Δɻ ɹաڈʹηΩϡϦςΟΩϟϯϓؔ࿈Πϕϯτ ʹؔΘ͍ͬͯͨͨΊɺϋʔυ΢ΣΞ͔Βιϑ τ΢ΣΞ·Ͱ෯޿͘ڵຯ͕͋Δɻझຯ͸੬ऑ ੑௐࠪͱےτϨɻ
  7. ◦ .BOZ944TBSFOPXTFFOUBLJOHBEWBOUBHFPGUIFDIBSBDUFSJTUJDT PG0CKFDU4UPSBHFBOEQFSJQIFSBMJNQMFNFOUBUJPOT ◦ *ODSFEJCMF$POUFOU5ZQF.PWFNFOU*EFOUJGJFEJO $7&BOE0UIFS7VMOFSBCJMJUJFT ◦ *ODSFBTFEUISFBUTEVFUPUIFJODSFBTFJO944BUUBDLWFDUPSTBOE UIFSFTVMUJOHFBTFPG944 ◦

    1PTTJCJMJUZUPPCUBJO5PLFOTTVDIBT"DDFTT5PLFOBOE*E 5PLFOGSPNUIFCSPXTFS ◦ #FDPNFBOBUUBDLHBEHFUGPSTFSWJDFTUIBUJTTVF $SFEFOUJBMT TVDIBT"NB[PO$PHOJUP*EFOUJUZ1PPM "MJUUMFCBDLHSPVOEPOIPXXFDBNFUP CFHJOUIJT3FTFBSDI 
  8. 8BT944BNBKPSGBDUPSJOUSBEJUJPOBMGJMFVQMPBET  ◦ 8IFOTUPSJOHGJMFTPOEJTLTUPSBHFPSEFMJWFSJOHUIFN UIF$POUFOU 5ZQFXBTTOJGGFECZUIFNJEEMFXBSFPSBQQMJDBUJPO BOEUIFBUUBDLFS DPVMEOPUEJSFDUMZTQFDJGZUIF$POUFOU5ZQF ◦ 7BMJEBUJPOXBTCFJOHEPOFBUVQMPBEUJNFJOUIFBQQMJDBUJPOBOE

    NJEEMFXBSF BOEUIFZOFFEFEUPCFCZQBTTFE #FDBVTFPGUIFBCPWFUXPQPJOUT GJMFVQMPBETJOUIFGPSNPGEJTLTUPSBHF XFSFPGUFONPSFEJGGJDVMUUPDBVTF944BTUIFZFBSTXFOUCZ  944QBUIXBZDBVTFECZGJMFVQMPBET
  9. 4QFDJGJDBUJPOPG$POUFOU5ZQF  3'$)5514FNBOUJDTBOE$POUFOU  $POUFOU5ZQF NFEJBUZQF NFEJBUZQF UZQFTVCUZQF 084084 

    QBSBNFUFS UPLFO UPLFORVPUFETUSJOH   RVPUFETUSJOH  %2605& REUFYURVPUFEQBJS %2605& REUFYU  )5"#41YY#Y%&PCTUFYU PCTUFYU  Y''
  10. 4QFDJGJDBUJPOPG$POUFOU5ZQF  3'$)5514FNBOUJDTBOE$POUFOU  $POUFOU5ZQF NFEJBUZQF NFEJBUZQF UZQFTVCUZQF 084084 

    QBSBNFUFS UPLFO UPLFORVPUFETUSJOH   RVPUFETUSJOH  %2605& REUFYURVPUFEQBJS %2605& REUFYU  )5"#41YY#Y%&PCTUFYU PCTUFYU  Y''
  11. 4QFDJGJDBUJPOPG$POUFOU5ZQF  3'$)5514FNBOUJDTBOE$POUFOU 8.3.1. Considerations for New Header Fields Whether

    the field is a single value or whether it can be a list (delimited by commas; see Section 3.2 of [RFC7230]). If it does not use the list syntax, document how to treat messages where the field occurs multiple times (a sensible default would be to ignore the field, but this might not always be the right choice). Note that intermediaries and software libraries might combine multiple header field instances into a single one, despite the field's definition not allowing the list syntax. A robust format enables recipients to discover these situations (good example: "Content-Type", as the comma can only appear inside quoted strings; bad example: "Location", as a comma can occur inside a URI).
  12. 4QFDJGJDBUJPOPG$POUFOU5ZQF  3'$)5514FNBOUJDTBOE$POUFOU Note that intermediaries and software libraries might

    combine multiple header field instances into a single one, despite the field's definition not allowing the list syntax. A robust format enables recipients to discover these situations (good example: "Content-Type", as the comma can only appear inside quoted strings; bad example: "Location", as a comma can occur inside a URI). (PPE&YBNQMF $POUFOU5ZQFJNBHFQOHIPHFlGVHB UFYUIUNMz ˠNFEJB5ZQFJNBHFQOH ˠQBSBNFUFST ◦ IPHFlGVHB UFYUIUNMz
  13. 4QFDJGJDBUJPOPG$POUFOU5ZQF  3'$)5514FNBOUJDTBOE$POUFOU Note that intermediaries and software libraries might

    combine multiple header field instances into a single one, despite the field's definition not allowing the list syntax. A robust format enables recipients to discover these situations (good example: "Content-Type", as the comma can only appear inside quoted strings; bad example: "Location", as a comma can occur inside a URI). 1PJOUTUPDPOTJEFS $POUFOU5ZQFJNBHFQOHIPHFGVHB UFYUIUNM ˠNFEJB5ZQFJNBHFQOH ˠQBSBNFUFST ◦ IPHFGVHB ˠ UFYUIUNM 🤔 -PPLBUPUIFSTQFDJGJDBUJPOT
  14. 4QFDJGJDBUJPOPG$POUFOU5ZQF  3'$4USVDUVSFE'JFME7BMVFTGPS)551 3.1 Lists Lists are arrays of zero

    or more members, each of which can be an Item (Section 3.3) or an Inner List (Section 3.1.1), both of which can be Parameterized (Section 3.1.2). 4QFD TGMJTUMJTUNFNCFS 084 084MJTUNFNCFS  MJTUNFNCFSTGJUFNJOOFSMJTU &YBNQMF &YBNQMF-JTUTVHBS UFB SVN
  15. 🤔 4QFDJGJDBUJPOPG$POUFOU5ZQF  3'$)5514FNBOUJDTBOE$POUFOU Note that intermediaries and software libraries

    might combine multiple header field instances into a single one, despite the field's definition not allowing the list syntax. A robust format enables recipients to discover these situations (good example: "Content-Type", as the comma can only appear inside quoted strings; bad example: "Location", as a comma can occur inside a URI). 1PJOUTUPDPOTJEFS $POUFOU5ZQFJNBHFQOHIPHFGVHB UFYUIUNM ˠNFEJB5ZQFJNBHFQOH UFYUIUNM ˠQBSBNFUFST ◦ IPHFGVHB UFYUIUNMDPVMECFTFUUP.FEJB5ZQFʜ
  16. 4QFDJGJDBUJPOPG$POUFOU5ZQF  3'$)5514FNBOUJDT  $POUFOU5ZQF NFEJBUZQF NFEJBUZQF UZQFTVCUZQF 084084 

    QBSBNFUFS UPLFO UPLFORVPUFETUSJOH   RVPUFETUSJOH  %2605& REUFYURVPUFEQBJS %2605& REUFYU  )5"#41YY#Y%&PCTUFYU PCTUFYU  Y''
  17. 4QFDJGJDBUJPOPG$POUFOU5ZQF  3'$)5514FNBOUJDT  $POUFOU5ZQF NFEJBUZQF NFEJBUZQF UZQFTVCUZQF 084084 

    QBSBNFUFS UPLFO UPLFORVPUFETUSJOH   RVPUFETUSJOH  %2605& REUFYURVPUFEQBJS %2605& REUFYU  )5"#41YY#Y%&PCTUFYU PCTUFYU  Y'' %FGJOJUJPOJOIFSJUFEGSPN 3'$ )5514FNBOUJDTBOE$POUFOU
  18. 4QFDJGJDBUJPOPG$POUFOU5ZQF  3'$)5514FNBOUJDT 5.6.2. Tokens Many HTTP field values are

    defined using common syntax components, separated by whitespace or specific delimiting characters. Delimiters are chosen from the set of US-ASCII visual characters not allowed in a token (DQUOTE and "(),/:;<=>?@\[\\]{}"). %2605&BOE l  !a<aa>\^ 👀 $POUFOU5ZQF7BMVFJTOPUFYQMJDJUMZNBSLFE l.645/05PS4)06-%/05 ˠ-JTU5ZQF7BMVFNBZCFBWBJMBCMF
  19. 4QFDJGJDBUJPOPG$POUFOU5ZQF  8)"58('FUDITUBOEBSE 1BSTF-PHJDGPS$POUFOU5ZQF  -FUDIBSTFUCFOVMM  -FUFTTFODFCFOVMM  -FUNJNF5ZQFCFOVMM

     -FUWBMVFTCFUIFSFTVMUPGHFUUJOH EFDPEJOH BOETQMJUUJOH$POUFOU5ZQFGSPNIFBEFST  *GWBMVFTJTOVMM UIFOSFUVSOGBJMVSF  'PSFBDIWBMVFPGWBMVFT  -FUUFNQPSBSZ.JNF5ZQFCFUIFSFTVMUPGQBSTJOHWBMVF  *GUFNQPSBSZ.JNF5ZQFJTGBJMVSFPSJUTFTTFODFJT UIFODPOUJOVF  4FUNJNF5ZQFUPUFNQPSBSZ.JNF5ZQF  *GNJNF5ZQF`TFTTFODFJTOPUFTTFODF UIFO  4FUDIBSTFUUPOVMM  *GNJNF5ZQF`TQBSBNFUFST<DIBSTFU>FYJTUT UIFOTFUDIBSTFUUPNJNF5ZQF`TQBSBNFUFST<lDIBSTFU>  4FUFTTFODFUPNJNF5ZQF`TFTTFODF  0UIFSXJTF JGNJNF5ZQF`TQBSBNFUFST<DIBSTFU>EPFTOPUFYJTU BOEDIBSTFUJTOPOOVMM TFUNJNF5ZQF`T QBSBNFUFST<DIBSTFU>UPDIBSTFU  *GNJNF5ZQFJTOVMM UIFOSFUVSOGBJMVSF  3FUVSONJNF5ZQF
  20. 4QFDJGJDBUJPOPG$POUFOU5ZQF  8)"58('FUDITUBOEBSE 1BSTF-PHJDGPS)FBEFS7BMVFT  -FUJOQVUCFUIFSFTVMUPGJTPNPSQIJDEFDPEJOHWBMVF  -FUQPTJUJPOCFBQPTJUJPOWBSJBCMFGPSJOQVU JOJUJBMMZQPJOUJOHBUUIFTUBSUPGJOQVU 

    -FUWBMVFTCFBMJTUPGTUSJOHT JOJUJBMMZFNQUZ  -FUUFNQPSBSZ7BMVFCFUIFFNQUZTUSJOH  8IJMFQPTJUJPOJTOPUQBTUUIFFOEPGJOQVU  "QQFOEUIFSFTVMUPGDPMMFDUJOHBTFRVFODFPGDPEFQPJOUTUIBUBSFOPU6   PS6 $ GSPNJOQVU HJWFO QPTJUJPO UPUFNQPSBSZ7BMVF  *GQPTJUJPOJTOPUQBTUUIFFOEPGJOQVU UIFO  *GUIFDPEFQPJOUBUQPTJUJPOXJUIJOJOQVUJT6   UIFO  "QQFOEUIFSFTVMUPGDPMMFDUJOHBO)551RVPUFETUSJOHGSPNJOQVU HJWFOQPTJUJPO UP UFNQPSBSZ7BMVF  *GQPTJUJPOJTOPUQBTUUIFFOEPGJOQVU UIFODPOUJOVF  0UIFSXJTF  "TTFSUUIFDPEFQPJOUBUQPTJUJPOXJUIJOJOQVUJT6 $   "EWBODFQPTJUJPOCZ  3FNPWFBMM)551UBCPSTQBDFGSPNUIFTUBSUBOEFOEPGUFNQPSBSZ7BMVF  "QQFOEUFNQPSBSZ7BMVFUPWBMVFT  4FUUFNQPSBSZ7BMVFUPUIFFNQUZTUSJOH  3FUVSOWBMVFT
  21. *OUFSQSFUBUJPO%JGGFSFODFGPS4QFDJGJDBUJPO  $PNNB 1TFVEPJNQMFNFOUBUJPOXJUI5ZQF4DSJQU 3'$ $POUFOU5ZQFJNBHFQOH UFYUIUNM 8)"58( $POUFOU5ZQFJNBHFQOH UFYUIUNM

    6OEFGJOFE $POUFOU5ZQFJTEFGJOFEBTTJOHVMBS .JNF5ZQFJTUFYUIUNM 5SFBUTWBMVFTBTTJOHVMBSEVFUPMBDLPG JOUFSQSFUBUJPOEFGJOJUJPO
  22. 4FDVSJUZNFBTVSFTJOJNQMFNFOUBUJPO  6TF6TFS*OQVU 'PS$POUFOU5ZQF 4FU.FDIBOJDBMMZEFUFSNJOFE7BMVF 'PS$POUFOU5ZQF ◦ $POUFOU5ZQFJTBOFYBDUNBUDI ◦ /PQBSUJBMNBUDIFTBSFVTFE

    ◦ /PTUBSUT8JUI ◦ /PFOET8JUI ◦ /PJODMVEFT ◦ #FDBSFGVMPGVOJOUFOEFETUSJOH NBUDIFTXIFOVTJOHSFHVMBS FYQSFTTJPOT ◦ ?JNBHF QOHcKQFHcKQHcHJG  ◦ %FUFSNJOFUIFWBMVFPG$POUFOU UZQFCBTFEPOUIFJOGPSNBUJPOJO UIFGJMF ◦ 'JMF)FBEFS ◦ &YUFOTJPO ◦ 7BMJEBUJPOPGUIFEFUFSNJOFEWBMVF
  23.  UFYUIUNM B JNBHFUFYUIUNM JNBHFQOHYB UFYUIUNM YZ YZ YZ YZ

    YZ YZ YZ UFYUIUNM JNBHF UFYUaIUNMQOH 🤔
  24.  UFYUIUNM B JNBHFUFYUIUNM JNBHFQOHYB UFYUIUNM YZ YZ YZ YZ

    YZ YZ YZ UFYUIUNM JNBHF UFYUaIUNMQOH 🤔 VOLOPXOUZQF
  25.  UFYUIUNM B JNBHFUFYUIUNM JNBHFQOHYB UFYUIUNM YZ YZ YZ YZ

    YZ YZ YZ UFYUIUNM JNBHF UFYUaIUNMQOH 😊 VOLOPXOUZQF ⭕
  26.  UFYUIUNM B JNBHFUFYUIUNM JNBHFQOHYB UFYUIUNM YZ YZ YZ YZ

    YZ YZ YZ UFYUIUNM JNBHF UFYUaIUNMQOH .JNF5ZQFTOJGGFS )J 😊
  27.  UFYUIUNM B JNBHFUFYUIUNM JNBHFQOHYB UFYUIUNM YZ YZ YZ YZ

    YZ YZ YZ UFYUIUNM JNBHF UFYUaIUNMQOH .JNF5ZQFTOJGGFS 5IJTJTBOPUIFSTUPSZ
  28. ◦ $POUFOU4FDVSJUZ1PMJDZ ◦ IUUQTEFWFMPQFSNP[JMMBPSHKBEPDT8FC)551)FBEFST$POUFOU4FDVSJUZ1PMJDZ ◦ "NB[PO4 ◦ IUUQTBXTBNB[PODPNKQT ◦ BXTTELKTW

    ◦ IUUQTHJUIVCDPNBXTBXTTELKTW ◦ TJHOFE63- ◦ IUUQTEPDTBXTBNB[PODPNKB@KQ*".MBUFTU6TFS(VJEFDSFBUFTJHOFESFRVFTUIUNM ◦ $BSSJFSXBWF ◦ IUUQTHJUIVCDPNDBSSJFSXBWFVQMPBEFSDBSSJFSXBWF ◦ 3'$ ◦ IUUQTEBUBUSBDLFSJFUGPSHEPDIUNMSGD ◦ 3'$ ◦ IUUQTEBUBUSBDLFSJFUGPSHEPDIUNMSGD ◦ 3'$ ◦ IUUQTEBUBUSBDLFSJFUGPSHEPDIUNMSGD ◦ 'FUDI4UBOEBSE ◦ IUUQTGFUDITQFDXIBUXHPSH ◦ #ZQBTTJOHBOEFYQMPJUJOH#VDLFU6QMPBE1PMJDJFTBOE4JHOFE63-T ◦ IUUQTMBCTEFUFDUJGZDPNXSJUFVQTCZQBTTJOHBOEFYQMPJUJOHCVDLFUVQMPBEQPMJDJFTBOETJHOFEVSMT ◦ $POUFOU5ZQFBMMPXMJTUCZQBTTWVMOFSBCJMJUZ QPTTJCMZMFBEJOHUP944 ◦ IUUQTHJUIVCDPNDBSSJFSXBWFVQMPBEFSDBSSJFSXBWFTFDVSJUZBEWJTPSJFT()4"HYIYHGRIK 3FGFSFODF