Real World Web Security

Developer Essentials
adorsys – 2016-03-18

Transcript

1. REAL WORLD WEB SECURITY public class SecurityFilter implements ContainerRequestFilter { @Override public void filter(ContainerRequestContext requestContext) throws IOException { // TODO implement security } }
2. REAL WORLD!
3. SHAME ON YOU!
4. A URI https://adorsys.de/esd.html
5. A FORM <form action="https://adorsys.de/shop/carts" method="GET"> Shopping cart of: <input type="text" name="customerId"> <input type="submit"> </form> https://adorsys.de/shop/carts?customerId=4711
6. A REQUEST URI Body Header (Cookies)
7. https://www.adorsys.de/shop.jsp ;jsessionid=557206C363F1267A24AB769CA0DE4529.node01
8. SESSION-CONFIG (WEB.XML) <?xml version="1.0" encoding="UTF-8"?> <web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" metadata-complete="true" version="3.0"> <session-config> <tracking-mode>URL</tracking-mode> <tracking-mode>COOKIE</tracking-mode> <tracking-mode>SSL</tracking-mode> </session-config> </web-app>
9. SESSION-CONFIG (WEB.XML) <session-config> <session-timeout>30</session-timeout> <cookie-config> <http-only>true</http-only> <secure>true</secure> </cookie-config> <tracking-mode>COOKIE</tracking-mode> </session-config>
10. @WebServlet("/login") public class LoginServlet extends HttpServlet { @Override protected void doGet(HttpServletRequest req, HttpServletResponse res) throws ServletException, IOException { if (login(req.getParameter("user"), req.getParameter("pw"))) { response.sendRedirect("/home"); } else { response.sendRedirect("/login-failed"); } } }
11. RENEW THE SESSION // Java EE 7 request.changeSessionId(); // Jave EE 6 request.getSession(false).invalidate(); request.getSession(true); Session fixation
12. https://www.adorsys.de/shop ?access_token=0eb3f7c6-4396-4f11-beae-d0cd5010237e
13. https://www.adorsys.de/shop/customers/4dcfbb3c6a4f1d4c4a000012
14. https://adorsys.de/money-transfer? to=4dcfbb3c6a4f1d4c4a000012&amount=5000
15. XSRF / CSRF <a href="https://adorsys.de/money-transfer?to=4dcfbb3c6a4f1d4c4a000012&amount=5000" >Show me Kittens!</a> <img src="https://adorsys.de/money-transfer?to=4dcfbb3c6a4f1d4c4a000012&amount=5000" width="0" height="0"> CSRF
16. CSRF VIA POST <form action="https://adorsys.de/money-transfer" method="POST" id="form"> <input type="hidden" name="to" value="4dcfbb3c6a4f1d4c4a000012"> <input type="hidden" name="amount" value="5000"> <input type="submit" value="Show me Kittens!"> </form> <img src="kittens.png" onmouseover="document.getElementById('form').submit(); return false;">
17. CSRF PROTECTION (SERVER SIDE) <input type="hidden" name="xsrf-token" value="8dcfbb3c6a4f1d4c4a372997">
18. CSRF PROTECTION (ANGULAR) Server: Set-Cookie: XSRF-TOKEN=4dcfbb3c6a4f1d4c4a000012 $http: X-XSRF-TOKEN: 4dcfbb3c6a4f1d4c4a000012
19. CSRF ON A JSON API? <form enctype="text/plain"> -> @Consumes("application/json") XHR requests -> Access-Control-Allow-Origin: https://api.com
20. SOP
21. CORS HEADER Access-Control-Allow-Origin: *
22. CSP HEADER Content-Security-Policy: default-src 'self'; script-src 'self' 'https://apis.google.com'; connect-src 'self' 'https://my.api.com'; img-src 'self' 'https://static.cdn.com'; Content Security Policy Reference
23. COOKIELESS LOGIN @Path("/login") public class LoginResource { @POST public Response login(@Context HttpServletRequest req) { if (basicAuth(req)) { return Response.ok() .header("X-AUTH-TOKEN", UUID.randomUUID()).build(); } else { return Response.status(403).build(); } } }
24. TOKEN STORAGE $http.post('/login', credentials).then(function(response) { $httpProvider.defaults.headers.common['X-AUTH-TOKEN'] = response.data.token; // for page reloads... $cookies.put('X-AUTH-TOKEN', response.data.token); $window.localStorage.setItem('X-AUTH-TOKEN', response.data.token); $window.sessionStorage.setItem('X-AUTH-TOKEN', response.data.token); });
25. <%@ page contentType="text/html; charset=utf-8" %> <!doctype html> <html> <head> <title>A JSP</title> </head> <body> <h1>Hello ${param.name}</h1> </body> </html>
26. https://adorsys.de/shop ?name=<script>alert('bubu');</script>
27. XSS PREVENTION (JSP) <c:out value="${param.name}"/> ${fn:escapeXml(param.name)} Java Web Application Enhancements Library
28. <!doctype html> <html ng-app="myApp"> <head> <title>A JSP</title> </head> <body> <h1>Hello {{ location.search().name }}</h1> </body> </html>
29. XSS PREVENTION (ANGULAR) // $sce enabled per default since 1.2, but: $translateProvider.useSanitizeValueStrategy('sanitize'); DOM based XSS Angular $sce Angular Translate Security
30. app.post('/login', function(req, res) { db.users.find({ username: req.body.username, password: req.body.password }, function (err, users) { // login successful! }); });
31. MONGO SQL INJECTION { "username": {"$gt": ""}, "password": {"$gt": ""} } // also possible with Java Driver BasicDBObject query = (BasicDBObject) JSON.parse(json); Hacking NodeJS and MongoDB
32. BTW... 30.000 MongoDB Instances accessible over the Internet without any authorization
33. src/main/resources/jboss.properties db.host=192.168.3.3 db.port=28017 api.secret=xdJF3f9fs3OJfs # for PROD # api.secret=2ddoU3fP12cv
34. OWASP DEPENDENCY CHECK <build> <plugins> <plugin> <groupId>org.owasp</groupId> <artifactId>dependency-check-maven</artifactId> <version>1.3.5.1</version> <executions> <execution> <goals> <goal>check</goal> </goals> </execution> </executions> </plugin> </plugins> </build>
35. public Response importCsv(InputStream stream) throws Exception { BufferedReader reader = new BufferedReader(new InputStreamReader(inputStream, "UTF-8")); List<ErrorDetail> errors = new ArrayList<>(); String line; while ((line = reader.readLine())) != null) { if (!importCsvLine(line)) { errors.add(new ErrorDetail(line)); } } reader.close(); return errors.isEmpty() ? Response.ok().build() : Response.status(400).entity(errors).build(); }
36. OWASP Top Ten 2013
37. JSR 375 Soteria
38. THANKS