負ける気せえへん HTML5セキュリティやし#OWASP Kansai Local Chapter Meeting 2nd

ෛ͚Δ͖ͤ͐΁Μ  ஍ݩ΍͠  HTML5ηΩϡϦςΟ (ެ։൛) Yoshinori Matsumoto OWASP
Kansai Local Chapter Meeting 2nd 2014/06/06

ࠓ೔ͷ಺༰ • HTML5ηΩϡϦςΟͰ࿩୊ͷٕज़ ͱͦͷղઆ ͦͷͳ͔͔Β୅දతͳ΋ͷ2఺ϐοΫΞο ϓ –XMLHttpRequestͱCORS
–Content-‐Security-‐Policy

ָউ ෛ͚Δ͖ͤ͐΁Μ  ΫϩευϝΠϯ΍͠ͷר

XMLHttpRequestͱ͸ • XMLHttpRequestͬͯͳΜ͚ͩͬʁ –JavaScriptΛ࢖༻ͯ͠αʔόͱHTTP௨ ৴Λߦ͏API –WebαΠτ಺ͷඇಉظॲཧͳͲͰΑ ͘࢖༻͞ΕΔ

ैདྷͷXMLHttpRequest 通常の場合 var url = “kobe.html”; var xhr
= new XMLHttpRequest(); xhr.open( "GET", url, true ); xhr.onreadystatechange = function(){ if( xhr.readyState == 4 && xhr.status == 200 ) { div.innerHTML = xhr.responseText; } kobe.html <div>

ैདྷͷXMLHttpRequest jQueryの場合 var url = “kobe.html”; $.get(url, nulll,
function(data){ $(“#elemID”).html(data); }); kobe.html <div>

ैདྷͷXHRͷ஫ҙ఺ • XSS ( Cross-‐Site-‐Scripting ) – ͜ͷ࣌ɺJavaScriptؚ͕·ΕΔͱ࣮ߦ͞Εͯ͠·͏৔߹͕͋ Δ
– XHR ͳͲͰ DOM ૢ࡞࣌ʹൃੜ͢Δ XSS ͸ DOM based XSSͱ ݺ͹Ε͓ͯΓɺJavaScriptΛଟ༻͢ΔαΠτͰ࡞ΓࠐΈ͍҆ – ಛʹୈࡾऀͷೖྗ஋Λग़ྗ͢Δ৔໘ʹ͓͍ͯൃੜ͢Δ͜ͱ ͕ଟ͍ some_text <div> SCRIPT <div>

ैདྷͷXHRͷ஫ҙ఺ 通常の場合 var url = “kobe.html”; var xhr
= new XMLHttpRequest(); xhr.open( "GET", url, true ); xhr.onreadystatechange = function(){ if( xhr.readyState == 4 && xhr.status == 200 ) { div.innerHTML = xhr.responseText; } SCRIPT <div>

ैདྷͷXHRͷ஫ҙ఺ʙରࡦʙ • HTMLੜ੒࣌ͷΤεέʔϓ –͜ͷΑ͏ͳXSSΛରࡦ͢Δʹ͸HTMLͱͯ͠ҙຯΛ ΋ͭه߸ͳͲͷจࣈΛΤεέʔϓ͢Δ͜ͱ͕ඞཁ • (e.g.
ʮ<ʯ →ʮ<ʯɺʮ”ʯ→ʮ"ʯ) • DOMܦ༝Ͱૢ࡞͢Δ –JavaScript಺Ͱૢ࡞͍ͯ͠Δ৔߹͸ɺςΩετϊʔ υΛੜ੒ͯ͠DOMܦ༝͢Δํ͕໢ཏతʹXSS߈ܸ ͷൃੜΛ๷͙͜ͱ͕Ͱ͖Δ

XSSʹ஫ҙ ʙରࡦʙ 通常の場合 var xhr = new XMLHttpRequest(); xhr.open("GET",
url, true); xhr.onreadystatechange = function(){ if(xhr.readyState == 4 && xhr.status == 200){ var result = document.getElementById("result"); var text = document.createTextNode( xhr.response ); result.appendChild(text); }

XSSʹ஫ҙ ʙରࡦʙ jQueryの場合 $.get(url, null, function(data){ $("#result").text(data);
});

HTML5ͰͲ͏มΘͬͨͷ͔ʁ • ࠷ۙͷϒϥ΢βͰ͸ –XHR Level2 ͷαϙʔτͳͲʹΑΓɺ ଟ͘ͷϒϥ΢βͰػೳ͕௥Ճ͞Εͨ –ͬ͘͟Γݴ͏ͱ…
• ࠓ·ͰɿηΩϡϦςΟͷ໘Ͱಉ͡αΠ τͰ͔͠௨৴Ͱ͖ͳ͍ • ࠷ۙ : αΠτΛ௒͑ͯ௨৴Մೳʹʂ

SOP • SOP : Same-‐Origin-‐Policy –XMLHttpRequest͕࢖༻Ͱ͖Δͷ͸ɺૹ৴ݩ ͱૹ৴ઌͷΦϦδϯ͕ಉҰͷ৔߹ͷΈ –ηΩϡϦςΟͷ؍఺ͳͲ͔ΒɺΦϦδϯΛ
௒͑ͨ௨৴͸Ͱ͖ͳ͍ ΦϦδϯͱ͸… ίϯςϯπͷಡΈࠐΈݩͷεΩʔϜɾϗετɾϙʔτͷ3छྨͷ૊ Έ߹Θͤ http://example.com:80

CORS • CORS : Cross Origin Resource Sharing –ΦϦδϯΛ௒͑ͨ௨৴͕Մೳ
–ϦΫΤετΛड͚Δαʔόଆ͕ΫϩεΦϦ δϯ௨৴Λड͚ೖΕΔઃఆʹ͍ͯͨ͠৔߹ ίϯςϯπΛड͚औΔ͜ͱ͕Ͱ͖Δ ίϯςϯπ ҟͳΔΦϦδϯ ͷαʔό ΦϦδϯ͸ ___Ͱ͢ ΞΫηεͰ͖ΔΦϦδϯ ͸ ___Ͱ͢

CORSͷରԠঢ়گ ʮCan I use …ʯ͔ΒͷҾ༻Ͱ࣮ࡍ͸ࢼ͍ͯ͠·ͤΜ http://caniuse.com/

CORSͷରԠঢ়گ • IE8,9͸ಠ࣮ࣗ૷Ͱ͢ʢXDomainRequest) υϝΠϯؒཁٻ (XDR) ͷ֓ཁ" http://msdn.microsoft.com/ja-‐jp/library/dd573303%28v=vs.85%29.aspx

CORS • ΫϩεΦϦδϯ௨৴ͷྲྀΕ 1. ௨ৗͱಉ͡Α͏ʹXMLHttpRequest௨৴Λߦ͏ JavaScriptΛهड़͢Δ 2. ϒϥ΢β͕ίϯςϯπͷϦΫΤετʹΦϦδ
ϯ(Origin) ϔομΛ෇Ճ͢Δ 3. ΞΫηεઌͷαʔό͕Ϩεϙϯεϔομʹڐ Մ͢ΔΦϦδϯΛ͚ͭͯฦ͢ 4. ڐՄ͢ΔΦϦδϯʹؚ·Ε͍ͯΔͱJavaScript ͔ΒΞΫηε͢Δ͜ͱ͕ՄೳʹͳΔ

CORS • HTTP௨৴(ൈਮ) GET /xhr_api.php HTTP/1.1 Host: server2.owaspkansai.test
Origin: http://server1.owaspkansai.test Referer: http://server1.owaspkansai.test/xhr_normal.php HTTP/1.1 200 OK Date: Wed, 04 Jun 2014 09:13:08 GMT Server: Apache Access-‐Control-‐Allow-‐Origin: http://server1.owaspkansai.test Content-‐Type: text/html " "

CORSͷ஫ҙ఺ ͦͷ1/3 • ػີ৘ใͷΞΫηε੍ݶʹ͜ͷػೳΛ ࢖͏͜ͱ͸Ͱ͖ͳ͍ –͜ͷػೳ͸ɺXMLHttpRequest͔Βͷ ΞΫηεʹର͢Δ੍ݶ –ΞΫηε੍ݶͳͲΛߦ͏ʹ͸Cookie
ͳͲैདྷͲ͓Γͷํ๏͕ඞཁ

CORSͷ஫ҙ఺ ͦͷ2/3 • ΞΫηε͠ͳ͍Θ͚Ͱ͸ͳ͍ –Access-‐Control-‐Allow-‐OriginͰڐՄ͞Ε͍ͯͳ͍ ΦϦδϯ͔ΒͷΞΫηε΋ϦΫΤετࣗମ͸ ૹ৴͞ΕΔ –ϦΫΤετ͕ૹ৴͞Ε͚ͨͩͰॲཧ͕ߦΘΕ
Δ΋ͷͰ͸ɺAccess-‐Control-‐Allow-‐OriginͰڐՄ ͍ͯ͠ͳ͍ΦϦδϯ͔Β΋ॲཧ͕ߦΘΕΔ –͜ͷ৔߹΋ɺैདྷͲ͓ΓCookieͳͲͰΞΫη ε੍ݶΛߦ͏͜ͱ͕ඞཁ

CORSͷ஫ҙ఺ ͦͷ3/3 • Cookie͸௨ৗૹ৴͞Εͳ͍ – CookieΛ࢖༻͢Δ৔߹͸ withCredentials ϓϩύςΟΛ༻͍Δ
– CookieΛ࢖༻ͨ͠৔߹  Access-‐Control-‐Allow-‐Origin: * (͢΂ͯͷΦϦδϯ͔ΒͷΞΫη εΛڐՄ)  ͱ͍͏ࢦఆΛ͢Δ͜ͱ͸࢓্༷ېࢭ͞Ε͍ͯΔɻ xhr.open( "GET", "http://other.example.jp", true ); xhr.withCredentials = true; xhr.onreadystatechange = function(){ if( xhr.readyState == 4 && xhr.status == 200 ){ div.appendChild( document.createTextNode( xhr.responseText ) ); } }; xhr.send( null );

CookieΛ࢖͏৔߹ͷHTTP • HTTP௨৴(ൈਮ) GET /xhr_api.php HTTP/1.1 Host: server1.owaspkansai.test
Origin: http://server2.owaspkansai.test Referer: http://server1.owaspkansai.test/xhr_normal.php Cookie: cookie1=1234567890 HTTP/1.1 200 OK Date: Wed, 04 Jun 2014 09:13:08 GMT Server: Apache Access-‐Control-‐Allow-‐Origin: http://server1.owaspkansai.test access-‐control-‐allow-‐credentials: true Content-‐Type: text/html "

͍͔Μͷ͔ʁ • ϦΫΤετͷΦϦδϯΛAccess-‐Control-‐Allow-‐Originʹೖ ΕΕ͹ɺ͢΂ͯͷΦϦδϯ͔ΒCookieΛड͚औΕΔʁ GET /xhr_api.php HTTP/1.1 Host: server2.owaspkansai.test
Origin: http://server1.owaspkansai.test Referer: http://server1.owaspkansai.test/xhr_normal.php Cookie: cookie1=1234567890 HTTP/1.1 200 OK Date: Wed, 04 Jun 2014 09:13:08 GMT Server: Apache Access-‐Control-‐Allow-‐Origin: _________________________ access-‐control-‐allow-‐credentials: true Content-‐Type: text/html "

͍͔ΜͰ͠ΐ • αΠτͷػີ৘ใΛ֎෦ʹૹ৴͞ΕΔՄೳੑ͕ ͋Δ – ߈ܸऀͷίϯςϯπ͔ΒɺCookie෇͖ϦΫΤετΛ ૹ৴͢Δ͜ͱ͕Ͱ͖Δ –
ݸਓ৘ใ͕֎෦ʹૹ৴͞ΕΔՄೳੑ΋͋Δ ߈ܸऀͷαΠτ ਖ਼نαΠτ JavaScript Cookie ݸਓ৘ใͱ͔ ߈ܸऀ Ϣʔβ

ָউ XSSൃੜ͢Δؾͤ͑΁Μ Content Security Policy ࢖ͬͯΔ ͠ͷר

Content-‐Security-‐Policyͱ͸ • CSP : Content-‐Security-‐Policy –ಡΈࠐΈՄೳͳϦιʔεͷΦϦδϯΛϙϦγʔ ͱͯ͠ࢦఆ͢Δ •
ΠϯϥΠϯͰ࣮ߦ͞ΕΔJavaScriptͳͲͷ੍ݶ΋ߦ ͏͜ͱ͕Ͱ͖Δ • ը૾΍iframeͳͲͷϦιʔεͷಡΈࠐΈݩΦϦδ ϯΛࢦఆ͢Δ͜ͱ͕Ͱ͖Δ –XSS߈ܸͷՄೳੑΛܰݮ͢Δ͜ͱ͕Ͱ͖Δ –खʹෛ͑ͳ͍

CSPͷରԠঢ়گ ʮCan I use …ʯ͔ΒͷҾ༻Ͱ࣮ࡍ͸ࢼ͍ͯ͠·ͤΜ http://caniuse.com/

CSPͷ࢖͍ํ • Content-‐Security-‐PolicyϔομΛϨεϙϯ εʹ͚ͭΔ͚ͩ " εΫϦϓτʹؔͯ͠ɺυΩϡϝϯτࣗ਎ͱಉҰͷΦϦδϯ ͷ৔߹ͷΈڐՄ͢Δ Content-‐Security-‐Policy: script-‐src ‘self’
σΟϨΫςΟϒ σΟϨΫςΟϒιʔε

CSPͷ࢖͍ํ • ϒϥ΢βʹΑͬͯॻ͖ํ͕ҧ͏ –Content-‐Security-‐Policy • W3Cඪ४
• Chrome 25 Ҏ߱ɺFirefox 23 Ҏ߱, Opera 19 Ҏ߱ɺ Safari 7 Ҏ߱ –X-‐Content-‐Security-‐Policy • Firefox 23 ΑΓલɺ Internet Explorer version 10 Ҏ߱ ʢ੍ݶతʣ –X-‐WebKit-‐CSP • Chrome 25ɺSafari 7 Ҏ߱

CSPͷ࢖͍ํ • Content-‐Security-‐Policyͷ͍Ζ͍Ζͳ࢖͍ ํ " ը૾σʔλͷΈɺimg.example.com ͔ΒͷϦιʔεΛڐՄ ͠ɺͦΕҎ֎ͷϦιʔε͸ɺυΩϡϝϯτࣗ਎ͱಉҰϦιʔ εͷΈڐՄ͢Δ Content-‐Security-‐Policy:
default-‐src 'self'; img-‐src img.example.com (ϝϞ) default-‐src ͱ͢Δͱɺimg-‐srcͳͲݸผͰࢦఆ͞Ε͍ͯͳ͍Ҏ֎ͷ σΟϨΫςΟϒͷϙϦγʔΛࢦఆ͢Δ͜ͱ͕Ͱ͖Δ

CSPͷ࢖͍ํ • Content-‐Security-‐Policyͷ͍Ζ͍Ζͳ࢖͍ ํ " ΠϯϥΠϯͷεΫϦϓτهड़ΛڐՄ͢Δ JavaScript಺ͰͷevalɺsetTimeout ͳͲͷจࣈྻ͔ΒίʔυΛ ੜ੒͢Δػೳ͸ϙϦγʔҧ൓ͱ࣮ͯ͠ߦ͞Εͳ͍
Content-‐Security-‐Policy: script-‐src ‘unsafe-‐inline’ (ϝϞ) ‘unsafe-‐eval’ ͱ͢Δ͜ͱͰจࣈྻ͔Βͷίʔυੜ੒Λ༗ޮʹ͢Δ ελΠϧγʔτΛࢦ͢σΟϨΫςΟϒ style-‐srcͰ΋࢖༻Ͱ͖Δ

CSPͷ஫ҙ఺ • ैདྷͲ͓ΓͷXSS͸͓͖ͯ͠·͠ΐ͏ –CSPͷهड़ํ๏͸ࠓޙ౷Ұ͞ΕΔ༧ఆͰ͋ Δ͕ɺϒϥ΢βʹΑͬͯهड़ํ๏͕ҟͳ Δ৔߹͕͋Δ –ରԠ͍ͯ͠ͳ͍ϒϥ΢β΋͋Δ
–ϙϦγʔΛݫ͘͢͠Δͱਖ਼౰ͳJavaScript ΋ಈ͔ͳ͘ͳΔ৔߹͕͋Δ –͍Ζ͍ΖมΘͬͨΓͯͯ͠ਖ਼௚Θ͔ΒΜ

CSPϨϙʔτ • ϙϦγʔҧ൓Λใࠂ͢ΔϨϙʔτػೳ – ϙϦγʔҧ൓͕ىͬͨ࣌͜ʹҧ൓Ϩϙʔτ͕ࢦఆ ͨ͠URLʹૹ৴͞ΕΔ – ҧ൓Ϩϙʔτͷૹ৴ઌͰεΫϦϓτΛॻ͘͜ͱͰɺ
࣮૷ͷෆඋɺXSS߈ܸͷݕ஌ͳͲ੬ऑੑͷૣظൃݟ ͳͲ͕ظ଴Ͱ͖Δ Content-‐Security-‐Policy: script-‐src ‘self’; report-‐uri http://example.jp/ report.cgi Ϩϙʔτͷૹ৴ઌ

CSP : script-‐src ‘self’ CSPτϦϏΞ • iframeͰಡΈࠐΜͩ৔߹Ͱ΋ಈ͘Α͏ <!DOCTYPE html>
<html> " " " " " " " </html> " " " <iframe> <!DOCTYPE html> <html> <script>alert(1);</script> </html> server1 server2

ָউෛ͚Δ͖ͤ͐΁Μ  ΋͏·ͱΊΔ͠

·ͱΊ • XMLHttpRequest – ௨ৗ͸ಉҰΦϦδϯͷΈ – CORS͕αϙʔτ͞Ε͍ͯΔϒϥ΢βͰ͸ΫϩεΦϦδϯͰͷ௨ ৴͕ՄೳʹͳΔ
– CookieͷऔΓѻ͍ํͳͲɺηΩϡϦςΟ্ͷ஫ҙΛ஌্ͬͨͰ ஫ҙ͕ඞཁ • Content-‐Security-‐Policy – ϨεϙϯεϔομΛ͚ͭΔͱɺϦιʔεಡΈࠐΈ࣌ʹ༷ʑͳϙ ϦγʔΛ͚ͭΔ͜ͱ͕Ͱ͖Δ – αϙʔτ͍ͯ͠ͳ͍ϒϥ΢β΋͋ΔͷͰઈରతͳ΋ͷͰ͸ͳ͍ – XSS߈ܸͷܰݮͱ΋ͳΔ – ϨϙʔτػೳΛ࢖༻͢ΔͱϙϦγʔҧ൓Λݕ஌͢Δ͜ͱ͕Ͱ͖ Δ

ࢀߟจݙ JPCERT/CC HTML5 Λར༻ͨ͠Web ΞϓϦέʔγϣϯͷηΩϡϦςΟ໰୊ʹؔ͢Δௐࠪใࠂॻ https://www.jpcert.or.jp/research/html5.html "
HTML5࣌୅ͷʮ৽͍͠ηΩϡϦςΟɾΤνέοτʯ http://www.atmarkit.co.jp/ait/articles/1311/26/news007.html ͸͕ͤΘΑ͏͚͢ ͞Μ " ʮWebΞϓϦέʔγϣϯ։ൃʹ͓͚ΔHTML5ͷηΩϡϦςΟʯ https://speakerdeck.com/owaspjapan/html5-‐security-‐for-‐web-‐application-‐development-‐number-‐ appsecapac2014 OWASP AppSec APAC 2014 in Tokyo দຊ ӻٓ " ʮHTML5 Security & Headers -‐ X-‐Crawling-‐Response-‐Header -‐ʯ https://www.jpcert.or.jp/present/2014/20140218CODEBLUE-‐HTML5_ja.pdf CODE BLUE ॏ৿ ༑ߦ ͞Μ

͓ΘΓ • ࣭໰ͳͲ y-‐[email protected] @ym405nm

負ける気せえへん HTML5セキュリティやし#OWASP Kansai Local Chapt...

負ける気せえへん HTML5セキュリティやし#OWASP Kansai Local Chapter Meeting 2nd

More Decks by OWASP Japan

Featured

Transcript