Vulnérabilités liées au téléversement de fichiers par Philippe Arteau

PRÉSENTATEUR PRINCIPAL: Philippe Arteau

WEBCAST: http://www.youtube.com/watch?v=mo10to3JNBY

RÉSUMÉ: Le téléversement de fichiers fait partie intégrante des applications web modernes. Qu'il s'agisse d'images ou de documents, plusieurs risques guettent l'acceptation de fichiers provenant d'un utilisateur. Les attaques les plus communes seront présentées allant de simples "webshells" à des problèmes de configuration plus poussés liés au "same orgin policy".

BIO: Philippe est conseiller en sécurité applicative pour le Groupe Technologies Desjardins. Au quotidien, il s'occupe d'effectuer des tests d'intrusions et des revues de code pour des applications utilisées par Desjardins. Il a découvert des vulnérabilités importantes dans plusieurs logiciels populaires comme Google Chrome, DropBox, ESAPI et Jira.

Transcript

1. Presentation by Philippe Arteau
   Owasp Montreal
   Live Demo (In
   french)
   

   View Slide

2. Agenda
   ● Who am I?
   ● The Basics
   ○ Web Shell
   ○ Path traversal
   ● Advanced tricks
   ○ Content-Type weakness
   ○ SWF
   ○ XXE
   

   View Slide

3. Who am I ?
   ● Security Advisor at Desjardins
   ● Bug hunter
   ○ Google Chromium, Dropbox, JIRA, ESAPI, PayPal...
   ● Open-Source developper
   ○ Find Security Bugs (Findbugs security extension)
   ○ Javascript Scanner for ZAP Proxy
   

   View Slide

4. Got a shell !
   

   View Slide

5. Web Shell
   Consist in the upload of a malicious script file.
   Once uploaded, the script can be reach
   remotely to execute command, read file and
   more.
   

   View Slide

6. Path traversal
   ● Vulnerabilities occurs when a path is build
   using user input that is not properly
   sanitize.
   Example :
   upload/$USER$/$FILE$
   upload/test/../../2_shell.php
   Ref: WASC-33: Path Traversal
   

   View Slide

7. HTMHEL
   L
   XSS the easy way
   

   View Slide

8. HTML
   ● Hosting user HTML files is equivalent to be
   vulnerable to XSS
   

   View Slide

9. Content-Type
   ● Content-type allow should be whitelisted
   ● Content Sniffing
   ○ X-Content-Type-Options (IE specific)
   Ref:
   Browser Security Handbook
   Secure Content Sniffing for Web Browsers
   

   View Slide

10. Fishing attack
    Can we trust this URL?
    ● domain *.dropbox.com
    ● ssl certificate
    ● no apparent XSS
    

    View Slide

11. Flash attacks
    cross-domain attacks using SWF
    

    View Slide

12. crossdomain.xml
    ● [...]domain="*.a.com"/>[...]
    

    View Slide

13. SWF attack
    ●
    

    View Slide

14. Bonus
    so you’re parsing XML ?
    

    View Slide

15. XML
    ● Parsing XML is dangerous if advanced
    feature such as Entities are activate
    ○ XML eXternal Entities (XXE)
    ○ XML Entities Expension (XEE)
    Ref:
    WS-Attacks.org: XML Generic Entity Expansion
    

    View Slide

16. XXE
    Example of XXE loading the content of a local
    file (server-side).
    ]>
    
    CONTENT---&xxe;---
    
    

    View Slide

17. Protections
    There is hope..
    

    View Slide

18. Protections
    ● Store files in a directory that is not publicly
    exposed
    ● Don’t use original filename as destination
    ● Validate extension
    ● Validate final path
    ● Validate file content
    ● Domain separation
    ● Make no assumption about the content
    

    View Slide

19. Follow me at
    http://blog.h3xstream.com/
    

    View Slide