research.securitum.com: Recent Episodes
None
In many situations, minor vulnerabilities might seem like small fish in the vast ocean of cybersecurity threats. They’re often marked as low severity and thus, overlooked by developers who assume that the conditions for their exploitation are too complicated to be met. However, in this article, we’re going to challenge that assumption and show you ...
The post How Private Cache Can Lead to Mass Account Takeover – pentest case appeared first on research.securitum.com.
IntroductionUsers often assume that known software is free of security flaws because it has been checked by a sufficient number of tools and security testers. However, this is not an assumption that a pentester or bug hunter can afford to make. Vulnerabilities may lurk in various places, and finding an interesting bug often requires patient searching.
Applying this approach allowed me to discover an XSS class vulnerability in a well-known CMS like WordPress, which I will describe later.
What is postMessage()?To understand my line of thinking and methodology, I first need to discuss what postMessage() is. It is part of the Web API, allows for safe and secure cross-origin communication between Window objects, it means that this method can send a message from one window to another, regardless of their origins. However, wrong usage of this feature can open up potential vectors for security vulnerabilities, such as the XSS we’re discussing in this article.
Root causeLet’s take a look to the core of problem – JavaScript postMessage handler:
if (c.wp.receiveEmbedMessage = function(e) { var t = e.data; if (t) if (t.secret || t.message || t.value) if (!/[^a-zA-Z0-9]/.test(t.secret)) { for (var r, a, i, s = d.querySelectorAll('iframe[data-secret="' + t.secret + '"]'), n = d.querySelectorAll('blockquote[data-secret="' + t.secret + '"]'), o = 0; o < n.length; o++) n[o].style.display = "none"; for (o = 0; o < s.length; o++) if (r = s[o], e.source === r.contentWindow) { if (r.removeAttribute("style"), "height" === t.message) { if (1e3 < (i = parseInt(t.value, 10))) i = 1e3; else if (~~i < 200) i = 200; r.height = i } if ("link" === t.message) if (a = d.createElement("a"), i = d.createElement("a"), a.href = r.getAttribute("src"), i.href = t.value, i.host === a.host) if (d.activeElement === r) c.top.location.href = t.value } } }
Things that could be noticed in this code:
- Secret need to be known (but it’s provided as location.hash of embed webpage, so it’s not a problem)
- Only content window can send postMessages (which is cool, as it’s attacker website)
- If message attribute of postMessage data has link value – crazy things are happening
most important c.top.location.href = t.value where t is postMessage data controlled by the attacker.
The last point obviously can lead to XSS if attacker will use javascript:alert(document.domain) as t.value, however – before it happen important check is made:
if (a = d.createElement("a"), i = d.createElement("a"), a.href = r.getAttribute("src"), i.href = t.value, i.host === a.host)
This code checks if the hostname provided in t.value is the same as the hostname of the embed page. It creates element, but t.value as href attribute and then – takes the host attribute of the created URL. This approach is of course way better than some regular expression magic but there’s a behavior specific in Safari browser:
```
var a = document.createElement("a")> a.href="javascript://google.com/%0aalert(document.domain);//"> console.log(a.host)< google.com ``` All other browsers return an empty string in case of using javascript: scheme, but not Safari. This could lead the attacker to use javascript schema and execute javascript code in top window (victim’s blog).
Steps to reproduce
- Get an evil WordPress instance.
- Edit wordpress/wp-includes/theme-compat/embed.php file and add your custom HTML code:
```
``` 3. Create any post on an attacker blog, publish it and get its URL. 4. On victim WordPress site (Safari) add new post with embed post from victim WordPress 5. Alert executed:
SummaryThis analysis and found bug demonstrates that even widely used platforms like WordPress are not immune to such known vulnerabilities as XSS.
The problem we found in the JavaScript postMessage handler shows how penetration testers can use deep knowledge how different web browsers work, and attack a function that was considered safe. This problem has now been fixed, but it’s a clear message to everyone creating websites and web apps that security audits need to be ongoing and cover all web browsers.
References:
- https://wpscan.com/vulnerability/3b574451-2852-4789-bc19-d5cc39948db5
- https://wordpress.org/news/2023/05/wordpress-6-2-1-maintenance-security-release/
The post XSS in WordPress via open embed auto discovery appeared first on research.securitum.com.
Do you suffer from eternal lack of time for system updates? Finally managed to find a moment to install them, but you didn’t finish the whole process because you had to run out of the office? Is your data safe? Read this article to find out.
As always in the IT world, it is difficult to find a good and refined standard. Linux has LUKS, Apple uses FileVault and Windows has BitLocker.
In fact, each of these solutions do the same thing: they provide full disk encryption (FDE). Thanks to this, even if our device or disk is physically taken over by unauthorized persons, we can be sure that the data stored on it will remain confidential. Well, at least if we used a strong enough password.
Encryption we can trust?
BitLocker has been with us for a long time, so long that it even remembers the Windows Vista days. Some individuals and organizations for which disk encryption of Windows devices has become a necessity have resisted the use of Microsoft’s solution.
BitLocker is a closed solution. While the algorithm used, i.e. AES (Advanced Encryption Standard) and its block encryption modes – CBC and XTS, are in the public domain and have been subjected to many evaluations, the implementation itself (specific code, in a specific programming language) remains proprietary.
In the “crypto” world, that’s reason enough to be wary. Even a perfect algorithm with mathematically proven properties can be vulnerable to attacks after incorrect implementation. There is a whole class of vulnerabilities called side-channel attacks that covers this issue.
The eyes of many users have turned to open solutions such as TrueCrypt. But not for long.
It quickly turned out that the “big” updates (so-called feature updates) of Windows are incompatible with various disk encryption methods that come from vendors independent of Microsoft. The Internet was flooded with a wave of posts of frustrated users whose devices turned to bricks just after rebooting the device, forced by the installation of updates.
The reason is simple, some updates for Windows use the Windows Preinstallation Environment (Windows PE, WinPE) which is an operating system in itself and, like “classic” Windows, requires dedicated drivers to understand the full disk encryption used and to cooperate with them.
Despite this, some users tried to stick to open source solutions, decrypting the entire disk before installing the update and re-encrypting it after completing this process.
In a business environment, it was disruptive to say the least. Mechanical 2.5-inch drives often took 24 or more hours to complete the above mentioned process and there were dozens or hundreds of devices.
Thus, even the most conscious users, tired of the whole process, finally apologized to BitLocker.
Today the problem of WinPE and the so-called 3rd party encryption solutions is less of a nuisance, but it’s hard to come across a large Windows-based environment that uses anything other than BitLocker.
Because with BitLocker everything works…
Here we come to the heart of the matter.
It seems that many users who have “struggled” with TrueCrypt or who have always used BitLocker have accepted that the solution is hassle-free, without asking any additional questions.
So how does Microsoft’s FDE solution deal with the previously described problems? Well… It does not. If necessary, it simply leaves our device and data unprotected. Shocking? This is just the beginning.
How does BitLocker work?
Running a reasonably modern PC in a way that ensures that its components have not been tampered with is an insanely complicated process.
Additionally, BitLocker itself is quite flexible and allows you to configure the way you enter a password to access your data. Here we have the opportunity to take advantage of, among others, TPM (Trusted Platform Module), PIN, text password, and even an external USB key.
BitLocker is basically a low-level driver. As long as we access the disk using the functions provided by Windows, its work is transparent to us.
So Microsoft decided to encrypt the main key called FVEK (Full Volume Encryption Key), which ensures the security of our data using a series of other keys – VMK (Volume Master Key).
In short, each VMK is a key encrypted with a different access method. This allows us to simultaneously access our data using both a text password and a Recovery Key.
All data is stored on a protected volume, in metadata marked with the header -FVE-FS- (some information is also stored in TPM, if it is in use).
The process of preparing BitLocker to work looks like this:
· The user provides the data needed to decrypt one of the VMK or TPM keys, after making sure that the system has not been tampered with, and releases the VMK key;
· the FVEK key is decrypted with the VMK key;
· FVEK key allows you to encrypt and decrypt data stored on the disk.
Each of the methods allowing access to the VMK key is called KP (Key Protector), each VMK key (outside of TPM) is therefore encrypted with KP.
During the update of the components of our device, a number of processes will take place in which we will not be able to decrypt the contents of the disk, and thus perform the activities related to the modernization, for example:
· after updating the BIOS, TPM determines that the system has been tampered with and will not release the VMK key;
· WinPE may not be able to communicate with the TPM and thus fail to obtain the VMK.
How does BitLocker handle these situations?
Brutal reality
Let’s follow the installation process of the feature update for the Windows 10 environment.
With the help of the screenshot above, we can describe the situation in which our system is currently located:
· The device drive has been fully encrypted with BitLocker. Encryption has been successfully completed for the entire disk. The algorithm is XTS-AES-128.
· The current operating system is Windows 10 Professional, version 1903 build 18362.449.
· Windows has finished downloading the update to 20H2 and prompted you to reboot to complete the installation.
· On the C: drive, in the root directory, there is, among others, a secret.txt file that can only be accessed if you know the BitLocker password.
Let’s see what the metadata related to BitLocker looks like at the same time.
The bdeinfo tool returns the information that there are two KPs available:
· Password – as the name suggests, this is our password,
· Recovery password – is our recovery key.
The program also clearly states that it is not possible to unlock the volume. The data is safe.
As Windows “requests”, let’s restart the computer. But only the part until the machine is turned off. We’re not rebooting it.
Another look at the metadata reveals the new Key Protector number 2, Clear Key type!
What is the new KP? It is a string of characters that was used to encrypt another copy of the VMK key, saved in the form of… public text. During shutdown, Windows put BitLocker into an operating mode called Suspended.
Since we have access to the string encrypted by VMK, it means that, as a consequence, we have access to all data on the disk. Let’s check it.
Attempting to mount the volume is successful!
We have access to the data stored on the disk, including the contents of the previously mentioned secret.txt file.
What’s more, we can get the FVEK key using the dislocker tool.
An interesting fact is that the system does not inform the user in any way that his data will not be protected during the update.
What happens next? The installation of the system update continues.
And upon its complete completion, Key Protector number 2 is removed from the metadata.
However, this is not very comforting, because if during the update someone managed to obtain the contents of the FVEK key, they will still be able to decrypt our disk without the need for any password or other key.
At this point, it is very important to understand that the presented operation of the mechanism is not a bug or a vulnerability. This is a design decision made by Microsoft. The way BitLocker works.
Microsoft’s solution creates situations that can cause problems and temporarily stop BitLocker from protecting our data.
The irony
The encryption “suspend” mechanism is not closely related to system updates. This is one of the BitLocker modes of operation. On Microsoft’s website, we will find detailed information on how we can operate it ourselves.
We can “suspend” encryption for a certain number of reboots or indefinitely.
The main danger of this mechanism is that we have no guarantee that after putting BitLocker in Suspended mode, the Clear Key type Key Protector will later be deleted.
So it’s worth checking from time to time how BitLocker is configured, which we entrusted with the data encryption function. Especially in the Active Directory environment, where there are hundreds of devices, and thus the probability of the problem is greater.
As in the screenshot above, the volume for which encryption is “suspended” gets an exclamation point icon. Pertinent information is also provided in the manage-bde tool.
Summary
In this article, I have outlined a potential angle for an attack on devices using BitLocker full disk encryption.
That being said, I am far from giving this tool a negative opinion: it works efficiently and uses reasonable algorithms. However, it does not change the fact that some of Microsoft’s design decisions seem to be a bit questionable, to say the least. And what do you think about Suspended mode? Be sure to let me know in the comments.
The post How to access data secured with BitLocker? Do a system update appeared first on research.securitum.com.
Last month, Amazon lost control of its cloud-based IP address pool for more than three hours, which allowed cyber criminals to steal $235,000 from users of one of AWS’s customers. Using BGP hijacking, hackers gained control over a pool of 256 IP addresses. Briefly describing the BGP protocol, it is a backbone – the basis ...
The post Amazon once again lost control (for 3 hours) over the IP pool in a BGP Hijacking attack appeared first on research.securitum.com.
SOCMINT is the process of gathering and analyzing the information collected from various social networks, channels and communication groups in order to track down an object, gather as much partial data as possible, and potentially to understand its operation. All this in order to analyze the collected information and to achieve that goal by making ...
The post SOCMINT – or rather OSINT of social media appeared first on research.securitum.com.
PyScript – or rather Python in your browser + what can be done with it? A few days ago, the Anaconda project announced the PyScript framework, which allows Python code to be executed directly in the browser. Additionally, it also covers its integration with HTML and JS code. An execution of the Python code in ...
The post PyScript – or rather Python in your browser + what can be done with it? appeared first on research.securitum.com.
Collecting information about the domain environment with SharpHound A program that collects domain environment data – SharpHound is a component of the BloodHound tool. The collection of environmental data starts when SharpHound.exe is run on one of the computers. The entire BloodHound package can be downloaded (Figure 32) from the address: https://github.com/BloodHoundAD/BloodHound/releases After downloading and ...
The post Part 3. Windows security: reconnaissance of Active Directory environment with BloodHound. appeared first on research.securitum.com.
Windows security: reconnaissance of Active Directory environment with BloodHound. In this article we will take a closer look at the BloodHound tool – Six Degrees of Domain Admin. The application was developed in JavaScript and built using the Electron platform. The graphical visualization uses the Neo4j database. During the experiment, we will use a Windows ...
The post Part 1. Windows security: reconnaissance of Active Directory environment with BloodHound. appeared first on research.securitum.com.
Windows security – what is LSASS dump. How to protect against it? The ability of Advanced Persistent Threat (APT) groups and other threat actors to take a dump of Windows credentials is a serious threat especially to enterprises and other organizations. The MITRE ATT&CK knowledge base, which is created primarily to support defense against cyber ...
The post Part 1. Windows security – what is LSASS dump. How to protect against it? appeared first on research.securitum.com.
Bypassing LSA Protection (RunAsPPL) with Mimikatz Mimikatz is a tool by Benjamin Delpy for extracting Windows credentials in various ways. Important note: It is possible that running Mimikatz on Windows 10 will end in an error: kuhl_m_sekurlsa_acquireLSA ; Key import It may be helpful to use an older version, specifically Mimikatz v2.1.1 from here: https://github.com/gentilkiwi/mimikatz/files/4167347/mimikatz_trunk.zip ...
The post Part 2. Windows security – what is LSASS dump. How to protect against it? appeared first on research.securitum.com.
There is a lot of legacy software running all over the network. This is an excellent example of technological debt. And the debt means that we are borrowing. We borrow time before compromise. It’s quite easy to identify that some software or system is outdated and no longer supported. Yet, it seems that no one ...
The post Is running legacy software with no publicly known exploits safe? appeared first on research.securitum.com.
A little experiment - comparison of Google, Bing and Yandax in terms of reverse image search. Guest post by Krzysztof Wosinski
The post Comparison of reverse image searching in popular search engines [OSINT hints] appeared first on research.securitum.com.
This article is about the recently published security advisory for a pretty popular software, fail2ban (CVE-2021-32749). It is about a bug that may lead to Remote Code Execution.
The post fail2ban – Remote Code Execution appeared first on research.securitum.com.
In this blog post I share my experience with helping secure DOMPurify and trying to kill an entire class of bypasses
The post Helping secure DOMPurify (part 1) appeared first on research.securitum.com.
In this blogpost I’ll explain my recent bypass in DOMPurify – the popular HTML sanitizer library. In a nutshell, DOMPurify’s job is to take an untrusted HTML snippet, supposedly coming from an end-user, and remove all elements and attributes that can lead to Cross-Site Scripting (XSS). This is the bypass: Believe me that there’s not ...
The post Mutation XSS via namespace confusion – DOMPurify < 2.0.17 bypass appeared first on research.securitum.com.
In this article I’ll cover the prototype pollution vulnerability and show it can be used to bypass client-side HTML sanitizers. I’m also considering various ways to find exploitation of prototype pollution via semi-automatic methods. It could also be a big help in solving my XSS challenge. Prototype pollution basics Prototype pollution is a security vulnerability, ...
The post Prototype pollution – and bypassing client-side HTML sanitizers appeared first on research.securitum.com.
On Jun 16, 2020 a security advisory for Ruby Sanitize library was released about an issue that could lead to complete bypass of the library in its RELAXED config. I have found this bug during a penetration test conducted by Securitum, and in this post I’ll explain how I came up with the idea of ...
The post HTML sanitization bypass in Ruby Sanitize < 5.2.1 appeared first on research.securitum.com.
On 6th July 2020 I’ve announced a XSS challenge on my Twitter. So far only four people were able to solve it and every single one of them told me that they had never heard about the quirk used in the challenge before. So here’s a writeup explaining this quirk along with some backstory. The ...
The post Marginwidth/marginheight – the unexpected cross-origin communication channel appeared first on research.securitum.com.
Summary: During my research on other bug bounty program I’ve found Cross-Site Scripting vulnerability in cmp3p.js file, which allows attacker to execute arbitrary javascript code in context of domain that include mentioned script. Below you can find the way of finding bug bounty vulnerabilities from the beginning to the end, which includes: In depth analysis ...
The post Art of bug bounty: a way from JS file analysis to XSS appeared first on research.securitum.com.
This writeup is a summary of my research on issues in handling copying and pasting in: browsers, popular WYSIWYG editors, and websites. Its main goal is to raise awareness that the following scenario can make users exposed to attacks: The victim visits a malicious site, The victim copies something from the site to the clipboard, ...
The post The Curious Case of Copy & Paste – on risks of pasting arbitrary content in browsers appeared first on research.securitum.com.