I. Web Application Security
A. Goal
------------------------------------------
GOALS OF WEB SECURITY
Confidentiality:
- No unwanted information disclosure
by browsing web
Isolation:
- Site A cannot interfere with
session browsing site B
Web app security:
- Apps on web can achieve same security
as on desktop
------------------------------------------
What does the first goal mean about user behavior?
What would be one way to formalize (or check) the second goal?
What does it mean for one site to interfere with a session
browsing another site?
B. threat model
------------------------------------------
WEB ATTACKER THREAT MODEL
Attacker can:
- controls website (attacker.com)
- can obtain SSL/TLS certificate(s)
However, attacker does NOT:
- control network
------------------------------------------
What does controlling a website mean from the user's viewpoint?
What would a web-based attacker want to do?
1. focus
------------------------------------------
FOCUS NOT ON WEB MALWARE
Web malware (exploiting browsers):
- trojans
- adware
(called "drive-by-downloads")
- control as in our previous study
- but NOT our focus now
Instead:
- we now focus on the web attacks
that are specific to the web
------------------------------------------
------------------------------------------
OUR FOCUS
Web-based attacks,
not attacks on browsers themselves
Examples:
- Cross-site Scripting (XSS)
- SQL injection
- Cross-site Request Forgery (CSRF)
------------------------------------------
Are XSS and CSRF important kinds of attacks?
C. background
1. URLs
------------------------------------------
URL
http://columbia.edu:80/class?name=4995#h
^ ^ ^ ^ ^ ^
| | ^ \path \query |
| \host name \port |
protocol fragment
Special characters are encoded as
hexadecimal escapes (e.g.):
- %0A = newline
- %20 = space
------------------------------------------
2. HTTP
a. requests
------------------------------------------
HTTP REQUESTS
Method File name version
| | |
v v v
GET /index.html HTTP/1.1
Accept: image/gif, image/x-bitmap,
image/jpeg, */*
Accept-Language: en
Connection: Keep-Alive
User-Agent: Mozilla/1.22
(compatible; MSIE 2.0; Windows 95)
Host: www.example.com
Referer: http://www.google.com?q=dingbats
<- Blank line
<- Data (none)
------------------------------------------
Is this any different in HTTPS?
Does HTTPS guarantee that the browser and server can trust
each other?
What is the difference between GET and POST?
b. response
------------------------------------------
HTTP RESPONSE
Protocol Status Reason phrase
| Code /
| | /
v v v
HTTP/1.1 200 OK
Date: Thu, 24 Jul 2008 17:36:27 GMT
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=UTF-8
<-- Blank line
... data ...
------------------------------------------
Does the data need to be HTML?
Could the response redirect the browser to another URL?
c. Browser execution model
------------------------------------------
BASIC BROWSER EXECUTION MODEL
Loop for each window/tab/frame:
- Load content
- Render content
- Processes HTML and scripts, possibly:
- display images
- recursively process subframes
- Respond to events, which may be:
- user actions (OnClick, OnMouseover)
- rendering (OnLoad, OnBeforeUnload)
- timing: (setTimeout, clearTimeout)
------------------------------------------
------------------------------------------
EXAMPLE WEBPAGE
Adapted from:
http://www.w3schools.com/js/js_output.asp
My First Web Page
------------------------------------------
How would this execute?
d. Document-Object Model (DOM)
------------------------------------------
DOCUMENT-OBJECT MODEL (DOM)
- API for web pages
- Web pages are hierarchically-structured
data
Property examples:
document.alinkColor
document.URL
document.forms[]
document.links[]
document.anchors[]
...
Methods:
document.write()
...
DOM includes Browser-Object Model (BOM):
window, document, frames[], history
location, navigator
------------------------------------------
Have you used this before in Javascript?
------------------------------------------
CHANGING THE HTML USING JAVASCRIPT
Examples of Javascript methods
that can change HTML:
- createElement(elementName)
- createTextNode(text)
- appendChild(newChild)
- removeChild(node)
------------------------------------------
Could Javascript be used to add a new list item to a
displayed list?
D. isolation of web sessions
------------------------------------------
FRAMES and IFRAMES
Frames are HTML elements
Uses of frames:
- delegate screen area to another source
- isolation from browser, so
parent may work even if frame broken
Kinds of frames:
- Frame: rigid division of webpage
- iFrame: floating inline frame
------------------------------------------
What webpages have you seen that use frames?
a. browser is analogous to OS
------------------------------------------
BROWSER ACTS LIKE OS
OS WEB BROWSER
Data: Data:
- Files - Cookies
Operations: Operations:
- System calls - DOM
Actor: Actor:
- Process - Frame
Principal: Principal:
- User - Origin
Access control: Access control:
- mandatory - discretionary
Vulnerabilities: Vulnerabilities:
- buffer overflow - XSS
- elev. of priv. - CSRF
- CPU cache hist. - Cache history
------------------------------------------
E. revisiting the goals
------------------------------------------
MORE SPECIFIC GOALS
Each frame has an origin
protocol://host:port
Associate data with an origin
Policy:
------------------------------------------
Does an origin really correspond to an individual person?
What would be a concrete example of an origin?
What would be a good way to use origins and frames to
formalize isolation?
F. attacks
------------------------------------------
ATTACK OVERVIEW
OWASP Top 10:
2013 2021
4. 1. Broken access control
1. 3. Injection and XSS
2. 7. Broken authentication
10. SSRF
------------------------------------------
What is broken access control?
II. Cross-site Scripting (XSS) Attacks and Defenses
------------------------------------------
Cross-site Scripting (XSS)
Attack:
- Injects malicious script
into trusted context
Attacker's goal:
- Steal information from honest website
------------------------------------------
What kind of threat is the attacker posing?
A. type 1 attacks (non-persistent)
------------------------------------------
CROSS-SITE SCRIPTING (XSS), TYPE 1
Attack idea:
1. Design URL containing malicious script
2. Get user to click on that URL
3. Web server puts the script on web page
that is rendered on the user's browser
4. The user's browser
runs the malicious script
In JSP:
<%= request.getParameter("Name") %>
In Ruby on Rails:
<%= comment.body %>
------------------------------------------
How do you get step 2 to work?
Why doesn't the attacker run the script themselves?
What role does the web server play in this?
What threats are served by this attack?
1. example
------------------------------------------
EXAMPLE XSS ATTACK, PAYPAL (2006)
1. Attackers contacted users via email
2. Fooled them into accessing URL
hosted on the legitimate PayPal website
3. Injected code redirected PayPal
visitors to a page warning users
their accounts had been compromised
4. Victims were redirected to a phishing
site and prompted to enter sensitive
financial data.
------------------------------------------
B. type 2, persistent xss attacks
------------------------------------------
STORED XSS ATTACKS (TYPE 2)
Like type 1, but the malicious query is
stored by the server
1. Send input containing malicious script
to the server, which stores it
2. Get user to browse that web site
3. Web server puts the script on web page
that is rendered on the user's browser
4. The browser runs the malicious script
------------------------------------------
What kinds of web sites store user input and show it to others?
Is there social engineering necessary to make this work?
1. example, stored images
------------------------------------------
STORED IMAGE ATTACK
Can a JPEG contain HTML?
Yes, if request for site.com/pic.jpg
results in:
HTTP/1.1 200 OK
...
Content-Type: image/jpeg
fooled ya
Some browsers would render the HTML
------------------------------------------
Consider a photo-sharing site that allows users to upload
images, could this result in XSS attacks?
2. example, PDF viewer feature
------------------------------------------
PDF VIEWER ATTACK
Adobe PDF viewer (vers. 7.9 and earlier)
- Viewer would execute JavaScript
in URLs such as:
http://path/to/pdf/
file.pdf#name=javascript:code_here
- JavaScript executed in context of
domain where PDF file is hosted
Attack:
1. Find PDF file on website.com
2. Create URL with JavaScript
http://website.com/path/to/
file.pdf#s=javascript:alert("xss");
3. Get victim to click on link
4. Reader plugin would execute
the JavaScript
------------------------------------------
What could the JavaScript do?
Could this affect your local computer?
C. response splitting
------------------------------------------
RESPONSE SPLITTING
Puts malicous script in HTTP headers
In Ruby on Rails:
redirect_to(url)
------------------------------------------
What's the problem with the rails code?
D. Summary of XSS attacks
What mistake is made by the developers that premits XSS attacks?
What can be done to prevent the attack?
What kind of tool could catch the bad code involved?
E. mitigation of XSS attacks
------------------------------------------
MITIGATING XSS ATTACKS
What can be done to stop XSS attacks?
------------------------------------------
1. use caution in filtering
------------------------------------------
CAUTION: SCRIPTS NOT ONLY IN
/* API response */
alert(document.domain);
------------------------------------------
Can an attacker use a JSONP interface to execute arbitrary JavaScript?
------------------------------------------
REFLECTION
What does this JavaScript do?
var array =
document
.getElementById('cmd')
.value.split(',');
window[array[0]]
.apply(this, array.slice(1));
Is it dangereous if the attacker controls
the value of cmd?
------------------------------------------
------------------------------------------
DYNAMIC CODE FROM ANGULAR.JS
What does this script do?
{{ 1000 - 1 }}
Is it dangerous if such a script gets data
from the DOM?
Does Angular use eval()?
Angular also has a CSP-compatability mode
(ng-csp) that interprets scripts
for itself
Can that mode bypass CSP restrictions?
Does the app need to use Angular
to be attacked?
------------------------------------------
Does angular use eval()?
Can Angular's CSP-compatability mode bypass CSP restrictions?
Does the app need to use Angular to be attacked?
------------------------------------------
DATA OFTEN INTERPRETED AS JAVASCRIPT
Web browsers interpret JavaScript
everywhere:
CSV data:
Name,Value
alert(1),234
Error messages that echo arguments:
Error: alert(1)// not found.
User file uploads
------------------------------------------
When would a user file upload cause trouble?
Do these problems affect an app if a trusted source of
scripts has such problems?
iv. Path restriction policies
------------------------------------------
CSP2 ALLOWS PATHS IN A WHITELIST
Content-Security-Policy:
script-src example.org
parially-trusted.org/foo/bar.js
Does this respect privacy?
Is this easy to maintain?
So, CSP2 allows redirects
Is allowing a redirect secure?
------------------------------------------
Do paths in CSPs respect privacy?
Do paths in CSPs help or hurt maintenance?
Are redirects safe?
b. study results
------------------------------------------
RESULTS OF STUDY
From Weichselbaum et al. (CCS'16),
section 3
Data: all web pages
------------------------------------------
i. How CSP is used in practice
------------------------------------------
USE IN PRACTICE
Only 3.7% of web pages had a CSP
Policies that can be bypassed:
- using unsafe-inline
- missing object-src
- use of wildcards in whitelists
- unsafe origin in whitelist
contains JSONP or angular.js
In practice use of:
unsafe-inline 87.26%
unsafe-eval 81.65%
wildcards about 70%
unsafe origins about 50%
------------------------------------------
What do these data tell us?
c. improvements to CSP
------------------------------------------
IMPROVEMENTS PROPOSAL
In the Weichselbaum et al. (CCS'16) paper
section 4
- Don't rely on whitelists
- Use nonces, from inline (static) sources
Content-Security-Policy:
script-src 'nonce-random123'
default-src 'none'
------------------------------------------
What is a nonce?
How does that help?
------------------------------------------
HOW TO ALLOW DYNAMIC SCRIPTS?
JavaScript libraries often use dynamically
created scripts
How can these scripts get the right nonce?
With script-src script-dynamic
- nonce inherited by scripts
created by trusted scripts
This works on several apps
e.g., Google Maps
------------------------------------------
How can dynamically created scripts get the right nonce?
d. evaluation
------------------------------------------
LIMITATIONS OF THE PROPOSAL
Of the Weichselbaum et al. (CCS'16) paper
- XSS can occur
if attacker can inject URL
used to dynamically create script
- injections into scripts with nonces
will allow unrestricted code
------------------------------------------
------------------------------------------
COMPATABILITY
Need to rewrite code that uses:
- document.write() to add scripts
instead:
- pass nonce, or
- use createElement()
- inline event handlers
- URIs of the form javascript:...
------------------------------------------
e. Summary
------------------------------------------
SUMMARY
Of the Weichselbaum et al. (CCS'16) paper
- CSP is insecure in practice
due to whitelists
- nonce-based CSP would be better
------------------------------------------
III. Cross-Site Request Forgery (CSRF or XSRF)
A. background on the attack
1. use of cookies for authentication
------------------------------------------
SESSIONS USING COOKIES
Browser Server
[] POST/login.cgi []
[] ---------------->[]
[] []
[] set-cookie: authenticator
[] <--------------- []
[] []
[] GET: Cookie: authenticator
[]----------------> []
[] []
[] response []
[] <--------------- []
------------------------------------------
2. example of attack
------------------------------------------
ATTACK EXAMPLE
1. User logs in to bank.com
- Session cookie remains in browser
2. User visits another site with