Daily Life - Something Trivial , Something Small

Saturday, 3 May 2014

Microsoft Live Online Service OAuth 2.0 Covert Redirect Web Security Bugs (Information Leakage & Open Redirect)

Microsoft Live Online Service OAuth 2.0 Covert Redirect Web Security Bugs (Information Leakage & Open Redirect)

(1) Domain:
live.com

(2) Vulnerability Description:
Live web application has a computer security problem. Hacker can exploit it by Covert Redirect cyber attacks.

The vulnerabilities can be attacked without user login. Tests were performed on Microsoft IE (10.0.9200.16750) of Windows 8, Mozilla Firefox (34.0) & Google Chromium 39.0.2171.65-0 ubuntu0.14.04.1.1064 (64-bit) of Ubuntu (14.04)，Apple Safari 6.1.6 of Mac OS X Lion 10.7.

(2.1) Vulnerability Detail:
Live's OAuth 2.0 system is susceptible to Attacks. More specifically, the authentication of parameter "&redirct_uri" in OAuth 2.0 system is insufficient. It can be misused to design Open Redirect Attacks to Live.

It increases the likelihood of successful Open Redirect Attacks to third-party websites, too.

The vulnerability was reported to Microsoft. Microsoft replies "We have completed our investigation and concluded that the vulnerability exists in idp.plane.edu.au and not login.live.com. I would recommend reporting this issue to plane.edu.au. We will be closing this case."

The vulnerabilities occurs at page "/oauth20_authorize.srf?" with parameter "&redirect_uri", e.g.
https://login.live.com/oauth20_authorize.srf?client_id=0000000040069047&scope=wl.basic&response_type=code&redirect_uri=http%3A%2F%2Fidp.plane.edu.au%2Fsimplesaml%2Fmodule.php%2Fmultiauth%2Fselectsource.php%3FAuthState%3D_c96d1f2d80c2dd6116e61ac3f08a7fa4c9b4454d4b%253Ahttp%253A%252F%252Fwww.tetraph.com%252Fessayjeans%252Fpoems%252Ffish_water.html [1]

Before acceptance of third-party application:
When a logged-in Live user clicks the URL ([1]) above, he/she will be asked for consent as in whether to allow a third-party website to receive his/her information. If the user clicks OK, he/she will be then redirected to the URL assigned to the parameter "&redirect_uri".

If a user has not logged onto Live and clicks the URL ([1]) above, the same situation will happen upon login.

After acceptance of third-party application:
A logged-in Live user would no longer be asked for consent and could be redirected to a webpage controlled by the attacker when he/she clicks the URL ([1]).

For a user who has not logged in, the attack could still be completed after a pop-up page that prompts him/her to log in.

(2.1.1) Live would normally allow all the URLs that belong to the domain of an authorized third-party website. However, these URLs could be prone to manipulation. For example, the "&redirect_uri" parameter in the URLs is supposed to be set by the third-party websites, but an attacker could change its value to make Attacks.

Hence, a user could be redirected from Live to a vulnerable URL in that domain first and later be redirected from this vulnerable site to a malicious site unwillingly. This is as if the user is redirected from Live directly. The number of Live's OAuth 2.0 client websites is so huge that such Attacks could be commonplace.

Before acceptance of the third-party application, Live's OAuth 2.0 system makes the redirects appear more trustworthy and could potentially increase the likelihood of successful Open Redirect Attacks of third-party website.

Once the user accepts the application, the attackers could completely bypass Live's authentication system and attack more easily.

It might be of Live's interest to patch up against such attacks.

(2.2) Used one of webpages for the following tests. The webpage is "http://lifegrey.tumblr.com/". Can suppose it is malicious.

Below is an example of a vulnerable third-party domain:
idp.plane.edu.au

Vulnerable URL in this domain:
http://idp.plane.edu.au/simplesaml/module.php/multiauth/selectsource.php?AuthState=_c96d1f2d80c2dd6116e61ac3f08a7fa4c9b4454d4b%3Ahttp%3A%2F%2Fwww.tetraph.com%2Fessayjeans%2Fpoems%2Ffish_water.html

Vulnerable URL from Live that is related to idp.plane.edu.au:
https://login.live.com/oauth20_authorize.srf?client_id=0000000040069047&scope=wl.basic&response_type=code&redirect_uri=http%3A%2F%2Fidp.plane.edu.au

POC:
https://login.live.com/oauth20_authorize.srf?client_id=0000000040069047&scope=wl.basic&response_type=code&redirect_uri=http%3A%2F%2Fidp.plane.edu.au%2Fsimplesaml%2Fmodule.php%2Fmultiauth%2Fselectsource.php%3FAuthState%3D_c96d1f2d80c2dd6116e61ac3f08a7fa4c9b4454d4b%253Ahttp%253A%252F%252Fwww.tetraph.com%252Fessayjeans%252Fpoems%252Ffish_water.html

(2.3) The following URLs have the same vulnerabilities.
https://oauth.live.com/authorize?client_id=0000000044072822&scope=wl.basic%20wl.offline_access%20wl.signin%20wl.birthday%20wl.emails%20wl.phone_numbers%20wl.postal_addresses%20wl.share%20wl.work_profile&response_type=code&redirect_uri=http://www.denglu.cc/dl_receiver.php&state=31482_windowslive_284401

POC Video:
https://www.youtube.com/watch?v=z3Eq6GJsHWI

Blog Detail:
http://tetraph.blogspot.com/2014/05/microsoft-lives-oauth-20-covert.html

(3) What is Covert Redirect?

Covert Redirect is a class of security bugs disclosed in May 2014. It is an application that takes a parameter and redirects a user to the parameter value without sufficient validation. This often makes use of Open Redirect and XSS (Cross-site Scripting) vulnerabilities in third-party applications.

Covert Redirect is also related to single sign-on. It is known by its influence on OAuth and OpenID. Hacker may use it to steal users' sensitive information. Almost all OAuth 2.0 and OpenID providers worldwide are affected. Covert Redirect can work together with CSRF (Cross-site Request Forgery) as well. After Covert Redirect was published, it is kept in some common databases such as SCIP, OSVDB, Bugtraq, and X-Force. Its scipID is 13185, while OSVDB reference number is 106567. Bugtraq ID: 67196. X-Force reference number is 93031.

Discover and Reporter:

Wang Jing, Division of Mathematical Sciences (MAS), School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore. (@justqdjing)

http://tetraph.com/wangjing/

https://twitter.com/tetraphibious/status/559168921534603264
https://tetraph.wordpress.com/2014/09/06/microsoft-live-vulnerability/
http://computerobsess.blogspot.com/2014/07/microsoft-live-exploit.html
http://webcabinet.tumblr.com/post/119496963567/securitypost
http://tetraph.blog.163.com/blog/static/2346030512014440315992/
http://securityrelated.blogspot.com/2014/07/microsoft-live-exploit.html
http://www.inzeed.com/kaleidoscope/covert-redirect/microsoft-lives-oauth-2-0-covert-redirect-vulnerablity/
http://whitehatpost.lofter.com/post/1cc773c8_706b622
https://computertechhut.wordpress.com/2014/09/02/microsoft-live-vulnerability/

Friday, 2 May 2014

Nytimes Covert Redirect Vulnerability Based on Google Doubleclick

(1) WebSite:

nytimes.com

"The New York Times (NYT) is an American daily newspaper, founded and continuously published in New York City since September 18, 1851, by the New York Times Company. It has won 117 Pulitzer Prizes, more than any other news organization.

The paper's print version has the largest circulation of any metropolitan newspaper in the United States, and the second-largest circulation overall, behind The Wall Street Journal. It is ranked 39th in the world by circulation. Following industry trends, its weekday circulation has fallen to fewer than one million daily since 1990. Nicknamed for years as "The Gray Lady", The New York Times is long regarded within the industry as a national "newspaper of record". It is owned by The New York Times Company. Arthur Ochs Sulzberger, Jr., (whose family (Ochs-Sulzberger) has controlled the paper for five generations, since 1896), is both the paper's publisher and the company's chairman. Its international version, formerly the International Herald Tribune, is now called the International New York Times." (Wikipedia)

(2) Vulnerability Description:

The New York Times web application has a computer cyber security problem. Hacker can exploit it by Covert Redirect attacks.

The programming code flaw occurs at “adx_click.html?” page with “&goto” parameter, i.e.
http://www.nytimes.com/adx/bin/adx_click.html?type=goto&opzn&page=www.nytimes.com/pages/nyregion/index.html&pos=SFMiddle&sn2=8dfce1f6/9926f9b3&sn1=bbba504f/c0de9221&camp=CouplesResorts_1918341&ad=NYRegionSF_Feb_300x250-B5732328.10663001&goto=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fddm%2Fclk%2F279541164%3B106630011%3Bs%3Fhttp%3A%2F%2Ffacebook%2Ecom%2Fall%2Dinclusive%2Ephp%3Futm%5Fsource%3Dnyt%26utm%5Fmedium%3Ddisplay%26utm%5Fcontent%3Dclicktracker%26utm%5Fcampaign%3D300x250%5FExpectMore%5FNYT%5FNYRegion

(2.1) When a user is redirected from Nytimes to another site, Nytimes will check parameters “&sn1″ and “&sn2″. If the redirected URL’s domain is OK, Nytimes will allow the reidrection.
However, if the URLs in a redirected domain have open URL redirection vulnerabilities themselves, a user could be redirected from Nytimes to a vulnerable URL in that domain first and later be redirected from this vulnerable site to a malicious site. This is as if being redirected from Nytimes directly.

One of the vulnerable domain is,
doubleclick.net (Google’s Ad website)

(2.2) Use one of webpages for the following tests. The webpage address is “http://xingti.tumblr.com”. We can suppose that this webpage is malicious.

Vulnerable URL:
http://www.nytimes.com/adx/bin/adx_click.html?type=goto&opzn&page=www.nytimes.com/pages/nyregion/index.html&pos=SFMiddle&sn2=8dfce1f6/9926f9b3&sn1=bbba504f/c0de9221&camp=CouplesResorts_1918341&ad=NYRegionSF_Feb_300x250-B5732328.10663001&goto=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fddm%2Fclk%2F279541164%3B106630011%3Bs%3Fhttp%3A%2F%2Ffacebook%2Ecom%2Fall%2Dinclusive%2Ephp%3Futm%5Fsource%3Dnyt%26utm%5Fmedium%3Ddisplay%26utm%5Fcontent%3Dclicktracker%26utm%5Fcampaign%3D300x250%5FExpectMore%5FNYT%5FNYRegion

POC:
http://www.nytimes.com/adx/bin/adx_click.html?type=goto&opzn&page=www.nytimes.com/pages/nyregion/index.html&pos=SFMiddle&sn2=8dfce1f6/9926f9b3&sn1=bbba504f/c0de9221&camp=CouplesResorts_1918341&ad=NYRegionSF_Feb_300x250-B5732328.10663001&goto=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fddm%2Fclk%2F279541164%3B106630011%3Bs%3Fhttp%3A%2F%2Ftetraph%2Ecom%2Fblog%3F%2Dinclusive%2Ephp%3Futm%5Fsource%3Dnyt%26utm%5Fmedium%3Ddisplay%26utm%5Fcontent%3Dclicktracker%26utm%5Fcampaign%3D300x250%5FExpectMore%5FNYT%5FNYRegion

POC Video:

https://www.youtube.com/watch?v=3XtrUqzxNW0

Blog Detail:
http://tetraph.blogspot.com/2014/05/nytimes-covert-redirect-vulnerability.html

(3) What is Covert Redirect?

Covert Redirect is also related to single sign-on. It is known by its influence on OAuth and OpenID. Hacker may use it to steal users' sensitive information. Almost all OAuth 2.0 and OpenID providers worldwide are affected. Covert Redirect was found and dubbed by a Mathematics PhD student Wang Jing from School of Physical and Mathematical Sciences, Nanyang Technological University, Singapore.

After Covert Redirect was published, it is kept in some common databases such as SCIP, OSVDB, Bugtraq, and X-Force. Its scipID is 13185, while OSVDB reference number is 106567. Bugtraq ID: 67196. X-Force reference number is 93031.

Discover and Reporter:

Wang Jing, Division of Mathematical Sciences (MAS), School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore. (@justqdjing)

http://www.tetraph.com/wangjing

More Articles:

http://tetraph.com/security/covert-redirect/nytimes-covert-redirect-vulnerability-based-on-google-doubleclick/

http://computerobsess.blogspot.com/2014/11/nytimes-covert-redirect-vulnerability.html

http://whitehatview.tumblr.com/post/102682917011/the-new-york-times-nytimes

https://mathfas.wordpress.com/2014/11/15/the-new-york-timesnytimes-com

http://tetraph.blog.163.com/blog/static/234603051201444111911779/

http://aga.ustc.edu.cn/news/view?id=2094

http://webtech.lofter.com/post/1cd3e0d3_706aec6
http://www.inzeed.com/kaleidoscope/covert-redirect/nytimes-covert-redirect-vulnerability-based-on-google-doubleclick/
http://webcabinet.tumblr.com/post/118901188782/itinfotech-covert#notes
https://twitter.com/tetraphibious/status/559167627470180352

http://xingti.tumblr.com/post/121909911895/the-new-york-times-nytimes-com-covert-redirect

http://securityrelated.blogspot.com/2014/11/the-new-york-timesnytimes.html

https://tetraph.wordpress.com/2014/11/15/the-new-york-timesnytimes-com-covert-redirect

Godaddy Online Website Covert Redirect Web Security Bugs Based on Google.com

Godaddy Online Website Covert Redirect Web Security Bugs Based on Google.com

(1) Domain:
godaddy.com

"GoDaddy is a publicly traded Internet domain registrar and web hosting company. As of 2014, GoDaddy was said to have had more than 59 million domain names under management, making it the world's largest ICANN-accredited registrar. It serves more than 12 million customers and employs more than 4,000 people. The company is known for its celebrity spokespeople, Super Bowl ads and as being an online provider for small businesses. In addition to a postseason college football bowl game, it sponsors NASCAR. It has been involved in several controversies related to security and privacy. In addition to domain registration and hosting, GoDaddy also sells e-business related software and services." (Wikipedia)

(2) Vulnerability Description:
Godaddy web application has a computer security problem. Hacker can exploit it by Covert Redirect cyber attacks.

The vulnerabilities can be attacked without user login. Tests were performed on Microsoft IE (10.0.9200.16750) of Windows 8, Mozilla Firefox (34.0) & Google Chromium 39.0.2171.65-0 ubuntu0.14.04.1.1064 (64-bit) of Ubuntu (14.04)，Apple Safari 6.1.6 of Mac OS X Lion 10.7.

The vulnerability occurs at "redirect.aspx?" page with "&target" parameter, i.e.
http://img.godaddy.com/redirect.aspx?ci=1161&target=https%3A%2F%2Fwww.google.com

(2.1) When a user is redirected from Godaddy to another site, Godaddy will check whether the redirected URL belongs to domains Godaddy's whitelist, e.g.
google.com
apple.com

If this is true, the redirection will be allowed.

However, if the URLs in a redirected domain have open URL redirection vulnerabilities themselves, a user could be redirected from Godaddy to a vulnerable URL in that domain first and later be redirected from this vulnerable site to a malicious site. This is as if being redirected from Godaddy directly.

One of the vulnerable domain is,
google.com

(2.2) Use one of webpages for the following tests. The webpage address is "http://diebiyi.com/articles/". Can suppose that this webpage is malicious.

Vulnerable URL:
http://img.godaddy.com/redirect.aspx?ci=1161&target=https%3A%2F%2Fwww.godaddy.com

POC:
http://img.godaddy.com/redirect.aspx?ci=1161&target=https%3A%2F%2Fwww.google.com%2Faccounts%2FLogout%3Fservice%3Dwise%26continue%3Dhttp%253A%252F%252Fgoogleads.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCtHoIVxn3UvjLOYGKiAeelIHIBfLQnccEAAAQASAAUNTx5Pf4_____wFgvwWCARdjYS1wdWItMDQ2NjU4MjEwOTU2NjUzMsgBBOACAKgDAaoE5AFP0NHr5cHwFmWgKNs6HNTPVk7TWSV-CDHX83dKdGSWJ2ADoZNIxUHZwjAODRyDY_7nVtpuqSLOTef4xzVxDQ2U22MNbGak33Ur7i2jDB8LdYt9TbC3ifsXmklY5jl3Zpq4_lP7wagVfjt0--tNPPGTR96NGbxgPvfHMq9ZsTXpjhc_lPlnyGjlWzF8yn437iaxhGRwYLt_CymifLO2YaJPkCm9nLpONtUM-mstUSpKQrP2VjjaZkbDtuK0naLLBV37aYEY4TzWQi8fQGN47z4XgpinBCna91zQayZjn2wxccDCl0zgBAGgBhU%2526num%253D0%2526sig%253DAOD64_3Qi4qG3CRVHRI5AHSkSGuL7HJqSA%2526client%253Dca-pub-0466582109566532%2526adurl%253Dhttp%253A%252F%252Fwww.tetraph.com%252Fcontact.html

POC Video:
https://www.youtube.com/watch?v=gS4n825Yx28

Blog Detail:
http://tetraph.blogspot.com/2014/05/godaddy-covert-redirect-vulnerability.html

(3) What is Covert Redirect?
Covert Redirect is a class of security bugs disclosed in May 2014. It is an application that takes a parameter and redirects a user to the parameter value without sufficient validation. This often makes use of Open Redirect and XSS (Cross-site Scripting) vulnerabilities in third-party applications.

Covert Redirect is also related to single sign-on, such as OAuth and OpenID. Hacker may use it to steal users' sensitive information. Almost all OAuth 2.0 and OpenID providers worldwide are affected. Covert Redirect can work together with CSRF (Cross-site Request Forgery) as well.

Discover and Reporter:

Jing Wang, Division of Mathematical Sciences (MAS), School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore. (@justqdjing)

http://tetraph.com/wangjing/

Related Articles:
https://twitter.com/tetraphibious/status/559167679353720834

http://tetraph.com/security/covert-redirect/godaddy-covert-redirect-vulnerability-based-on-google/

http://tetraph.blog.163.com/blog/static/234603051201444111919171/

http://whitehatpost.lofter.com/post/1cc773c8_706b6bf
http://japanbroad.blogspot.jp/2015/06/godaddy-bug.html
http://securitypost.tumblr.com/post/119439859067/itinfotech-id-oauth

https://infoswift.wordpress.com/2014/07/02/godaddy-hack/

http://germancast.blogspot.de/2014/06/godaddy-exploit.html

http://www.inzeed.com/kaleidoscope/covert-redirect/godaddy-covert-redirect-vulnerability-based-on-google/

https://mathfas.wordpress.com/2014/07/07/godaddy-hacking/

Amazon Website Covert Redirect Web Security Bugs Based on Facebook - Attack Simulation

This summary is not available. Please click here to view the post.

eBay Covert Redirect Vulnerability Based on Googleads.g.doubleclick.net

The vulnerability occurs at "ebay.com/rover" page with "&mpre" parameter, i.e.
http://rover.ebay.com/rover/1/711-67261-24966-0/2?mtid=691&kwid=1&crlp=1_263602&itemid=370825182102&mpre=http://www.google.com

The vulnerability can be attacked without user login. Tests were performed on Firefox (26.0) in Ubuntu (12.04) and IE (9.0.15) in Windows 7.