The Security State of Open Source PHP Applications Dr. Johannes Dahse, RIPS Technologies GmbH
Introduction About Johannes Dahse ● Master IT Security at RUB, Germany (2006 - 2012) ● Capture The Flag (CTF) Contests ● Security Consultant ● Developer of RIPS open source security scanner (2009 - 2011) ● PhD in „Static Code Analysis“ at RUB (2013 - 2016) ● CEO & Co-Founder RIPS Technologies GmbH
Introduction Why care about PHP security? #1 Choice 22 Attacks/Day of cyber criminals on an average website 90% $3.8M use open source libraries average data breach costs
Introduction The Security State of Top 5 PHP Applications Top 50 PHP Applications PHP Application Extensions Top 6 PHP Frameworks
The Security State of the Top 5 PHP Applications
The Security State of the Top 5 PHP Applications CMS Market Share WordPress 25% Joomla! Drupal 1% Magento 2% 60% 5% Typo3 7% Other Source: w3techs.com
Top 5 PHP Applications Security Features Application Prepared Template CSRF Password Security Auto Bug Bounty (latest version) Statements Engine Protection Hashing Team Update* Program WordPress vsprintf() none yes phpass yes yes yes Joomla! MySQLi custom yes bcrypt yes no no Drupal PDO Twig yes salted sha-512 yes no 2015 Magento PDO custom yes salted sha-256 yes no yes Typo3 Doctrine Fluid yes pbkdf2 yes yes no *Pro/Con Discussion: https://www.drupal.org/node/2367319
Top 5 PHP Applications Vulnerabilities Number of Vulnerabilities per Year 45 40 WordPress 35 Joomla! 30 25 Drupal 20 15 Magento 10 Typo3 5 0 2010 2011 2012 2013 2014 2015 2016 2017 Source: cvedetails.com
Top 5 PHP Applications Vulnerabilities Number of Critical Vulnerabilities per Year (CVSS Score > 7) 8 WordPress 7 6 Joomla! 5 4 Drupal 3 Magento 2 1 Typo3 0 2010 2011 2012 2013 2014 2015 2016 2017 Source: cvedetails.com
Top 5 PHP Applications Vulnerability Example #1 CVE-2015-3438 – Persistent XSS in Wordpress 4.1.2 ● MySQL‘s utf8 charset only supports 3-byte characters ● Strings with 4-byte characters will be truncated when inserted into utf8 columns Insert: test 𝌇 123 Result: test ● Solution: Use MySQL strict mode or latin1 charset https://cedricvb.be/post/wordpress-stored-xss-vulnerability-4-1-2/
Top 5 PHP Applications Vulnerability Example #1 CVE-2015-3438 – Persistent XSS in Wordpress 4.1.2 https://cedricvb.be/post/wordpress-stored-xss-vulnerability-4-1-2/
Top 5 PHP Applications Vulnerability Example #1 CVE-2015-3438 – Persistent XSS in Wordpress 4.1.2 < div class="comment" id="comment-1" > < div class="comment-content" > < a title='test 𝌇 123' >click</ a > </ div > </ div > https://cedricvb.be/post/wordpress-stored-xss-vulnerability-4-1-2/
Top 5 PHP Applications Vulnerability Example #1 CVE-2015-3438 – Persistent XSS in Wordpress 4.1.2 < div class="comment" id="comment-1" > < div class="comment-content" > < a title='test </div> </div> https://cedricvb.be/post/wordpress-stored-xss-vulnerability-4-1-2/
Top 5 PHP Applications Vulnerability Example #1 CVE-2015-3438 – Persistent XSS in Wordpress 4.1.2 < div class="comment" id="comment-1" > < div class="comment-content" > < a title='test </div> </div> <div class="comment" id="comment-2"> <div class="comment-content"> hack' onmouseover=' alert(1) ' style='width :100%; height :100%; … ' </ div > </ div > https://cedricvb.be/post/wordpress-stored-xss-vulnerability-4-1-2/
Top 5 PHP Applications Vulnerability Example #2 CVE-2017-14596 – LDAP Injection in Joomla! 1.5 - 3.7.5 https://blog.ripstech.com/2017/joomla-takeover-in-20-seconds-with-ldap-injection-cve-2017-14596/
Top 5 PHP Applications Vulnerability Example #2 CVE-2017-14596 – LDAP Injection in Joomla! 1.5 - 3.7.5 class LoginController extends JControllerLegacy { public function login() { ⋮ $app = JFactory:: getApplication (); ⋮ $model = $this->getModel( 'login' ); $credentials = $model->getState( 'credentials' ); ⋮ $app->login($credentials, array ( 'action' => 'core.login.admin' )); } https://blog.ripstech.com/2017/joomla-takeover-in-20-seconds-with-ldap-injection-cve-2017-14596/
Top 5 PHP Applications Vulnerability Example #2 CVE-2017-14596 – LDAP Injection in Joomla! 1.5 - 3.7.5 class JApplicationCms extends JApplicationWeb { public function login($credentials, $options = array ()) { ⋮ $authenticate->authenticate($credentials, $options); } } class JAuthentication extends Jobject { public function authenticate($credentials, $options = array ()) { ⋮ $plugin ->onUserAuthenticate($credentials, $options, $response); } https://blog.ripstech.com/2017/joomla-takeover-in-20-seconds-with-ldap-injection-cve-2017-14596/
Top 5 PHP Applications Vulnerability Example #2 CVE-2017-14596 – LDAP Injection in Joomla! 1.5 - 3.7.5 class PlgAuthenticationLdap extends JPlugin { public function onUserAuthenticate($credentials, $options, &$response){ ⋮ $userdetails = $ldap->simple_search( str_replace( '[search]' , $credentials[ 'username' ], $this-> params ->get( 'search_string' ) // uid=[search] ) ); } https://blog.ripstech.com/2017/joomla-takeover-in-20-seconds-with-ldap-injection-cve-2017-14596/
Top 5 PHP Applications Vulnerability Example #2 CVE-2017-14596 – LDAP Injection in Joomla! 1.5 - 3.7.5 XXX;(&(uid=Admin)(userPassword= A* )) XXX;(&(uid=Admin)(userPassword= B* )) XXX;(&(uid=Admin)(userPassword= C* )) ... XXX;(&(uid=Admin)(userPassword= s* )) ... XXX;(&(uid=Admin)(userPassword= se* )) ... XXX;(&(uid=Admin)(userPassword= sec* )) ... XXX;(&(uid=Admin)(userPassword= secretPassword )) https://blog.ripstech.com/2017/joomla-takeover-in-20-seconds-with-ldap-injection-cve-2017-14596/
Top 5 PHP Applications Vulnerability Demo #2
Top 5 PHP Applications Conclusion ● Good security features by default ● Great security teams ● Bug bounty programs ● But very attractive targets ● Average 14 security issues reported per year ● Average 1-2 critical issues reported per year https://codex.wordpress.org/Hardening_WordPress ● As secure/insecure as any other popular software https://docs.joomla.org/Security_Checklist/en https://www.drupal.org/docs/8/security https://magento.com/security/best-practices https://docs.typo3.org/typo3cms/SecurityGuide/
The Security State of the Top 50 PHP Applications
The Security State of the Top 50 PHP Applications ● PHP Applications within the list of popular CMS (w3techs.com) ● E.g. PrestaShop, phpBB, SugarCRM ● Popular PHP Applications with a similar high google trend ● E.g. phpMyAdmin, Piwik, Roundcube ● 50 Applications, 13.2 MLOC total (300 KLOC average) ● Automated code analysis
Top 50 PHP Applications Security State Time To Fix (if) Critical Detected by RIPS Security Contact Available 33% 39% 42% 44% 56% 58% 28% Yes No Yes No 2 weeks 6 weeks 3 month
Top 50 PHP Applications Attack Vectors File Inclusion Code Execution SQL Injection Path Traversal File Upload PHP Object Injection Command Execution Cross-Site Scripting
Top 50 PHP Applications Critical Examples Software Attack Vector detected by RIPS Roundcube Command Execution via Email FreePBX Command Execution via Cross-Site Scripting Coppermine Command Execution via SQL Injection osClass Command Execution via Local File Inclusion Expression Engine Command Execution via PHP Object Injection KLIQQI CMS Command Execution via Cross-Site Request Forgery Redaxo CMS Command Execution via Cross-Site Request Forgery Precurio Command Execution via Path Traversal Serendipity Command Execution via Logical Flaw https://demo.ripstech.com
Top 50 PHP Applications Vulnerability Example #1 CVE-2016-9920 – Remote Command Execution in Roundcube 1.2.2 https://blog.ripstech.com/2016/roundcube-command-execution-via-email/
Top 50 PHP Applications Vulnerability Example #1 CVE-2016-9920 – Remote Command Execution in Roundcube 1.2.2 $from = rcube_utils:: get_input_value ( '_from' , rcube_utils:: INPUT_POST ); $RCMAIL->deliver_message($MAIL, $from, $mailto, $error); public function deliver_message(&$message, $from, $mailto, &$error) { ⋮ if (filter_var(ini_get( 'safe_mode' ), FILTER_VALIDATE_BOOLEAN )) $sent = mail($to, $subject, $msg_body, $header_str); else $sent = mail($to, $subject, $msg_body, $header_str, "-f $from " ); https://blog.ripstech.com/2016/roundcube-command-execution-via-email/
Top 50 PHP Applications Vulnerability Example #1 CVE-2016-9920 – Remote Command Execution in Roundcube 1.2.2 $from = rcube_utils:: get_input_value ( '_from' , rcube_utils:: INPUT_POST ); $RCMAIL->deliver_message($MAIL, $from, $mailto, $error); public function deliver_message(&$message, $from, $mailto, &$error) { ⋮ if (filter_var(ini_get( 'safe_mode' ), FILTER_VALIDATE_BOOLEAN )) $sent = mail($to, $subject, $msg_body, $header_str); else $sent = mail ($to, $subject, $msg_body, $header_str, "-f $from " ); https://blog.ripstech.com/2016/roundcube-command-execution-via-email/
Recommend
More recommend
