Uses and Abuses of Server-Side Requests Giancarlo Pellegrino 1 , Onur - PowerPoint PPT Presentation

Uses and Abuses of Server-Side Requests Giancarlo Pellegrino 1 , Onur Catakoglu 2 , Davide Balzarotti 2 , and Christian Rossow 1 giancarlo.pellegrino@cispa.saarland 19th International Symposium on Research in Attacks, Intrusions and Defenses Paris, September 21 st , 2016 1 2

Uses and Abuses of Server-Side Requests An increasing number of web applications use Server-Side Requests (SSRs) ● to fetch resources E.g., social networks, business applications, and many more – SSRs adopted before security consequences were fully understood ● Simple to implement; severe consequences if not done properly – ➔ Our work: first extensive assessment of SSRs security implication 1. Classification 2. Two new SSR-based attacks 3. Eight mitigations September 21, 2016 G. Pellegrino - Uses and Abuses of Server-Side Requests 2

Server-Side Requests

SSR Communication Pattern S C ES Three entities: browser C , SSR service S , External Server ES ● September 21, 2016 G. Pellegrino - Uses and Abuses of Server-Side Requests 4

SSR Communication Pattern S C ES req( url ES ) Three entities: browser C , SSR service S , External Server ES ● C provides url ES to S ● September 21, 2016 G. Pellegrino - Uses and Abuses of Server-Side Requests 5

SSR Communication Pattern S C ES url ES req( url ES ) SSR! Three entities: browser C , SSR service S , External Server ES ● C provides url ES to S ● S instantiates an HTTP client to retrieve url ES ● September 21, 2016 G. Pellegrino - Uses and Abuses of Server-Side Requests 6

SSR Communication Pattern S C ES url ES req( url ES ) res S res ES Three entities: browser C , SSR service S , External Server ES ● C provides url ES to S ● S instantiates an HTTP client to retrieve url ES ● S can return either res ES to C , e.g., res S = res ES , or a transformation, e.g., res S = f ( res ES ) ● September 21, 2016 G. Pellegrino - Uses and Abuses of Server-Side Requests 7

What are they used for? ● Share content in social networks url ES ● Import data in online documents ● Security protocols (e.g., OpenID) – avoid exposing sensitive data, e.g., security tokens, to untrusted users ● Feed aggregators ● Others ... res S September 21, 2016 G. Pellegrino - Uses and Abuses of Server-Side Requests 8

Simple to implement S C ES url ES req(url ES ) res S res ES $ssr = curl_init(); $ssr = curl_init(); curl_setopt($ssr, CURLOPT_URL, url ES ); curl_setopt($ssr, CURLOPT_URL, url ES ); ssr = urllib.urlopen( url ES ) ssr = urllib.urlopen( url ES ) curl_setopt($ssr, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ssr, CURLOPT_RETURNTRANSFER, 1); data = ssr.read() data = ssr.read() $data = curl_exec($ssr); $data = curl_exec($ssr); curl_close($ssr); curl_close($ssr); ● HTTP client libs available in most popular programming languages – PHP: e.g., cURL, and file_get_contents – Python: e.g., urllib, httplib, and requests September 21, 2016 G. Pellegrino - Uses and Abuses of Server-Side Requests 9

The Problems of SSRs S C ES url ES req(url ES ) res S res ES ● If not properly implemented, SSRs can be abused: 1. as stepping stones to attack ES 2. to access local resources of S , e.g., file:// , http://127.0.0.1/ 3. to expose malicious content to C 4. res ES can be used to attack S ● Popular abuse is Server-Side Request Forgery (SSRF) [1] September 21, 2016 G. Pellegrino - Uses and Abuses of Server-Side Requests 10

The Problems of SSRs S C ES url ES req(url ES ) 1 res S res ES ● If not properly implemented, SSRs can be abused: 1. as stepping stones to attack ES 2. to access local resources of S , e.g., file:// , http://127.0.0.1/ 3. to expose malicious content to C 4. res ES can be used to attack S ● Popular abuse is Server-Side Request Forgery (SSRF) [1] September 21, 2016 G. Pellegrino - Uses and Abuses of Server-Side Requests 11

The Problems of SSRs S C ES url ES req(url ES ) 1 2 res S res ES ● If not properly implemented, SSRs can be abused: 1. as stepping stones to attack ES 2. to access local resources of S , e.g., file:// , http://127.0.0.1/ 3. to expose malicious content to C 4. res ES can be used to attack S ● Popular abuse is Server-Side Request Forgery (SSRF) [1] September 21, 2016 G. Pellegrino - Uses and Abuses of Server-Side Requests 12

The Problems of SSRs S C ES url ES req(url ES ) 1 2 res S res ES 3 ● If not properly implemented, SSRs can be abused: 1. as stepping stones to attack ES 2. to access local resources of S , e.g., file:// , http://127.0.0.1/ 3. to expose malicious content to C 4. res ES can be used to attack S ● Popular abuse is Server-Side Request Forgery (SSRF) [1] September 21, 2016 G. Pellegrino - Uses and Abuses of Server-Side Requests 13

The Problems of SSRs S C ES url ES req(url ES ) 1 2 res S res ES 3 4 ● If not properly implemented, SSRs can be abused: 1. as stepping stones to attack ES 2. to access local resources of S , e.g., file:// , http://127.0.0.1/ 3. to expose malicious content to C 4. res ES can be used to attack S ● Popular abuse is Server-Side Request Forgery (SSRF) [1] September 21, 2016 G. Pellegrino - Uses and Abuses of Server-Side Requests 14

The Problems of SSRs S C ES url ES req(url ES ) 1 2 res S res ES 3 4 ● If not properly implemented, SSRs can be abused: 1. as stepping stones to attack ES 2. to access local resources of S , e.g., file:// , http://127.0.0.1/ 3. to expose malicious content to C 4. res ES can be used to attack S ● Popular abuse is Server-Side Request Forgery (SSRF) September 21, 2016 G. Pellegrino - Uses and Abuses of Server-Side Requests 15

Server-Side Request Forgery S C ES Attack payload ● C aims to exploit vulnerability in ES or access local resources of S ● ES behind a firewall that blocks direct access from the Internet ● S is exposed both to the Internet and to the local network September 21, 2016 G. Pellegrino - Uses and Abuses of Server-Side Requests 16

Server-Side Request Forgery S C ES attack payload req( attack payload ) res S res ES ● SSR used to bypass firewalls and deliver attack payload to ES URL encoded buffer overflow shell code – e.g., gopher:// ES /X %EB%2A%5E%89v%08%C6 […] %FF%FF /bin/sh %00%89%EC%5D%C3 ● SSR used to access local resources as well: Filename – e.g., file:///etc/passwd September 21, 2016 G. Pellegrino - Uses and Abuses of Server-Side Requests 17

Server-Side Request Forgery S C ES attack payload req( attack payload ) res S res ES Do we, now, know better? Do we, now, know better? ● SSR used to bypass firewalls and deliver attack payload to ES URL encoded buffer overflow shell code – e.g., gopher:// ES /X %EB%2A%5E%89v%08%C6 […] %FF%FF /bin/sh %00%89%EC%5D%C3 ● SSR used to access local resources as well: Filename – e.g., file:///etc/passwd September 21, 2016 G. Pellegrino - Uses and Abuses of Server-Side Requests 18

Awareness of Security Risks: The Present S C ES url ES req(url ES ) 1 2 res S res ES 4 3 ● Reviewed of academic/non-academic literature and development best practices: Unawareness of risks, and guidelines on implementing SSRs are missing September 21, 2016 G. Pellegrino - Uses and Abuses of Server-Side Requests 19

Awareness of Security Risks: The Present S C ES url ES req(url ES ) 1 2 res S res ES 4 3 Academic/non-academic literature: ● No attention from academic literature – Non-academic works focused only on SSRF – ➔ Attacks against C and S not considered Devel. best practices (design patterns, coding rules, and API doc.) ● Default programming language APIs offer no defense mechanism – No patterns nor coding rules specific for SSRs – ➔ Lack of both proper ways to implement S and attack countermeasures September 21, 2016 G. Pellegrino - Uses and Abuses of Server-Side Requests 20

Awareness of Security Risks: The Present S C ES url ES req(url ES ) 1 2 res S res ES 4 3 How does this lack of knowledge How does this lack of knowledge Academic/non-academic literature: ● affect SSR implementations? affect SSR implementations? No attention from academic literature – Non-academic works focused only on SSRF – ➔ Attacks against C and S not considered Devel. best practices (design patterns, coding rules, and API doc.) ● Default programming language APIs offer no defense mechanism – No patterns nor coding rules specific for SSRs – ➔ Lack of both proper ways to implement S and attack countermeasures September 21, 2016 G. Pellegrino - Uses and Abuses of Server-Side Requests 21

Our Contribution ● Systematic study of security implication of SSRs 1. Propose a classification that establishes common terminology and supersedes pre-existing works 2. Present two new attack scenarios against C and S Web Origin Laundering and Denial of Service ● 3. Analyse of 68 popular online services 4. Present list of mitigations September 21, 2016 G. Pellegrino - Uses and Abuses of Server-Side Requests 22

SSR Classification