Japan Computer Emergency Response TeamCoordination Center

電子署名者 : Japan Computer Emergency Response
Team Coordination Center
DN : c=JP, st=Tokyo, l=Chiyoda-ku,
email=office@jpcert.or.jp, o=Japan Computer Emergency
Response Team Coordination Center, cn=Japan
Computer Emergency Response Team Coordination
Center
日付 : 2014.06.12 17:11:21 +09'00'

HTML5 Security & Headers- X-Crawling-Response-Header-

JPCERT Coordination Center
Watch and Warning Group, Information Security Analyst
Tomoyuki ShigemoriOverview of JPCERT/CC••••Japan Computer Emergency Response Team Coordination Center
Founded in 1996
An independent, non-profit organization
National CSIRT (Computer Security Incident Response Team)
Coordination center JPCERT/CC, as a national CSIRT, monitors computer security
incidents at a national level, identifies and handles incidents that
could affect the economy and critical infrastructures, and warns
critical stakeholders and the nation about computer security threats.
 JPCERT/CC, as a coordination center, provides technical support in
response to computer security incidents through coordination withother local and overseas CSIRTs.

1Copyright©2014 JPCERT/CC All rights reserved.

 Coordinate with developerson unknown vulnerability
information
 Secure Coding-Information
gathering /analysis / sharing-Internet TrafficMonitoring Alerts / Advisories

Respond-Vulnerability
Information
Handling

MonitorPrevent

Overview of JPCERT/CC - 3 pillars and 4 foundations - Incident Handling Mitigating the damage
through efficient incident
handling
 Information sharing toprevent similar incidents

Early Warning Information
Information sharing with critical infrastructure enterprises, etc.

CSIRT Establishment Support
Capacity building for internal CSIRTs in enterprises / overseas national CSIRTs

Artifact Analysis
Analysis on attack methods / behavior of malware (unauthorized program)International Collaboration
Collaboration with overseas organizations for smoother handling of incidents and vulnerabilities
2Copyright©2014 JPCERT/CC All rights reserved.

What is HTML5?
HTML5 is the next HTML standard.
HTML5 enables us to build more flexible and highly convenientwebsites. It allows us to store data within the visitor’s browser,
enables full-duplex communication between the visitor’s browser andweb servers, obtain location information of the visitor, etc.
It is becoming widely utilized in Asia-Pacific region including Japan.
Major browsers are compatible with HTML5 (Some functions are notenabled).
Full-duplex
Communication

Cross-domain
Communication

Acceleration
BrowserEmbedded
Multimedia

UI
Enhancements
OnlineApplication
3

Copyright©2014 JPCERT/CC All rights reserved.

What is HTML5?
HTML5 is the next HTML standard.
HTML5 enables us to build more flexible and highly convenientwebsites. It allows us to store data within the visitor’s browser,
enables full-duplex communication between the visitor’s browser andweb servers, obtain location information of the visitor, etc.
It is becoming widely utilized in Asia-Pacific region including Japan.
Major browsers are compatible with HTML5 (Some functions are notenabled).
While HTML5 enhances browser
CSRF
XSS
capabilities, it also brings newDoS
security concerns which were not an
issue in previous versions of HTML.
The possible impacts are not fully
verified or widely known, which may
Open
Information
affect users by attackers leveraging
Redirect
Leakagethe security flaws of these newarchitectures.
4Copyright©2014 JPCERT/CC All rights reserved.

Research Report on Security Issues of HTML5Japanese version was published on October 2013 and English
version will be coming up soon.
https://www.jpcert.or.jp/research/html5.html (Japanese ver.)5Copyright©2014 JPCERT/CC All rights reserved.

Research Report Terms of Use
The report is expected to be utilized as…
Technical paper, basic information for guidelines
Material for study meetings
Reference for seminars
For citing or reproducing the original document, please refer tothe following:
JPCERT/CC Terms of use
https://www.jpcert.or.jp/guide.html (Japanese only)
Sample）
Source: JPCERT Coordination Center“Technical research report on security issue of web applications
utilizing HTML5”
https://www.jpcert.or.jp/research/HTML5-20131030.pdf
6Copyright©2014 JPCERT/CC All rights reserved.

JavaScript API
XMLHttpRequest
7Copyright©2014 JPCERT/CC All rights reserved.

XMLHttpRequest(XHR) Summary
XMLHttpRequest (XHR) :— an API to communicate with HTTP using JavaScript— enables interactive web contents by asynchronous communication— widely used due to increased usage of AJAX
— this function could only communicate with same origin in versions
earlier than HTML5' Origin' : loaded by the original source
JavaScript

example.jp

other.example.jp' Access-Control-Allow-Origin' : authorized origin or ‘*’ (wildcard)
In order to allow Cookie, “Access-Control-Allow-Credentials” needs to be configured※Origin : combination of host name, protocol and port number
8Copyright©2014 JPCERT/CC All rights reserved.

Current Status of HTML5

9Copyright©2014 JPCERT/CC All rights reserved.

Previous Survey Results
Survey against 2,359 sites was conducted on November 2012

0.25% of websites supports CORS

Source：http://www.veracode.com/blog/2012/11/security-headers-report/

How about Cross-Origin Resource Sharing (CORS) headerswith values other than ' Access-Control-Allow-Origin’?
10Copyright©2014 JPCERT/CC All rights reserved.

Fact-Finding on Websites utilizing HTML5
Following points were checked:—CORS headers (*1)
—Headers with security features (*2)

Approach to fact-finding—Crawl top page of websites on Alexa Top 1,000,000 (*3)
—Check the HTTP header of the curl command response—If the website redirects to other points, final redirection point will
be surveyed—Origin request header will be added to the sending request—Survey was conducted from 2013/12/26 to 2013/12/30(*1) Response header which starts with ’Access-Control-’on headers used by CORS(*2) Specific headers with security features introduced in the research report(*3) http://www.alexa.com/topsites
11Copyright©2014 JPCERT/CC All rights reserved.

CORS Headers
Access-Control-Allow-Origin—Specifies the Origin that is allowed to access to resource

Access-Control-Allow-Credentials—Configured ‘true’ for permission on accessing to response
towards requests with authentication information such as
CookieAccess-Control-Expose-Headers—Specifies the header which the browser can use

Access-Control-Allow-Methods (preflight)—Specifies the method which allows transmission

Access-Control-Allow-Headers (preflight)—Specifies the header which allows transmission

Access-Control-Max-Age (preflight)—Specifies the time to cache a preflight response
12Copyright©2014 JPCERT/CC All rights reserved.

Headers with Security Features
X-XSS-Protection—Protects from XSS attack

X-Frame-Options—Manages contents in accordance with the configuration inContent-Type header

X-Frame-Options—Restricts embedding into a frame such as iframe

Content-Security-Policy—Restricts the sources of contents to be loaded

Content-Disposition—Controls download dialog of a file

Strict-Transport-Security—Enforces the use of secure HTTPS connections
13Copyright©2014 JPCERT/CC All rights reserved.

Key Findings

14Copyright©2014 JPCERT/CC All rights reserved.

Current status on CORSCORS Headers (Access-Control-xxx)

CORS enabled websites
7218

Not
非対応
enabled

8000
7000
6000
5000
4000
3000
2000
1000
0941999
Enabled対応

Number of websites which responded was 949,217 sites.
Number of CORS enabled websites(*) was 7,218 sites.
Only 0.76% of the websites had CORS enabled.

(*) Websites which returned headers related to CORS
15Copyright©2014 JPCERT/CC All rights reserved.

Access-Control-Allow-Origin
377‘Access-Control-AllowOrigin’ Configuration

Value Configured（withproper configuration）＊

Proper
正しい設定

Configuration

6650

Improper
誤った設定
Configuration

1909
4741

Originオリジン

5.4% of the websites were configured improperly.
If improperly configured, the value will be invalid and“Access-Control-Allow-Origin” will not work properly.

16

Copyright©2014 JPCERT/CC All rights reserved.

Access-Control-Allow-Origin
Proper Configuration— scheme://host[:port][ scheme://host[:port]]* (※1)
— null—*Improper configuration sample（either of the settings will be invalid）— No scheme：
example.com— Multiple configuration with comma breaking：
http://example1.com,http://example2.com— Wildcard usage：
http://*.example.com— ‘/’ inserted at the end of origin ：http://example.com/— Multiple header：
http://example1.com
http://example2.com
Attention!! Without the knowledge of proper configuration on how to add
headers, it may weaken the authorization and create vulnerabilities.
※１：Some browsers forbid origin configuration with space breaking
17

Copyright©2014 JPCERT/CC All rights reserved.

Access-Control-Allow-Origin
377‘Access-Control-AllowOrigin’ Configuration

Value Configured（withproper configuration）＊

Proper
正しい設定

Configuration

6650

Improper
誤った設定
Configuration

19094741

Originオリジン

Websites with proper ‘Access-Control-Allow-Origin’ wereconfigured as follows:—Approximately 71% configured to ‘*’⇒allows CORS from any website—Approximately 29% configured ‘origin’⇒CORS is only allowed from the website specified by theorigin header
18

Copyright©2014 JPCERT/CC All rights reserved.

Access-Control-Allow-Credentials
Access-Control-Allow-Credentials
71
No

設定なし
Configuration

15255622

TRUE
FALSE

Websites enabling Access-Control-Allow-Credentials were22% out of all of the CORS websites.
Value set to ‘true’ is only valid. Value other than that operates
as it is not set to ‘true’. Furthermore, there were several
websites which value is set to ‘false’.

19

Copyright©2014 JPCERT/CC All rights reserved.

Access-Control-Allow-Credentials
Websites with value ‘*’ configured
to Access-Control-Allow-Origin

Access-Control-AllowCredentials
4163

Websites with proper origin to‘Access-Control-Allow-Origin’

2Access-Control-AllowCredentials
NoNo

設定なしConfiguration
4573

TRUE
FALSE

599
1250

設定なし
Configuration
TRUE
FALSE

In case ‘true’ is specified on Access-Control-AllowCredentials, the value ‘*’ cannot be used for Access-ControlAllow-Origin. However,163 sites were configured to ‘*’.
Please check beforehand whether it operates as it isintended!!
20

Copyright©2014 JPCERT/CC All rights reserved.

Access-Control-Allow-Credentials
Websites with value ‘*’ configured
to Access-Control-Allow-Origin

Access-Control-AllowCredentials
4163Websites with proper origin toAccess-Control-Allow-Origin

2

Access-Control-AllowCredentialsNoNo

設定なし
Configuration
4573

TRUE
FALSE

599
1250

設定なし
Configuration
TRUE
FALSE

Within the 68% of the websites for which the origin was set
in Access-Control-Allow-Origin, ‘true’ was configured inAccess-Control-Allow-Credentials.

21

Copyright©2014 JPCERT/CC All rights reserved.

Access-Control-Allow-Origin
Websites with value ‘*’ configured inAccess-Control-Allow-Origin

2

Access-Control-AllowCredentials

5991250

No
設定なし

Configuration

Sample of sending response header：for ‘true’
Access-Control-Allow-Origin: http://example.com
Access-Control-Allow-Credentials: true

TRUE
FALSE

If the response header returned is as shown above, JavaScript
loaded from http://example.com will operate as same as the clientbrowser.
⇒ When arbitrary JavaScript can be executed from a website
specified in Access-Control-Allow-Origin, it may become very
dangerous.
Then, is it safe if this vulnerability does not exist?
22Copyright©2014 JPCERT/CC All rights reserved.

Mashup Example
A-C-Allow-Origin: siteA
A-C-Allow-Credentials:true

Mashup origin site

A-C-Allow-Origin:siteB
A-C-Allow-Credentials:true

Mr. X’s image

Mashup site B
Mashup site A

CookieOrigin: site A

Use favorite image
as background.
23

Origin: site B

In order to allow Cookie
added CORS to each site,
generate value in AccessControl-Allow-Origin
dynamically.

Copyright©2014 JPCERT/CC All rights reserved.

Provide favorite image
related products.

How can attacker leverage this?
A-C-Allow-Origin:
http://evil.example.com
A-C-Allow-Credentials:true

Mashup origin site
Mr. X’s photoevil web site
（evil.examle.com）
Information
Leakage

CookieOrigin: http://evil.example.com

send outsideMr. X
24

Copyright©2014 JPCERT/CC All rights reserved.

Cross Origin Request utilizing XHR2

Sample Advisory

IPA Lectures on secure coding Web Application course
https://www.ipa.go.jp/security/awareness/vendor/programmingv2/contents/704.html
25

Copyright©2014 JPCERT/CC All rights reserved.

Access-Control-Allow-Origin
Actual value of Allow-Origin
Actual request sent by thesurvey:
GET / HTTP/1.1
HOST: <target>
Origin: http://example.com

194
http://example.com
1056
Other origin

194 sites inherited the value from the original origin header
and configured in Access-Control-Allow-Origin header andsent it back!!
Data may be intercepted if the user authenticated web
page is configured as aforementioned.
Furthermore, it may bypass CSRF token protection.
26

Copyright©2014 JPCERT/CC All rights reserved.

Password Change by CSRF
GET /passwd HTTP/1.1
Origin: http://evil.com

CookieIssue atoken

Access-Control-Allow-Origin: http://evil.com
Access-Control-Allow-Credentials: true

XHR
Java
Scripttoken=2a8bc84e

POST /passwd HTTP/1.1
newpwd=infected& token=2a8bc84e
Origin: http://evil.com

CookieVerify thetoken

27

Copyright©2014 JPCERT/CC All rights reserved.

Password
ChangedObtain token byJavaScriptProper Configuration
Restriction on permitted page
— Access-Control-Allow-Origin and Access-Control-Allow-Credentials should
not be added to a web page which is not intended to be open to the public.
（i.e. Configuration Change Page, Password Change Page）

Verify origin header— In case of allowing particular web sites, verify the value of the Origin andthen only add Access-Control-Allow-Origin and Access-Control-AllowCredentials as necessary.

GET /passwd HTTP/1.1
Origin: http://evil.com

CookieIssue atoken
Verify&Restriction

Access-Control-Allow-Origin: http://evil.com
Access-Control-Allow-Credentials: true
token=2a8bc84e

JavaScript cannot
access to token
28

Copyright©2014 JPCERT/CC All rights reserved.

XHRJavaScriptConfiguration examples※ Based on the application specification,
consideration on proper configuration and sufficienttesting is required upon applying this configuration.

Restriction on permitted page
— Access-Control-Allow-Origin and Access-Control-Allow-Credentials
should not be added to a web page which is not intended to be open
to the public.
（i.e. Configuration Change Page, Password Change Page）
Ex: Allow usage of the resource only by an image file

<FilesMatch “¥.(jpeg|gif|png|img)$”>SetEnvIf Origin “^https?://.*$” ORIGIN=$0Header set Access-Control-Allow-Origin %{ORIGIN}e env=ORIGIN</FilesMatch>

Verify the origin header
In case of allowing particular web sites, verify the value of the Origin andthen only add Access-Control-Allow-Origin and Access-Control-AllowCredentials as necessary.
Ex: Only allow requests from sub domains of example.com to use the resource

SetEnvIf Origin “^https?://.*¥.example¥.com$” ORIGIN=$0
Header set Access-Control-Allow-Origin %{ORIGIN}e env=ORIGIN
29

Copyright©2014 JPCERT/CC All rights reserved.

Headers with Security Features

30

Copyright©2014 JPCERT/CC All rights reserved.

X-XSS-Protection
51444783

100

1

Configured
設定あり

90443444169

1; mode=block

Not

設定なし
configured

0

Most sites with X-XSS-Protection enabled were configured
to ‘1’;mode=block (Enable protection filter, blank page wasdisplayed upon detection)
514 websites configured to ‘0’ (disabled)
Attention!! Disabling the XSS Protection should be
restricted to specific web pages such as a page having
false-positive issues.
31

Copyright©2014 JPCERT/CC All rights reserved.

Strict-Transport-Security
max-age value

1754

18966

HSTS
configured

HSTS notconfigured

49
93
119
187

337

969

31536000
2592000
15768000
016070400
Other

20,720 sites out of all sites were redirected to HTTPS.
1,754 sites configured HSTS.
Over half of the sites configured max-age to 1 year.
Attention!! If max-age is configured to ‘0’ , thiswebsite will be deleted from HSTS list of the browser.
32

Copyright©2014 JPCERT/CC All rights reserved.

Conclusion

33

Copyright©2014 JPCERT/CC All rights reserved.

Conclusion
While HTML5 enhances browser capabilities, there are
multiple architectural issues which we should be aware ofupon use.
Please refer to “Technical research report on security
issue of web applications utilizing HTML5” for developing
secure web applications.
Any inquiries are welcome. Please contact to
JPCERT Coordination Center
Email：ww-info@jpcert.or.jp
Tel：+81-3-3518-4600
Web: https://www.jpcert.or.jp/
34

Copyright©2014 JPCERT/CC All rights reserved.

Appendix

35

Copyright©2014 JPCERT/CC All rights reserved.

Custom HTTP header
X-Recruiting: We’re looking for talented people, join us:<URL>(We have cookies!)
X-Recruiting: Like HTTP headers? Come write ours:<URL>
x-poetry: Choose Life. Choose a job. Choose a career.
X-<CompanyName>-jobs: you’re reading this … comework at xxx!

Were-currently-looking-for-devs-like-you: Tweet @xxx forjob details.
36

Copyright©2014 JPCERT/CC All rights reserved.

X-Want-A-Job-With-Us response header

37

Copyright©2014 JPCERT/CC All rights reserved.

discem file typeoutput to a file

Compressed file…. :-c38Copyright©2014 JPCERT/CC All rights reserved.

extraction by bzip2
extraction

confirm file type

ASCII！ Readable！！
39

Copyright©2014 JPCERT/CC All rights reserved.

finish?

rotate …

40

Copyright©2014 JPCERT/CC All rights reserved.

perl

41

Copyright©2014 JPCERT/CC All rights reserved.

Thank you for your attention

42

Copyright©2014 JPCERT/CC All rights reserved.