Penetration Test Report (Hackmanit): Penetration Test Report WAYF SSH Certificate Authority by Hackmanit

Security Analysis Report:
SSH CA
Version: 1.3
24.02.2025
Conrad Schmidt
|
Phone: +49(0)234/54459996 E-Mail: conrad.schmidt@hackmanit.de
Project Information
Customer: WAYF/Danishe-InfrastructureCooperation
AsmussensAllé,Building305
DK-2800Lyngby,DENMARK
Contact: MadsFreekPetersen
Commissionedto: HackmanitGmbH
Universitätsstraße60(Exzenterhaus)
44789Bochum,Germany
Projectexecutive: ConradSchmidt
Phone: +49(0)234/54459996
Fax: +49(0)234/54427593
E-Mail: conrad.schmidt@hackmanit.de
InitialPenetrationTest
Projectmembers: ConradSchmidt(HackmanitGmbH)
NiklasConrad(HackmanitGmbH)
KarstenMeyerzuSelhausen(HackmanitGmbH)
JurajSomorovsky(HackmanitGmbH)
Projectperiod:
Retest
Projectmembers: ConradSchmidt(HackmanitGmbH)
JurajSomorovsky(HackmanitGmbH)
Projectperiod: 2024-10-28–2024-10-30
Versionofthereport: 1.3
ThisreportwastechnicallyverifiedbyProf. Dr. JurajSomorovsky.
ThisreportwaslinguisticallyverifiedbyKarstenMeyerzuSelhausen.
HackmanitGmbH
Representedby: Prof. Dr. JörgSchwenk,Prof. Dr. JurajSomorovsky,
Dr. ChristianMainka,Prof. Dr. MarcusNiemietz
Registercourt: AmtsgerichtBochum,HRB14896,Germany
1
Contents
Contents
1 Summary 3
2 ProjectTimeline 5
3 Methodology 5
4 GeneralConditionsandScope 5
5 ScenarioDescription 6
5.1 PythonClientFlow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
5.2 “Webfirst”-flow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
5.3 “SSHfirst”-flow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
6 ThreatAnalysis 12
6.1 GuessingSessionTokens . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
6.2 ReusingaSessionTokentoGenerateaCertificate . . . . . . . . . . . . . . . . . . 12
6.3 ReusingaSessionTokentoObtainaCertificate’sContents. . . . . . . . . . . . . 13
6.4 IdP/CAMixUp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
6.5 Usingarbitraryidentityproviders(IdPs) . . . . . . . . . . . . . . . . . . . . . . . . 13
6.6 ObtainingaCertificateWithaForeignIdentity . . . . . . . . . . . . . . . . . . . . 14
6.6.1 Obtaining a Certificate With a Foreign Identity by Making a Victim Au-
thenticateattheSSHCA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
6.6.2 ObtainingaCertificateWithaForeignIdentityUsingthe“PythonClient”-
Flow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
6.6.3 ManipulatingtheTokenstoContainanArbitraryIdentity . . . . . . . . . . 15
6.7 Denial-of-ServiceAttackviaMultipleOpenConnections . . . . . . . . . . . . . . 15
6.8 TokenConfusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
6.9 Cross-SiteRequestForgery(CSRF)AttacksAgainsttheSingleSign-OnFlows . 16
6.10CodeInjectionIntotheWebsite . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
6.11PathTraversalatGET /www/ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
6.12CollisionofGlobalUnixUsername . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
7 OverviewofWeaknesses,Recommendations,andInformation 20
8 Weaknesses 22
8.1 C01 CSRFAttack: ObtainingaCertificateWithaVictim’sIdentity . . . . . . . 22
8.2 C02 CSRFAttackatMyAccessID:ObtainingaCertificateWithaVictim’sIdentity 24
8.3 H01 Denial-of-ServiceviaSimultaneousHTTPConnections . . . . . . . . . . . 27
9 Recommendations 29
9.1 R01 InformationDisclosure: ServerHeader . . . . . . . . . . . . . . . . . . . . . 29
10 References 30
2
1 Summary
1 Summary
Hackmanit GmbH was commissioned by WAYF / Danish e-Infrastructure Cooperation to per-
formasecurityanalysisoftheirapplicationSSHCA.Theanalysiswasperformedremotelywith
atotalexpenseof7man-days–includingdocumentationandwritingofthisreport. Itconsisted
ofapenetrationtest,aswellas,athreatanalysis,andacodereview. Additionallyaretestwas
performedforatotalexpenseof1,5man-days.
Weaknesses. During our analysis we identified 14 potential security threats. Three of these
threatsleadtoweaknesseswhichshouldbeaddressed;tworatedasCriticalandoneratedas
High.
ThetwoweaknessesratedasCriticalbothdescribeamethodinwhichanattackercouldobtain
an SSH certificate with the identity of a victim for their public keys – one time using a flaw in
SSHCAandonetimeexploitingaflawinMyAccessID.TheweaknessratedasHighdescribes
a denial-of-service (DoS) attack, in which an attacker could block access to the SSH CA for
otherusersusingsimultaneousHTTPconnections.
Top Weaknesses:
RiskLevel Finding Reference
C01 CSRFAttack: ObtainingaCertificateWithaVictim’s Section8.1,page22
Identity
C02 CSRF Attack at MyAccessID: Obtaining a Certificate Section8.2,page24
WithaVictim’sIdentity
H01 Denial-of-Service via Simultaneous HTTP Connec- Section8.3,page27
tions
Recommended Actions. We recommend implementing the countermeasures described for
each weakness, especially the ones rated as Critical, since they can be used by an attacker
to gain access to a victim’s account. For the third weakness rated as High countermeasures
shouldbeappliedaswell,sinceitcouldleadtoaDoSattack.
Since C02 isnotaweaknessinSSHCAbutratherinMyAccessIDwerecommendtoforward
theissuetoMyAccessIDtoenablethemtofixitontheirside.
Retest. WAYF followed our recommendations and implemented countermeasures for every
identified weakness, as well as the recommendation. We conducted a retest and can confirm
thatallidentifiedweaknessesweresuccessfullyfixed.
For C02 ,WAYFcontactedMyAccessID,sincetheyhadtoimplementafix. Measuresinform
ofaconsentpagewereimplementedfromtheirside. Theyalsofollowedourrecommendation
toremovetheabilitytoskiptheconsentpageinthedeviceauthgrant.
Allweaknessesandrecommendationshavethereforebeenresolved.
3
1 Summary
Structure. Thereportisstructuredasfollows:InSection2,thetimelineofthepenetrationtest
is listed. Section 3 introduces our methodology and Section 4 explains the general conditions
andscopeofthepenetrationtest.InSection5,thescenarioofthesecurityanalysisisdescribed
indetail.Section6containsananalysisofthreatsaffectingtheSSHCA.Section7providesan
overview of the identified weaknesses, as well as, further recommendations and information.
In Section 8, all identified weaknesses are discussed in detail and specific countermeasures
aredescribed.Section9summarizesourrecommendationsresultingfromobservationsofthe
application.
4
4 GeneralConditionsandScope
2 Project Timeline
Thesecurityanalysiswascarriedoutremotelyfrom2024-06-03to2024-06-07. Theconcept
andimplementationoftheSSHCAdevelopedbyWAYFwasexaminedbyfourpeoplewiththe
entireeffortof7man-days–includingdocumentationandwritingofthisreport.
From2024-10-28to2024-10-30,aretestofthedescribedweaknesseswasperformed. Ad-
ditionallyanewfeature,called“GlobalUnixUsername”wasaddedtothethreadanalysis. The
retestwasperformedbyonepersonwiththeeffortof1,5man-days–includingupdatingthe
report.
3 Methodology
Amongothers,thefollowingtoolswereusedforthepenetrationtest:
Tool Link
MozillaFirefox https://www.mozilla.org/de/firefox/
GoogleChrome https://www.google.com/intl/de_ALL/chrome/
BurpSuiteProfessional https://portswigger.net/burp
Self-developedtools -
Risk Rating. Each weakness has its own CVSS 3.1 base score rating (Common Vulnerability
Scoring System Version 3.1 Calculator).1,2 Based on the CVSS 3.1 base score, the following
weaknessesassessmentisperformed:
0.0–3.9: Low
4.0–6.9: Medium
7.0–8.9: High
9.0–10.0: Critical
4 General Conditions and Scope
Inthescopeofthepenetrationtestwastheapplication“SSHCA”fromWAYF.WAYFprovided
Hackmanit with the source code of a proof-of-concept application as well as access to a live
testimplementation.
Thethreatanalysis,aswellasthepenetrationtest,wascarriedoutforthetestimplementation
accessibleatthefollowingURL:
https://sshca.deic.dk
1https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator
2https://www.first.org/cvss/v3.1/user-guide
5
5 ScenarioDescription
ForlogginginwiththedefaultcertificateauthoritywewereprovidedwithaccountsforGrand
UnifiedandadditionallyusedexistingaccountsforlogginginwithMyAccessID.
To facilitate the threat analysis and pen