Penetration Test Report (RadicallyOpenSecurity): 2017 CodeReview Expat XML Parser v1.0

Confidential
CODE AUDIT REPORT
for
Secure Open Source (Mozilla)
V1.0
Amsterdam
March 31st, 2017
1/30
Radically Open Security B.V. - 60628081
Confidential
Document Properties
Client Secure Open Source (Mozilla)
Title Code Audit Report
Target The Expat XML Parser codebase
Version 1.0
Pentesters Stefan Marsiske, Mahesh Saptarshi
Authors Stefan Marsiske, Patricia Piolon, Marcus Bointon
Reviewed by Peter Mosmans
Approved by Melanie Rieback
Version control
Version Date Author Description
0.1 March 23rd, 2017 Stefan Marsiske Initial draft
0.2 March 27th, 2017 Patricia Piolon Layout edit
0.3 March 27th, 2017 Marcus Bointon Proofing
1.0 March 31st, 2017 Patricia Piolon Final version
Contact
For more information about this Document and its contents please contact Radically Open Security B.V.
Name Melanie Rieback
Address Overdiemerweg 28
1111 PP Diemen
The Netherlands
Phone +31 6 10 21 32 40
Email info@radicallyopensecurity.com
2/30
Radically Open Security B.V. - 60628081
Confidential
Table of Contents
1 Executive Summary ................................................................................................................................... 4
1.1 Introduction .............................................................................................................................................. 4
1.2 Scope of work ......................................................................................................................................... 4
1.3 Project objectives .................................................................................................................................... 4
1.4 Timeline ................................................................................................................................................... 4
1.5 Results In A Nutshell .............................................................................................................................. 4
1.6 Summary of Findings .............................................................................................................................. 5
1.7 Summary of Recommendations .............................................................................................................. 5
2 Methodology ............................................................................................................................................... 6
2.1 Planning .................................................................................................................................................. 6
2.2 Risk Classification ................................................................................................................................... 6
3 Tools and scanners .................................................................................................................................... 7
4 Pentest Technical Summary ...................................................................................................................... 8
4.1 Findings ................................................................................................................................................... 8
4.1.1 MOX-001 — Hash Function is Vulnerable to Collisions ...................................................................... 8
4.1.2 MOX-002 — Integer Overflow at lib/xmlparse.c:1629 ........................................................... 11
4.1.3 MOX-003 — xmlparse.c uses uninitialized memory in function processInternalEntity .................. 13
4.1.4 MOX-004 — xmlparse.c uses uninitialized memory in function internalEntityProcessor ............... 14
4.1.5 MOX-005 — Salt Generation Might Leak Addresses .......................................................................... 15
4.1.6 MOX-006 — Several APIs Do Not Check for NULL Argument Before Dereferencing ......................... 16
4.1.7 MOX-007 — Some APIs Operate on Unchecked User-Supplied Memory Pointers ............................ 17
4.2 Non-Findings ........................................................................................................................................... 18
4.2.1 XML_GetBuffer Integer Overflow at xmlparse.c:1751 .......................................................... 18
4.2.2 Uninitialized Pointer Usage in unknown_toUtf8 at Lib/xmlparse.c:1417 .......................... 19
4.2.3 Reproduce Marcograss/20160617 Heap Overflow .............................................................................. 22
4.2.4 API Code Review Non-findings ........................................................................................................... 22
4.2.4.1 Memory allocation and usage related code review .......................................................................... 22
4.2.4.2 Other APIs reviewed: ........................................................................................................................ 24
4.2.5 Microsoft Visual Studio Code Scanning False Positives ..................................................................... 25
5 Future Work ............................................................................................................................................... 28
6 Conclusion .................................................................................................................................................. 29
Appendix 1 Testing Team ............................................................................................................................. 30
3/30
Radically Open Security B.V. - 60628081
Confidential
1 Executive Summary
1.1 Introduction
Radically Open Security B.V. was hired to undertake a thorough code review and vulnerability research on the
expat XML Parser.
This report contains our findings as well as detailed explanations of exactly how ROS performed the
penetration test.
1.2 Scope of work
The scope of the penetration test was limited to the following target:
• The Expat XML Parser codebase
1.3 Project objectives
Conduct a thorough code-review and vulnerability research on libexpat.
1.4 Timeline
The security audit took place between February 13 and March 24, 2017.
1.5 Results In A Nutshell
The library seems to be of mature quality, with one massive state-engine that looks solid. The only significant
findings are three Denial of Service vulnerabilities and three memory corruption issues.
4/30
Radically Open Security B.V. - 60628081
Confidential
1.6 Summary of Findings
ID Type Description Threat level
MOX-001 Denial of Service Randomized hash function vulnerable to collisions, causing Moderate
worst-case run-time performance (forming a DoS attack vector).
MOX-002 Denial of Service Huge input can cause an application crash on 32-bit systems. Moderate
MOX-003 Memory Corruption xmlparse.c uses uninitialized memory 'next' in function Moderate
processInternalEntity at line no. 4886 and line no. 4891.
MOX-004 MemoryCorruption xmlparse.c uses uninitialized memory 'next' in function Moderate
internalEntityProcessor at lines 4931 and 4936.
MOX-005 Information Leak Salt generation for the randomized hash is weak and could leak Low
addresses.
MOX-006 Denial of Service In xmlparse.c, several XML_Set* and XML_Get* APIs Low
take a pointer argument but do not check for NULL before
dereferencing.
MOX-007 Memory Corruption The XML_FreeContentModel, XML_MemFree and Low
XML_MemRealloc APIs do not (or have no way to) check user
supplied memory pointers.
1.7 Summary of Recommendations
ID Type Recommendation
MOX-001 Denial of Service Use a proper hash such as SipHash.
MOX-002 Denial of Service Check for integer overflows.
MOX-003 Memory Corruption After the call to XmlPrologTok, check return value and handle the error before calling
doProlog on line 4886 and doContent on line 4891 of xmlparse.c.
MOX-004 MemoryCorruption Check for the return value of XmlPrologTok at line 4930 in xmlparse.c, and handle the
error before calling doProlog on l