Penetration Test Report (RadicallyOpenSecurity): 2017 Summary of CodeReview uProxy v1.0

Public
PENETRATION TEST REPORT
for
Jigsaw LLC
V1.0
Amsterdam
November 28th, 2017
1/10
Radically Open Security B.V. - Chamber of Commerce 60628081
Public
Document Properties
Client Jigsaw LLC
Title PENETRATION TEST REPORT
Targets uProxy air client apps for macOS, Windows, iOS, and Android
uProxy server for Linux (uproxy-cloud-install)
uProxy server manager for macOS and Windows (uproxy-cloud-install)
Dependency: shadowsocks-libev proxy (not including libev)
Dependency: the tun2socks part of the badvpn dependency
Dependency: the SSH key generation part of the NodeForge dependency
Version 1.0
Pentesters Mahesh Saptarshi, Stefan Grönke
Authors Stefan Grönke, Alex Arlt
Reviewed by Marcus Bointon
Alex Arlt
Approved by Melanie Rieback
Version control
Version Date Author Description
0.1 November 3rd, 2017 Stefan Grönke Add general project
information and draft
report
0.2 November 8th, 2017 Stefan Grönke Address review from
Santiago Andrigo
0.3 November 9th, 2017 Alex Arlt Reviewing
0.4 November 27th, 2017 Stefan Grönke Verify previous findings
and review updated
source code
1.0 November 28th, 2017 Alex Arlt Review and Finalization
Contact
For more information about this Document and its contents please contact Radically Open Security B.V.
Name Melanie Rieback
Address Overdiemerweg 28
1111 PP Diemen
The Netherlands
2/10
Radically Open Security B.V. - Chamber of Commerce 60628081
Public
Phone +31 (0)20 2621 255
Email info@radicallyopensecurity.com
3/10
Radically Open Security B.V. - Chamber of Commerce 60628081
Public
Table of Contents
1 Executive Summary ................................................................................................................................... 5
1.1 Introduction .............................................................................................................................................. 5
1.2 Scope of work ......................................................................................................................................... 5
1.3 Project objectives .................................................................................................................................... 5
1.4 Timeline ................................................................................................................................................... 6
1.5 Results In A Nutshell .............................................................................................................................. 6
2 Review and Verification ............................................................................................................................. 7
3 Future Work ............................................................................................................................................... 8
4 Conclusion .................................................................................................................................................. 9
Appendix 1 Testing team ............................................................................................................................. 10
4/10
Radically Open Security B.V. - Chamber of Commerce 60628081
Public
1 Executive Summary
1.1 Introduction
This report summarizes the findings and non-findings of a code audit between September 4, 2017 and October
20, 2017 as well as a re-visit of previous remarks and issues by state of Nov 23rd, 2017.
Subject of the audit was a set of software projects named uProxy for orchestrating Shadowsocks servers,
share/invite users and have them connect from multiple platforms, including Mac OS, iOS, Windows, Linux
and Android, to a secure VPN.
Client user interfaces are built with WebComponents using Polymer encapsulated in Cordova or Electron
Apps. While the VPN servers and client connections are managed with code maintained by uProxy, we did
not explicitly test for general flaws in Shadowsocks or the effectiveness as resilient tool to circumvent network
filters.
The code repositories referenced in the scope of work were checked for best practice violations, insufficient
input data validation and vulnerabilities in uProxy Client, uProxy Server Manager and bundled the uProxy
Server.
1.2 Scope of work
• uProxy air client apps for macOS, Windows, iOS, and Android
• uProxy server for Linux (uproxy-cloud-install)
• uProxy server manager for macOS and Windows (uproxy-cloud-install)
• Dependency: shadowsocks-libev proxy (not including libev)
• Dependency: the tun2socks part of the badvpn dependency
• Dependency: the SSH key generation part of the NodeForge dependency
1.3 Project objectives
The objective of this audit was to grant users safe usage of uProxy client applications and secure setup
and management of uProxy servers on DigitalOcean, other cloud providers, and when using their own
infrastructure.
5/10
Radically Open Security B.V. - Chamber of Commerce 60628081
Public
1.4 Timeline
The Security Audit took place between September 4, 2017 and October 20, 2017.
1.5 Results In A Nutshell
After manually tracing and analyzing execution paths of the target applications based on a snapshot from the
repositories, ROS sought direct contact with the implementing engineers to discuss findings and leads early
on. This collaboration allowed us to address findings on a general level instead of just suggesting to fix them
individually.
To establish connections the reviewed applications fork subprocesses. Insufficient input data validation had
the potential to become a serious security issue that could lead to client side code execution vulnerabilities
through malicious URLs or manipulated DigitalOcean Droplets in general. This could occur for example when
a server provider gets compromised and the clients read malicious data or when attackers manage to inject a
crafted ss:// URL to a users clipboard. In addition to checks regarding the safety of executed sub-commands,
ROS has spent special attention to data interfaces (clipboard, keyboard inputs, URL schema or scanned QR
codes) by following the data consuming methods backwards to their data input sources. We found that the
data entry points were strictly secured by end of the audit and found that the reviewed uProxy code is safely
executed with an array of arguments from the applications. Measures to secure development assets like
Dockerfiles and other build scripts with the same principle of strict data validation as recommended were also
applied before finishing the audit, so that we can assume that users and developers systems are protected
against command injection from compromised server instances.
Apart from the analysis of remotely exploitable vulnerabilities, minor local issues in key handling and data
processing functions affecting the development environment were reported and fixed in GitHub pull requests.
The changes ensured that sensitive data is not printed in log files or stored in system-wide accessible
locations.
The mentioned vulnerabilities were addressed immediately after verification with the engineers, so that
we were able to focus on establishing detection and quality enforcement mechanisms in the form of
automated build steps. The input data validation was moved into a separate TypeScript Library called
ShadowsocksConfig that allows safe usage of untrusted user input by strictly validating the presented data.
The library can be utilized in all JavaScript environments used by uProxy applications: as a browser module,
Node package, or TypeScript impo rt.
Due to proper usage of Polymer data-binding there were no front-end vulnerabilities found during the
audit. The absence of previous findings was manually tested for uproxy-air@06a0938 and uproxy-
cloud-install@e720ac8 on Nov, 23rd 2017. Out recommendation to tighten the native app wrappers
(Cordova/Electron) permissions was also implemented and tested to further enhance the resilience against
vulnerabilities.
6/10
Radically Open Security B.V. - Chamber of Commerce 60628081
Public