Penetration Test Report (Cure53): pentest report whiteout

Pentest-Report Whiteout.io 04.2015
Cure53, Dr.-Ing. Mario Heiderich, Dr. Jonas Magazinius, Franz Antesberger, Jann Horn
Index
Introduction
Scope
Identified Vulnerabilities
WO -03-002 Insecure Regexps usage on DOMPurify Sanitizer Outpu t ( High )
WO -03-003 Insecure File Download Method Fallbacks ( Low )
WO -03-009 Image Loading Op t - in Protection can be bypassed ( Low )
WO -03-011 No Reliable Sender Indication is implemented ( Medium )
WO -03-012 Broken postMessage Origin - Check in Iframe - Resizer ( Low )
WO -03-013 Lack o f X - Frame - Options Header on Whiteou t Server ( Medium )
WO -03-014 Spoofing o f Signed Messages and genera l U I Concerns ( High )
WO -03-016 TOFU Behavior for Forge - based TLS ( Medium )
WO -03-017 No Forward Secrecy for TLS Connection in Forge ( L ow )
WO -03-018 Weak Passwords & Misleading Passphrase Strength Check ( Low )
WO -03-019 Persona l Data appearing in Debug Logs ( Low )
WO -03-020 Insecure Defaul t in Implementation o f BCC Feature ( Low )
WO -03-021 No Caching happening for Keyserver Responses ( Medium )
WO -03-022 Mai l Server Settings are no t displayed by defaul t ( Low )
WO -03-023 STARTTLS Setting leads to opportunistic STARTSSL ( High )
WO -03-024 Links can be opened in the message frame in MSIE 11 ( High )
WO -03-027 Public - Key Verifier approves o f unknown public Keys ( Low )
WO -03-028 Spoofing o f Return Address using malformed Reply - To Header ( High )
Miscellaneous Issues
WO -03-001 Loss o f Entropy in randomString () Method o f crypto - lib ( Low )
WO -03-004 Of f - by - one Error in randomString () Method o f crypto - lib ( Low )
WO -03-005 Of f - by - one Error in Prime Worker Code o f Forge library ( Low )
WO -03-008 No Origin Checks for postMessage Communication ( High )
WO -03-015 Regex - based Certificate Verification prone to Bypasses ( Medium )
WO -03-025 Unsafe Extraction o f clearsigned Tex t ( Low )
WO -03-026 Key ID Collisions can preven t Key Download from working ( Low )
Conclusion
1/17
Introduction
“Whiteout Mail is the first email solution with end-to-end encryption based on open
standards that has a beautiful user interface and is easy to use. We support all major
platforms and form factors (Windows and Firefox coming soon).“
From https :/ / whiteout . io /# product
This penetration test and source code audit against several parts of the Whiteout.io
software portfolio was carried out by four senior testers of the Cure53 team. The test
was completed over the course of eight days. The audit was performed against a
specific version of the Whiteout software, specifically tagged as ready for testing by the
maintainers. The results of this test comprise eighteen security vulnerabilities of varying
severity, as well as several general weaknesses.
Prior to this test, Cure53 has since late 2013 accompanied the Whiteout team in their
work towards arriving at a secure yet user-friendly PGP-based mail client solution. This
penetration test report describes the last of numerous tests that took place at different
stages leading to the time when the Whiteout software reached the much anticipated
stable version 1.0.
The reported high severity vulnerabilities have been discussed with the Whiteout team
and fixed in accordance with the agreed discussions’ outcomes. This final report
describes the identified findings and gives insight into attack methodology, impact, and
fix recommendations. Some of the mentioned low-severity issues will be addressed in
the later versions, due to the fact that the resulting attack surface and connected risks
were deemed acceptable: they would require complex preconditions for successful
exploitation and can therefore await holistic handling through “Defense in Depth”.
Scope
• Concept-Review “PGP Key Management”
◦ https :/ / blog . whiteou t . io /2015/02/06 / making - pgp - key - managemen t - invisible - so -
johnny - can - encryp t/
• Penetration-Test against Whiteout.io 0.25
◦ https :/ / github . com / whiteou t - io / mai l - htm l 5 / tree / v 0.25.0
2/17
Identified Vulnerabilities
The following sections list both vulnerabilities and implementation issues spotted during
the testing period. Note that findings are listed in a chronological order rather than by
their degree of severity and impact, which is simply given in brackets following the title
heading for each vulnerability. Each vulnerability is additionally given a unique identifier
(e.g. WO-03-00X) for the purpose of facilitating any future follow-up correspondence.
WO-03-002 Insecure Regexps usage on DOMPurify Sanitizer Output (High)
Upon reviewing the usage of the XSS filter library DOMPurify, a problem was spotted
that results from attempting to manually filter out certain attributes from image elements
for privacy’s sake. The file mail-html5/src/js/controller/app/read-sandbox.js uses the
following code to sanitize HTML mails:
// sanitize HTML content: https://github.com/cure53/DOMPurify
html = window.DOMPurify.sanitize(html);
// make links open in a new window
html = html.replace(/<a /g, '<a target="_blank" ');
// remove sources where necessary
if (e.data.removeImages) {
html = html.replace(/(<img[^>]+\b)src=['"][^'">]+['"]/ig, function(match,
prefix) {
return prefix;
});
}
document.body.innerHTML = html;
While DOMPurify outputs HTML code that is safe to assign to innerHTML, it does not
guarantee that the code is free of potentially problematic issues like single-quotes within
attribute values. In addition, a regular expression is being used against the resulting
HTML string, seeking to manipulate image elements - and the manipulation is done in an
unsafe way. Therefore the following attack is possible.
The attacker sends an HTML mail containing the code:
<img src="foo' onmouseover=alert(1)//" width="200" height="200">
After going through DOMPurify, the code looks like this:
<img height="200" width="200" src="foo' onmouseover=alert(1)//">
Then, if e.data.removeImages is enabled, the regular expression turns the code into this:
<img height="200" width="200" onmouseover=alert(1)//">
This is then parsed by the browser as the following HTML:
<img height="200" width="200" onmouseover="alert(1)//&quot;">
While it does not seem possible to use this for an attack in most browsers due to the
Content-Security-Policy header, it is vital that Internet Explorer 11 ignores that
3/17
header. Thus, in order to make CSP rules effective in this case, it is necessary to set the
X-Content-Security-Policy header.1 Combined with WO -03-008, the problem
described here indicates that any website can run arbitrary JS code in the context of the
user, just as long as the employed browser is Internet Explorer accompanied by code
like this:
<iframe src="https://mail.whiteout.io/tpl/read-sandbox.html#alert('this is
xss!\nlocation: '+location)" width="100%" height="100%"></iframe>
<script>
setTimeout(function() {
frames[0].postMessage({html:'<img src="foo\'
onmouseover=eval(location.hash.slice(1))//" width="2000" height="2000">',
removeImages: true}, '*');
}, 3000);
</script>
Instead of manipulating the output of DOMPurify by means of regular expressions, it is
recommended to use DOMPurify hooks or implement a proper configuration object to
filter certain elements and attributes. The Hook API is predestined to be used with
special element and attribute modifications, which signifies its high capability in handling
this specific use case. Furthermore, it is recommended to set CSP rules for both the
Content-Security-Policy and the X-Content-Security-Policy headers.
Note: The issue has been addressed by the Whiteout-Team and was verified as fixed by
Cure53.
WO-03-003 Insecure File Download Method Fallbacks (Low)
In browsers failing to support the combination of the download attribute and Blob, as
well as lacking support for window.navigator.msSaveBlob() (a setup currently
appearing exclusively applicable to Safari), Download.prototype.createDownload()
falls back to navigating to a Blob or a Data URI with attacker-specified MIME