Penetration Test Report (Hackmanit): Penetration Test Report DENIC ID Login Relying Party by Hackmanit

Penetration Test Report:
DENIC ID Relying Party - Member Login
Version: 1.2.1
22.04.2024
Dr. Juraj Somorovsky
|
Phone: (+49)(0)234/45930961 E-Mail: Juraj.Somorovsky@hackmanit.de
Project Information
Customer: DENICeG
Kaiserstraße75-77
60329FrankfurtamMain,Deutschland
Contact: MarcosSanz
Commissionedto: HackmanitGmbH
Universitätsstraße60(Exzenterhaus)
44789Bochum,Germany
Projectexecutive: Dr. JurajSomorovsky
Phone: (+49)(0)234/45930961
Fax: (+49)(0)234/45930960
E-Mail: Juraj.Somorovsky@hackmanit.de
Projectmembers: MarioKorth(HackmanitGmbH)
Dr. ChristianMainka(HackmanitGmbH)
KarstenMeyerzuSelhausen(HackmanitGmbH)
Dr. VladislavMladenov(HackmanitGmbH)
Projectperiod: June4,2019–June11,2019
Versionofthereport: 1.2.1
ThisreportwastechnicallyverifiedbyDr. ChristianMainka.
ThisreportwaslinguisticallyverifiedbyDavidHerring.
HackmanitGmbH
Representedby: Prof. Dr. JörgSchwenk,Dr. JurajSomorovsky,
Dr. ChristianMainka,Prof. Dr. MarcusNiemietz
Registercourt: AmtsgerichtBochum,HRB14896,Germany
1
Contents
Contents
1 Summary 3
2 ProjectTimeline 4
3 Methodology 4
4 GeneralConditionsandScope 4
5 ScenarioDescription 5
6 OverviewofWeaknesses,Recommendations,andInformation 8
7 Weaknesses 10
7.1 M01 ValidOpenIDConnectFlowwithaMissingstateParameter . . . . . . . 10
7.2 M02 InsufficientCross-SiteRequestForgeryProtection . . . . . . . . . . . . . . 11
7.3 M03 FaultySessionManagementandMissingFreshCookieGeneration . . . . 12
7.4 L01 ValidOpenIDConnectFlowwithaReplayedstateParameter . . . . . . 13
7.5 L02 EnforceStrictComparisonsfortheValuesofIDTokenClaims . . . . . . . 14
7.6 L03 EnforceValidationofiatandexpClaimsintheIDToken . . . . . . . . . 15
8 Recommendations 17
8.1 R01 UsetheOpenIDConnectParameternonce . . . . . . . . . . . . . . . . . . 17
8.2 R02 RepeatingValuesinEphemeralTLS-ECDHKeys . . . . . . . . . . . . . . . 17
8.3 R03 RemoveReferencestoCRYPT_RSA . . . . . . . . . . . . . . . . . . . . . . 19
8.4 R04 PreventtheUseofUninitializedValues . . . . . . . . . . . . . . . . . . . . . 19
8.5 R05 PotentiallyInsecureXMLParsingofRSAKeys . . . . . . . . . . . . . . . . 19
9 FurtherEvaluations 21
9.1 BindingBetweenCookiesandthestateParameter . . . . . . . . . . . . . . . . 21
9.2 ChangingtheOpenIDConnectFlow . . . . . . . . . . . . . . . . . . . . . . . . . . 21
9.3 IDTokenValidations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
9.3.1 ClaimValidations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
9.3.2 ReplacingtheIDTokenintheTokenResponse . . . . . . . . . . . . . . . . 22
9.3.3 SignatureExclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
9.3.4 KeyInformation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
9.4 CovertRedirect . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
9.5 MaliciousValuesforthestateParameter . . . . . . . . . . . . . . . . . . . . . . 24
9.6 TLSConfiguration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
10 References 29
2
1 Summary
1 Summary
DENIC ID is the first widely-deployed implementation of the ID4me protocol [1]. ID4me is a
novel protocol for federated identity management whose two main goals are to provide (1)
Authorization of a user for access to any third party accepting ID4me identifiers and (2) Con-
trolled communication of the user’s personal information to the third parties accessed by the
user [1]. ID4me is based on well-established standards such as OpenID Connect (OIDC) [8]
andthedomainnamesystem(DNS)[4].
Hackmanit GmbH was commissioned to perform a penetration test on a relying party in the
contextofDENICID-thenewDENICMemberLoginpage. Thepenetrationtestwasperformed
remotelywithatotalexpenseof11PT.
Weaknesses. Duringthepenetrationtest,threeweaknessesclassifiedasMediumwereiden-
tified. Twooftheseweaknessesrelatetotheinsufficientprotectionagainstcross-siterequest
forgery (CSRF) attacks. First, the login page does not contain CSRF protection mechanisms
like CSRF tokens, which allows an attacker to force a victim to start an authentication flow
without its consent ( M01 ). Second, the presence of the state parameter, which is used to
protectagainstCSRFattacksintheOIDCprotocol,isnotenforcedbytherelyingparty( M02 ).
Thisenablesanattackertologavictimintoanaccountcontrolledbytheattackerwhichmight
result in the victim revealing personal information or files to the attacker. The third weakness
couldallowanattackertocompromisetheaccountofavictimduetofaultysessionandcookie
management when the victim logs in again after a successful logout using the same browser
( M03 ). Someoftheweaknessesidentifiedduringthepenetrationtestareweaknessesinthe
library OpenID-Connect-PHP1 which the tested relying party is based on. We responsi-
blydisclosedtheseweaknessestothelibrarydevelopersinJune2019andsupportedthemby
implementingsecurityfixes.
Structure. Thereportisstructuredasfollows:InSection2,thetimelineofthepenetrationtest
is listed. Section 3 introduces our methodology and Section 4 explains the general conditions
andscopeofthepenetrationtest. Section6providesanoverviewoftheidentifiedweaknesses,
as well as, further recommendations and information. In Section 7, all identified weaknesses
arediscussedindetailandspecificcountermeasuresaredescribed.Section8summarizesour
recommendations resulting from observations of the application. Finally, Section 9 lists ad-
ditionalteststhatdidnotrevealanyweaknesses.
1https://github.com/jumbojett/OpenID-Connect-PHP
3
4 GeneralConditionsandScope
2 Project Timeline
ThepenetrationtestwasperformedremotelybetweenJune4,2019andJune11,2019. Four
penetrationtesterswithdifferenttechnicalbackgroundswereinvolvedwithatotalexpenseof
11PT.
3 Methodology
Amongothers,thefollowingtoolswereusedforthepenetrationtest:
Tool Link
MozillaFirefox https://www.mozilla.org/de/firefox/
GoogleChrome https://www.google.com/intl/de_ALL/chrome/
BurpSuiteProfessional https://portswigger.net/burp
EsPReSSO https://github.com/RUB-NDS/BurpSSOExtension
testssl.sh https://testssl.sh/
TLS-Scanner https://github.com/tls-attacker/TLS-Scanner
Self-developedtools -
Risk Rating. Each weakness has its own CVSS 3.1 base score rating (Common Vulnerability
Scoring System Version 3.1 Calculator).2,3 Based on the CVSS 3.1 base score, the following
weaknessesassessmentisperformed:
0.0–3.9: Low
4.0–6.9: Medium
7.0–8.9: High
9.0–10.0: Critical
4 General Conditions and Scope
In the scope of the grey-box penetration test was the new DENIC Member Login page which
wasaccessibleat: https://member.secure.denic.de/member-login/new/
In contrast to the old login page, it supports the ID4me implementation, DENIC ID, to allow
userstologinusingtheirDENICIDidentifier.
IntermsoftheID4mestandard,theloginpagerepresentsarelyingpartywhichusesIDtokens
issuedbyanidentityauthoritytoidentifyandauthenticatetheuserduringtheloginprocess.
2https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator
3https://www.first.org/cvss/v3.1/user-guide
4
5 ScenarioDescription
TherelyingpartyonlysupportstheuseofonepredefinedidentityauthorityoperatedbyDENIC.
Therefore,ascenariowithmultipleidentityauthoritiesisexplicitlyoutofthescopeofthispen-
etration test. If an relying party supports more than one identity authority, further security
considerationsandpossibleattacksmustbetakenintoaccount.
5 Scenario Description
DENIC ID is an implementation of ID4me [1] – an “Open, Global, Federated Standard For The
Digital Identity Management”.4 It is based on established standards such as OIDC and the
DNS.Incontrasttoothersinglesign-on(SSO)schemes,ID4medividesthedutiesoftheiden-
tityprovider(IdP)intotwoseparatedentities: anidentityagentandanidentityauthority. The
identity agent provides registration services and manages user data. The identity authority is
responsible for user authentication and authorization. This role separation results in the fol-
lowingfourentitiesbeinginvolvedinaloginprocessbasedonID4me:
User AuserutilizingID4metologinatanonlineservice. Hisuseraccountisassoc