Penetration Test Report (X41 D-Sec): X41 Balrog Review 2018 Final Report Public

TechnicalSecurityAudit-FirefoxApplicationUpdateService
forMozillaCorporation
FinalReportandManagementSummary
2018-04-23
PUBLIC
X41D-SECGmbH
Dennewartstr.25-27
D-52068Aachen
AmtsgerichtAachen:HRB19989
TechnicalSecurityAudit-FirefoxApplicationUpdateService MozillaCorporation
Revision Date Change Editor
1 2018-03-27 InitialDocument N.Abel
2 2018-03-29 Findings N.Abel,E.Sesterhenn,M.Vervier,J.-P.Aumasson
3 2018-04-02 Findings N.Abel,E.Sesterhenn,M.Vervier,J.-P.Aumasson
4 2018-04-06 Findings N.Abel,E.Sesterhenn,M.Vervier,J.-P.Aumasson
5 2018-04-11 Findings N.Abel,E.Sesterhenn,M.Vervier,J.-P.Aumasson
6 2018-04-13 Summaries N.Abel,E.Sesterhenn,M.Vervier,J.-P.Aumasson
7 2018-04-16 Corrections N.Abel,E.Sesterhenn,M.Vervier,J.-P.Aumasson
8 2018-04-23 Finalization&Delivery N.Abel,E.Sesterhenn,M.Vervier,J.-P.Aumasson
X41D-SECGmbH PUBLIC Page1of68
TechnicalSecurityAudit-FirefoxApplicationUpdateService MozillaCorporation
Contents
1 ExecutiveSummary 4
2 Overview 6
3 Scope 7
4 RatingMethodologyforSecurityVulnerabilities 8
4.1 CVSS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
4.2 SeverityMapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
4.3 CommonWeaknessEnumeration(CWE). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
5 Results 12
5.1 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
5.2 SideFindings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
5.3 RecommendedFurtherTests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
6 AboutX41D-SecGmbH 60
A Appendix 63
A.1 BSPatchHeapOverflowPoC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
X41D-SECGmbH PUBLIC Page2of68
TechnicalSecurityAudit-FirefoxApplicationUpdateService MozillaCorporation
DASHBOARD
Target
Customer MozillaCorporation
Name SourceCodeandNetworksofMozillaCorporation
Type NetworkInfrastructureandApplications
Version Asdeployedbetween 2018-03-26and 2018-04-17
Engagement
Type WhiteBoxPenetrationTestandCodeAudit
Consultants 4:E.Sesterhenn,M.Vervier,N.AbelandDr.J.-P.Aumasson
EngagementEffort 27days, 2018-03-26to 2018-04-17
Totalissuesfound 14
Figure1:IssueOverview(l:Severity,r:CWEdistribution)
Figure2:CVSSImpactandExploitabilityDistribution
X41D-SECGmbH PUBLIC Page3of68
TechnicalSecurityAudit-FirefoxApplicationUpdateService MozillaCorporation
1 Executive Summary
X41D-SecGmbHperformedatechnicalsecurityauditoftheFirefoxApplicationUpdateService(AUS)in
MarchandApril2018toassestheserviceforpotentialsecurityvulnerabilities.
TheFirefoxAUShandlessoftwareupdatesondesktopandAndroidplatforms.Itcomprisesserver-side
backendservicesthatexposepublicAPIsreturningXMLdocumentstoallowFirefoxclientstoretrieve
updatefiles.ClientspolltheAPIatregularintervalsanddownloadupdateswhenneeded.
Atotalof14vulnerabilitieswerediscoveredduringthetestbyX41D-SecGmbH.Novulnerabilitieswere
ratedascritical,threewereclassifiedashighseverity,sevenasmedium,andfouraslow.Additionally,21
issueswithoutadirectsecurityimpactwereidentified.
Figure1.1:IssuesandSeverity
ThegoalofthisreviewwastoidentifysecurityvulnerabilitiespresentinthecomponentsofAUS.This
includestheupdaterclientcomponentsincludedinFirefox,thebackenddeliveringtheupdates,andthe
managementwebapplication(Balrog).
Thereviewinvolvedatotalof216person-hoursbyateamof4securityexperts,includingacryptographer.
X41D-SECGmbH PUBLIC Page4of68
TechnicalSecurityAudit-FirefoxApplicationUpdateService MozillaCorporation
Testingwasperformedwithvariousmethodsofpenetrationtestingtoassesstheintegrityoftheinfras-
tructure,webapplications,andupdaterclients. Additionally,thesourcecodeofthetestedapplication
componentswasreviewed.
X41D-SecGmbHfoundthesecuritylevelofAUStobegood. Nocriticalvulnerabilitieswereidentified
inanyofthecomponents.ThemostseriousvulnerabilitydiscoveredwasaCross-SiteRequestForgery
(CSRF)vulnerabilityintheadministrationwebapplicationinterface,whichmightallowattackerstotrigger
unintendedadministrativeactionsundercertainconditions.Othervulnerabilitiesidentifiedwerememory
corruptionissues,insecurehandlingofuntrusteddata,andstabilityissues(DenialofService(DoS)).Most
oftheseissueswereconstrainedbytherequirementtobypasscryptographicsignatures.
Noissueswereidentifiedinthehandlingofcryptographicsignaturesforupdatefiles. Therewereno
cryptographicsignaturesontheXMLfilesdescribingtheupdatefiles’locationandothermetadata.The
filesweredownloadedviaHTTPS,buttheservercertificatesorpublickeyswerenotpinned.
ItisstronglyrecommendedtosigntheupdateXMLfileswithastrongcryptographicsignaturetoprotect
metadatavaluessuchaslinkstoreleasenotes. Thiswillalsoreducetheattacksurfaceandmitigate
attacksagainsttheExtensibleMarkupLanguage(XML)parser,whichrunsinaprivilegedcontext. The
authenticationoftheBalrogwebapplicationiscurrentlyusingHTTPBasicAuthenticationwithoutrate
limiting. Toenableusageofstrongerauthentication,includingmultiplefactors,theusageofaproven
authenticationsystemorserviceisadvised.
Severalcomponentsparsingandhandlingpotentiallyuntrusteddatawererelyingonlegacycodewritten
inC.Itisrecommendedtorefactorthiscodeandpotentiallytoreimplementitusingonlymemory-safe
operations,suchasviautilizingsafelanguagesubsetsofRustorGolang.
Thenumberofsidefindingsdescribedinsection5.2wasunusuallyhigh.X41D-SecGmbHbelievesthiscan
beattributedtothetestingmode,andtoprevioustechnicalauditsthatspawnedmitigationstoprevent
theexploitationofweaknesses. Itcannotberuledoutthatsomeofthesidefindingsmightprovetobe
exploitablewithincreasedtimeeffort,andthuscouldyetresultincriticalvulnerabilities.Therefore,itis
stronglyrecommendedtofixtheseissuesinatimelymanner.
Inconclusion,theAUSshowedgoodresistanceagainsttheactualexploitationofvulnerabilities.Several
highseverityvulnerabilitiesandahighnumberofnon-directlyexploitablebugswerediscovered. Itis
recommendedtofixtheseissuesandtoconductare-testinordertovalidatethefixes.
X41D-SECGmbH PUBLIC Page5of68
TechnicalSecurityAudit-FirefoxApplicationUpdateService MozillaCorporation
2 Overview
DESCRIPTION SEVERITY ID SECTION
UseofInsecurenode.jsLibrariesWithKnownVulnerabilitiesInBalrogUI MEDIUM BLRG-PT-18-001 5.1.1
UseofInsecureJavaScriptLibrariesWithKnownVulnerabilities HIGH BLRG-PT-18-002 5.1.2
DoSDuetoNegativefseek() LOW BLRG-PT-18-003 5.1.3
Off-By-OneWriteinSECU_FilePasswd() MEDIUM BLRG-PT-18-004 5.1.4
WeakFilenameHashinmar_hash_name() LOW BLRG-PT-18-005 5.1.5
NoRateLimitingonAuthentication MEDIUM BLRG-PT-18-006 5.1.6
UpdateviaInsecureChannels MEDIUM BLRG-PT-18-007 5.1.7
BalrogAdminWebDoSviaUnicode MEDIUM BLRG-PT-18-008 5.1.8
Heap-OverflowinBSPatchFileHandling MEDIUM BLRG-PT-18-009 5.1.9
CSRFTokennotValidated HIGH BLRG-PT-18-010 5.1.10
CookiesWithouttheSecureFlag HIGH BLRG-PT-18-011 5.1.11
InadequateKeyExchangeStrengthofSSL/TLS-DH1024bits LOW BLRG-PT-18-012 5.1.12
DoSbyOverlyLargeFilesinMAR MEDIUM BLRG-PT-18-013 5.1.13
DoSagainstDiskSpace LOW BLRG-PT-18-014 5.1.14
TestcaseUsingetreeXMLParserwithDefaultSettings NONE BLRG-PT-18-101 5.2.1
TestcaseUsingxml.dom.minidom.parseString() NONE BLRG-PT-18-102 5.2.2
TestcaseUsingString-BasedSQLQueryConstruction NONE BLRG-PT-18-103 5.2.3
MixofZeroMemory()andmemset() NONE BLRG-PT-18-104 5.2.4
ReflectedXSSinBalrogUIinSelfhostedTestSetup NONE BLRG-PT-18-105 5.2.5
InformationExposureinBalrogUIinSelfhostedTestSetup NONE BLRG-PT-18-106 5.2.6
MixofMAX_PATHComparisons NONE BLRG-PT-18-107 5.2.7
CreationofBackupFilesMightFail NONE BLRG-PT-18-108 5.2.8
MemoryLeakinCaseofrealloc()Failure NONE BLRG-PT-18-109 5.2.9
ReturnTypeofmar_ensure_parent_dir() NONE BLRG-PT-18-110 5.2.10
NULLPointerDereferenceinstrip_signature_block() NONE BLRG-PT-18-111 5.2.11
LengthChecknotUsefulinmar_consume_index() NONE BLRG-PT-18-112 5.2.12
UseofUnsafeYAMLLoad NONE BLRG-PT-18-113 5.2.13
SlashatEndofPathnotRemoved NONE BLRG-PT-18-114 5.2.14
MemoryLeakinCaseofFailures N