Penetration Test Report (Cure53): pentest report clipperz

Pentest-Report Clipperz 04.2014
Cure53, Dr.-Ing. Mario Heiderich / Franz Antesberger / Jonas Magazinius / Johannes Dahse
Index
Intro
Scope
Test Chronicle
Identified Vulnerabilities
CLP-01-001 DOMXSS in Clipperz Bookmarklet via benign HTML Injection (Medium)
CLP-01-002 Remote Code Execution in PHP Backend (Critical)
CLP-01-003 SQL Injection in PHP Backend (High)
CLP-01-004 Reflective Cross-Site Scripting in PHP Backend (Medium)
CLP-01-005 Local Cross-Site Scripting in PHP Backend (Low)
CLP-01-006 Unauthenticated Data Modification in PHP Backend (Info)
CLP-01-007 Session Fixation in PHP and Python Backend (Low)
CLP-01-008 File Disclosure in Java Backend on Windows (Low)
CLP-01-009 Unfiltered Street Address Data causes Self-XSS (Medium)
CLP-01-014 Persistent XSS via Direct Login from Bookmarklet (Critical)
CLP-01-015 Persistent XSS on Index Page via Direct Login Favicon (Critical)
CLP-01-016 SRP Implementation vulnerable to known Attacks (High)
CLP-01-017 SRP Authentication Bypass (Critical)
Miscellaneous Issues
CLP-01-010 Reflection Injection in PHP Backend (Low)
CLP-01-011 Static window.name after Card Creation or Editing (Low)
CLP-01-012 No ID-Collision check disables Close Button (Low)
CLP-01-013 Information Leakage in PHP Backend (Low)
CLP-01-018 Weak PRNG in use by Clipperz Crypto-Libraries (Medium)
CLP-01-019 Erroneous Code used in SHA Module (Low)
CLP-01-020 Dead Code used in Clipperz Crypto Modules (Low)
CLP-01-021 AES Block Cipher differs from Standards (Low)
CLP-01-022 Usage of outdated MochiKit Library (Low)
CLP-01-023 Usage of outdated YUI Library (Low)
CLP-01-024 MitM attack allows execution of Privileged Functions (Medium)
CLP-01-025 Reuse of a previously calculated Toll (Low)
Conclusion
Intro
“Clipperz is an online vault and password manager that knows nothing about you and
your data. Everything you submit is locally encrypted by your browser before being
uploaded to Clipperz. The encryption key is a passphrase known only to you and
Clipperz could never access your data. Clipperz is built upon open proven and trusted
encryption algorithms. You can review the Javascript code anytime you like. It’s all open
source.”
From https://clipperz.is/
Scope
• Clipperz Sourcecode
◦ Beta branch on Github, high focus on “Crypto”-Lib
◦ https://github.com/clipperz/password-manager/tree/master/frontend/beta
• Clipperz Server & Java App
◦ Info about Java App: (see shared files)
◦ https://github.com/clipperz/password-manager/tree/master/backend
Test Chronicle
• 2014/04/27 - Penetration-Test begins
• 2014/04/27 - Standard XSS Tests against Clipperz.is
• 2014/04/27 - XSS Tests in logged-in area
• 2014/04/28 - Java Backend Audit
• 2014/04/28 - XSS Tests against Bookmarklet
• 2014/04/28 - Bookmarklet Source Code Analysis
• 2014/04/28 - Added CLP-01-001
• 2014/04/29 - PHP and Python Backend Audit
• 2014/04/29 - DOMXSS analysis
• 2014/04/29 - Offline mode analysis
• 2014/04/30 - Frontend/js/Clipperz/Crypto Audit
• 2014/04/30 - Tests against Backend XSS in Clipperz
• 2014/04/30 - Close analysis of Bookmarklet Code and JSON Import
• 2014/04/30 - Discovery of several XSS vulnerabilities
• 2014/04/30 - Added CLP-01-014 and CLP-01-015
• 2014/04/30 - Analysis of communication protocols
• 2014/04/30 - Analysis of client-side crypto implementation
• 2014/05/01 - Ongoing XSS Tests
• 2014/05/01 - Frontend/js/Clipperz/PM Audit
• 2014/05/04 - Fix verification for Fixes of CLP-01-014 and CLP-01-015
• 2014/05/04 - XSS Tests based on fixes and changes
• 2014/05/05 - In-depth analysis of SRP authentication
• 2014/05/05 - Analysis of server-side crypto implementation
• 2014/05/05 - Added CLP-01-017
• 2014/05/06 - Continued in depth analysis of communication protocols
• 2014/05/06 - Verified fix for CLP-01-017
• 2014/05/06 - Analysis of server-side logic
• 2014/05/06 - Analysis of “toll” system
• 2014/05/08 - Finalization of Pentest-Report
Identified Vulnerabilities
The following sections list both vulnerabilities and implementation issues spotted during
the testing period. Note that findings are listed in a chronological order rather than by
their degree of severity and impact, which is simply given in brackets following the title
heading for each vulnerability. Each vulnerability is additionally given a unique identifier
for the purpose of facilitating future follow-up correspondence.
CLP-01-001 DOMXSS in Bookmarklet via benign HTML Injection (Medium)
An insecure concatenation of HTML strings in the Clipperz bookmarklet core leads to an
array of options that an attacker can use to turn a harmless injection on a victim-website
into an XSS scenario. This occurs as soon as a user activates the bookmarklet, as it
contains injectable code that allows arbitrary JavaScript execution from a harmless
injection. Please follow the outline below:
PoC:
(run Clipperz Bookmarklet on this website)
<body>
<form action=''>
<input name='username' type='text'>
<input name='</textarea><img src=x onerror=alert(domain)>' type='password'>
</form>
Affected HTML:
<textarea style="border:2px solid #333366; font-family:sans-serif; font-
size:8pt; color:#336; width:240px; height:135px; padding:4px; background-
color:white; margin:0px 10px;" id="bookmarklet_textarea">{"page": {"title": ""},
"form": {"attributes": {"action": "http://0x0/Test/",
"method": null},
"inputs": [{"type": "text",
"name": "username",
"value": "root"},
{"type": "password",
"name": "</textarea><img onerror="alert(domain)" src="x">",
"value": "k4n0n3!?"}]},
"version": "0.2.3"}</div>
Affected Code:
innerHTML+="<textarea id=\"bookmarklet_textarea\" style=\"border:2px solid
#333366; font-family:sans-serif; font-size:8pt; color:#336; width:240px;
height:135px; padding:4px; background-color:white; margin:0px
10px;\">"+sj(someParameters)+"</textarea>";}
...
sj=function(o){var objtype=typeof(o);if(objtype=="number"||objtype=="boolean")
{return o+"";}else if(o===null){return"null";} if(objtype=="string"){return
rs(o);} var me=arguments.callee;if(objtype!
="function"&&typeof(o.length)=="number"){var res=[];for(var i=0;i<o.length;i++)
{var val=me(o[i]);if(typeof(val)!="string"){val="undefined";} res.push(val);}
return"["+res.join(",\n")+"]";}
...
rs=function(o){return("\""+o.replace(/([\"\\])/g,"\\$1")+"\"").replace(/
[\f]/g,"\\f").replace(/[\b]/g,"\\b").replace(/[\n]/g,"\\n").replace(/
[\t]/g,"\\t").replace(/[\r]/g,"\\r");}
Any form of HTML (even the contents of HTML element attributes) must be considered
as a potential attack vector. While Clipperz currently does a good job in terms of
encoding HTML element value attributes, other attribute types are not escaped, encoded
or filtered at all. An identification of this and other bugs, specifically CLP-01-014 and
CLP-01-015, is due to this behavior.
Solving this problem entails any form of user-controlled data being processed safely
prior to the resulting data display. The HTML special characters need to be encoded to
their respective entity representation before they are displayed.
CLP-01-002 Remote Code Execution in PHP Backend (Critical)
The PHP backend is susceptible to Remote Code Execution attacks. In the
setup/rpc.php file the name of a class can be specified in the objectname parameter,
an object of which is later instantiated within an eval statement.
$objectName = isset($_REQUEST['objectname']) ? $_REQUEST['objectname'] : '';
[...]
eval ('$instance = new '.$objectName.'();');
[...]
switch($action)
{
case 'Add':
eval ('$instance = new '.$objectName.'();');
[...]
case 'Delete':
eval ('$instance = new '.$objectName.'();');
[...]
case 'Update':
eval ('$instance = new '.$objectName.'();');
function RefreshTree($objectName, $root, $offset = '', $limit = '')
{
[...]
eval ('$instance = new '.$objectName.'();');
An attacker can add arbitrary PHP code to the unsanitized objectname parameter that
is then executed on the web server. As a result, the web server and its data are fully
compromised.
/setup/rpc.php?objectname=stdClass();system(‘whoami’);phpinfo
Note that the setup routine can be protecte