Penetration Test Report (Bishop Fox): Beast   Hybrid Application Assessment 2017   Assessment Report   20171114

COMPREHENSIVE REPORT
BEAST
HYBRID APPLICATION ASSESSMENT 2017
DECEMBER 8, 2017
This engagement was performed in accordance with the Statement of Work, and the procedures were limited
to those described in that agreement. The findings and recommendations resulting from the assessment are
provided in the attached report. Given the time-boxed scope of this assessment and its reliance on client-
provided information, the findings in this report should not be taken as a comprehensive listing of all security
issues.
Bishop Fox Contact Information:
[PII_REDACTED]
contact@bishopfox.com
8240 S. Kyrene Road
Suite A-113
Tempe, AZ 85284
Bishop Fox™ Confidential 2017/12/08 2
TABLE OF CONTENTS
Table of Contents .................................................................................................................... 3
Summary.................................................................................................................................. 4
Project Overview.................................................................................................................................. 4
Summary of Findings .......................................................................................................................... 7
Assessment Report ............................................................................................................... 10
Hybrid Application Assessment ..................................................................................................... 10
Denial of Service .................................................................................................................. 10
Insecure Randomness ......................................................................................................... 15
Appendix A — Measurement Scales ................................................................................... 19
Finding Severity ................................................................................................................................ 19
Appendix B — Secure Development with Beast ............................................................... 20
Bishop Fox™ Confidential 2017/12/08 3
SUMMARY
Finding Counts
Project Overview 1 High
1 Medium
The author of Beast, Vinnie Falco, engaged Bishop
Fox to assess the security of the Boost C++ Beast 2 Total findings
HTTP/S networking library. The following report
details the findings identified during the course of Scope
Beast Library v.124
the engagement, which started on September 11,
2017.
SHA1 Commit Hash
Goals 9dc9ca13b9c08c1597d0
5bcf6c19be357e426041
• Identify critical- and high-risk issues (especially
memory corruption issues) in the Beast library
Please see the Summary’s
that could be exploited to subvert expected Additional Resources for a link to
v.124 commit and the author’s
application behavior
public key
• Review Beast for security vulnerabilities with a
focus on those documented by OWASP and Dates
specific to web application technologies 09/11/2017
Kickoff
• Determine whether the design of the Beast
library meets secure-by-design principles 09/11/2017 – 10/31/2017
• Thoroughly fuzz the example advanced- Active testing
server Beast library application
12/8/2017
• Perform a manual review of Beast library
Report delivery
application source code to uncover subtle
implementation issues that may impact library
security
Approach
The assessment team conducted a hybrid application assessment of the Beast library.
Bishop Fox’s hybrid application assessment methodology leverages real-world attack
techniques through application penetration testing in combination with targeted source
code review to identify application security vulnerabilities. These full-knowledge
assessments begin with automated scans of the deployed application and source code.
Next, analyses of the scan results are combined with manual review to identify potential
application security vulnerabilities. In addition, the team performs a review of the
application architecture and business logic to locate any design-level issues. Finally, the
team performs manual exploitation and review of these issues to validate the findings.
Bishop Fox™ Confidential 2017/12/08 4
The team considered it important to assess the application in a live environment using
modern fuzzing frameworks, including both honggfuzz and afl-fuzz, as well as to
identify security vulnerabilities through manual source code review.
All references to Beast in this report are to version 124.
Fuzzing Strategy
A primary goal of the engagement was to identify vulnerabilities in the HTTP and
WebSocket protocol parsing implementations. As such, the advanced-server
application was chosen as it implemented a basic HTTP and WebSocket server,
exercised significant portions of the Beast library, and simultaneously reduced the
amount of custom code needed to get up and running. The advanced-server is found
at the following location:
https://github.com/boostorg/beast/tree/v124/example/advanced/server
The engagement team modified the advanced-server code using the following steps
to prepare Beast for fuzzing:
1. Start the HTTP server on a randomized port.
2. Read the payload to be sent from a user-specified command-line filename
argument.
3. Select the fuzzing mode based on a user-supplied value. (Three modes were
implemented: HTTP server fuzzing, WebSocket protocol fuzzing, and
WebSocket per-message deflate fuzzing.)
4. Connect to the server.
a. If fuzzing the HTTP implementation, simply write the payload as is to the
socket stream.
b. If fuzzing the WebSocket protocol implementation, perform the
WebSocket upgrade request, and then write the raw WebSocket protocol
frame bytes to the socket stream.
c. If fuzzing the WebSocket per-message deflate implementation, prepare
the WebSocket frame header manually, apply the frame header mask
value to the payload, and write the resulting frame to the socket stream.
5. Close the connection.
The engagement team used wireshark to observe the correctness of the fuzzing code,
as shown below:
Bishop Fox™ Confidential 2017/12/08 5
FIGURE 1 - WebSocket protocol fuzzing payload as viewed in wireshark
Fuzzing payloads were generated using both afl-fuzz and honggfuzz built-in
functionality. Test cases and the fuzzing implementation will be provided after report
publication and internal review.
Static Source Code Analysis
The engagement team executed the Checkmarx scanner against the Beast codebase to
achieve additional coverage and supplement the manual source code review and
fuzzing activities. Specifically, Checkmarx CX version 8.1.0 was used.
While Checkmarx did flag issues in third-party zlib library test code that were deemed
unimportant, it flagged only three informational issues in the Beast core folder that the
assessment team did not consider important enough to include in this report. Due to
the time-boxed nature of the engagement and sparse static code analysis results, the
assessment team focused on thoroughly fuzzing the server to uncover issues.
Manual Source Code Review
In addition to the fuzzing activities, the assessment team devoted a considerable
amount of time to manual source code review with the purpose of both identifying
vulnerabilities and understanding how the Beast library actually works. Due to the time-
boxed nature of the engagement, an exhaustive line-by-line review was not performed.
The manual source code review focused on the HTTP message parsing code, the
WebSocket protocol implementation, and the WebSocket per-message deflate
extension implementation via a ported zlib library. The Insecure Randomness finding
detailed below was identified as a result of the manual review.
Bishop Fox™ Confidential 2017/12/08 6
Summary of Findings
The assessment team identified the following issues as a result of the time-boxed
assessment of Beast library version 124:
Denial of Service — The assessment team successfully demonstrated three denial-of-
service a