Penetration Test Report (RadicallyOpenSecurity): 2019 CodeReview Onion Routed Cloud v0.3

Penetration Test Report
Open Tech Fund
V 0.3
Diemen, July 15th, 2019
Confidential
Document Properties
Client Open Tech Fund
Title Penetration Test Report
Targets https://deadcanaries.gitlab.io/orc/docs/tutorial-contributing.html
https://gitlab.com/deadcanaries/orc/
https://gitlab.com/deadcanaries/kadence/
Version 0.3
Pentesters Daan Spitz, Fabian Freyer
Authors Patricia Piolon, John Sinteur
Reviewed by John Sinteur
Approved by Melanie Rieback
Version control
Version Date Author Description
0.1 June 25th, 2019 Patricia Piolon Initial draft
0.2 June 26th, 2019 Patricia Piolon Edited findings/non-findings
0.3 July 15th, 2019 John Sinteur Edited findings/non-
findings, added conclusion
and future work
Contact
For more information about this document and its contents please contact Radically Open Security B.V.
Name Melanie Rieback
Address Overdiemerweg 28
1111 PP Diemen
The Netherlands
Phone +31 (0)20 2621 255
Email info@radicallyopensecurity.com
Radically Open Security B.V. is registered at the trade register of the Dutch chamber of commerce under number 60628081.
Table of Contents
1 Executive Summary 5
1.1 Introduction 5
1.2 Scope of work 5
1.3 Project objectives 5
1.4 Timeline 5
1.5 Results In A Nutshell 5
1.6 Summary of Findings 6
1.6.1 Findings by Threat Level 7
1.6.2 Findings by Type 8
1.7 Summary of Recommendations 8
2 Methodology 10
2.1 Planning 10
2.2 Risk Classification 10
3 Reconnaissance and Fingerprinting 12
3.1 Automated Scans 12
4 Findings 13
4.1 OTF-001 — CSRF Vulnerability in /Objects/Resolve Bridge Endpoint 13
4.2 OTF-002 — DoS Vulnerability in Multipart Processing in Dicer Module 15
4.3 OTF-003 — CSRF Vulnerability in /Objects Bridge Endpoint 16
4.4 OTF-004 — Hibernation May Lead to DoS of Individual Nodes 18
4.5 OTF-005 — Outdated Dependency in Development Modules (Handlebars 4.1.1) 19
4.6 OTF-006 — X-Powered-By Header Discloses Framework 20
4.7 OTF-007 — Eclipse and Sybil Attacks Are Still Possible 21
4.8 OTF-008 — Outdated Dependency in Development Modules (Tar >=4.4.2) 22
4.9 OTF-009 — Outdated Dependency in Development Modules (Marked >=0.6.2) 23
5 Non-Findings 24
5.1 NF-001 — Potential Header Injection in /Objects/:Id 24
5.2 NF-002 — Potentially Interesting Decrypt Operation in /Totp 24
5.3 NF-003 — Eval Call With Explicit Eslint Exception in Sinon Dependency 25
5.4 NF-004 — No Apparent XSS or Header Injection in File Download 25
5.5 NF-005 — Eslint-Plugin-Security Output 27
5.6 NF-006 — NodeJsScan Output 29
5.7 NF-007 — No XSS in Bridge Pug Templates 29
5.8 NF-008 — Misc Missing Headers 29
5.9 NF-009 — Kadence Only Checks Rmd160 Hash of Content on STORE, but ORC Correctly
Verifies It in BlobMapping.writeToSliceMap 30
5.10 NF-010 — Nodes Respond With Any Data Stored, Including That Requested Themselves 31
5.11 NF-011 — Mime-Type Set on Downloaded Items, but No XSS Due to Content-Disposition:
Attachment 32
5.12 NF-012 — Churnfilter Plugin Looks Good 32
5.13 NF-013 — No Type Confusion Between BlobPointers and Raw Blob Slices Possible 32
5.14 NF-014 — No Unencrypted Data Stored in the DHT 33
5.15 NF-015 — Notifications Do Not Leak Crypto Paramters 33
5.16 NF-016 — Potentially Interesting Decrypt Operation With Error Messages in Bridge /Objects/
Resolve 33
5.17 NF-017 — Potentially Interesting Decrypt Operation With Timing Issue in bridge.js
_checkOathToken 35
6 Future Work 36
7 Conclusion 37
Appendix 1 Testing team 38
Confidential
1 Executive Summary
1.1 Introduction
Between April 27, 2019 and June 2, 2019, Radically Open Security B.V. carried out a security audit for Open Tech Fund
This report contains our findings as well as detailed explanations of exactly how ROS performed the security audit.
1.2 Scope of work
The scope of the security audit was limited to the following targets:
• https://deadcanaries.gitlab.io/orc/docs/tutorial-contributing.html
• https://gitlab.com/deadcanaries/orc/
• https://gitlab.com/deadcanaries/kadence/
1.3 Project objectives
• Perform a security audit on the Onion Routed Cloud (ORC) application, and in particular:
• Identify any vulnerabilities that could expose the identity of the user, censor or destroy data, compromise secrets.
• Identify any vulnerabilities or shortcomings in network architecture that could undermine the ability of the network
to function properly, like DDoS, Sybil, etc.
• Identify any issues in the way that ORC makes use of the Tor network.
1.4 Timeline
The Security Audit took place April 27, 2019 and June 2, 2019.
1.5 Results In A Nutshell
A number of web-application vulnerabilities in the bridge application and API were found that can lead to successful,
high-impact CSRF attacks (OTF-001 (page 13), OTF-003 (page 16)) and DoS ( OTF-002 (page 15)).
Additionally, a minor information disclosure of the framework used (OTF-006 (page 20)) was identified.
Executive Summary 5
While auditing the peer-to-peer networking component, it was found that the mitigations agains eclipse and sybil attacks
are not sufficient to deter a motivated attacker (OTF-007 (page 21)), and that the "hibernation" functionality may be
abused to perform a DoS attack (OTF-004 (page 18)).
Finally, a number of outdated and vulnerable dependencies were found ( OTF-005 (page 19), OTF-008 (page 22),
OTF-009 (page 23)), which seem to have negligible security impact.
1.6 Summary of Findings
ID Type Description Threat level
OTF-001 CSRF There is no CSRF protection on the files -> import form in High
the bridge management web application.
OTF-002 DoS A Denial of Service vulnerability was discovered in the High
way the dicer module is used to process multipart post
requests.
OTF-003 CSRF There is no CSRF protection in the files -> upload form in High
the bridge management web application.
OTF-004 DoS The hibernate kadence plugin can be abused to DOS a Elevated
node.
OTF-007 DoS The kadence eclipse plugin is not sufficient to mitigate Moderate
eclipse and sybil attacks.
OTF-005 Arbitrary Code An outdated development dependency was detected Low
Execution which contains a potential arbitrary code execution
vulnerability.
OTF-006 Information Disclosure The bridge application server discloses that it's using the Low
Express framework in all HTTP responses.
OTF-008 Arbitrary File Overwrite An outdated development dependency was detected Low
which contains a potential arbitrary file overwrite
vulnerability.
OTF-009 Regular Expression An outdated development dependency was detected Low
DoS which contains a potential Regular Expression Denial of
Service vulnerability.
6 Radically Open Security B.V.
Confidential
1.6.1 Findings by Threat Level
High (3)
Elevated (1)
Moderate (1)
Low (4)
33.3%
44.4%
11.1%
11.1%
Executive Summary 7
1.6.2 Findings by Type
Dos (3)
CSRF (2)
11.1%
Arbitrary code execution (1)
Information disclosure (1)
11.1% 33.3%
Arbitrary file overwrite (1)
Regular expression dos (1)
11.1%
11.1%
22.2%
1.7 Summary of Recommendations
ID Type Recommendation
OTF-001 CSRF
• By using CSRF tokens that are freshly generated on new page loads
and required to trigger any important functionality during a logged-
in session, an attacker cannot trigger any of this functionality without
first obtaining this token. There are several middleware solutions for
NodeJS which implement this, so a custom solution would be fairly
easy to implement.
OTF-002 DoS
• Properly catch this error so that only the handling of the current
request fails and the server itself stays up to process any further
requests.
OTF-003 CSRF
• By using CSRF tokens that are freshly generated on new page loads
and required to trigger any important functionality during a logged-
in session, an attacker cannot trigger any of this functionality without
first obtaining this token. There are several middleware solutions for
8 Radically Open Security B.V.
Confidential
NodeJS which implement this, and a custom solution would be fairly
easy to implement.
OTF-004 DoS
• Keep BandwidthAccountingEnabled set to 0
• Do not reject requests when bandwidth limits are exceeded, but
instead