Penetration Test Report (Cure53): pentest report Cryptocat 2

Cure53 Public Pentest Report: Cryptocat 2
Testing & Documentation: Dr.-Ing. Mario Heiderich, Krzysztof Kotowicz & Maxim Rupp
Proof-Read & Editing: Paula Pustulka · 9th of November 2012
Table of Contents
Cure53 Public Pentest Report: Cryptocat 2.....................................................................................................................1
Introduction.....................................................................................................................................................................2
Vulnerabilities..................................................................................................................................................................3
Stored XSS/HTML Injection via Conversation-/Nick-Name (High)........................................................................3
Remote Code Execution via Conversation-/Nick-Name (Critical).........................................................................4
De-Anonymization / Local Exploits via malformed Data URIs (High) ..................................................................4
Math.random() usage for unpredictable numbers (Medium)...............................................................................6
Potential DOM XSS within user nickname alteration (Medium)...........................................................................7
Invalid HTML code in link markup decorator (Low)..............................................................................................8
Multi-party HMAC implementation inconsistent with specs (Low).......................................................................9
Typo in multiparty key request implementation (Low)........................................................................................9
Remote kick / user impersonalization in multipart chat (Critical)......................................................................10
Usernames capable of altering the logic of Cryptocat 2 (Low)..........................................................................12
XMPP request IDs potential disclosure of OTR chat activity (High)...................................................................13
Cryptocat Chrome extension's cross-origin detection (Low) ............................................................................14
OTR implementation vulnerable to poisoning in rare cases (Medium)..............................................................15
Other findings................................................................................................................................................................15
Entropy Pool Misuse...........................................................................................................................................15
Multiparty public key distribution inconsistent with the specification...............................................................16
General Comments and Security Advice.......................................................................................................................17
Avoid untrusted input in jQuery selectors..........................................................................................................17
Avoid all non-alphanumeric characters in nicknames.......................................................................................18
Implement centralized filtering method............................................................................................................18
Avoid allowing SVG files.....................................................................................................................................18
Consider removing wildcard host permissions in Chrome extension................................................................19
Consider moving key storage
and encryption logic to WebWorker thread.......................................................................................................19
Develop protection against timing attacks........................................................................................................19
Conclusion.....................................................................................................................................................................20
Introduction
Cryptocat 2 is an open source web application intended to allow secure and encrypted
online chatting. Utilizing client’s side for the encryption purposes, Cryptocat 2 trusts and
uses the already encrypted data on the server only. Cryptocat 2 is delivered as a
browser extension, offering plugins for Google Chrome, Mozilla Firefox and Apple Safari.
The aim of Cryptocat 2 is to provide means for impromptu encrypted communication that
guarantees more privacy than services such as Google Talk and the like. In comparison
to various high-level encryption platforms, Cryptocat 2 strives to maintain a high degree
of accessibility, while preserving various functionalities, such as that of multiple users
connecting to a single chat room.
During the testing, the Cryptocat's 2 source code was analyzed and audited. The code
was specifically monitored for concatenation patterns, suspicious function calls, string-to-
code sinks, DOMXSS sources and implementation flaws in cryptographic protocols used
(Multiparty Protocol Specification, OTR). In addition, for debugging purposes, the
incoming server messages were tampered with or simulated, all in the attempt to see
whether a malicious server can compromise this client-level security. The following tools
were employed during the debugging process: Firefox with Firebug, Google Chrome with
Debug Tools.
Note that all vulnerabilities mentioned in this final report and pentest overview are
currently repaired and fixes are being consequently verified at the time of writing.
Vulnerabilities
Stored XSS/HTML Injection via Conversation-/Nick-Name (High)
A malicious Cryptocat 2 user can disable the client-side conversation-/nick-name
validation feature by removing the following code from the file /cryptocat.js:
else if (!$('#conversationName').val().match(/^\w{1,20}$/)) {
loginFail(Cryptocat.language['loginMessage']['conversationAlphanumeric']);
$('#conversationName').select();
}
It is through this removal that HTML can be submitted to a server of attacker's choice.
This HTML is displayed in the conversation overview without any additional encoding or
filtering. Based on the CSP protection in place for the Chrome extension, we may
assume that executing JavaScript within the application context is impossible; however,
an attacker can inject an HTML form and thereby intercept conversations, collect
keystrokes and affect the privacy promise given by Cryptocat 2 in other respects.
Note that the Chrome Extension CSP permits form submissions to external HTTP
resources, therefore enabling successful data exfiltration.
Examplary Screenshot:
Any input coming from the server or different users should be considered untrusted and
should therefore be displayed only when a condition of the proper output filtering is met.
In this situation, usage of DOM methods such as escape() is recommended.
Remote Code Execution via Conversation-/Nick-Name (Critical)
Unfortunately, Firefox Cryptocat 2 extension has proven vulnerable to the very same
problem with unfiltered reflection of user-name and/or conversation name. In addition,
unlike the Chrome browser, Firefox provides no CSP or similar browser protection.
This elevates this bug in severity, making it a potential RCE vulnerability, as the injected
JavaScript can access objects available exclusively in the privileged code. This way, the
attacker can create and execute arbitrary files and code segments on the victim’s
machine, running in the normally sanctioned privileged context of the Firefox browser
hosting the Cryptocat 2 extension.
Examplary Screenshot:
As a result, only with proper output filtering in place can an in