Penetration Test Report (KudelskiSecurity-X41): X41 Kudelski Wire Security Review Web Calling

WireSecurityReview–Phase2–Web,Calling
forWireSwissGmbH
FinalReport
2018-03-07
FORPUBLICRELEASE
Contents
1 Summary 2
2 Findings 3
2.1 WebApplication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
2.2 Calling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
3 About 18
1
1 Summary
This report documents the findings identified in the Wire web application and calling
components.
From a total of seven vulnerabilities that were discovered during the test, one was
classifiedashighseverity,fiveasmedium,andoneaslow. Noobservationswithouta
direct security impact have been made. The issue with the highest severity was an
outdatedJavaScriptframeworkthatcouldpotentiallyallowinjectionattacksagainstthe
application.AllidentifiedvulnerabilitiesexceptforaDoSissuerequirepreconditionsto
beexploitedsuccessfully.
ThemainWirerepositoriescoveredduringthereviewarewire-webappandwire-audio-
video-signaling.
Thisreviewdoesnotcover:
• codeofaudio/videocodecsandtheWebRTCimplementation;
• codeofthird-partydependenciesandtemplateengines.
Wirehaspatchedormitigatedthediscoveredvulnerabilitiesaftertheywerereported.
The work was performed between March 7th and July 5th, 2017, by Jean-Philippe
Aumasson (Kudelski Security) and Markus Vervier (X41 D-Sec GmbH). A total of 7.5
person-dayswerespent,withmostofthetimespentreviewingcodeandinvestigating
potentialsecurityissues.
2
2 Findings
ThissecurityreviewreportcoversseveralcomponentsoftheWiresuiteofapplications:
• Thewebapplication(section2.1)
• Signallingcomponentsofthecallingprotocol(section2.2)
TheworkwasperformedbetweenMarchandJuly2017,withatotalof4.5person-days
(KudelskiSecurity)and3person-days(X41D-Sec).Thecodesubjecttothisreviewwas
available in the repositories wire-webapp (revision
ef30665e6824047a60af00405b10758897db46fa) and wire-audio-video-signaling
(revision99799d12f49fcddf7252748b8f3dceff3625d0fe).
3
WireSecurityReview–Phase2–Web,Calling WireSwissGmbH
2.1 W A
EB PPLICATION
WereviewedtheWirewebapplication(availableintherepositoryhttps://github.c
om/wireapp/wire-webapp,revisionef30665e6824047a60af00405b10758897db46fa)
for common web application vulnerabilities. This app is the base for the standalone
desktopclientsbasedonElectron1,andisalsoavailableforusageinnormalbrowsers
athttps://app.wire.com.Thisreviewwasfocusedonthewebapplicationcomponents
anddoesnotconsiderElectronandthepotentialattacksurfacethatitmightprovide.
1
https://electron.atom.io/
FORPUBLICRELEASE Page4of19
WireSecurityReview–Phase2–Web,Calling WireSwissGmbH
2.1.1 WIRE-P2-00: PossibleXSSViaDeviceLocation
Severity: MEDIUM
CWE: 123
2.1.1.1 Description
TheWirewebapplicationwilldisplaythelocationwhereauser’sdevicewasfirstactivated
anddoesnotfiltertheresolvednamesformarkup.
LocationdataisresolvedusingtheGoogleMapsAPI2.Givennumericlocationcoordinates
itwillresolvethemtoaname. ThisnameisthenusedunfilteredinHTMLmarkupas
displayedinfigure2.1.
Figure2.1:UnfilteredLocationData
This markup is later used in the user preferences to fill a template using Knockout3
templates:
<div class="label-xs" data-bind="html: activated_in"></div>
1
Asseenabovethedata-bind attributehasthehtml: optionenabledwhichmeansthat
markupwillbeinsertedunfilteredintothepage. Anattackerabletocontroldataona
compromisedbackendortheGoogleMapsAPImightinsertmaliciousmarkupintothe
wire-webapppagecontext.
Wirefixed4 thisissuebyreplacingthehtml attributewiththetext attribute.
2
https://developers.google.com/maps/
3
https://knockoutjs.com
4
https://github.com/wireapp/wire-webapp/commit/a28c2cb6d3efd49ea61bbdbd67f3a
f734753bd8a
FORPUBLICRELEASE Page5of19
WireSecurityReview–Phase2–Web,Calling WireSwissGmbH
2.1.1.2 SolutionAdvice
Werecommendtousethetext: optionofthedata-bindattributetopreventunfiltered
data entering the web page. Additionally all untrusted user data should be enclosed
insandboxediFrameswithanopaqueorigininordertomitigatepotentialflawsinthe
Knockouttemplateengine.
FORPUBLICRELEASE Page6of19
WireSecurityReview–Phase2–Web,Calling WireSwissGmbH
2.1.2 WIRE-P2-01: Outdated JavaScript-Component With Known
Vulnerabilities
Severity: HIGH
CWE: 937
2.1.2.1 Description
Theantiscroll-2packageusedbythewirewebapplicationdependsonaversionofjQuery
withknownvulnerabilities.
Usingthetoolnsp 5,thedependencyonjQueryversion2.1.4wasdetectedasshownin
figure2.2.
Figure2.2:VulnerablePackage.
XSSattacksmightbeconductedwhenAJAXcallsaremadetountrustedsites.Duringthe
timegivenwecouldnotverifyifthiswasthecase.Itisstillrecommendedtoupgradeall
packageswithsecurityvulnerabilitiesinordertomitigatepotentialtechnicalrisks.
WirehaspatchedtheversionofjQueryinuseagainstthisattackinparalleltothisreview
afteraninternalevaluation.Itrecentlymigrated6 7 toanewerversionofjQuerythat
5
https://nodesecurity.io/opensource
6
https://github.com/wireapp/wire-webapp/commit/4d016d5b1bca75fb39708502af7f19f4f8e
ffa36
7
https://github.com/wireapp/antiscroll-2/commit/eb1b6a21aca0b2d35fd73231662d801f3f
66d265
FORPUBLICRELEASE Page7of19
WireSecurityReview–Phase2–Web,Calling WireSwissGmbH
hasnoknownvulnerabilitiesatthetimeofwriting.
2.1.2.2 SolutionAdvice
Wesuggesttoupdatethepackagestorecentversionswithoutknownvulnerabilities.
If fixed versions are not available for specific packages, it is recommended to disable
themtemporarilyuntilafixisimplemented.Additionallyanautomatedprocessshould
beimplementedthatregularlychecksforpackageswithknownvulnerabilities.
FORPUBLICRELEASE Page8of19
WireSecurityReview–Phase2–Web,Calling WireSwissGmbH
2.1.3 WIRE-P2-02: AccessTokenLeakViaURLParameter
Severity: MEDIUM
CWE: 123
2.1.3.1 Description
TheaccesstokenusedtoauthenticateagainsttheWirebackendiscontainedintheURL
parametersofdifferentHTTPrequests. ForexampleitisattachedtotheURLusedto
downloadencryptedassetssuchasimagesasdisplayedinfigure2.3.Thetokencouldfor
examplepotentiallybecachedinproxyserverlogs.Wirestatedthatthescenarioswhere
thisisexploitablearenotpartoftheirthreatmodelandtheissueisriskaccepted.
Figure2.3:AccessTokenLeakViaURLParameter
2.1.3.2 SolutionAdvice
Sensitive tokens and credentials should not be stored in URL parameters. It is
recommended to use dedicated authorization request headers or HTTP-POST
parameterstotransmitthem.
FORPUBLICRELEASE Page9of19
WireSecurityReview–Phase2–Web,Calling WireSwissGmbH
2.1.4 WIRE-P2-03: LaxParsingofBase64Strings
Severity: LOW
CWE: 228
2.1.4.1 Description
The base64 decoding function z.util.base64_to_array tolerates invalid base64 strings.
This function is used to decode encrypted messages in the following code
(z.cryptography.CryptographyRepository.decrypt_event):
session_id = @_construct_session_id event.from, event.data.sender
1
ciphertext = z.util.base64_to_array(event.data.text or event.data.key).buffer
2
return @cryptobox.decrypt(session_id, ciphertext).then (plaintext) ->
3
(cid:44)→ z.proto.GenericMessage.decode plaintext
Itfollowsthatanencodedmessagemodifiedintransit(accidentallyormaliciously)may
beacceptedasvalid,iftheinvalidbase64stringdecodestothecorrectarrayofbytes.In
thefollowingtestinvalidcharactersaretolerated:
z.util.array_to_base64(z.util.base64_to_array("d2lyZQ==*** ??? ***"))
1
"d2lyZQ=="
2
AsRFC3548explains,“Nonalphabetcharactersmaybeexploitedasa"covertchannel",
wherenon-protocoldatacanbesentfornefariouspurposes.”AlthoughMIMEforexample
toleratesnon-base64characters,itisgenerallysafertorejectthem.
Amaliciouspeermayusethislaxdecodingtosendlargeinvalidstringsthatthebase64
decodeasshortvalidbytearrays.
Also the base64 decoder tolerates invalid base64 encodings as for example
single-characterorpadding-lessstrings.
FORPUBLICRELEASE Page10of19
WireSecurityReview–Phase2–Web,Calling WireSwissGmbH
Therootcauseistheuseofsodium.from_base64,abase64decoderpartoflibsodium.js
thatwillacceptmalformedbase64strings(firstbystrippingnon-base64characters,and
thenbylazilyparsingthedatareceived,decodingeveninvalidstrings).
However,thisbehaviorwillnotallowattackerstoforgevaliddatawithmaliciouscontent,
becausetheunderlyingdataisencryptedandauthenticated.Thesecurityris