CVE-2023-26046 (published 2023-03-02T01:15Z)

teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. In teler-waf prior to version 0.1.1 is vulnerable to bypassing common web attack rules when a specific HTML entities payload is used. This vulnerability allows an attacker to execute arbitrary JavaScript code on the victim's browser and compromise the security of the web application. The vulnerability exists due to teler-waf failure to properly sanitize and filter HTML entities in user input. An attacker can exploit this vulnerability to bypass common web attack threat rules in teler-waf and launch cross-site scripting (XSS) attacks. The attacker can execute arbitrary JavaScript code on the victim's browser and steal sensitive information, such as login credentials and session tokens, or take control of the victim's browser and perform malicious actions. This issue has been fixed in version 0.1.1.\n\n

CVSS v3 base score: 6.1, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-79
cwe_name: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
extended_description: 
            Cross-site scripting (XSS) vulnerabilities occur when:
            
               Untrusted data enters a web application, typically from a web request.
               The web application dynamically generates a web page that contains this untrusted data.
               During page generation, the application does not prevent the data from containing content that is executable by a web browser, such as JavaScript, HTML tags, HTML attributes, mouse events, Flash, ActiveX, etc.
               A victim visits the generated web page through a web browser, which contains malicious script that was injected using the untrusted data.
               Since the script comes from a web page that was sent by the web server, the victim's web browser executes the malicious script in the context of the web server's domain.
               This effectively violates the intention of the web browser's same-origin policy, which states that scripts in one domain should not be able to access resources or run code in a different domain.
            
            There are three main kinds of XSS:
            
               
                  Type 1: Reflected XSS (or Non-Persistent) - 
         			The server reads data directly from the HTTP request and reflects it back in the HTTP response. Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content to a vulnerable web application, which is then reflected back to the victim and executed by the web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to the victim. URLs constructed in this manner constitute the core of many phishing schemes, whereby an attacker convinces a victim to visit a URL that refers to a vulnerable site. After the site reflects the attacker's content back to the victim, the content is executed by the victim's browser.
               
                  Type 2: Stored XSS (or Persistent) - 
               The application stores dangerous data in a database, message forum, visitor log, or other trusted data store. At a later time, the dangerous data is subsequently read back into the application and included in dynamic content. From an attacker's perspective, the optimal place to inject malicious content is in an area that is displayed to either many users or particularly interesting users. Interesting users typically have elevated privileges in the application or interact with sensitive data that is valuable to the attacker. If one of these users executes malicious content, the attacker may be able to perform privileged operations on behalf of the user or gain access to sensitive data belonging to the user. For example, the attacker might inject XSS into a log message, which might not be handled properly when an administrator views the logs.
            
               
                  Type 0: DOM-Based XSS - 
               In DOM-based XSS, the client performs the injection of XSS into the page; in the other types, the server performs the injection. DOM-based XSS generally involves server-controlled, trusted script that is sent to the client, such as Javascript that performs sanity checks on a form before the user submits it. If the server-supplied script processes user-supplied data and then injects it back into the web page (such as with dynamic HTML), then DOM-based XSS is possible.
            
            
            Once the malicious script is injected, the attacker can perform a variety of malicious activities. The attacker could transfer private information, such as cookies that may include session information, from the victim's machine to the attacker. The attacker could send malicious requests to a web site on behalf of the victim, which could be especially dangerous to the site if the victim has administrator privileges to manage that site. Phishing attacks could be used to emulate trusted web sites and trick the victim into entering a password, allowing the attacker to compromise the victim's account on that web site. Finally, the script could exploit a vulnerability in the web browser itself possibly taking over the victim's machine, sometimes referred to as "drive-by hacking."
            In many cases, the attack can be launched without the victim even being aware of it. Even with careful users, attackers frequently use a variety of methods to encode the malicious portion of the attack, such as URL encoding or Unicode, so the request looks less suspicious.
         
         

Fix information:
repo_url: https://github.com/kitabisa/teler-waf
commit_details: repo_url: https://github.com/kitabisa/teler-waf
author: Dwi Siswanto
author_date: 2023-01-11 10:17:56+07:00
msg: feat: unescape any HTML entities

Any HTML entities of URL-decoded characters should be unescape before
perform the checks.

$ curl localhost:3000 -so /dev/null -w "%{http_code}\n" -A X -d "body=%22autofocus%20onFocUs=%27%26%2397%3blert()%27"
403
repository: repo_url: https://github.com/kitabisa/teler-waf
repo_name: teler-sh/teler-waf
description: teler-waf is a Go HTTP middleware that protects local web services from OWASP Top 10 threats, known vulnerabilities, malicious actors, botnets, unwanted crawlers, and brute force attacks.
repo_language: Go
owner: kitabisa
file_changes: filename: README.md
change_type: ModificationType.MODIFY
diff: @@ -194,22 +194,22 @@ goos: linux
 goarch: amd64
 pkg: github.com/kitabisa/teler-waf
 cpu: 11th Gen Intel(R) Core(TM) i9-11900H @ 2.50GHz
-BenchmarkTelerDefaultOptions-4               	    4530	    265197 ns/op	   35710 B/op	    1690 allocs/op
-BenchmarkTelerCommonWebAttackOnly-4          	   32484	     35325 ns/op	    5949 B/op	     118 allocs/op
-BenchmarkTelerCVEOnly-4                      	    6248	    187397 ns/op	   33402 B/op	    1647 allocs/op
-BenchmarkTelerBadIPAddressOnly-4             	   20649	     54890 ns/op	    5974 B/op	      86 allocs/op
-BenchmarkTelerBadReferrerOnly-4              	   48594	     22629 ns/op	    5548 B/op	      87 allocs/op
-BenchmarkTelerBadCrawlerOnly-4               	   41832	     26891 ns/op	    5634 B/op	      85 allocs/op
-BenchmarkTelerDirectoryBruteforceOnly-4      	   48087	     22008 ns/op	    5554 B/op	      84 allocs/op
-BenchmarkTelerCustomRule-4                   	   50428	     21523 ns/op	    5323 B/op	      84 allocs/op
-BenchmarkTelerWithoutCommonWebAttack-4       	    5133	    230608 ns/op	   34619 B/op	    1654 allocs/op
-BenchmarkTelerWithoutCVE-4                   	   15229	     75995 ns/op	    7169 B/op	     124 allocs/op
-BenchmarkTelerWithoutBadIPAddress-4          	    5677	    211478 ns/op	   34602 B/op	    1685 allocs/op
-BenchmarkTelerWithoutBadReferrer-4           	    4875	    240689 ns/op	   35127 B/op	    1684 allocs/op
-BenchmarkTelerWithoutBadCrawler-4            	    4922	    238995 ns/op	   35000 B/op	    1686 allocs/op
-BenchmarkTelerWithoutDirectoryBruteforce-4   	    4894	    242973 ns/op	   35241 B/op	    1687 allocs/op
+BenchmarkTelerDefaultOptions-4               	    4396	    266918 ns/op	   35944 B/op	    1696 allocs/op
+BenchmarkTelerCommonWebAttackOnly-4          	   30795	     35602 ns/op	    5990 B/op	     118 allocs/op
+BenchmarkTelerCVEOnly-4                      	    6171	    194193 ns/op	   33533 B/op	    1652 allocs/op
+BenchmarkTelerBadIPAddressOnly-4             	   20464	     55957 ns/op	    5986 B/op	      86 allocs/op
+BenchmarkTelerBadReferrerOnly-4              	   48403	     23128 ns/op	    5551 B/op	      87 allocs/op
+BenchmarkTelerBadCrawlerOnly-4               	   42002	     27165 ns/op	    5633 B/op	      85 allocs/op
+BenchmarkTelerDirectoryBruteforceOnly-4      	   50103	     23074 ns/op	    5535 B/op	      84 allocs/op
+BenchmarkTelerCustomRule-4                   	   49483	     22086 ns/op	    5332 B/op	      84 allocs/op
+BenchmarkTelerWithoutCommonWebAttack-4       	    5156	    228950 ns/op	   34683 B/op	    1658 allocs/op
+BenchmarkTelerWithoutCVE-4                   	   15295	     76501 ns/op	    7167 B/op	     124 allocs/op
+BenchmarkTelerWithoutBadIPAddress-4          	    5484	    216523 ns/op	   34820 B/op	    1691 allocs/op
+BenchmarkTelerWithoutBadReferrer-4           	    4894	    240202 ns/op	   35133 B/op	    1689 allocs/op
+BenchmarkTelerWithoutBadCrawler-4            	    5012	    239976 ns/op	   34995 B/op	    1691 allocs/op
+BenchmarkTelerWithoutDirectoryBruteforce-4   	    4736	    247549 ns/op	   35496 B/op	    1693 allocs/op
 PASS
-ok  	github.com/kitabisa/teler-waf	23.207s
+ok  	github.com/kitabisa/teler-waf	23.660s
 ```
 
 > **Note**: It's important to note that the benchmarking results may vary and may not be consistent. Those results were obtained when there were **>1.5k** CVE templates and the [teler-resources](https://github.com/kitabisa/teler-resources) dataset may have increased since then, which may impact the results.

programming_language: Markdown
filename: analyze.go
change_type: ModificationType.MODIFY
diff: @@ -110,8 +110,8 @@ func (t *Teler) checkCustomRules(r *http.Request) error {
 	// Converts map of headers to RAW string
 	headers := headersToRawString(r.Header)
 
-	// Decode the URL-encoded request URI of the URL
-	uri := toURLDecode(r.URL.RequestURI())
+	// Decode the URL-encoded and unescape HTML entities request URI of the URL
+	uri := stringDeUnescape(r.URL.RequestURI())
 
 	// Declare byte slice for request body.
 	var body string
@@ -130,8 +130,8 @@ func (t *Teler) checkCustomRules(r *http.Request) error {
 		body = buf.String()
 	}
 
-	// Decode the URL-encoded of body
-	body = toURLDecode(body)
+	// Decode the URL-encoded and unescape HTML entities of body
+	body = stringDeUnescape(body)
 
 	// Iterate over the Customs field of the Teler struct, which is a slice of custom rules
 	for _, rule := range t.opt.Customs {
@@ -201,8 +201,8 @@ func (t *Teler) checkCustomRules(r *http.Request) error {
 // If a match is found, it returns an error indicating a common web attack has been detected.
 // If no match is found, it returns nil.
 func (t *Teler) checkCommonWebAttack(r *http.Request) error {
-	// Decode the URL-encoded request URI of the URL
-	uri := toURLDecode(r.URL.RequestURI())
+	// Decode the URL-encoded and unescape HTML entities request URI of the URL
+	uri := stringDeUnescape(r.URL.RequestURI())
 
 	// Declare byte slice for request body.
 	var body string
@@ -221,8 +221,8 @@ func (t *Teler) checkCommonWebAttack(r *http.Request) error {
 		body = buf.String()
 	}
 
-	// Decode the URL-encoded of body
-	body = toURLDecode(body)
+	// Decode the URL-encoded and unescape HTML entities of body
+	body = stringDeUnescape(body)
 
 	// Iterate over the filters in the CommonWebAttack data stored in the t.threat.cwa.Filters field
 	for _, filter := range t.threat.cwa.Filters {

programming_language: Go
filename: utils.go
change_type: ModificationType.MODIFY
diff: @@ -2,6 +2,7 @@ package teler
 
 import (
 	"fmt"
+	"html"
 	"strings"
 
 	"net/http"
@@ -69,11 +70,24 @@ func headersToRawString(headers http.Header) string {
 	return h.String()
 }
 
-// toURLDecode decode URL-decoded characters string using mdurl package
+// unescapeHTML to unescapes any HTML entities, i.e. &aacute;"
+// unescapes to "á", as does "&#225;" and "&#xE1;".
+func unescapeHTML(s string) string {
+	return html.UnescapeString(s)
+}
+
+// toURLDecode decode URL-decoded characters string using mdurl
 func toURLDecode(s string) string {
 	return mdurl.Decode(s)
 }
 
+// stringDeUnescape to decode URL-decoded characters, and
+// unescapes any HTML entities
+func stringDeUnescape(s string) string {
+	s = toURLDecode(s)
+	return unescapeHTML(s)
+}
+
 // isValidMethod check if the given request.Method is valid
 func isValidMethod(method request.Method) bool {
 	switch method {

programming_language: Go