New blog
This blog is closed, new posts will be published at http://sakurity.com/blog Thanks for being with me here for so many years :)
Egor Homakov
Architect of Xln – Financial Planetary Substrate | Sakurity | X: @homakov . homakov@gmail.com
Latest posts
Blatant CSRF in Doorkeeper, most popular OAuth2 gem
I read a post about CSRF on DigitalOcean (in Russian) by Sergey Belove . My first reaction was, obviously, how come ? DigitalOcean is not kind of a team that would have lame "skip_before_action :verify_authenticity_token". DigitalOcean uses Doorkeeper , the most popular OAuth Provider library for rails apps and it manages clients, tokens, scopes and validations out of box. Then I looked into…
New Paypal gateway UI is a disaster
Hey. I decided to get a paid plan on Github and Paypal looked like a good payment option to me. Click the blue button here : This looks and feels really good . Lightweight elements, updated color scheme and new logo. Except one thing - how do I know this smooth and lovely popup asking for my Email and password is authorized / belongs to Paypal.com ? "These emails warn you of account problems or…
The No CAPTCHA problem
When I read about No CAPTCHA for the first time I was really excited. Did we finally find a better solution? Hashcash? Or what? Finally it's available and the blog post disappointed me a bit. Here's Wordpress registration page successfully using No CAPTCHA. Now let's open it in incognito tab... Wait, annoying CAPTCHA again? But i'm a human! So what Google is trying to sell us as a comprehensive…
Hacking file uploaders with race condition
TL;DR I use a race condition to upload two avatars at the same time to exploit another Paperclip bug and get remote code execution on Apache+Rails stacks. I believe many file uploaders are vulnerable to this. It's fun, go ahead! 10 months ago I wrote about a simple but powerful bug in Paperclip <=3.5.3 (we can upload a file with arbitrary extension by spoofing Content-Type header). Thoughtbot…
Bypassing ClearClick and X-Frame-Options:Visible
I bet, you know what Clickjacking (CJ) is. Old problem everybody's tired of hearing of. There are three types of web pages. Don't need to be shown in iframes but have no X-Frame-Options. Basically 99% or more of pages, CJ only exist due to poor design of web which made framing of cross domain pages possible without their consent... A little bit later people created X-Frame-Options header which…
Timing attack, 6.66% faster
Personally I'm not a big fan of timing attack as I believe they are impractical for web apps (while perfectly useful in other fields). To make them useful you need to reduce latency and put your script just in front of the victim's server, send zillions of requests (which will most likely be blocked & investigated) and even if everything seems to go smoothly your script might have chosen a wrong…
Covert Redirect FAQ
Hey, so called covert redirect was all over the news today. I was asked by our client Auth0 if everything is ok with them - they are alright, because their middleware cannot be used as an open redirector. After seeing tons of tweets I decided to stop the panic and publish a short FAQ. How does it work? First of all it is a known Facebook Connect bug, other providers are not vulnerable (author…
Paperclip vulnerability leading to XSS or RCE.
Paperclip is the most popular upload tool for Ruby on Rails, and I found a way to upload a file with arbitrary extension, which can lead to XSS (file.html) or RCE (file.php/file.pl/file.cgi). By default Paperclip allows all types of files, and I believe it's a vulnerability on its own, "insecure-by-default". Developer is supposed to write validates_attachment :avatar, :content_type => {…
How I hacked Github again.
This is a story about 5 Low-Severity bugs I pulled together to create a simple but high severity exploit, giving me access to private repositories on Github. These vulnerabilities were reported privately and fixed in timely fashion. Here is the "timeline" of my emails. More detailed/alternative explanation . A few days ago Github launched a Bounty program which was a good motivator for me to play…
Turbo API: How to use CORS without Preflights
From official doc on Cross Origin Resource Sharing A header is said to be a simple header if the header field name is an ASCII case-insensitive match for Accept , Accept-Language , or Content-Language or if it is an ASCII case-insensitive match for Content-Type and the header field value media type (excluding parameters) is an ASCII case-insensitive match for application/x-www-form-urlencoded ,…
Two "WontFix" vulnerabilities in Facebook Connect
TL;DR Every website with "Connect Facebook account and log in with it" is vulnerable to account hijacking. Every website relying on signed_request (for example official JS SDK) is vulnerable to account takeover, as soon as an attacker finds a 302 redirect to other domain. I don't think these will be fixed, as I've heard from the Facebook team that it will break compatibility. I really wish they…
Header injection in Sinatra/Rack
Try to run this simple app: require 'sinatra' get '/' do redirect params[:to] if params[:to].start_with? 'http://host.com/' end Let's load /?to=http://host.com/?%0dX-Header:1 and see a new "injected" X-Header in Chrome (not in FF) because %0d aka \r is considered by Chrome as a valid headers' delimiter (don't really agree with this feature). OK, bad news are: Rack is the root of the problem. It…
Cookie Bomb or let's break the Internet.
TL;DR I can craft a page "polluting" CDNs, blogging platforms and other major networks with my cookies. Your browser will keep sending those cookies and servers will reject the requests, because Cookie header will be very long. The entire Internet will look down to you. I have no idea if it's a known trick, but I believe it should be fixed. Severity: depends. I checked only with Chrome. We all…
Account hijacking on MtGox
If it wasn't MtGox I wouldn't even mention it — XSS/fixation/etc are web sec routines, and are not worth a blog post. But it *is* MtGox. When I started checking bitcoin-related websites it was my target #1. First XSS was found in 5 minutes on payments.mtgox.com, few mins later I discovered session fixation leading to account takeover. Long story short, here's exploit:…
Evolution of Open Redirect Vulnerability.
TL;DR ///host.com is parsed as relative-path URL by server side libraries, but Chrome and Firefox violate RFC and load http://host.com instead, creating open-redirect vulnerability for library-based URL validations. This is WontFix, so don't forget to fix your code. Think as developer. Say, you need to implement /login?next_url=/messages functionality. Some action must verify that the next URL is…
Using Content-Security-Policy for Evil
TL;DR How can we use technique created to protect websites for Evil? (We used XSS Auditor for Evil before) There's a neat way: taking advantage of CSP we can detect whether URL1 does redirect to URL2 and even bruteforce /path of URL2/path. This is a conceptual vulnerability in CSP design (violation == detection), and there's no obvious way to fix it. Demo & playground:…
Token Fixation in Paypal
Remember OAuth1 session fixation? No? Read writeup from Eran Hammer (the guy who hates OAuth2 as much as I do). Guess what - there's exact same vulnerability in Paypal Express Checkout flow (they will not fix it). Furthermore, tons of other payment-related providers can be vulnerable to the same attack. How does it work? OAuth1-like flows are based on request_token/invoice id (for example…
Path Encoding Vulnerability in https/www redirects.
Playing with 302-based header injection (majority of web servers is not vulnerable to it btw) i found one tricky neat bug which can be really useful to leak ?query data by putting them in the #fragment. Remark about the difference : fragment might seem to be more secure than query - no, I don't think so. There are just thousands of open-redirects out there leaking access_token-s . I personally…
Regexp Groups "Overflow" in Firefox
TL;DR: In Firefox regexps with 999 998+ groups return false, no matter was the given string valid or not. It seems like a performance optimization, but theoretically can lead to security issues. I believe it should raise an exception instead of fooling the code. Unrelated prehistory : Few weeks ago I was trying to XSS m.facebook.com location.hash validation with a timing attack.…
How to send DM on Twitter w/o permission
I just recalled " SMS commands " feature and tried to send a DM (private, direct message) with "Share on Twitter"-button. It works! Twitter trick - you can ask your readers to tweet about your post, but in fact send a DM. Example https://t.co/03nZRdP2xO — Egor Homakov (@homakov) December 14, 2013 But you know what's really cool? ANY app can send a DM on behalf of your account, by sending to API "d…
RJS leaking vulnerability in multiple Rails applications.
I wrote about this problem in May, without showcases, just a theoretical post http://homakov.blogspot.com/2013/05/do-not-use-rjs-like-techniques.html It didn't help. Now I want people to take the issue seriously. This is a huge unsolved problem. Developers have a tool which they don't know how to properly use. So they use it how they feel convenient. It leads to security breach. Reminds…
Use 404 or Lazy Tips to finding XSS
In my opinion usefulness of an XSS on a random website is next to nothing. What are you going to do with XSS on your local school website? Stil da kookies? So either you should look for XSS on a major website or find tons of random XSSes in hope some of them will turn out to be any useful. https://gist.github.com/homakov/7384127 What is a Lazy technique ? Only one GET request is required to check…
Stealing user session with open-redirect bug in Rails
Is open redirect bad for your website? If we don't take into account "phishing", how can be open redirect dangerous? Mind reading http://homakov.blogspot.com/2013/03/redirecturi-is-achilles-heel-of-oauth.html because any redirect to 3rd party website will leak facebook access_tokens of your users. So innocent open redirect on logout will simply reveal access_token of current user when we set…
Google Translate hack explained
I wrote an article today and it sucked. Here on HN I was told a couple of times that: 1) PoC doesn't work 2) nothing is clear Sorry, everyone. I really didn't notice that "Safe Mode" issue locally. How can I fix this? 1) I crafted a groundbreaking awesome PoC using new technique, and it's working in Chrome and FF for logged in / logged out users like a charm. 2) I will explain how it works…