Química on line

renin

OWASP
Connector

May 2019

Communications | Projects | Events | Community | Membership

COMMUNICATIONS

Letter from the Vice Chairman:

Dear OWASP Community,

Since last month the foundation has been busy working towards enabling our project leaders and community members to utilize funds to work on nurturing and developing projects. So far there has been huge uptake on this initiative. It's great to see so many people passionate about collaborating at project summits.

Our Global AppSec Tel-Aviv is nearly upon us, for members, there is an extra incentive for attending this conference, in the form of a significant discount. This and the sandy beaches and beautiful scenery, not to mention the great speakers and trainers we have lined up, is a great reason to attend. If you have not done so we would encourage you to attend this great conference - https://telaviv.appsecglobal.org.

One of the key things I've noticed in my Board of Director tenure is the passion our community emits, sometimes this passion aids in growing the foundation, but sometimes it also forces us to take a step back and look at how we do things within the foundation. With Mike, our ED and staff we have seen a lot of good change from an operations perspective, with more in the pipeline. Mike's appointment has allowed the Board of Directors to take a step back from operations and enable us to work on more strategic goals. To this end at a recent Board meeting we discussed each Board member taking up one of the following strategic goals, as set out at the start of the year:

1.Marketing the OWASP brand
2.Membership benefits
3.Developer outreach

Improve benefits
Decrease the possibility of OWASP losing relevance
Reaching out to management and Risk levels
Increase involvement in new tech/ ways of doing things – dev ops

4.Project focus

Get Universities involved
Practicum sponsored ideas
Internships

5.Improve finances
6.Improve OWAP/ Board of Directors Perception
7.Process improvement
8. Get consistent ED
9.Community empowerment

I would encourage the community to come forward if you have any ideas on the above and are happy to work with one of the 7 Board of Directors and community members on one of these initiatives.

Thanks and best wishes,
Owen Pendlebury
Vice Chair

OWASP FOUNDATION UPDATE FROM INTERIM EXECUTIVE DIRECTOR:

OWASP Foundation welcomes aboard Emily Berman as Events Director. Emily was most recently with the Scrum Alliance where she planned high-profile functions for upwards of 2,000 guests. Emily brings a fresh approach to events planning and her 12 years of experience planning and organizing large-scale events worldwide well in advance will greatly benefit our Global AppSecs.

Did you Register yet?

Global AppSec DC September 9-13, 2019
submit to the Call for Papers and Call for Training
Check out Sponsorship Opportunities while they are still available.

Save the Date for Global AppSec Amsterdam Sept 23-27, 2019
Sponsorship Opportunities are available

EVENTS

You may also be interested in one of our other affiliated events:

REGIONAL AND LOCAL EVENTS

Event	Date	Location
Latam Tour 2019	Starting April 4, 2019	Latin America
OWASP Portland Training Day	September 25, 2019	Portland, OR
OWASP Italy Day Udine 2019	September 27,2019	Udine, Italy
OWASP Portland Day	October 16,2019	Wroclaw, Poland
LASCON X	October 24-25,2019	Austin, TX
OWASP AppSec Day 2019	Oct 30 - Nov 1, 2019	Melbourne, Australia

PARTNER AND PROMOTIONAL EVENTS

Event	Date	Location
Open Security Summit	June 3-7,2019	Woburn Forest Center Parcs, Bedfordshire
Hack in Paris 2019	June 16-20, 2019	Paris
Cyber Security and Cloud Expo Europe	June 19-20, 2019	Amsterdam
IoT Tech Expo Europe	June 19-20, 2019	Amsterdam
BlackHat USA 2019	August 3-8,2019	Las Vegas, Nevada
DefCon 27	August 8-11,2019	Las Vegas, Nevada
it-sa-IT Security Expo and Congress	October 8-10, 2019	Germany

PROJECTS

We have had the following projects added to the OWASP inventory. Please congratulate these leaders and check out the work they have done:

Project	Type	Leader(s)
Risk Assessment Framework	Documentation	Ade Yoseman Putra, Rejah Rehim
QRLJacker	Tool	Mohammed Baset
Container Security Verification Standard	Documentation	Sven Vetsch
Find Security Bugs	Code	Philippe Arteau
Vulnerable Web Application	Code	Fatih Çelik
D4N155	Tool	Julio Pedro de Lira Neto
Jupiter	Tool	Matt Stanchek
Top 10 Card Game	Documentation	Dennis Johnson
Samurai WTF	Code	Kevin Johnson
DevSecOps Maturity Model	Documentation	Timo Pagel

Also, we will have the following projects presenting at the Project Showcase Global AppSec Tel Aviv:

Final Schedule
Wednesday, May 29th				Thursday, May 30th
Time	Project	Presenter(s)	Confirmed	Time	Project	Presenter(s)	Confirmed
10:45 a.m.	Glue Tool	Omer Levi Hevroni	Yes	10:30 a.m.	API Security	Erez Yalon, Inon Shkedy	Yes
			7

11:55 a.m.	IoT & Embedded AppSec	Aaron Guzman	Yes	11:50 a.m.	Mod Security Core Rule Set	Tin Zaw	Yes
				12:25 p.m.	Automated Threats	Tin Zaw	Yes
12:30 p.m. Lunch Break				12:55 p.m. Lunch Break
2:35 p.m.	SAMM	John DiLeo	Yes
3:10 p.m.	Application Security Curriculum	John DiLeo	Yes	3:10 p.m.	Damned Vulnerable Serveless Application	Tal Melamed	Yes

Finally, if you are able to help participate in the Project Reviews at the Conference, please send me an email at harold.blankenship@owasp.com. We have a large line-up of projects to review this time around:

Project	To Level	Leader(s)
Snakes and Ladders	Flagship	Katy Anton, Colin Watson
Cheat Sheet Series	Flagship	Dominique Righetto, Jim Manico
Mobile Security Testing Guide	Flagship	Jeroen Willemsen, Sven Schleier
Amass	Lab	Jeff Foley
Attack Surface Detector	Lab	Ken Prole
SecureTea	Lab	Ade Yoseman Putra, Bambang Rahmadi K.P, Rejah Rehim.A.A
Serverless Goat	Lab	Ory Segal

Google Summer of Code Update:
We were allocated 13 students this year! The current timeline is as follows:

Google Season of Docs:
We were accepted into the Google Season of Docs. There will be a single technical writer resource. The current timeline is as follows:

COMMUNITY

New OWASP Chapters
Riyadh, Saudi Arabia
Guayaquil, Equador
Lome, Togo
Natal, Brazil
Nashua, New Hampshire
Gwalior, India
Louisville, Kentucky
Nainital, India
Liverpool, United Kingdom
Syracuse, New York

MEMBERSHIP

We would like to welcome the following Premier and Contributor Corporate Members.

Premier Corporate Members

Contributor Corporate Members

Join us

Donate

Our mailing address is:
OWASP Foundation
1200-C Agora Drive, # 232
Bel Air, MD 21014

Contact Us

Unsubscribe

This email was sent to *|EMAIL|*
why did I get this? unsubscribe from this list update subscription preferences
*|LIST:ADDRESSLINE|*

renin

In this post, Christian Fries shows an approach to unveil security flaws in OpenID Connect Certified implementations with well-known attack methods. One goal of the master's thesis Security Analysis of Real-Life OpenID Connect Implementations was to provide a platform for developers and security researchers to test implementations in a reproducible and maintainable OIDC lab environment.

We included six OpenID Provider (OP) and eight Relying Party (RP) services in the lab environment. For the comprehensive security analysis, we tested the implementations against eleven Relying Party attacks and seven OpenID Provider attacks in different variations with our tool PrOfESSOS. In addition, we carried out manual tests as well. We have disclosed twelve implementation flaws and reported them to the developers in a responsible disclosure process.

Two developer teams fixed (✔) the vulnerabilities before the deadline of the master's thesis. One Redirect URI Manipulation vulnerability was rejected (✖). This particular case can be permissible for only one registered URI for reasons of interoperability and fault tolerance. We informed three further development teams (✦).

Name	Vulnerability	Fixed	CVE
MITREid Connect	PKCE Downgrade Attack	✦
mod auth openidc	ID Spoofing, JWKS Spoofing	✔
node oidc-provider	Redirect URI Manipulation	✖
OidcRP	Replay Attack	✦
phpOIDC	Message Flow Confusion, ID Spoofing, Key Confusion	✦
pyoidc	Replay Attack, Signature Manipulation, Token Recipient Confusion	✔	CVE-2020-26244

We explain the method of how we have archived this result in the following sections.

Introduction

The OpenID Connect protocol framework defines three basic flows, Authorization Code Flow (or just Code Flow), Implicit Flow, and Hybrid Flow. OAuth 2.0, which is the foundation of OpenID Connect, introduces several extensions. One of the latest extensions is Code Flow with PKCE (Proof Key for Code Exchange, RFC7636).

Compliance with the specification requirements is essential for application security. Settings and parameter conditions are changed. For example, in Code Flow, a nonce parameter in the Authentication Request is optional but required for the Implicit Flow. The developers have to deal with such changes. They end up implementing several code branches and various state machines. The implementation's code complexity naturally increases if it supports more features and extensions. This complexity implies that minor changes with only one specific flow in mind can introduce a security issue in another flow.

Various well-known attacks are published in different papers and several mitigations are mentioned in best practice guides. One tool, which can perform the fully automated evaluation of services with generic attack vectors, is PrOfESSOS.

PrOfESSOS

PrOfESSOS is our evaluation as a Service (EaaS) security tool. We have implemented significant improvements into it over the past few years. The latest version can simulate a malicious RP that can carry out the attacks against an OP. In addition, PrOfESSOS can simulate an honest and a malicious OP to perform Single-Phase and Cross-Phase attacks. A penetration tester can access the RESTful API directly or the Web UI to start an evaluation.

Supported attacks on Relying Parties

Single Phase	# Attack Patterns	Cross Phase	# Attack Patterns
ID Spoofing	12	Issuer Confusion	1
Replay Attack	6	IdP Confusion	1
Key Confusion	13	Malicious Endpoint Attack	1
Signature Manipulation	4	Session Overwriting	2
Cross Site Request Forgery	3
Token Recipient Confusion	3
Token Substitution	2

Supported attacks on OpenID Provider

Attack	# Attack Patterns
Authorization Code Reuse and Substitution	5
Redirect URI Manipulation	15
Open Redirector	1
Client Authentication Bypass	15
Message Flow Confusion	2
PKCE Downgrade Attack	5
Sub Claim Spoofing	5

The Lab Environment

Overview

A developer or security researcher needs a running web application to start an evaluation. One way to create an analysis is to execute the web application and evaluation tools on a local development machine. This approach might be a practical compromise for small-scale projects. For multiple instances of applications with different configurations, this approach can be cumbersome. Docker containers can help here. Various RP and OP already offer a container setup, or there are examples of creating Dockerfiles, at least. It is possible to have reproducible build results through the container concept. In addition, this approach enables us to store static configuration files and SQL dumps for a specific instance.

We introduced three networks running on a server for our lab environment setup. The ProfNET for all evaluation tools can be controlled and debugged from a remote client. Furthermore, we added a RPNet for all Relying Parties and an OPNet for all OpenID Provider. The MitMProxy connects the networks and the users' browser. It allows us to observe and manipulate every http(s) communication in front- and back-channel.

Setup

Server Side

It is only required to checkout the oidc-docker-libs. The docker-compose setup can be built and run with:

git clone https://github.com/RUB-NDS/oidc-docker-libs docker-compose build docker-compose up -d

The following ports are used by the lab: 8787, 9990, 8888, 8042, 8080, 8081. You should ensure that you don't have service running on those ports.

The docker-compose provides the possibility to run only a small subset, for example:

docker-compose up -d professos mitmproxy mitreid-server

Docker Structure

The basic idea of our docker containers is to build from sources in a more or less generic way. We intended that each application runs as a completely independent unit. The application configuration can be performed with build arguments, environment variables, or complete SQL dumps.

You can see that we structured a Dockerfile in four blocks:

FROM ubuntu:18.04  ARG BRANCH=v3 ARG FLOW=implicit ARG CONTROLLER_URL ARG SERVER_HOST  # Setup the application ENV APPDIR /opt/app WORKDIR ${APPDIR} RUN git clone --depth=1 --branch=$BRANCH https://github.com/YOU/YOUR_APP RUN cd YOUR_APP \     && echo config=$FLOW >> configuration_file \     && ./build  # deploy automatically created certs ARG CA_DIR="/certs" ARG CA_CERT="oidc-ca.crt" VOLUME ["$CA_DIR"]  # Configure apache or nginx COPY config/apache-ssl.conf /etc/apache2/sites-available/ssl.conf RUN sed -i "s#SERVER_HOST#$SERVER_HOST#g" /etc/apache2/sites-available/ssl.conf RUN a2enmod headers ssl proxy proxy_http rewrite && a2ensite ssl RUN echo "https://$CONTROLLER_URL" > /var/www/html/.professos  # Start the application and apache/nginx server COPY docker-entrypoint.sh ${SUBDIR}/ WORKDIR ${SUBDIR} ENTRYPOINT ["./docker-entrypoint.sh"]

From this point, it is possible to add two or more configured instances to the docker-compose.yml file. Every instance can be tested independently and without influencing each other. This independence enables us to test various switches, e.g., different flows or authentication methods in different combinations.

app1-implicit:     build:       context: rp/app1       args:         FLOW: "implicit"         CONTROLLER_URL: ${CONTROLLER_HOST}         CLIENT_HOST: ${APP1-IMPLICIT}     depends_on:       - certs     volumes:       - certs:/certs:ro     env_file:       - .proxy_env     environment:       CA_DIR: ${CA_DIR}       CA_CERT: ${CA_CERT}       VIRTUAL_HOST: ${APP1-IMPLICIT}     networks:       - rpnet       - profnet

app1-code:   build:     context: rp/app1     args:       FLOW: "code"           CONTROLLER_URL: ${CONTROLLER_HOST}       CLIENT_HOST: ${APP1-CODE}   depends_on:     - certs   volumes:     - certs:/certs:ro   env_file:     - .proxy_env   environment:     CA_DIR: ${CA_DIR}     CA_CERT: ${CA_CERT}     VIRTUAL_HOST: ${APP1-CODE}   networks:     - rpnet     - profnet

Client Side

The user solely has to establish a proxy connection to SERVERIP:8080. For example, in Firefox, the addon FoxyProxy can switch easily between different proxy settings.

It is advisable to install the generated Root-CA (oidc-ca.crt) in the browsers' certification store. Otherwise, self-signed certification warnings will be displayed. After the web browser is connected to the proxy, it should be possible to reach the landing page https://lab.

Automatic Tests with PrOfESSOS

We have two options for automatic tests with PrOfESSOS. We can either use the Web UI at https://professos, or call the RESTful API methods directly. Both options require a configuration file with target information. PrOfESSOS requires this information to find all needed URLs and parameter fields to login with selenium scripts.

You can use the following JSON file for the MITREid Connect Client:

{   "UrlClientTarget": "https://mitreid-client/simple-web-app/login",   "InputFieldName": "identifier",   "SeleniumScript": "",   "FinalValidUrl": "https://mitreid-client/simple-web-app/",   "HonestUserNeedle": "{sub=honest-op-test-subject, iss=https://honest-idp.professos/CHANGE_ME}",   "EvilUserNeedle": "{sub=evil-op-test-subject, iss=https://attack-idp.professos/CHANGE_ME}",   "ProfileUrl": "https://mitreid-client/simple-web-app/user" }

Only the CHANGE_ME parameter must be replaced manually with the displayed Test ID, as you can see in the following screenshot. The Test ID represents a unique OP address. This allows parallel testing as long as the implementation supports Dynamic Registration.

After clicking the "Learn" button, PrOfESSOS tries to log in with the honest and evil OP. Note that it takes a while until the process is finished.

If everything has worked as expected, PrOfESSOS displays a green checkmark. Otherwise, the UI provides minor logs and a few screenshots until the error has occurred. The MitMProxy Web UI can be a helpful additional tool to debug such issues.

On success, explicit tests or all tests can be executed. Each test step provides a small description and a test execution log.

The other option to start these tests is to use the RESTful API. Therefore, we provide a python cli tool in the oidc-docker-libs/oidc-lab-scripts folder. For all currently implemented RP and OP solutions, we have stored the json configurations. After starting the cli tool you solely need to select a target and run a complete test. An HTML report is also created which can be shared with collaborators.

#> ./cli.py [*] Professos CLI started Starting Control Center for Professos! cli> load rp mitreid-client  Start session default cli>> rp> mitreid-client> full_test Create new test plan: TestId = 6RZmcJHNd6o Learn: {     "HonestWebfingerResourceId": "https://honest-idp.professos/6RZmcJHNd6o",     "EvilWebfingerResourceId": "https://attack-idp.professos/6RZmcJHNd6o",     "UrlClientTarget": "https://mitreid-client/simple-web-app/login",     "InputFieldName": null,     "SeleniumScript": "",     "FinalValidUrl": "https://mitreid-client/simple-web-app",     "HonestUserNeedle": "{sub=honest-op-test-subject, iss=https://honest-idp.professos/6RZmcJHNd6o}",     "EvilUserNeedle": "{sub=evil-op-test-subject, iss=https://attack-idp.professos/6RZmcJHNd6o}",     "ProfileUrl": "https://mitreid-client/simple-web-app/user",     "Type": "de.rub.nds.oidc.test_model.TestRPConfigType" } ================================================================================ Run Test Step [0]: ID Spoofing 1 - ID Token (sub) - PASS ================================================================================ Run Test Step [1]: ID Spoofing 2 - ID Token (sub+iss) - PASS ================================================================================

Semi-Automated and Manual Tests

The MitMProxy can intercept and manipulate front and backend communication for minor manual tests. For example, the MITREid Connect client can perform user authentication with Keycloak as the OpenID provider. To simulate a redirect URI attack, you can intercept the Authentication Request or Token Request and manipulate the values.

Another reproducible way is to combine a specific PrOfESSOS attack, and a prepared script that is uploaded to the MitM scripting interface. Therefore, we added a server application to the MitM scripting interface, which can be controlled with the lab script cli tool.

We used such a workflow to check if a special redirect URI is vulnerable to an XSS attack. You can try it on your own. The command to prepare this attack is:

./cli.py [*] Professos CLI started Starting Control Center for Professos! cli> load op mitreid-server  Start session default cli>> op> mitreid-server> create Create new test plan: TestId = vWmdL4XHe2w cli>> op> mitreid-server> learn Learn: {     "HonestRpResourceId": "https://rp.professos/vWmdL4XHe2w",     "EvilRpResourceId": "https://evilrp.professos/vWmdL4XHe2w",     "UrlOPTarget": "https://mitreid-server/oidc-server",     "OPMetadata": "",     "AccessToken1": "",     "AccessToken2": "",     "User1Name": "user1",     "User2Name": "user2",     "User1Pass": "user1pass",     "User2Pass": "user2pass",     "LoginScript": "",     "ConsentScript": "",     "Client1Config": "",     "Client2Config": "",     "Type": "de.rub.nds.oidc.test_model.TestOPConfigType" } cli>> op> mitreid-server> run_pyscript pentest/mitreid-server-redirect.py Received: OK Received: OK cli>> op> mitreid-server> run 48 ================================================================================ Run Test Step [48]: Custom 1 - Redirect URI - PASS cli>> op> mitreid-server> export cli>> op> mitreid-server> report

As a result, in the screenshot you can see that our javascript was escaped correctly.

Another new feature for RP tests is to expose a specific attack pattern with PrOfESSOS and go through the login process manually with a browser. This is archived with the cli and the expose command. If you want to test, execute these commands:

./cli.py [*] Professos CLI started Starting Control Center for Professos! cli> load rp mitreid-client  Start session default cli>> rp> mitreid-client> create Create new test plan: TestId = hDOAisJy9OE cli>> rp> mitreid-client> learn Learn: {     "HonestWebfingerResourceId": "https://honest-idp.professos/hDOAisJy9OE",     "EvilWebfingerResourceId": "https://attack-idp.professos/hDOAisJy9OE",     "UrlClientTarget": "https://mitreid-client/simple-web-app/login",     "InputFieldName": null,     "SeleniumScript": "",     "FinalValidUrl": "https://mitreid-client/simple-web-app",     "HonestUserNeedle": "{sub=honest-op-test-subject, iss=https://honest-idp.professos/hDOAisJy9OE}",     "EvilUserNeedle": "{sub=evil-op-test-subject, iss=https://attack-idp.professos/hDOAisJy9OE}",     "ProfileUrl": "https://mitreid-client/simple-web-app/user",     "Type": "de.rub.nds.oidc.test_model.TestRPConfigType" } cli>> rp> mitreid-client> expose --test 3

Start login at https://mitreid-client/simple-web-app/login
For the OpenID Provider use the exposed attacker OP address https://attack-idp.professos/CHANGE_ME which can be copied from the learn step.
The browser should display a simple message: Authentication Failed: Id Token Issuer is null -> Our attack was unsuccessful
The honest OP address can be used to compare the result with a successful login attempt.

References

Acknowledgement

The master's thesis was supervised by Vladislav Mladenov, Christian Mainka, and Jörg Schwenk. Thank you for the support and opportunity to write this thesis.

Author of this Post

Christian Fries

viernes, 26 de mayo de 2023

OWASP May Connector 2019