============================================ ||| Security Advisory AKLINK-SA-2008-001 ||| ||| CVE-2008-0556 (CVE candidate) ||| ============================================ OpenCA - Cross Site Request Forgery (XSRF) ========================================== Date released: 13.02.2008 Date reported: 12.12.2007 Last update: 18.02.2008 $Revision: 1.2 $ by Alexander Klink Cynops GmbH a.klink@cynops.de https://www.cynops.de/advisories/CVE-2008-0556.txt (S/MIME signed: https://www.cynops.de/advisories/CVE-2008-0556-signed.txt) https://www.klink.name/security/aklink-sa-2008-001-openca-xsrf.txt http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0556 Vendor: OpenCA LABS Product: OpenCA PKI Website: http://www.openca.org/projects/openca/ Vulnerability: Cross Site Request Forgery Class: remote Status: unpatched Severity: high (arbitrary issuance of certificates without the knowledge and/or consent of a registration officer) Releases known to be affected: 0.9.2.5, possibly 0.9.2.x (untested) Releases known NOT to be affected: none +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Background: The OpenCA PKI Project (v0.9) is a collaborative effort to develop a robust, full-featured and Open Source out-of-the-box Certification Authority implementing the most used protocols with full-strength cryptography world-wide. Disclaimer: I am actively involved in OpenXPKI, a project with similar goals that "inherited" most of OpenCA's core developers. +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Overview: OpenCA suffers from a typical cross-site request forgery (XSRF) problem. This means that an authenticated user (a registration officer, for example) can be manipulated into executing certain activities on the CA without his knowledge and consent. In a CA, this is especially problematic as this means an attacker can issue arbitrary certificates this way. +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Technical details: As the user is authenticated using a session cookie and the forms that are used to execute certain activities on the CA are not protected by some kind of token, one can easily put activities for example into an tag on another website. If a user has an active session on the CA, these activities are executed. Examples: Some guessing of valid serials is needed in these cases, but this can be ignored if the user has access to the public frontend, as he can then create a certificate request himself that can be changed and approved using XSRF. Serials are (more or less) consecutive, so guessing is relatively easy. +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Communication: * 12.12.2007: Reported bug to the openca-core mailing list (the private mailing list of core developers) via Martin Bartosch * 17.12.2007: Martin Bartosch forwards the mail directly to the project maintainer, Massimiliano Pala * 02.01.2008: Asked for a contact to a release coordinator on the openca-devel mailing list * 01.02.2008: Sent patch to openca-core and Massimiliano Pala with the announcement to release advisory and patch if no reply is received until February 10th +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Solution: Apply the following patch. It introduces an XSRF protection token parameter that is added to all internal links and forms which consists of a SHA1 hash of the session ID that is stored in the cookie. The server side compares if the parameter is set correctly if needed and complains if it is not. As no help from the current OpenCA developers was available to us, this patch is not very well tested. It works for us - use at your own risk. Note that it introduces a dependency to Digest::SHA1, but this should be included with the base modules in modern Perl distributions. diff -ru OpenCA-0.9.2.5.orig/src/modules/openca-ac/AC.pm OpenCA-0.9.2.5/src/modules/openca-ac/AC.pm --- OpenCA-0.9.2.5.orig/src/modules/openca-ac/AC.pm 2008-01-14 15:05:16.000000000 +0100 +++ OpenCA-0.9.2.5/src/modules/openca-ac/AC.pm 2008-01-15 10:23:11.000000000 +0100 @@ -34,7 +34,7 @@ use OpenCA::Log::Message; use FileHandle; - +use Digest::SHA1 qw( sha1_hex ); my $is_ldaps; @@ -781,6 +781,7 @@ ## return undef; ## } + my @not_vulnerable_cmds = qw( genMenu serverInfo getStaticPage scepGetCACert scepPKIOperation ); if (not $self->getSession ()) { if (not $self->login ()) { return undef; @@ -795,6 +796,11 @@ $self->{journal}->{login}->{role} = $self->{ident}->{role}; $self->{journal}->{session_id} = $self->{session}->getID(); $self->{journal}->{session_type} = "cookie"; + if (defined $self->{cgi}->param('cmd') && + (! grep { $_ eq $self->{cgi}->param('cmd'} } @not_vulnerable_cmds)) { + # only the above commands should be called after a login + return undef; + } return $h; } } else { @@ -804,6 +810,25 @@ $self->stopSession; return $self->checkIdent; } + + # XSRF checks + my $potentially_vulnerable; + if (defined $self->{cgi}->param('cmd')) { + $potentially_vulnerable = 1; + } + if (grep {$_ eq $self->{cgi}->param('cmd')} @not_vulnerable_cmds) { + $potentially_vulnerable = 0; + } + + if ($potentially_vulnerable && + ($self->{cgi}->param('xsrf_protection_token') + ne sha1_hex($self->{session}->getID()))) { + # potential XSRF attack + $self->debug('Potential XSRF attack'); + $self->debug('XSRF token: ' . $self->{cgi}->param('xsrf_protection_token')); + $self->debug('SHA1 hash of session ID: ' . sha1_hex($self->{session}->getID())); + return undef; + } return $self->{session}->update(); } diff -ru OpenCA-0.9.2.5.orig/src/modules/openca-ui-html/HTML.pm OpenCA-0.9.2.5/src/modules/openca-ui-html/HTML.pm --- OpenCA-0.9.2.5.orig/src/modules/openca-ui-html/HTML.pm 2008-01-14 15:05:16.000000000 +0100 +++ OpenCA-0.9.2.5/src/modules/openca-ui-html/HTML.pm 2008-01-15 09:07:17.000000000 +0100 @@ -26,6 +26,7 @@ use CGI; use Locale::Messages (':locale_h'); use Locale::Messages (':libintl_h'); +use Digest::SHA1 qw( sha1_hex ); use FileHandle; our ($STDERR, $STDOUT); @@ -482,6 +483,8 @@ } $page .= ' '."\n"; + my $xsrf_protection_token = sha1_hex($self->{CGI}->param('CGISESSID')); + $keys->{HIDDEN_LIST}->{xsrf_protection_token} = $xsrf_protection_token; if (exists $keys->{HIDDEN_LIST}) { my $list = $keys->{HIDDEN_LIST}; @@ -502,11 +505,22 @@ ' '."\n". ' '."\n". ''."\n"; + $page = $self->addXSRFProtectionTokenToLinks($page); $self->sendContentType(); print $STDOUT $page; return 1; } +sub addXSRFProtectionTokenToLinks { + my $self = shift; + my $page = shift; + my $session_id = $self->{CGI}->param('CGISESSID'); + my $xsrf_protection_token = sha1_hex($session_id); + + $page =~ s/(href="[a-zA-Z\/\-]*\?cmd=[^"]+)/$1;xsrf_protection_token=$xsrf_protection_token/g; + return $page; +} + sub libSendMenu { my $self = shift; @@ -542,6 +556,7 @@ ' '."\n". ''; + $page = $self->addXSRFProtectionTokenToLinks($page); print $STDOUT $page; return 1; } @@ -630,6 +645,7 @@ ' '."\n". ' '."\n". ''."\n"; + $page = $self->addXSRFProtectionTokenToLinks($page); print $STDOUT $page; return 1; } +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Credits: - Alexander Klink, Cynops GmbH (discovery and patch) +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Version history: 1.2 - updated patch, no longer breaks SCEP support 1.1 - initial release +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Thanks: - Jürgen Brauckmann (DFN-CERT) for providing helpful input during the patch development