SSRF / XSPA
Real world Attacks and Mitigations
@riyazwalikar
whoami | head
file agenda.txt
So what are we going to discuss today?
dpkg -i investigate.deb
Found a facebook.com URL which fetched the <title> from a URL I could control
Tested for XSS, SQLi and LFI/RFI
Setup a HTTP server with port 8080 exposed to the Internet
Used http://myserver:8080 as an argument, mistyped the port number as 808
Facebook displayed an error that hinted on the port being closed
I tested this with other open and closed ports as well
uptime | cut –d " " –f2
Realized I could port scan Internet facing servers using verbose distinct errors from facebook
cat /etc/issue
Facebook was using underlying server side code to open socket connections to remote servers to download content
Friendly error messages were being sent to the client for failed socket connections at the web application level
There was no proper data handling for non HTTP streams, which was causing the application to behave unexpectedly
mail -s 'Bug!' sec@fb.com < /dev/null
Reported the issue to Facebook who responded saying that they did not see how this was a problem
mail -s 'Bug!' sec@fb.com < /dev/null
Sent facebook a Proof of Concept python port scanner
Scanned some random servers on the Internet using the script
Facebook replied and acknowledged that this was a problem
export vuln = 'XSPA / SSRF'
XSPA occur when a web application attempts to connect to user supplied URLs and does not validate backend responses received from the remote server
XSPA allows an attacker to port scan servers and attack services (Internet facing as well as internal devices) while proxying the attack from another web application
XSPA – Cross Site Port Attacks
export vuln = 'XSPA / SSRF'
XSPA – Cross Site Port Attacks
export vuln = 'XSPA / SSRF'
XSPA – Cross Site Port Attacks
Consider an application that allows users to specify an external image URL.
Image File URL | Server Status & Body Response |
http://remote_server.com/image.png | 200 OK – Image retrieved |
http://remote_server.com:22/image.png | 200 OK – “Invalid Image” |
http://remote_server.com:3306/image.png | 200 OK – “Invalid Image” |
http://remote_server.com:8081 | 200 OK – “Connection refused!” |
The remote server on which the image resides has ports 22,80 and 3306 open
export vuln = 'XSPA / SSRF'
Application displays verbose errors for failed socket connections, receives fixed length responses or delays response for a fixed length of time
Application does not verify received data from the remote server, if the connection was successful
Application does not blacklist internal IP addresses/URLs
XSPA – Cross Site Port Attacks
An attacker generates an HTTP request of the form
�http://vulnerable/getimage.php?img=http://internet/image.png
HTTP GET
The vulnerable server then on behalf of the attacker makes a GET request to the internet server for the image.png
HTTP GET
The image is downloaded to the web server and then a local link to it is sent to the attacker
Image
(Response)
Page
(Response)
An attacker generates an HTTP request of the form
�http://vulnerable/getimage.php?img=http://LANIP:22/img.png
HTTP GET
The vulnerable server then on behalf of the attacker makes a GET request to the locally accessible server for the img.png
HTTP GET
SSH Banner (Response)
Error
(Response)
Since a GET is made to a non HTTP service, the service returns any banners and/or errors
The web application may then generate specific errors or may display raw errors received – banners for example
find . -print | xargs grep 'logic'
cat popular_servers | ./poke
Found XSPA/SSRF in
cat facebook
The first finding
Application specific response for open port above 1024
cat facebook
The first finding
Application specific response for open port below 1024
cat facebook
The first finding
Application specific response for closed port
cat Google
Google Webmasters – XSPA/SSRF
Application specific response for open HTTP Port
cat Google
Google Webmasters – XSPA/SSRF
Application specific response for open non-HTTP Port
cat Google
Google Webmasters – XSPA/SSRF
Application specific response for closed port
cat mozilla_marketplace
Application specific response for open HTTP port
cat mozilla_marketplace
Application specific response for open non HTTP port
cat mozilla_marketplace
Application specific response for closed port
cat yahoo_developer_network
HTML Page content received from remote server on Open HTTP Port
cat yahoo_developer_network
Non HTTP Service responds with banner – Open non HTTP Port
cat yahoo_developer_network
Non HTTP Service responds with banner – Open non HTTP Port
ls adobe*.flv | xargs vlc
cat /xspa/other_attacks
Attackers can access internal applications and perform URL based attacks (SQLi, Parameter manipulation etc.)
Since the GET /<data> part is controlled by the attacker, it would be possible to attack services and execute code on internal systems
Denial of service attacks on internal services
sudo demo &
patch -p1 < /var/xspa/fixes
Response Handling - implement server side validation of responses received from remote resources
Error handling and messages - Display generic error messages to the client in case something goes wrong.
Restrict connectivity to HTTP based ports - restrict connections to HTTP ports on the server
Blacklist IP addresses - Internal IP addresses, localhost specifications and internal hostnames should be blacklisted
cat /xspa/reading
All images are the property of their respective creators.
cat /xspa/special_thanks
A big thanks to Jeremiah, @makash, @w3bd3vil, @abh1sek, @nikchillz, Alexander Polyakov and everybody at the @null0x00 community for their help with testing, verifying, building exploits and just being so cool!
Riyaz Ahemed Walikar�@riyazwalikar�http://www.riyazwalikar.com�