Re: IQ Handling vulnerabilities

Am 06.02.2014 12:26, schrieb Kevin Smith:
> Hi folks,
>    Discussion in the XSF and at the recent XMPP Summit has shown that
> there are widespread issues with handling of iq responses in XMPP
> software. This is probably something we need to consider handling.
>
> The basis of this is that many libraries/clients
> a) Only check the id of an iq error/result, not the sender, to check
> it matches one they've sent (Very Wrong)
> b) Use predictably generated ids for stanzas (ill-advised, but not
> strictly wrong)
> c) Use known resource strings (bad, but not strictly wrong)

Just to make it clear, the real problem here is neither the IDs nor the 
resources, but not checking the sender of the reply.

If the sender would be checked, random IDs would only protect against 
sniffing/injecting packets into a stream or against malicious servers. 
The first (sniffing/injecting) is already protected by using encryption 
and the second (malicious servers) doesn't make much sense at all, 
because a client has to trust it's server.

One of the reasons why clients don't check the sender part seems to be 
that it wasn't clear what the sender of a reply is, if the IQ query was 
without an explicit 'to' attribute.

A simple rule for clients could be to check that the JID of IQ replies 
where the origin should be the connected server is either the JID of the 
server (no node, no resource) or the received bare JID (stripping a 
possible resource) is the bare JID of the client.

Regards,

Alexander Holler