Monday, February 25, 2013

About the latest Rack vulnerability and how it affected BeEF

A friend of mine, Louis @snyff Nyffenegger, recently found an XSS in Rack default 404 page. By default, Rack is reflecting the value of the not found URI in the page, without applying proper output escaping. This leads to reflected XSS.

A simple patch suggested by him is the following:
https://github.com/snyff/rack/commit/66b41c8394569e87b85122d7b2cdf194017b82c3

So how does this affect BeEF?

The bug is present when using Rack::File or similar directives to mount content in the Thin web server. We use that directive to mount the static content served via the /demos URI.

beef_server.mount('/demos/', Rack::File.new(dir))

The affected code in the file.rb Rack library is:




Bear in mind, the demo content should be disabled when using BeEF in production, especially because you're not going to hook browser using the default hook demo page. This is the same as disabling debug logging in your web application when switching to a UAT to production environment.

The exploitability of the bug itself is actually very low, because the 404 page is returned with Content-type: text/plain. To trigger an XSS with such content type you need to rely on browser bugs, which are now mostly patched, and rely on not honoring the content type leading to content type mismatches.

 And yes, I patched the bug in less than one hour from the moment I knew about the bug. So even without updating Rack to 1.4.5 or greater versions, your BeEF is gonna be safe.

This is my patch:
https://github.com/beefproject/beef/commit/c37f0e1719bb9eee71dabed15584bd672df7b443
which is basically removing completely the reflection point:



Now, as I already knew this could be an issue, something like 8 months ago I changed the default
routing behavior in the BeEF core, creating a routing.rb class that overrides the behavior of the default 404 page from Rack.

So, the whole BeEF UI/Core and RESTful-API was not vulnerable since at least 10 months ago.
The only resources mounted with Rack::File are the /demos stuff, which I honestly never use in production, disabling the extension. You can see below how a not found page is handled in BeEF's router.rb class, which is used by every component of the framework:



So, a limited-exploitability bug, on an handler that is supposed to be not available in production, and last on a library we use (not code we explicitly wrote) :D

But, as we take these things seriously, expect a BeEF module which aims at hooking BeEF itself :D


50 comments:

  1. Really nice post, however on a unrelated topic. What IDE is that you are using?

    ReplyDelete

  2. Thanks for posting this useful content, Good to know about new things here, Let me share this, . Hadoop training in pune

    ReplyDelete

  3. Thanks for sharing your info. I really appreciate your efforts and I will be waiting for your further write.
    Thanks for sharing !
    tanki online 2 | 2048 game online

    ReplyDelete
  4. Make sure that you read this article before doing anything to your phone. This is important

    ReplyDelete

  5. شراء اثاث مستعمل بالرياض
    عزيزي العميل إذا أردت بيع محتويات بيتك القديم أو شركتك القديمة واستبدالها بأخرى جديدة أو مستعملة فنحن في شركة شراء اثاث مستعمل بالرياض سنشتري منك كل الأثاث القديم الذي ترغب في بيعه وشراء بأعلى الأسعار الموجودة في السوق لأننا لا نبخس الأسعار ما يفعل الكثير من التجار عند شراء الأثاث المستعمل.
    شراء الاثاث المستعمل بالرياض
    شراء الاثاث المستعمل بجدة
    شراء الاثاث المستعمل بالمدينة المنورة
    إذا كنت ترغب في التخلص من جميع أثاث منزلك فلا داعي للقلق شراء اثاث مستعمل بالرياض تقوم بتوفير الطيقة المثالية حتى يتم بيع الأثاث بكل سهولة وذلك من خلال توفير التالي :-
    • عدد من الفروع الخاص بعملية شراء الأثاث المستعمل .
    • عدد من الفنيين والخبراء المختصين في تقييم الأثاث حتى تحصل على اعلى سعر عند بيع القطع القديمه .
    • سوف تعمل على توفير مساحة خالية بعد ذلك يمكن ان تستغلها في المكان .
    • العمل على شعور المتواجدين بالراحة النفسية نتيجة إلى التخلص من القطع القديمة .
    شراء الاثاث المستعمل بالرياض
    شراء الاثاث المستعمل بجدة
    شراء الاثاث المستعمل بالمدينة المنورة

    ReplyDelete

  6. حقين شراء اثاث مستعمل في الرياض :
    عزيزي العميل إذا كنت تود أن تغير أثاث منزلك القديم وتود شراء أثاث أخر جديد وليس معك المال الكافي لذلك فنحن فى حقين شراء اثاث مستعمل في الرياض نقوم ببيع الأثاث المستعمل ونتبع الطرق المناسبة عند شراء الأثاث القديم فلا تخاف من عدم جودة الأثاث حيث اننا نقوم بالتالي :-
    • شراء اثاث مستعمل بالرياض يقوم بشراء واعادة بيعجميع قطع الأثاث .
    • يتم تلميع قطع الأثاث وإعادة إصلاح التالف منها ودهنها وعرضها بصورة لا تختلف عن الأثاث الجديد ولكن تكون بأسعار رخيصة وفي متناول يد الجميع.
    • لدينا سيارات متخصص في نقل الأثاث المستعمل إلى مكان المنزل مهما كان موقعه.
    • لدينا أفضل العمالة المدربة على نقل الأثاث بكل احترافية ومهارة في حمل قطع الأثاث وتوصيلها إليكم دون التعرض للتلف أو الكسر .
    • يوجد لدى الشركة أوناش لرفع الأثاث إذا كنتم ممن تسكنون في الأدوار العليا فلا داعي للقلق .
    شراء الاثاث المستعمل بالرياض
    شراء الاثاث المستعمل بجدة
    شراء الاثاث المستعمل بالمدينة المنورة
    في حالة الرغبة من السفر أو الهجرة خارج البلاد لفترة طويلة ولا تعرف أين تتخلص من أثاثك القديم فالآن شراء اثاث مستعمل بالرياض قامت بحل هذه المشكلة الآن يمنكم الاتصال بنا فورًا على ارقام محلات شراء اثاث مستعمل الرياض وذلك من خلال الأرقام المعلن عنها من خلال الانترنت وسوف يرد عليكم خدمة العملاء وتلقي طلباتكم حيث أن لدى شركة شراء اثاث مستعمل بالرياض فريق خدمة عملاء يعمل على مدار أربع وعشرين ساعة لخدمتكم وعقب القيام بالاتصال بنا نقوم بالآتي :
    • عند تحديد الموعد المناسب إليكم تقوم الشركة بإرسال مندوب لكم لمعاينة قطع الأثاث المراد بيعها والاتفاق معكم على أفضل سعر للأثاث المراد بيعه.
    • ثم إرسال فريق متخصص من قبل الشركة لدينا في فك قطع الأثاث بكل احترافية فلا داعي للاستعانة بنجارين أو فنيين لفك الأثاث القديم فنحن نقدم لكم تلك الخدمة مجانًا من الشركة.
    • بعدها يتم وضع الأثاث في الاسفل والعمل على رشة جيدا للحفاظ على العملاء الجدد من الاصابة في حالة بيعه .
    شراء الاثاث المستعمل بالرياض
    شراء الاثاث المستعمل بجدة

    ReplyDelete
  7. Here are some of the best apps that will turn your shots into HDR quality photos. HDR Camera. HDR Camera by Almalence is one of the best HDR cameras on the Google Play Store. Camera360. Make photography a work of art with Camera360 for Android. Retro Camera. Photaf Panorama Pro. Pro HDR Camera. Cymera. Camera ZOOM FX.

    ReplyDelete
  8. Good Post! Thank you so much for sharing this pretty post, it was so good to read and useful to improve my knowledge as updated one, keep blogging.

    Selenium with python Training in Electronic City

    ReplyDelete
  9. Great post! I didn’t knowral of these resources and I’m going to go check them out now!wuxiaworld

    ReplyDelete
  10. This article is really fantastic and thanks for sharing the valuable post.

    bloxorz

    ReplyDelete
  11. Below you will understand what is important, the idea provides one of the links with an exciting site fireboy and watergirl

    ReplyDelete
  12. Your share is great, I found a lot of things in your post.
    manga

    ReplyDelete
  13. Thanks for the information you shared.
    get on top

    ReplyDelete
  14. Thank you for the information, may be useful for all people of course who read this article return man 3

    ReplyDelete
  15. Your thoughts are very deep, I feel it has many meanings and humanities
    read manga online

    ReplyDelete
  16. Our non plagiarized college essays writers have been 14 years experience in the field where they have assisted thousands of returning clients in attaining high scores in their college research paper services.

    ReplyDelete
  17. This shows what impact does different negative and fake reviews of best paper writing service and how it can affect the business.
    Reviews or testimonials regarding any service are the only way to get an idea about its quality and credibility. MyAssignmentHelp Review feedbacks from students all over the world. MyAssignmenthelp.com reviews show the dedication and efforts the company put to ensure 100% quality. Although most of the reviews are positive, but there are testimonials with negative feedback as well.
    It is needless to say that if the students are convinced that edubirdie review is not a good, they will definitely not opt for it. Therefore, if the number of negative and fake reviews is increased on reputed sites like essay reviews, the sale can rapidly get down.
    To counter this issue, the only way is to go through or read Argumentative Essay on Essay Writing Services that are posted on the site,
    However, essayshark review and Uk essays review posted on the sites are very small.

    ReplyDelete
  18. Our declaration to providing the best customer experience when it comes to the term papers for sale online are guided by these principles we entrench daily in our delivery for the delivery of cheap custom essay writing services.

    ReplyDelete
  19. Our powerpoint presentation makers always remove them before adding it into the slides. As our experts are familiar with many image editing tools that can successfully discard the white spaces.

    ReplyDelete
  20. If you are in college or are applying to colleges, you are probably aware that college essays aren’t as easy as they used to be when you were in school. But before you can even begin to prepare the essays, you need to figure out the essay format your university department follows.

    ReplyDelete
  21. Really very informative and creative. This sharing concept is a good way to enhance knowledge. www.appslure.com

    ReplyDelete
  22. Students Assignment Help holds the dedicated professional writers providing make my assignment to the students. Our writing helpers have enough knowledge to assist students. Our writers are highly educated from the top universities around the world.

    ReplyDelete
  23. Thanks for Sharing the beautiful content with us.This is really very helpful for best real estate investing podcast.

    ReplyDelete
  24. Nice stuff. Umrah Packages 2019 really thankful for sharing it.

    ReplyDelete
  25. Our top-notch writers have access to peer-reviewed articles, Free Essay Writer Services and online databases that are essential in writing Custom Writing Services on any chosen topic.

    ReplyDelete
  26. Hi there! great stuff. Thanks for sharing a very interesting and informative content, it helps me a lot, keep it up!
    Where to stay Espiritu Santo Vanuatu
    Espiritu Santo Island
    Best place to stay Espiritu Santo Vanuatu

    ReplyDelete
  27. Individuals are the individuals responsible for the fertilization process as this range of termites are present during spring and autumn. It is characterized by dark color and has eyes that have the ability to communicate strongly. Besides she considers this caste is an enriched caste that works on sex exchange with queens and kings of termites. So new colonies are built and are therefore a sect that always has a very important role in termite colony.
    شركة النجوم لمكافحة الحشرات
    شركة رش مبيدات بجدة
    شركة مكافحة الفئران بجدة
    شركة مكافحة النمل الابيض بجدة
    شركة مكافحة حشرات بجدة

    ReplyDelete


  28. strongly. Besides she considers this caste is an enriched caste that works on sex exchange with queens and king
    http://www.kulinerindonesia.web.id/

    ReplyDelete
  29. We provide the chance to spice up your career and confidence level by passing the test with the assistance of AZ-900 braindumps from on-line exam homework and simply AZ-900 study guide.
    AZ-900 practice test
    AZ-900 online exam

    ReplyDelete
  30. یکی از سوالاتی که برای همه مشتریان وجود دارد این است که کاغذ دیواری ساده
    برای اتاق خوابشان انتخاب کنند کاغذ دیواری نکست که بهترین باشد. پشت تخت خواب را چه کاغذ دیواری باید زد؟
    توجه کنید در اتاق خواب دیوار پشت تخت خواب دیوار اصلی محسوب می شود که کاغذ دیواری طرح دار روی آن نصب می شود. در مورد اتاق خواب بر اساس سلیقه های مختلف کاغذدیواری های مختلفی نصب می کنند. بعضی کاغذ دیواری گل دار را انتخاب می کنن
    هتل ساحل سرخ تنها هتل جزیره هرمز با قیمت مناسب و امکانات خوب. هر سوییت شامل آشپزخانه و سرویس بهداشتی جداگانه. رخت خواب ها و حوله ها خیلی تمیز . جزیره هرمز
    غذای رستوران دریایی به سبک محلی و خیلی خوشمزه با قیمت مناسب.

    ReplyDelete
  31. Jeewangarg is a Leading Digital Marketing Company which is helping your brand to cut through the Digital Clutter with its best SEO Company in Delhi. Our range of Services includes SEO Services, PPC Company in Delhi, Website Designing Services and Social Media Marketing Services. Being a Google Partners Agency we provide our client with 100% satisfaction in every aspect of their marketing goals. So, what are you waiting for Connect to the team of best SEO Expert India, Google Ads Experts, Website Designing Experts, Social Media Experts & more to boost your Digital Presence today with the high quality Digital Marketing Services.

    ReplyDelete
  32. BluPrints is an Indian Electronics Product Manufacturing Company that develops world-class cost-competitive solutions for the Indian market. You can buy POS thermal mobile printers, wireless POS receipt printers, easy integration with Android, Windows, iOS.

    Bluetooth Thermal Receipt Printer (2 Inch/ 58mm)

    Bluetooth Thermal Receipt Printer With USB (2 Inch/58mm)

    ReplyDelete
  33. Servo Stabilizer Manufacturer in India, Servo Star offers a wide range of single phase to three-phase Servo Voltage Stabilizer units to suit various types of domestic and industrial applications such as metal processing equipment, production lines, construction devices, elevators, medical equipment, air-conditioners, etc. Call us on 9250809090 to get the best quote for Servo Stabilizer Price & Transformer Price in India.

    ReplyDelete
  34. Are you Looking for Buy Indian
    lehenga choli Online Shopping ? We have Largest & latest Collection of Designer Indian Lehenga Choli which is available now at Best Discounted Prices.

    lehenga choli

    ReplyDelete
  35. Thanks for your helpful sharing. I have read that knowledge very much, it gives me a lot of things.
    cat mario

    ReplyDelete
  36. Thanks for sharing such a great information, Here we are India's best service provider of sbi kiosk banking.
    csp bank mitra
    bank mitra
    bank mitra csp

    ReplyDelete
  37. I am really happy to say it’s an interesting post to read . I learn new information from your article myprepaidcenter

    ReplyDelete
  38. Nice Information. Thanks for sharing this Post. Are you looking for web design and logo design for your company or business please contact Subraa your freelance website designer and logo designer in Singapore. Structure your business website and get your logo FREE.

    Click the below links know more the offers:

    Logo Design
    Logo Design Singapore
    Logo Designer Singapore
    Web Designer Singapore
    Digital Marketing Agency in Singapore
    Flyer Design Singapore
    Name Card Design Singapore

    ReplyDelete
  39. Thanks for the information.This is very informative post. If you are looking for the best Frame Workers then we provide Frame Services faster and at a better price.

    ReplyDelete