Class: Arachni::Checks::XssScriptContext

Inherits:
Arachni::Check::Base show all
Defined in:
components/checks/active/xss_script_context.rb

Overview

Injects JS taint code and checks to see if it gets executed as proof of vulnerability.

See Also:

Author:

Defined Under Namespace

Classes: SAX

Constant Summary collapse

ATTRIBUTES = 
[
    'onload',
    'onunload',
    'onblur',
    'onchange',
    'onfocus',
    'onreset',
    'onselect',
    'onsubmit',
    'onabort',
    'onkeydown',
    'onkeypress',
    'onkeyup',
    'onclick',
    'ondblclick',
    'onmousedown',
    'onmousemove',
    'onmouseout',
    'onmouseover',
    'onmouseup',

    # Not an event attribute so it gets special treatment by being checked
    # for a "script:" prefix.
    'src'
]

Constants included from Arachni::Check::Auditor

Arachni::Check::Auditor::DOM_ELEMENTS_WITH_INPUTS, Arachni::Check::Auditor::ELEMENTS_WITH_INPUTS, Arachni::Check::Auditor::FILE_SIGNATURES, Arachni::Check::Auditor::FILE_SIGNATURES_PER_PLATFORM, Arachni::Check::Auditor::Format, Arachni::Check::Auditor::SOURCE_CODE_SIGNATURES_PER_PLATFORM

Constants included from Arachni

BANNER, Arachni::Cookie, Form, Header, JSON, Link, LinkTemplate, NestedCookie, Severity, UIForm, UIInput, VERSION, WEBSITE, WIKI, XML

Instance Attribute Summary

Attributes included from Arachni::Check::Auditor

#framework, #page

Class Method Summary collapse

Instance Method Summary collapse

Methods inherited from Arachni::Check::Base

#browser_cluster, #clean_up, elements, exempt_platforms, has_exempt_platforms?, has_platforms?, #initialize, platforms, #plugins, prefer, #preferred, preferred, #prepare, #session, supports_platforms?

Methods included from Arachni::Check::Auditor

#audit, #audit_differential, #audit_signature, #audit_timeout, #audited, #audited?, #buffered_audit, #each_candidate_dom_element, #each_candidate_element, has_timeout_candidates?, #http, #initialize, #log, #log_issue, #log_remote_file, #log_remote_file_if_exists, #match_and_log, #max_issues, #preferred, reset, #skip?, timeout_audit_run, #trace_taint, #with_browser, #with_browser_cluster

Methods inherited from Arachni::Component::Base

author, description, fullname, #shortname, shortname, shortname=, version

Methods included from Arachni::Component::Output

#depersonalize_output, #depersonalize_output?, #intercept_print_message

Methods included from UI::Output

#caller_location, #debug?, #debug_level, #debug_level_1?, #debug_level_2?, #debug_level_3?, #debug_level_4?, #debug_off, #debug_on, #disable_only_positives, #error_buffer, #error_log_fd, #error_logfile, #has_error_log?, #included, #log_error, #mute, #muted?, #only_positives, #only_positives?, #print_bad, #print_debug, #print_debug_backtrace, #print_debug_exception, #print_debug_level_1, #print_debug_level_2, #print_debug_level_3, #print_debug_level_4, #print_error, #print_error_backtrace, #print_exception, #print_info, #print_line, #print_ok, #print_status, #print_verbose, #reroute_to_file, #reroute_to_file?, reset_output_options, #set_error_logfile, #unmute, #verbose?, #verbose_off, #verbose_on

Methods included from Arachni::Component::Utilities

#read_file

Methods included from Utilities

#available_port, available_port_mutex, #bytes_to_kilobytes, #bytes_to_megabytes, #caller_name, #caller_path, #cookie_decode, #cookie_encode, #cookies_from_file, #cookies_from_parser, #cookies_from_response, #exception_jail, #exclude_path?, #follow_protocol?, #form_decode, #form_encode, #forms_from_parser, #forms_from_response, #full_and_absolute_url?, #generate_token, #get_path, #hms_to_seconds, #html_decode, #html_encode, #include_path?, #links_from_parser, #links_from_response, #normalize_url, #page_from_response, #page_from_url, #parse_set_cookie, #path_in_domain?, #path_too_deep?, #port_available?, #rand_port, #random_seed, #redundant_path?, #regexp_array_match, #remove_constants, #request_parse_body, #seconds_to_hms, #skip_page?, #skip_path?, #skip_resource?, #skip_response?, #to_absolute, #uri_decode, #uri_encode, #uri_parse, #uri_parse_query, #uri_parser, #uri_rewrite

Methods included from Arachni

URI, collect_young_objects, #get_long_win32_filename, jruby?, null_device, profile?, windows?

Constructor Details

This class inherits a constructor from Arachni::Check::Base

Class Method Details

.check_browser_result(result, element, referring_page, cluster) ⇒ Object 



190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
 
# File 'components/checks/active/xss_script_context.rb', line 190

def self.check_browser_result( result, element, referring_page, cluster )
    page = result.page

    print_info 'Checking results of deferred taint analysis for' <<
                   ' execution-flow sink data.'

    return if page.dom.execution_flow_sinks.empty?

    log(
        vector:         element,
        proof:          element.seed,
        page:           page,
        referring_page: referring_page
    )
end

.check_browser_result_cb ⇒ Object 



206
207
208
 
# File 'components/checks/active/xss_script_context.rb', line 206

def self.check_browser_result_cb
    @check_browser_result_cb ||= method(:check_browser_result)
end

.info ⇒ Object 



219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
 
# File 'components/checks/active/xss_script_context.rb', line 219

def self.info
    {
        name:        'XSS in script context',
        description: %q{
Injects JS taint code and check to see if it gets executed as proof of vulnerability.
},
        elements:    [ Element::Form, Element::Link, Element::Cookie,
                       Element::NestedCookie, Element::Header, Element::LinkTemplate ],
        author:      'Tasos "Zapotek" Laskos <[email protected]> ',
        version:     '0.2.6',

        issue:       {
            name:            %q{Cross-Site Scripting (XSS) in script context},
            description:     %q{
Client-side scripts are used extensively by modern web applications.
They perform from simple functions (such as the formatting of text) up to full
manipulation of client-side data and Operating System interaction.

Cross Site Scripting (XSS) allows clients to inject scripts into a request and
have the server return the script to the client in the response. This occurs
because the application is taking untrusted data (in this example, from the client)
and reusing it without performing any validation or sanitisation.

If the injected script is returned immediately this is known as reflected XSS.
If the injected script is stored by the server and returned to any client visiting
the affected page, then this is known as persistent XSS (also stored XSS).

Arachni has discovered that it is possible to force the page to execute custom
JavaScript code.
},
            references:  {
                'Secunia' => 'http://secunia.com/advisories/9716/',
                'WASC'    => 'http://projects.webappsec.org/w/page/13246920/Cross%20Site%20Scripting',
                'OWASP'   => 'https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet'
            },
            tags:            %w(xss script dom injection),
            cwe:             79,
            severity:        Severity::HIGH,
            remedy_guidance: %q{
To remedy XSS vulnerabilities, it is important to never use untrusted or unfiltered
data within the code of a HTML page.

Untrusted data can originate not only form the client but potentially a third
party or previously uploaded file etc.

Filtering of untrusted data typically involves converting special characters to
their HTML entity encoded counterparts (however, other methods do exist, see references).
These special characters include:

* `&`
* `<`
* `>`
* `"`
* `'`
* `/`

An example of HTML entity encoding is converting `<` to `&lt;`.

Although it is possible to filter untrusted input, there are five locations
within an HTML page where untrusted input (even if it has been filtered) should
never be placed:

1. Directly in a script.
2. Inside an HTML comment.
3. In an attribute name.
4. In a tag name.
5. Directly in CSS.

Each of these locations have their own form of escaping and filtering.

_Because many browsers attempt to implement XSS protection, any manual verification
of this finding should be conducted using multiple different browsers and browser
versions._
}
        }
    }
end

.optimization_cache ⇒ Object 



136
137
138
 
# File 'components/checks/active/xss_script_context.rb', line 136

def self.optimization_cache
    @optimization_cache ||= {}
end

.options ⇒ Object 



132
133
134
 
# File 'components/checks/active/xss_script_context.rb', line 132

def self.options
    @options ||= { format: [ Format::STRAIGHT ] }
end

.seed ⇒ Object 



100
101
102
 
# File 'components/checks/active/xss_script_context.rb', line 100

def self.seed
    'window.top._%s_taint_tracer.log_execution_flow_sink()'
end

.strings ⇒ Object 



104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
 
# File 'components/checks/active/xss_script_context.rb', line 104

def self.strings
    return @strings if @strings

    @strings ||= [ "javascript:#{seed}" ]

    ['\'', '"', ''].each do |quote|
        [ "%q;#{seed}%q", "%q;#{seed};%q" ].each do |payload|
            @strings << payload.gsub( '%q', quote )
        end
    end

    [ "1;#{seed}%q", "1;\n#{seed}%q" ].each do |payload|
        ['', ';'].each do |s|
            @strings << payload.gsub( '%q', s )
        end
    end

    @strings = @strings.map { |s| [ s, "#{s}//" ] }.flatten
    @strings << "*/;\n#{seed}/*"

    # In case they're placed as assoc array values.
    @strings << seed
    @strings << "\",x:#{seed},y:\""
    @strings << "',x:#{seed},y:'"

    @strings << "</script><script>#{seed}</script>"
end

Instance Method Details

#check_and_log(response, element) ⇒ Object 



163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
 
# File 'components/checks/active/xss_script_context.rb', line 163

def check_and_log( response, element )
    # Check to see if the response is tainted before going any further,
    # this also serves as a rudimentary check for really simple cases.
    return if !(proof = tainted?( response, element.seed ))

    if proof.is_a? String
        log vector: element, proof: element.seed, response: response
        return
    end

    with_browser_cluster do |cluster|
        print_info 'Response is tainted, scheduling a taint-trace.'

        # Pass the response to the BrowserCluster for evaluation and see if the
        # JS payload we injected got executed by inspecting the page's
        # execution-flow sink.
        cluster.trace_taint(
            response,
            {
                taint: self.class.seed,
                args:  [element, page]
            },
            self.class.check_browser_result_cb
        )
    end
end

#optimization_cache ⇒ Object 



139
140
141
 
# File 'components/checks/active/xss_script_context.rb', line 139

def optimization_cache
    self.class.optimization_cache
end

#run ⇒ Object 



147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
 
# File 'components/checks/active/xss_script_context.rb', line 147

def run
    with_browser_cluster do |cluster|
        audit taints( cluster ), self.class.options do |response, element|
            next if !response.html?

            # Completely body based, identical bodies will yield identical
            # results.
            k = "#{response.url.hash}-#{response.body.hash}".hash
            next if optimization_cache[k]
            optimization_cache[k] = true

            check_and_log( response, element )
        end
    end
end

#tainted?(response, seed) ⇒ Boolean

Returns:

  • (Boolean) 


210
211
212
213
214
215
216
217
 
# File 'components/checks/active/xss_script_context.rb', line 210

def tainted?( response, seed )
    return if seed.to_s.empty? || !response.body.to_s.include?( seed )

    handler = SAX.new( self.class.seed % browser_cluster.javascript_token )
    Arachni::Parser.parse( response.body, handler: handler )

    handler.tainted?
end

#taints(browser_cluster) ⇒ Object 



143
144
145
 
# File 'components/checks/active/xss_script_context.rb', line 143

def taints( browser_cluster )
    self.class.strings.map { |taint| taint % browser_cluster.javascript_token }
end