This is a post about an old vulnerability that I finally found the time to blog about. It dates back to 2014, but from a technical point of view it is nevertheless interesting: An XML parser that tries to fix structural errors in a document caused a DoS problem.
All previous posts of this series focused on XSS. This time, we present a vulnerability which is connected another Cloud Management Platform: OpenNebula. This Infrastructure-as-a-Service platform started as a research project in 2005. It is used by information technology companies like IBM, Dell and Akamai as well as academic institutions and the European Space Administrations (ESA). By relying on standard Linux tools as far as possible, OpenNebula reaches a high level of customizability and flexibility in hypervisors, storage systems, and network infrastructures. OpenNebula is distributed using the Apache-2 license.
OpenNebula offers a broad variety of interfaces to control a cloud. This post focuses on Sunstone, OpenNebula's web interface (see Figure 1).
Before OpenNebula 4.6.2, Sunstone had no Cross-Site Request Forgery (CSRF) protection. This is a severe problem. Consider an attacker who lures a victim into clicking on a malicious link while being logged in at a private cloud. This enables the attacker to send arbitrary requests to the private cloud through the victims browser. However, we could find other bugs in OpenNebula that allowed us to perform much more sophisticated attacks.
OpenNebula saves the incorrectly generated XML document in a database. The next time the OpenNebula core retrieves information about that particular VM from the database the XML parser is mixed up and runs into an error because it only expects a string as name, not an XML tree. As a result, Sunstone cannot be used to control the VM anymore. The Denial-of-Service attack can only be reverted from the command line interface of OpenNebula.
This bug can be triggered by a CSRF-attack, which means that it is a valid attack against a private cloud: By luring a victim onto a maliciously crafted website while logged in into Sunstone, an attacker can make all the victim's VMs uncontrollable via Sunstone. A video of the attack can be seen here:
This bug has been fixed in OpenNebula 4.6.2.
This result is a collaborative work together with Mario Heiderich. It has been published at ACM CCSW 2015. The paper can be found here.
All previous posts of this series focused on XSS. This time, we present a vulnerability which is connected another Cloud Management Platform: OpenNebula. This Infrastructure-as-a-Service platform started as a research project in 2005. It is used by information technology companies like IBM, Dell and Akamai as well as academic institutions and the European Space Administrations (ESA). By relying on standard Linux tools as far as possible, OpenNebula reaches a high level of customizability and flexibility in hypervisors, storage systems, and network infrastructures. OpenNebula is distributed using the Apache-2 license.
OpenNebula offers a broad variety of interfaces to control a cloud. This post focuses on Sunstone, OpenNebula's web interface (see Figure 1).
Figure 1: OpenNebula's Sunstone Interface displaying a VM's control interface |
Before OpenNebula 4.6.2, Sunstone had no Cross-Site Request Forgery (CSRF) protection. This is a severe problem. Consider an attacker who lures a victim into clicking on a malicious link while being logged in at a private cloud. This enables the attacker to send arbitrary requests to the private cloud through the victims browser. However, we could find other bugs in OpenNebula that allowed us to perform much more sophisticated attacks.
Denial-of-Service on OpenNebula-VM
At its backend, OpenNebula manages VMs with XML documents. A sample for such an XML document looks like this:<VM>OpenNebula 4.6.1 contains a bug in the sanitization of input for these XML documents: Whenever a VM's name contains an opening XML tag (but no corresponding closing one), an XML generator at the backend automatically inserts the corresponding closing tag to ensure well-formedness of the resulting document. However, the generator outputs an XML document that does not comply with the XML schema OpenNebula expects. The listing below shows the structure that is created after renaming the VM to 'My <x> VM':
<ID>0</ID>
<NAME>My VM</NAME>
<PERMISSIONS>...</PERMISSIONS>
<MEMORY>512</MEMORY>
<CPU>1</CPU>
...
</VM>
<VM>The generator closes the <x> tag, but not the <NAME> tag. At the end of the document, the generator closes all opened tags including <NAME>.
<ID>0</ID>
<NAME>My <x> VM</x>
<PERMISSIONS>...</PERMISSIONS>
<MEMORY>512</MEMORY>
<CPU>1</CPU>
...
</NAME>
</VM>
OpenNebula saves the incorrectly generated XML document in a database. The next time the OpenNebula core retrieves information about that particular VM from the database the XML parser is mixed up and runs into an error because it only expects a string as name, not an XML tree. As a result, Sunstone cannot be used to control the VM anymore. The Denial-of-Service attack can only be reverted from the command line interface of OpenNebula.
This bug can be triggered by a CSRF-attack, which means that it is a valid attack against a private cloud: By luring a victim onto a maliciously crafted website while logged in into Sunstone, an attacker can make all the victim's VMs uncontrollable via Sunstone. A video of the attack can be seen here:
This bug has been fixed in OpenNebula 4.6.2.
This result is a collaborative work together with Mario Heiderich. It has been published at ACM CCSW 2015. The paper can be found here.
Continue reading
- Hacking Tools Usb
- Pentest Box Tools Download
- Hack Tools For Windows
- Hacker Tools Software
- Nsa Hacker Tools
- Usb Pentest Tools
- Hack Tool Apk No Root
- Hacker Tools List
- Hacking Tools Pc
- Hacking Tools For Games
- Hacking Tools Usb
- Pentest Tools Review
- Hacker Tools Apk
- Hacking Tools For Kali Linux
- Hacking Tools For Pc
- Hack Tools Github
- Pentest Tools
- Physical Pentest Tools
- Hacking Tools Windows
- Hacker Tools Online
- Hacking Tools 2019
- Growth Hacker Tools
- Hacking Tools For Mac
- Hacking Tools Mac
- Tools 4 Hack
- Hacker Tools Online
- Pentest Tools Download
- Hacker Tools For Mac
- Pentest Tools
- Hack Tools For Windows
- Hacker Tools
- Termux Hacking Tools 2019
- Pentest Tools Review
- Hacker Tools Mac
- Pentest Tools Port Scanner
- Pentest Tools Website
- Hack Tools For Pc
- Android Hack Tools Github
- Hack Tools Online
- Hacker Tools Software
- Hacker Tools For Pc
- Hacker Tools List
- Top Pentest Tools
- Hack Tools Download
- Nsa Hack Tools
- Hack Tools For Windows
- World No 1 Hacker Software
- Pentest Reporting Tools
- Hacker Tools Free Download
- Pentest Tools Kali Linux
- Pentest Tools Tcp Port Scanner
- Hacking Tools For Windows 7
- Hacking Tools 2020
- Hacking Tools And Software
- Hacking Tools For Beginners
- Tools Used For Hacking
- Hacker Tools Hardware
- Hacking Tools Name
- Hack Tools Pc
- Hacking Tools Hardware
- Hack And Tools
- Pentest Tools Kali Linux
- Hack Tools 2019
- Hack Tools For Games
- Pentest Tools For Ubuntu
- Hack Tools For Windows
- Pentest Tools Tcp Port Scanner
- Hacking App
- Hack Website Online Tool
- Pentest Tools Nmap
- Hack Tools 2019
- How To Make Hacking Tools
- Pentest Reporting Tools
- What Are Hacking Tools
- Hack Rom Tools
- Hack Tools For Ubuntu
- Pentest Reporting Tools
- Pentest Tools Subdomain
- Github Hacking Tools
- Hacking Tools For Kali Linux
- Hacker Tools Mac
- Hacking Tools Free Download
- Hacker Tools Software
- Hacking Tools Windows
- Pentest Tools Kali Linux
- Pentest Tools Subdomain
- Nsa Hacker Tools
- Hack Tools Download
- Hacker Tools For Pc
- How To Install Pentest Tools In Ubuntu
- Hackrf Tools
- Nsa Hacker Tools
- Hacking Tools For Windows
- Android Hack Tools Github
- Hacking Tools Windows 10
- Pentest Tools Online
- Ethical Hacker Tools
- Hacker Tools Apk
- Nsa Hacker Tools
- Hacker Tools List
- Hack Tools For Windows
- Best Hacking Tools 2019
- Hacking Tools Software
- Hacking Tools For Kali Linux
- Hacking Apps
- Hacker Security Tools
- Hacking Tools Windows
- Hack Website Online Tool
- Hacking Tools Windows 10
- Hacks And Tools
- Hacking Tools Download
- Hack Tools For Windows
- Pentest Automation Tools
- Pentest Tools Url Fuzzer
- Hack And Tools
- Hacker Tools
- Hackers Toolbox
- Hacker Tools List
- Wifi Hacker Tools For Windows
- Hack Tools Github
- Hacking Tools For Pc
- Pentest Tools Review
- Pentest Tools Download
- Hacking Tools Hardware
- Easy Hack Tools
- Beginner Hacker Tools
- Hacker Tools 2020
- Pentest Tools Find Subdomains
- Top Pentest Tools
- Physical Pentest Tools
- Hacker Techniques Tools And Incident Handling
- Hack Tools For Windows
- Hacking Tools Free Download
- Hacker Tools Github
- Hacker Tools 2019
- Hacking Tools Hardware
- Hacker Tools Apk
- Hacker Tools For Windows
- Hacking Tools Kit
- Hacker Search Tools
- Hack Tools Online
- Pentest Box Tools Download
- Free Pentest Tools For Windows
- Hack Apps
- Pentest Tools For Mac
- Hacker Tools Linux
- Hack Website Online Tool
- Hacking Tools Download
- Hacker Tools 2019
- Hacker Tools Free Download
- Hacker Tools Online
- Nsa Hack Tools
- Hacking Tools Download
- Best Hacking Tools 2020
- Hacker Tools Linux
- Hacker Tools For Windows
- Hacker Techniques Tools And Incident Handling
- Pentest Tools Port Scanner
No comments:
Post a Comment