This is a post about an old vulnerability that I finally found the time to blog about. It dates back to 2014, but from a technical point of view it is nevertheless interesting: An XML parser that tries to fix structural errors in a document caused a DoS problem.
All previous posts of this series focused on XSS. This time, we present a vulnerability which is connected another Cloud Management Platform: OpenNebula. This Infrastructure-as-a-Service platform started as a research project in 2005. It is used by information technology companies like IBM, Dell and Akamai as well as academic institutions and the European Space Administrations (ESA). By relying on standard Linux tools as far as possible, OpenNebula reaches a high level of customizability and flexibility in hypervisors, storage systems, and network infrastructures. OpenNebula is distributed using the Apache-2 license.
OpenNebula offers a broad variety of interfaces to control a cloud. This post focuses on Sunstone, OpenNebula's web interface (see Figure 1).
Before OpenNebula 4.6.2, Sunstone had no Cross-Site Request Forgery (CSRF) protection. This is a severe problem. Consider an attacker who lures a victim into clicking on a malicious link while being logged in at a private cloud. This enables the attacker to send arbitrary requests to the private cloud through the victims browser. However, we could find other bugs in OpenNebula that allowed us to perform much more sophisticated attacks.
OpenNebula saves the incorrectly generated XML document in a database. The next time the OpenNebula core retrieves information about that particular VM from the database the XML parser is mixed up and runs into an error because it only expects a string as name, not an XML tree. As a result, Sunstone cannot be used to control the VM anymore. The Denial-of-Service attack can only be reverted from the command line interface of OpenNebula.
This bug can be triggered by a CSRF-attack, which means that it is a valid attack against a private cloud: By luring a victim onto a maliciously crafted website while logged in into Sunstone, an attacker can make all the victim's VMs uncontrollable via Sunstone. A video of the attack can be seen here:
This bug has been fixed in OpenNebula 4.6.2.
This result is a collaborative work together with Mario Heiderich. It has been published at ACM CCSW 2015. The paper can be found here.
All previous posts of this series focused on XSS. This time, we present a vulnerability which is connected another Cloud Management Platform: OpenNebula. This Infrastructure-as-a-Service platform started as a research project in 2005. It is used by information technology companies like IBM, Dell and Akamai as well as academic institutions and the European Space Administrations (ESA). By relying on standard Linux tools as far as possible, OpenNebula reaches a high level of customizability and flexibility in hypervisors, storage systems, and network infrastructures. OpenNebula is distributed using the Apache-2 license.
OpenNebula offers a broad variety of interfaces to control a cloud. This post focuses on Sunstone, OpenNebula's web interface (see Figure 1).
Figure 1: OpenNebula's Sunstone Interface displaying a VM's control interface |
Before OpenNebula 4.6.2, Sunstone had no Cross-Site Request Forgery (CSRF) protection. This is a severe problem. Consider an attacker who lures a victim into clicking on a malicious link while being logged in at a private cloud. This enables the attacker to send arbitrary requests to the private cloud through the victims browser. However, we could find other bugs in OpenNebula that allowed us to perform much more sophisticated attacks.
Denial-of-Service on OpenNebula-VM
At its backend, OpenNebula manages VMs with XML documents. A sample for such an XML document looks like this:<VM>OpenNebula 4.6.1 contains a bug in the sanitization of input for these XML documents: Whenever a VM's name contains an opening XML tag (but no corresponding closing one), an XML generator at the backend automatically inserts the corresponding closing tag to ensure well-formedness of the resulting document. However, the generator outputs an XML document that does not comply with the XML schema OpenNebula expects. The listing below shows the structure that is created after renaming the VM to 'My <x> VM':
<ID>0</ID>
<NAME>My VM</NAME>
<PERMISSIONS>...</PERMISSIONS>
<MEMORY>512</MEMORY>
<CPU>1</CPU>
...
</VM>
<VM>The generator closes the <x> tag, but not the <NAME> tag. At the end of the document, the generator closes all opened tags including <NAME>.
<ID>0</ID>
<NAME>My <x> VM</x>
<PERMISSIONS>...</PERMISSIONS>
<MEMORY>512</MEMORY>
<CPU>1</CPU>
...
</NAME>
</VM>
OpenNebula saves the incorrectly generated XML document in a database. The next time the OpenNebula core retrieves information about that particular VM from the database the XML parser is mixed up and runs into an error because it only expects a string as name, not an XML tree. As a result, Sunstone cannot be used to control the VM anymore. The Denial-of-Service attack can only be reverted from the command line interface of OpenNebula.
This bug can be triggered by a CSRF-attack, which means that it is a valid attack against a private cloud: By luring a victim onto a maliciously crafted website while logged in into Sunstone, an attacker can make all the victim's VMs uncontrollable via Sunstone. A video of the attack can be seen here:
This bug has been fixed in OpenNebula 4.6.2.
This result is a collaborative work together with Mario Heiderich. It has been published at ACM CCSW 2015. The paper can be found here.
Related posts
- Hacker Hardware Tools
- Hacker Tools List
- Blackhat Hacker Tools
- Growth Hacker Tools
- Github Hacking Tools
- Hack Rom Tools
- Hacker Tools 2019
- Pentest Tools Tcp Port Scanner
- Hacking App
- Hacking Tools 2020
- Hacker Tools Apk
- Hacking Tools For Games
- Hacking Tools For Windows
- Best Pentesting Tools 2018
- Hacking Tools For Windows 7
- Hacking Tools For Games
- Hacker Tools Apk Download
- Pentest Recon Tools
- Pentest Reporting Tools
- Hacker Tools Linux
- Hack And Tools
- Nsa Hack Tools Download
- Hack Tools
- Pentest Tools Windows
- Hacking Tools For Windows 7
- Hacking Tools Mac
- Physical Pentest Tools
- Pentest Tools Open Source
- Hacker Tools Windows
- Hacker Tools Apk Download
- Hacker Tools Mac
- Hacking Tools Pc
- Pentest Tools Tcp Port Scanner
- Best Hacking Tools 2019
- Pentest Reporting Tools
- Hacker Tools For Ios
- What Are Hacking Tools
- Hacker Search Tools
- Hack Website Online Tool
- Hacker Tools Mac
- Hacking Tools Software
- Nsa Hacker Tools
- Pentest Tools Website Vulnerability
- Nsa Hacker Tools
- Hacker Tools Software
- Hacker Search Tools
- Hacker Security Tools
- Hacking Tools For Windows
- Termux Hacking Tools 2019
- Hacking Tools Kit
- Hacking Tools Pc
- Best Pentesting Tools 2018
- Hacking Tools For Kali Linux
- Pentest Tools List
- New Hacker Tools
- Pentest Automation Tools
- Hacking Tools Online
- Nsa Hack Tools Download
- Pentest Tools For Windows
- Hack Tools For Mac
- Hack Tools
- Nsa Hacker Tools
- Pentest Tools Android
- Hacker Tools Free Download
- Pentest Tools Subdomain
- Black Hat Hacker Tools
- Growth Hacker Tools
- Pentest Reporting Tools
- New Hacker Tools
- New Hacker Tools
- Hacking Tools Name
- Pentest Tools Download
- Tools For Hacker
- Hacking Tools 2020
- Pentest Tools Linux
- Hacking Tools For Pc
- Hack And Tools
- Hacker Tools Apk
- Pentest Recon Tools
- Hacking Tools For Games
- Hack Tools Online
- Pentest Tools Nmap
- Hack App
- Hacker Tool Kit
- Hack Tools For Ubuntu
- New Hacker Tools
- Game Hacking
- Hak5 Tools
- Hacking Tools For Mac
- New Hacker Tools
- Hack Tool Apk
- Pentest Tools Url Fuzzer
- Hack Tools For Windows
- Tools For Hacker
- Easy Hack Tools
- Physical Pentest Tools
- Pentest Tools Port Scanner
- Hacking Tools Free Download
- Tools Used For Hacking
- Pentest Tools Online
- Install Pentest Tools Ubuntu
- Physical Pentest Tools
- Pentest Tools Kali Linux
- Hacking Tools And Software
- Pentest Tools Alternative
- Hacking Tools Download
- Hack App
- Pentest Tools Download
- Hacking Tools Kit
- Hack Tools Online
- Hackrf Tools
- Hacker Tools
- Hack Tools For Games
- Hack Tools For Windows
- Hack Tool Apk No Root
- Hack Tools Online
- Pentest Tools Alternative
- Hacker Tools For Windows
- Pentest Tools Url Fuzzer
- Hacker Tools For Ios
- Pentest Tools Apk
No comments:
Post a Comment