+ + +
+

Parity SOP Bypass

+

Same-Origin Policy Bypass in Parity's Dapp Browser

+
+
+

+ Disclaimer + 

/* This program is free software. It comes without any warranty, to
+ * the extent permitted by applicable law. You can redistribute it
+ * and/or modify it under the terms of the GNU General Public License,
+ * Version 2, as published by the Free Software Foundation. See
+ * github.com/tintinweb/pub/tree/master/pocs/cve-2017-18016/
+ * for more details. */

+
+

+ +

+ +
+

Issue #1

+

Same-Origin Policy (SOP) bypass vulnerability due to parity proxying websites

+
+
+ Every webpage you browse to with parity's built-in browser (http://127.0.0.1:8180/#/web) is proxied via http://127.0.0.1:8080. + For example, when you browse to +
    +
  • http://google.com's the websites origin changes to 127.0.0.1:8080.
    • +
  • Navigating to http://oststrom.com changes the origin to 127.0.0.1:8080 as it is proxied via parity.
    • +
+ Both websites therefore share the same origin rendering a core feature of modern web browsers - the Same-Origin Policy - ineffective. + A website is same-origin if proto, host and port (iexplore does not check port) match. + Bypassing the SOP gives full control over XHR and DOM of child nodes (including iframe source) with the same origin. +
+ + DEMO #1 Cookies shared with other websites +
    +
  • 1) using parity's built-in browser, navigate to any website to set a cookie (e.g. http://google.com)
    • +
  • 2) reload this this PoC (https://tintinweb.github.io/pub/pocs/cve-2017-18016/)
    • +
  • 3) hit the Display Cookies button
    • +
+

+
+ Display Cookies +

+
+
+

Issue #2

+

Parity WebProxy Token Reuse vulnerability

+
+
When navigating to a website with the built-in parity webbrowser a webproxy request token is requested and sent along an encoded request for an url. For example, navigating parity to http://oststrom.com the url gets turned into a proxy url like http://127.0.0.1:8080/web/8X4Q4EBJ71SM2CK6E5AQ6YBNB4NPGX3ME0X2YBVFEDT76X3JDXPJWRVFDM of the form http://127.0.0.1:8080/web/[base32_encode(token+url)].
+ +
+ + + + + +

+ DEMO #2 Full control of arbitrary websites via token reuse and SOP bypass +
    +
  • 1) enter url into the textbox
    • +
  • 2) hit Spawn SOP Iframe
    • +
+ Notes: +
    +
  • Note the current page can modify/inject arbitrary DOM/scripting into the iframe, access cookies (only the ones stored for 127.0.0.1, potentially from prevs sessions with parity), manipulate change and reload the websites content (e.g. removing parity's inject.js), get the source via XHR
    • +
  • Note some websites may not load due to js errors. However, since the website has full control it is likely the calling website can fix any js errors occuring in the subframe.
    • +
  • Note Untested but likely possible: Prepare a transaction to send off ether via parity/web3 api or xhr, open an iframe or perform requests to directly authorize (may require unlock secret) or redress the UI to clickjack the authorization or perform other actions messing with the users account
    • +
+
+

+ Spawn SOP Iframe + +

+ +

+ DEMO #3 (Chrome) get local lan ip and service scan for web-enabled devices on the LAN to mess with them
+ e.g. search for local router interfaces with default passwords and reconfigure it to perform DNS based redirection attacks (mitm) or similar +
    +
  • 1) click 'Find LAN-Local WebInterfaces' to scan for devices listening on http port 80 within your LAN (IP .1 to .254)
    • +
  • 2) an iframe with full control will be created for each device found on the lan
    • +
  • Note: might require some fixups for the iframe conted to be loaded completely due to parity webproxy messing with header scripts or websites unable to be loaded via iframes. XHR should work though and CSRF tokens can be read from XHR requests or iframe dom (if dom based). See javascript console for debug.
    • +
+ +

+ Find LAN-Local WebInterfaces +

+ + + +
+ +
+

Contact

+
+ +