Saturday, January 20, 2024

Security Analysis In An OpenID Connect Lab Environment

In this post, Christian Fries shows an approach to unveil security flaws in OpenID Connect Certified implementations with well-known attack methods. One goal of the master's thesis Security Analysis of Real-Life OpenID Connect Implementations was to provide a platform for developers and security researchers to test implementations in a reproducible and maintainable OIDC lab environment.

We included six OpenID Provider (OP) and eight Relying Party (RP) services in the lab environment. For the comprehensive security analysis, we tested the implementations against eleven Relying Party attacks and seven OpenID Provider attacks in different variations with our tool PrOfESSOS. In addition, we carried out manual tests as well. We have disclosed twelve implementation flaws and reported them to the developers in a responsible disclosure process.

Two developer teams fixed (✔) the vulnerabilities before the deadline of the master's thesis. One Redirect URI Manipulation vulnerability was rejected (✖). This particular case can be permissible for only one registered URI for reasons of interoperability and fault tolerance. We informed three further development teams (✦).

Name Vulnerability Fixed CVE
MITREid Connect PKCE Downgrade Attack
mod auth openidc ID Spoofing, JWKS Spoofing
node oidc-provider Redirect URI Manipulation
OidcRP Replay Attack
phpOIDC Message Flow Confusion, ID Spoofing, Key Confusion
pyoidc Replay Attack, Signature Manipulation, Token Recipient Confusion CVE-2020-26244

We explain the method of how we have archived this result in the following sections.

 

Introduction

The OpenID Connect protocol framework defines three basic flows, Authorization Code Flow (or just Code Flow), Implicit Flow, and Hybrid Flow. OAuth 2.0, which is the foundation of OpenID Connect, introduces several extensions. One of the latest extensions is Code Flow with PKCE (Proof Key for Code Exchange, RFC7636).

Compliance with the specification requirements is essential for application security. Settings and parameter conditions are changed. For example, in Code Flow, a nonce parameter in the Authentication Request is optional but required for the Implicit Flow. The developers have to deal with such changes. They end up implementing several code branches and various state machines. The implementation's code complexity naturally increases if it supports more features and extensions. This complexity implies that minor changes with only one specific flow in mind can introduce a security issue in another flow.

Various well-known attacks are published in different papers and several mitigations are mentioned in best practice guides. One tool, which can perform the fully automated evaluation of services with generic attack vectors, is PrOfESSOS.

PrOfESSOS

PrOfESSOS is our evaluation as a Service (EaaS) security tool. We have implemented significant improvements into it over the past few years. The latest version can simulate a malicious RP that can carry out the attacks against an OP. In addition, PrOfESSOS can simulate an honest and a malicious OP to perform Single-Phase and Cross-Phase attacks. A penetration tester can access the RESTful API directly or the Web UI to start an evaluation.

Supported attacks on Relying Parties

Single Phase # Attack Patterns   Cross Phase # Attack Patterns
ID Spoofing 12   Issuer Confusion 1
Replay Attack 6   IdP Confusion 1
Key Confusion 13   Malicious Endpoint Attack 1
Signature Manipulation 4   Session Overwriting 2
Cross Site Request Forgery 3      
Token Recipient Confusion 3      
Token Substitution 2      

Supported attacks on OpenID Provider

Attack # Attack Patterns
Authorization Code Reuse and Substitution 5
Redirect URI Manipulation 15
Open Redirector 1
Client Authentication Bypass 15
Message Flow Confusion 2
PKCE Downgrade Attack 5
Sub Claim Spoofing 5

The Lab Environment

Overview

A developer or security researcher needs a running web application to start an evaluation. One way to create an analysis is to execute the web application and evaluation tools on a local development machine. This approach might be a practical compromise for small-scale projects. For multiple instances of applications with different configurations, this approach can be cumbersome. Docker containers can help here. Various RP and OP already offer a container setup, or there are examples of creating Dockerfiles, at least. It is possible to have reproducible build results through the container concept. In addition, this approach enables us to store static configuration files and SQL dumps for a specific instance.

We introduced three networks running on a server for our lab environment setup. The ProfNET for all evaluation tools can be controlled and debugged from a remote client. Furthermore, we added a RPNet for all Relying Parties and an OPNet for all OpenID Provider. The MitMProxy connects the networks and the users' browser. It allows us to observe and manipulate every http(s) communication in front- and back-channel.

Setup

Server Side

It is only required to checkout the oidc-docker-libs. The docker-compose setup can be built and run with:

git clone https://github.com/RUB-NDS/oidc-docker-libs docker-compose build docker-compose up -d 

The following ports are used by the lab: 8787, 9990, 8888, 8042, 8080, 8081. You should ensure that you don't have service running on those ports.

The docker-compose provides the possibility to run only a small subset, for example:

docker-compose up -d professos mitmproxy mitreid-server 

Docker Structure

The basic idea of our docker containers is to build from sources in a more or less generic way. We intended that each application runs as a completely independent unit. The application configuration can be performed with build arguments, environment variables, or complete SQL dumps.

You can see that we structured a Dockerfile in four blocks:

FROM ubuntu:18.04  ARG BRANCH=v3 ARG FLOW=implicit ARG CONTROLLER_URL ARG SERVER_HOST  # Setup the application ENV APPDIR /opt/app WORKDIR ${APPDIR} RUN git clone --depth=1 --branch=$BRANCH https://github.com/YOU/YOUR_APP RUN cd YOUR_APP \     && echo config=$FLOW >> configuration_file \     && ./build  # deploy automatically created certs ARG CA_DIR="/certs" ARG CA_CERT="oidc-ca.crt" VOLUME ["$CA_DIR"]  # Configure apache or nginx COPY config/apache-ssl.conf /etc/apache2/sites-available/ssl.conf RUN sed -i "s#SERVER_HOST#$SERVER_HOST#g" /etc/apache2/sites-available/ssl.conf RUN a2enmod headers ssl proxy proxy_http rewrite && a2ensite ssl RUN echo "https://$CONTROLLER_URL" > /var/www/html/.professos  # Start the application and apache/nginx server COPY docker-entrypoint.sh ${SUBDIR}/ WORKDIR ${SUBDIR} ENTRYPOINT ["./docker-entrypoint.sh"] 

From this point, it is possible to add two or more configured instances to the docker-compose.yml file. Every instance can be tested independently and without influencing each other. This independence enables us to test various switches, e.g., different flows or authentication methods in different combinations.

app1-implicit:     build:       context: rp/app1       args:         FLOW: "implicit"         CONTROLLER_URL: ${CONTROLLER_HOST}         CLIENT_HOST: ${APP1-IMPLICIT}     depends_on:       - certs     volumes:       - certs:/certs:ro     env_file:       - .proxy_env     environment:       CA_DIR: ${CA_DIR}       CA_CERT: ${CA_CERT}       VIRTUAL_HOST: ${APP1-IMPLICIT}     networks:       - rpnet       - profnet 
app1-code:   build:     context: rp/app1     args:       FLOW: "code"           CONTROLLER_URL: ${CONTROLLER_HOST}       CLIENT_HOST: ${APP1-CODE}   depends_on:     - certs   volumes:     - certs:/certs:ro   env_file:     - .proxy_env   environment:     CA_DIR: ${CA_DIR}     CA_CERT: ${CA_CERT}     VIRTUAL_HOST: ${APP1-CODE}   networks:     - rpnet     - profnet 

Client Side

The user solely has to establish a proxy connection to SERVERIP:8080. For example, in Firefox, the addon FoxyProxy can switch easily between different proxy settings.

It is advisable to install the generated Root-CA (oidc-ca.crt) in the browsers' certification store. Otherwise, self-signed certification warnings will be displayed. After the web browser is connected to the proxy, it should be possible to reach the landing page https://lab.

Automatic Tests with PrOfESSOS

We have two options for automatic tests with PrOfESSOS. We can either use the Web UI at https://professos, or call the RESTful API methods directly. Both options require a configuration file with target information. PrOfESSOS requires this information to find all needed URLs and parameter fields to login with selenium scripts.

You can use the following JSON file for the MITREid Connect Client:

{   "UrlClientTarget": "https://mitreid-client/simple-web-app/login",   "InputFieldName": "identifier",   "SeleniumScript": "",   "FinalValidUrl": "https://mitreid-client/simple-web-app/",   "HonestUserNeedle": "{sub=honest-op-test-subject, iss=https://honest-idp.professos/CHANGE_ME}",   "EvilUserNeedle": "{sub=evil-op-test-subject, iss=https://attack-idp.professos/CHANGE_ME}",   "ProfileUrl": "https://mitreid-client/simple-web-app/user" } 

Only the CHANGE_ME parameter must be replaced manually with the displayed Test ID, as you can see in the following screenshot. The Test ID represents a unique OP address. This allows parallel testing as long as the implementation supports Dynamic Registration.

After clicking the "Learn" button, PrOfESSOS tries to log in with the honest and evil OP. Note that it takes a while until the process is finished.

If everything has worked as expected, PrOfESSOS displays a green checkmark. Otherwise, the UI provides minor logs and a few screenshots until the error has occurred. The MitMProxy Web UI can be a helpful additional tool to debug such issues.

On success, explicit tests or all tests can be executed. Each test step provides a small description and a test execution log.

The other option to start these tests is to use the RESTful API. Therefore, we provide a python cli tool in the oidc-docker-libs/oidc-lab-scripts folder. For all currently implemented RP and OP solutions, we have stored the json configurations. After starting the cli tool you solely need to select a target and run a complete test. An HTML report is also created which can be shared with collaborators.

#> ./cli.py [*] Professos CLI started Starting Control Center for Professos! cli> load rp mitreid-client  Start session default cli>> rp> mitreid-client> full_test Create new test plan: TestId = 6RZmcJHNd6o Learn: {     "HonestWebfingerResourceId": "https://honest-idp.professos/6RZmcJHNd6o",     "EvilWebfingerResourceId": "https://attack-idp.professos/6RZmcJHNd6o",     "UrlClientTarget": "https://mitreid-client/simple-web-app/login",     "InputFieldName": null,     "SeleniumScript": "",     "FinalValidUrl": "https://mitreid-client/simple-web-app",     "HonestUserNeedle": "{sub=honest-op-test-subject, iss=https://honest-idp.professos/6RZmcJHNd6o}",     "EvilUserNeedle": "{sub=evil-op-test-subject, iss=https://attack-idp.professos/6RZmcJHNd6o}",     "ProfileUrl": "https://mitreid-client/simple-web-app/user",     "Type": "de.rub.nds.oidc.test_model.TestRPConfigType" } ================================================================================ Run Test Step [0]: ID Spoofing 1 - ID Token (sub) - PASS ================================================================================ Run Test Step [1]: ID Spoofing 2 - ID Token (sub+iss) - PASS ================================================================================ 

Semi-Automated and Manual Tests

The MitMProxy can intercept and manipulate front and backend communication for minor manual tests. For example, the MITREid Connect client can perform user authentication with Keycloak as the OpenID provider. To simulate a redirect URI attack, you can intercept the Authentication Request or Token Request and manipulate the values.

Another reproducible way is to combine a specific PrOfESSOS attack, and a prepared script that is uploaded to the MitM scripting interface. Therefore, we added a server application to the MitM scripting interface, which can be controlled with the lab script cli tool.

We used such a workflow to check if a special redirect URI is vulnerable to an XSS attack. You can try it on your own. The command to prepare this attack is:

./cli.py [*] Professos CLI started Starting Control Center for Professos! cli> load op mitreid-server  Start session default cli>> op> mitreid-server> create Create new test plan: TestId = vWmdL4XHe2w cli>> op> mitreid-server> learn Learn: {     "HonestRpResourceId": "https://rp.professos/vWmdL4XHe2w",     "EvilRpResourceId": "https://evilrp.professos/vWmdL4XHe2w",     "UrlOPTarget": "https://mitreid-server/oidc-server",     "OPMetadata": "",     "AccessToken1": "",     "AccessToken2": "",     "User1Name": "user1",     "User2Name": "user2",     "User1Pass": "user1pass",     "User2Pass": "user2pass",     "LoginScript": "",     "ConsentScript": "",     "Client1Config": "",     "Client2Config": "",     "Type": "de.rub.nds.oidc.test_model.TestOPConfigType" } cli>> op> mitreid-server> run_pyscript pentest/mitreid-server-redirect.py Received: OK Received: OK cli>> op> mitreid-server> run 48 ================================================================================ Run Test Step [48]: Custom 1 - Redirect URI - PASS cli>> op> mitreid-server> export cli>> op> mitreid-server> report 

As a result, in the screenshot you can see that our javascript was escaped correctly.

Another new feature for RP tests is to expose a specific attack pattern with PrOfESSOS and go through the login process manually with a browser. This is archived with the cli and the expose command. If you want to test, execute these commands:

./cli.py [*] Professos CLI started Starting Control Center for Professos! cli> load rp mitreid-client  Start session default cli>> rp> mitreid-client> create Create new test plan: TestId = hDOAisJy9OE cli>> rp> mitreid-client> learn Learn: {     "HonestWebfingerResourceId": "https://honest-idp.professos/hDOAisJy9OE",     "EvilWebfingerResourceId": "https://attack-idp.professos/hDOAisJy9OE",     "UrlClientTarget": "https://mitreid-client/simple-web-app/login",     "InputFieldName": null,     "SeleniumScript": "",     "FinalValidUrl": "https://mitreid-client/simple-web-app",     "HonestUserNeedle": "{sub=honest-op-test-subject, iss=https://honest-idp.professos/hDOAisJy9OE}",     "EvilUserNeedle": "{sub=evil-op-test-subject, iss=https://attack-idp.professos/hDOAisJy9OE}",     "ProfileUrl": "https://mitreid-client/simple-web-app/user",     "Type": "de.rub.nds.oidc.test_model.TestRPConfigType" } cli>> rp> mitreid-client> expose --test 3 
  • Start login at https://mitreid-client/simple-web-app/login
  • For the OpenID Provider use the exposed attacker OP address https://attack-idp.professos/CHANGE_ME which can be copied from the learn step.
  • The browser should display a simple message: Authentication Failed: Id Token Issuer is null -> Our attack was unsuccessful
  • The honest OP address can be used to compare the result with a successful login attempt.

References

Acknowledgement

The master's thesis was supervised by Vladislav Mladenov, Christian Mainka, and Jörg Schwenk. Thank you for the support and opportunity to write this thesis.

Author of this Post

Christian Fries

More info


  1. Github Hacking Tools
  2. Hacking Tools Mac
  3. World No 1 Hacker Software
  4. Hacking Tools For Beginners
  5. Github Hacking Tools
  6. Pentest Tools Online
  7. Hacking Tools For Windows
  8. Nsa Hack Tools Download
  9. Best Hacking Tools 2020
  10. Underground Hacker Sites
  11. Pentest Tools Port Scanner
  12. Hacking Tools For Pc
  13. Pentest Tools Subdomain
  14. Pentest Recon Tools
  15. Blackhat Hacker Tools
  16. Pentest Tools Apk
  17. Pentest Tools Bluekeep
  18. Computer Hacker
  19. Hack Tools For Ubuntu
  20. Hacker Tools Hardware
  21. Pentest Tools Website
  22. Hacker Tool Kit
  23. Install Pentest Tools Ubuntu
  24. How To Make Hacking Tools
  25. Hack Apps
  26. Hacking Tools For Windows 7
  27. New Hack Tools
  28. Pentest Tools For Windows
  29. Nsa Hack Tools Download
  30. Pentest Tools Port Scanner
  31. Hacking Tools Download
  32. Nsa Hack Tools Download
  33. Hack Tools Pc
  34. Nsa Hack Tools
  35. Kik Hack Tools
  36. Pentest Recon Tools
  37. Android Hack Tools Github
  38. Physical Pentest Tools
  39. Tools For Hacker
  40. Pentest Tools Website
  41. Hacker Tools List
  42. Pentest Tools For Mac
  43. Hacking Tools For Kali Linux
  44. Hacking Tools 2020
  45. Hacker Search Tools
  46. Free Pentest Tools For Windows
  47. Kik Hack Tools
  48. Android Hack Tools Github
  49. Hacking Tools And Software
  50. Pentest Tools For Android
  51. Hacks And Tools
  52. Easy Hack Tools
  53. Physical Pentest Tools
  54. Hack And Tools
  55. Hacking Tools Free Download
  56. Free Pentest Tools For Windows
  57. Hack Rom Tools
  58. Hak5 Tools
  59. Hacker Tools 2020
  60. Android Hack Tools Github
  61. Hacking Tools Download
  62. Hack Rom Tools
  63. Pentest Tools Apk
  64. Pentest Tools Port Scanner
  65. Computer Hacker
  66. Hacking Tools And Software
  67. Hacker
  68. Pentest Tools List
  69. Pentest Tools List
  70. Pentest Tools Open Source
  71. How To Hack
  72. Hacking Tools For Windows 7
  73. Pentest Tools
  74. Hacking Tools Online
  75. Hacking Tools Usb
  76. Hacker Tools For Mac
  77. Pentest Tools List
  78. Pentest Tools For Mac
  79. Game Hacking
  80. Hacker
  81. Pentest Tools Subdomain
  82. Hack Tools
  83. Hacking Tools Kit
  84. Hacks And Tools
  85. Hacker Tools Windows
  86. Hack App
  87. Hacking Tools Usb
  88. Pentest Tools Download
  89. Hacking Tools Windows 10
  90. Best Pentesting Tools 2018
  91. Best Hacking Tools 2020
  92. Pentest Tools Windows
  93. Hacking Tools And Software
  94. Pentest Tools Port Scanner
  95. Hacking Tools 2020
  96. Hack And Tools
  97. Hacking Tools Free Download
  98. Pentest Tools Windows
  99. Tools 4 Hack
  100. How To Install Pentest Tools In Ubuntu
  101. Hacking Tools Windows
  102. Hacker Tools List
  103. Pentest Tools For Windows
  104. Easy Hack Tools
  105. Hacker Tools
  106. Hacking Tools Download
  107. Wifi Hacker Tools For Windows
  108. Hacker Tools Windows
  109. Hacking Tools For Windows Free Download
  110. Hack App
  111. Black Hat Hacker Tools
  112. Hacking Tools Online
  113. Hack App
  114. Hackers Toolbox
  115. Hacking Tools For Pc
  116. Hacker Tools Windows
  117. Hacking Tools Kit
  118. Pentest Tools Nmap
  119. Hacking Tools Windows 10
  120. Hack Tools 2019
  121. Hacker Tools Software
  122. New Hack Tools
  123. Pentest Tools Alternative
  124. Pentest Tools Android
  125. How To Hack
  126. Best Hacking Tools 2019
  127. Pentest Tools For Mac
  128. Hacker Tools For Ios
  129. Hacking Tools Windows 10
  130. Hacking Tools Github
  131. Hacking Tools Pc
  132. Hack Tools
  133. Pentest Tools For Ubuntu
  134. Hacking Apps
  135. Physical Pentest Tools
  136. New Hacker Tools
  137. Hacking Tools Mac
  138. Tools 4 Hack
  139. Hacking Tools 2020
  140. Pentest Reporting Tools
  141. Pentest Recon Tools
  142. Pentest Tools Online
  143. Hack Tool Apk
  144. Pentest Tools Free
  145. Pentest Tools For Ubuntu
  146. New Hack Tools
  147. Github Hacking Tools
  148. Nsa Hack Tools

No comments:

Post a Comment