More Related Content
Similar to Web Cache Deception Attack(20)
![[OPD 2019] Side-Channels on the Web:
Attacks and Defenses](https://cdn.slidesharecdn.com/ss_thumbnails/owasp-poland-day-tom-van-goethem-191021171917-thumbnail.jpg?width=560&fit=bounds)
![[2.1] Web application Security Trends - Omar Ganiev](https://cdn.slidesharecdn.com/ss_thumbnails/2-150301070554-conversion-gate02-thumbnail.jpg?width=560&fit=bounds)
Web Cache Deception Attack
- 1.
- 2.
- 3. About me • OmerGil • 28 • Married + Java • PT team leader at EY • Student @omer_gil omergil.blogspot.com
- 4.
- 5.
- 6.
- 7.
- 8.
- 9.
- 10.
- 11.
- 12.
- 13.
- 14.
- 15.
- 16.
- 17.
- 18. /nonexistent.css Servers’ reactions http://www.example.com/account.php account.php The Spanner:http://www.thespanner.co.uk/2014/03/21/rpo/ XSS Jigsaw: http://blog.innerht.ml/page/2/
- 19.
- 20. Getting down tobusiness “Hey, access https://www.bank.com/account.do/stylesheet.css” WAF!
- 21. Getting down tobusiness The user browses to https://www.bank.com/account.do/stylesheet.css
- 22. Getting down tobusiness https://www.bank.com/account.do/stylesheet.css returns with the content of account.do and the private page is cached
- 23. Getting down tobusiness The attacker browses to https://www.bank.com/account.do/stylesheet.css and gets the content of the user’s account.do page
- 24. Getting down tobusiness The attacker browses to https://www.bank.com/account.do/stylesheet.css and gets the content of the user’s account.do page
- 25.
- 27. Conditions • Web cachefunctionality is set for the web application to cache static files based on their extensions, disregarding any caching header. • When accessing a page like http://www.example.com/home.php/nonexistent.css, the web server will return the content of home.php for that URL. • Victim has to be authenticated while accessing the triggering URL.
- 28. Why the HELL#1 would a web application react like this?
- 29. Why the HELL#1 Django: http://www.sampleapp.com/inbox/
- 30. Why the HELL#1 Django: http://www.sampleapp.com/inbox/test.css urls.py
- 31. Why the HELL#1 Django: urls.py http://www.sampleapp.com/inbox.css
- 32. Why the HELL#1 Django: http://www.sampleapp.com/inbox/test.css urls.py
- 33. Why the HELL#2 would a caching mechanism react like this?
- 34. Why the HELL#2 IIS ARR:
- 35. Why the HELL#2 IIS ARR: http://www.sampleapp.com/welcome.php/test.css
- 36. Why the HELL#2 IIS ARR: http://www.sampleapp.com/welcome.php/test.css
- 37. Why the HELL#2 Cloudflare: • Eligibility phase class, css, jar, js, jpg, jpeg, gif, ico, png, bmp, pict, csv, doc, docx, xls, xlsx, ps, pdf, pls, ppt, pptx, tif, tiff, ttf, otf, webp, woff, woff2, svg, svgz, eot, eps, ejs, swf, torrent, midi, mid https://blog.cloudflare.com/understanding-our-cache-and-the-web-cache-deception-attack/ https://blogs.akamai.com/2017/03/on-web-cache-deception-attacks.html
- 38. Why the HELL#2 Cloudflare: • Disqualification phase ‘Edge cache expire TTL’ to the rescue!
- 39. Why the HELL#2 Cloudflare: https://blog.cloudflare.com/edge-cache-expire-ttl-easiest-way-to-override/
- 40. Mitigation • Only cachefiles if their HTTP caching headers allow • Store all static files in a designated directory • Cache files by their content type • Don’t accept this! http://www.example.com/home.php/non-existent.css. Return 302 or 404 instead
- 41. THANKS @omer_gil Icon vectors createdby Freepik.com omergil.blogspot.com