This is a post about an old vulnerability that I finally found the time to blog about. It dates back to 2014, but from a technical point of view it is nevertheless interesting: An XML parser that tries to fix structural errors in a document caused a DoS problem.
All previous posts of this series focused on XSS. This time, we present a vulnerability which is connected another Cloud Management Platform: OpenNebula. This Infrastructure-as-a-Service platform started as a research project in 2005. It is used by information technology companies like IBM, Dell and Akamai as well as academic institutions and the European Space Administrations (ESA). By relying on standard Linux tools as far as possible, OpenNebula reaches a high level of customizability and flexibility in hypervisors, storage systems, and network infrastructures. OpenNebula is distributed using the Apache-2 license.
OpenNebula offers a broad variety of interfaces to control a cloud. This post focuses on Sunstone, OpenNebula's web interface (see Figure 1).
Before OpenNebula 4.6.2, Sunstone had no Cross-Site Request Forgery (CSRF) protection. This is a severe problem. Consider an attacker who lures a victim into clicking on a malicious link while being logged in at a private cloud. This enables the attacker to send arbitrary requests to the private cloud through the victims browser. However, we could find other bugs in OpenNebula that allowed us to perform much more sophisticated attacks.
OpenNebula saves the incorrectly generated XML document in a database. The next time the OpenNebula core retrieves information about that particular VM from the database the XML parser is mixed up and runs into an error because it only expects a string as name, not an XML tree. As a result, Sunstone cannot be used to control the VM anymore. The Denial-of-Service attack can only be reverted from the command line interface of OpenNebula.
This bug can be triggered by a CSRF-attack, which means that it is a valid attack against a private cloud: By luring a victim onto a maliciously crafted website while logged in into Sunstone, an attacker can make all the victim's VMs uncontrollable via Sunstone. A video of the attack can be seen here:
This bug has been fixed in OpenNebula 4.6.2.
This result is a collaborative work together with Mario Heiderich. It has been published at ACM CCSW 2015. The paper can be found here.
All previous posts of this series focused on XSS. This time, we present a vulnerability which is connected another Cloud Management Platform: OpenNebula. This Infrastructure-as-a-Service platform started as a research project in 2005. It is used by information technology companies like IBM, Dell and Akamai as well as academic institutions and the European Space Administrations (ESA). By relying on standard Linux tools as far as possible, OpenNebula reaches a high level of customizability and flexibility in hypervisors, storage systems, and network infrastructures. OpenNebula is distributed using the Apache-2 license.
OpenNebula offers a broad variety of interfaces to control a cloud. This post focuses on Sunstone, OpenNebula's web interface (see Figure 1).
Figure 1: OpenNebula's Sunstone Interface displaying a VM's control interface |
Before OpenNebula 4.6.2, Sunstone had no Cross-Site Request Forgery (CSRF) protection. This is a severe problem. Consider an attacker who lures a victim into clicking on a malicious link while being logged in at a private cloud. This enables the attacker to send arbitrary requests to the private cloud through the victims browser. However, we could find other bugs in OpenNebula that allowed us to perform much more sophisticated attacks.
Denial-of-Service on OpenNebula-VM
At its backend, OpenNebula manages VMs with XML documents. A sample for such an XML document looks like this:<VM>OpenNebula 4.6.1 contains a bug in the sanitization of input for these XML documents: Whenever a VM's name contains an opening XML tag (but no corresponding closing one), an XML generator at the backend automatically inserts the corresponding closing tag to ensure well-formedness of the resulting document. However, the generator outputs an XML document that does not comply with the XML schema OpenNebula expects. The listing below shows the structure that is created after renaming the VM to 'My <x> VM':
<ID>0</ID>
<NAME>My VM</NAME>
<PERMISSIONS>...</PERMISSIONS>
<MEMORY>512</MEMORY>
<CPU>1</CPU>
...
</VM>
<VM>The generator closes the <x> tag, but not the <NAME> tag. At the end of the document, the generator closes all opened tags including <NAME>.
<ID>0</ID>
<NAME>My <x> VM</x>
<PERMISSIONS>...</PERMISSIONS>
<MEMORY>512</MEMORY>
<CPU>1</CPU>
...
</NAME>
</VM>
OpenNebula saves the incorrectly generated XML document in a database. The next time the OpenNebula core retrieves information about that particular VM from the database the XML parser is mixed up and runs into an error because it only expects a string as name, not an XML tree. As a result, Sunstone cannot be used to control the VM anymore. The Denial-of-Service attack can only be reverted from the command line interface of OpenNebula.
This bug can be triggered by a CSRF-attack, which means that it is a valid attack against a private cloud: By luring a victim onto a maliciously crafted website while logged in into Sunstone, an attacker can make all the victim's VMs uncontrollable via Sunstone. A video of the attack can be seen here:
This bug has been fixed in OpenNebula 4.6.2.
This result is a collaborative work together with Mario Heiderich. It has been published at ACM CCSW 2015. The paper can be found here.
Read more
- Pentest Tools Alternative
- Pentest Tools Kali Linux
- Hacker Tools Online
- Pentest Tools Open Source
- Hack Tools For Windows
- Hackrf Tools
- Hacker Security Tools
- Pentest Tools Port Scanner
- Hacker Tools Online
- Hack Tools 2019
- Hack Tools For Mac
- Hacking Tools Usb
- Hacking Tools Software
- Github Hacking Tools
- Hack Tools
- New Hacker Tools
- Pentest Tools Online
- Hacking Tools For Games
- Pentest Reporting Tools
- Pentest Tools Website
- Hacker
- Hacking Tools Kit
- Tools For Hacker
- Hack Tools 2019
- Hacker Tools Github
- Hack Tools For Ubuntu
- Pentest Tools Online
- Pentest Tools For Ubuntu
- Hacking Tools Github
- Hacker Tools For Mac
- Game Hacking
- Hacking Tools Online
- Pentest Tools For Mac
- Hacker Hardware Tools
- Hack Tools Github
- Ethical Hacker Tools
- Pentest Tools Tcp Port Scanner
- Wifi Hacker Tools For Windows
- Hacker Techniques Tools And Incident Handling
- Pentest Tools Download
- Install Pentest Tools Ubuntu
- Android Hack Tools Github
- Hacker Search Tools
- Hacking Tools For Beginners
- Physical Pentest Tools
- Best Hacking Tools 2020
- Top Pentest Tools
- Pentest Automation Tools
- Hacker Tools For Windows
- Pentest Tools Bluekeep
- Hack Rom Tools
- Hacking Tools Hardware
- How To Install Pentest Tools In Ubuntu
- Pentest Tools Open Source
- Pentest Tools Port Scanner
- Computer Hacker
- Hacking Tools Github
- Hacking Tools Download
- Pentest Tools Github
- Hackers Toolbox
- Android Hack Tools Github
- Hacker Techniques Tools And Incident Handling
- Hacking Apps
- Hacker Search Tools
- Hacking Tools Windows 10
- Pentest Tools Download
- Pentest Tools Apk
- Pentest Tools List
- Hacking Tools Software
- Blackhat Hacker Tools
- Pentest Tools Online
- Free Pentest Tools For Windows
- Pentest Tools Review
- Black Hat Hacker Tools
- Hacking Tools Windows 10
- Hackrf Tools
- Pentest Tools List
- Game Hacking
- Pentest Tools Framework
- Hack Tools For Pc
- Hacking Tools And Software
- Hacker Tools 2019
- Hack Tools For Pc
- Nsa Hacker Tools
- Hack Tool Apk No Root
- Hacker Tools For Pc
- Hacker Techniques Tools And Incident Handling
- Pentest Tools Website
- Top Pentest Tools
- Hacker Tools For Pc
- Best Pentesting Tools 2018
- Pentest Automation Tools
- Hacking Tools 2020
- Pentest Tools Framework
- Best Pentesting Tools 2018
- Pentest Recon Tools
- Pentest Tools Subdomain
- Hacker Search Tools
- Hack Tools For Games
- Free Pentest Tools For Windows
- Best Hacking Tools 2019
- Ethical Hacker Tools
- Bluetooth Hacking Tools Kali
- Hacking Tools For Windows Free Download
- Hacking Tools Github
- Hacking Tools Pc
- Hacking Tools For Mac
- Hack Tools Pc
- Wifi Hacker Tools For Windows
- Pentest Tools For Windows
- Hack Tools
- Hacking Tools 2020
- Hack Tools Pc
- Pentest Tools Review
- Hacker Search Tools
- Hacker Tools Apk
- Hacking Tools And Software
- Hack Tools Mac
- Hack Tools For Ubuntu
- Hacker Techniques Tools And Incident Handling
- Black Hat Hacker Tools
- Pentest Tools Online
- Hacker Tools Hardware
- Hacking Tools Free Download
- Hacker Tools Github
- Pentest Tools Open Source
- Hacker Tools Free
- Pentest Tools Windows
- Android Hack Tools Github
- Hacking Tools 2020
- Pentest Tools Nmap
- Hack Tools Pc
- Hacking Tools Online
- Hacking Apps
- Game Hacking
- Hacker Security Tools
- Pentest Tools Kali Linux
- Hacker Techniques Tools And Incident Handling
- Hack Tools Download
- Hacker Tools Mac
- What Are Hacking Tools
- Hacker Tools
- Hacker Tools Software
- Pentest Recon Tools
- Hack Tools
- Termux Hacking Tools 2019
- Pentest Tools For Windows
- Hacker
- Hacking Tools For Mac
- Hacker Tools Apk
- Hack Tools For Pc
- Top Pentest Tools
- Hack Tools Online
- Hacking Tools Download
- Pentest Tools For Ubuntu
- Pentest Tools Port Scanner
- Tools For Hacker
- Ethical Hacker Tools
- Tools Used For Hacking
- Pentest Tools Framework
- Hacking Tools For Pc
No comments:
Post a Comment