1253795 - Authentication bypass vulnerability in mod_authnz_persona

Status: RESOLVED FIXED

(Cloud Services :: Server: Identity, defect)

Description

[Ryan Kelly [:rfkelly]]

Attachment: proof-of-concept script to get unauthorized access to kibana

I was able to gain unauthorized access to the production Cloud Services kibana dashboards at [1] by passing a carefully crafted BrowserID assertion to mod_authnz_persona.  A proof-of-concept exploit script it attached.

The technique builds on the permissive data-validation rules of the persona verifier identified in Bug 1253495, using them to pass strings with embedded NULL bytes into the C code for mod_authnz_persona.  If I send a BrowserID assertion for an email like the following:

  "[e-mail]\x00\[e-mail]"

Then the hosted persona verifier will verify it and return the full email as above.  But mod_authnz_persona will truncate this value at the NULL byte and record the email address as "[e-mail]", a user which is allowed access to the site.

AFAICT, any site protected by the "Require valid-user" or "Require user" directives of mod_authnz_persona would be similarly vulnerable.  I was not able to extend the technique to bypass the "Require persona-idp" directive, which checks against the returned issuer rather than the email address (and which I believe we use in several places to restrict access to @mozilla.com users).

The most immediate fix will be to ship some variant of the tightened data validation proposed in Bug 1253495, so that the verifier will reject such assertions before any relier code ever sees them.  I'm not sure if we should take any further steps in the mod_authnz_persona source code itself.

Either way, I feel like this one deserves a proper security disclosure and public statement etc once the fix is rolled out.

[1] https://kibana.fxa.us-west-2.prod.mozaws.net

Comment 1

[Ryan Kelly [:rfkelly]]

Attachment: proof-of-concept script to get unauthorized access to kibana

(updating test script because the previous version was using a locally-running verifier instance rather than the one on login.persona.org)

Comment 2

[Julien Vehent]

CC-ing security council for information.

Ryan has a patch being deployed in staging right now. Production will follow, hopefully tonight.

Comment 3

[Julien Vehent]

The patch has been deployed to production, but is not yet public, due to concerns that other vulnerabilities of the same type may be present in Persona or FxA. Work continues in bug 1253495.