1268989 - Inefficient check of "Bugzilla_api_token" might lead to CSRF/data disclosure vulnerability in Bugzilla's REST API

Status: RESOLVED FIXED

(Bugzilla :: WebService, defect)

Description

[Mario Gomes]

User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.19 Safari/537.36

Steps to reproduce:

Hey,

Bugzilla doesn't properly check the "Bugzilla_api_token" and as result of that allow attackers to obtain informations about a bug without proper authentification.

PoC: https://bugzilla.mozilla.org/rest/bug?&include_fields=id,summary,status&bug_status=UNCONFIRMED&bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&email1=netfuzzerr%40gmail.com&emailassigned_to1=1&emailreporter1=1&emailtype1=exact&field0-0-0=bug_status&field0-0-1=reporter&type0-0-0=notequals&type0-0-1=equals&value0-0-0=UNCONFIRMED&value0-0-1=netfuzzerr%40gmail.com

if you visit the above URL, you'll only see the public open reports that I have filed, now if you visit:

https://bugzilla.mozilla.org/rest/bug?&include_fields=id,summary,status&bug_status=UNCONFIRMED&bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&email1=netfuzzerr%40gmail.com&emailassigned_to1=1&emailreporter1=1&emailtype1=exact&field0-0-0=bug_status&field0-0-1=reporter&type0-0-0=notequals&type0-0-1=equals&value0-0-0=UNCONFIRMED&value0-0-1=netfuzzerr%40gmail.com&Bugzilla_api_token

In this second URL, you'll get the response including informations about the private bugs as well.

This occurs 'cause "Bugzilla_api_token" is present but it is empty

Let me know if you dont understand this bug and if it's necessary PoC demonstrating how this could be exploitable.

Comment 1

[Mario Gomes]

Keep in mind that I can "hijack" this informations through the "callback" parameter.

Comment 2

[Dylan Hardison [:dylan] (he/him)]

When I visit the second link, I get this:

{
   "code" : 307,
   "documentation" : "http://www.bugzilla.org/docs/tip/en/html/api/",
   "error" : true,
   "message" : "The cookies or token provide were not valid or have expired. You may login again to get new cookies or a new token."
}

Comment 3

[Mario Gomes]

when i visit it i get:

{
   "bugs" : [
      {
         "id" : 758907,
         "status" : "REOPENED",
         "summary" : "XSS via URL field when using \"open in new tab\""
      },
      {
         "id" : 1120074,
         "status" : "UNCONFIRMED",
         "summary" : "Bugzilla doesn't prevent local links to be used to log in"
      },


      {
         "id" : 1268989,
         "status" : "UNCONFIRMED",
         "summary" : "unefficient check of \"Bugzilla_api_token\" might lead to CSRF/data disclosure vulnerability in Bugzilla's REST API"
      }
   ]
}

Comment 4

[Dylan Hardison [:dylan] (he/him)]

If "Require API key authentication for API requests" is off, this can be exploited.

The good news is that anyone with 2fa enabled gets "Require API key authentication for API requests" turned on.

1) callback= should be forbidden (it's there because jsonrpc had it, it is not an intentional feature
2) all users should be forced to have "Require API key authentication for API requests" turned on

Comment 5

[Dylan Hardison [:dylan] (he/him)]

Using https://bugzilla.mozilla.org/page.cgi?id=group_members.html, all users without Duo or TOTP,
or with (Weakened) after the 2nd factor auth are vulnerable to this bug.

Comment 6

[Dylan Hardison [:dylan] (he/him)]

the callback= parameter does not show up in the user_request_log, however it does show up in the syslogs. I took a preliminary look and I see a few suspicious entries, but they look like someone playing around with this rather than trying to ex-filtrate information.

Do we want to force on "Require API key authentication for API requests" for all users as a precaution?

Comment 7

[Mark Côté [:mcote]]

That's probably going to break some apps, but if this is serious I'm okay with that.  We wanted to do this at some point anyway; maybe now is the time.  There has been plenty of time for people to switch their apps over to using API keys.

Comment 8

[Frédéric Buclin]

Are you talking about bmo or Bugzilla in general?

Comment 9

[Mario Gomes]

Attachment: Proof of Concept(Poc) - Works only in Firefox

I have created a simple PoC that demonstrate this vulnerability.

Comment 10

[Dylan Hardison [:dylan] (he/him)]

(In reply to Mario Gomes from comment #9)
> Created attachment 8747491 [details]
> Proof of Concept(Poc) - Works only in Firefox
> 
> I have created a simple PoC that demonstrate this vulnerability.

Thanks, but I already confirmed the vulnerability in comment 4.

Comment 11

[Dylan Hardison [:dylan] (he/him)]

Likely impacts both 5.0.x and master. Workarounds: disable api token auth for JSONP?

Comment 12

[Dylan Hardison [:dylan] (he/him)]

Currently suspect this was introduced by bug 1139257

Comment 13

[Dylan Hardison [:dylan] (he/him)]

Hmm, nope. I think maybe bug 1192687.

Comment 14

[Dylan Hardison [:dylan] (he/him)]

Actually, it was probably bug 1139257. I have a working patch for bmo, working on testing upstream 5.0 now.

Comment 15

[Frédéric Buclin]

(In reply to Dylan William Hardison [:dylan] from comment #14)
> Actually, it was probably bug 1139257. I have a working patch for bmo,
> working on testing upstream 5.0 now.

If it's 1139257, then 5.0 is not affected.

Also, if you can reproduce this bug, then mark the bug as such (either NEW or ASSIGNED).

Comment 16

[Dylan Hardison [:dylan] (he/him)]

Yes, it was the patch in bug 1139257. All that is left is to check master.

Comment 17

[Dylan Hardison [:dylan] (he/him)]

This is also a problem for the master branch. This bug cannot be public yet because it impacts bmo.

Comment 18

[Dylan Hardison [:dylan] (he/him)]

Attachment: 1268989_2.patch

This is the same patch as for bmo -- both seem to work.

Comment 19

[David Lawrence [:dkl]]

Comment on attachment 8747569 [details] [diff] [review]
1268989_2.patch

Review of attachment 8747569 [details] [diff] [review]:
-----------------------------------------------------------------

r=dkl

Comment 20

[Mario Gomes]

What would be the appropriate security-rate for this bug?

Comment 21

[David Lawrence [:dkl]]

To ssh://[e-mail]/bugzilla/bugzilla.git
   c3b2af3..64df9b7  master -> master