3 ms·
His setup is vulnerable to hash length extension attacks: secure_link_md5 "my awesome secret $uri"; This means anyone can extend the URI (eg. adding "/../..
by mrb 11y ago
His setup is vulnerable to hash length extension attacks:
secure_link_md5 "my awesome secret $uri";
This means anyone can extend the URI (eg. adding "/../../../some/other/file" at the end of the filename) and compute a valid key, and force the server to access an arbitrary image file on the backend. If the backend is a private server not publicly accessible, then this may be a security issue.
This is why in the ngx_http_secure_link_module's documentation the secret is appended (instead of prepended), see http://nginx.org/en/docs/http/ngx_http_secure_link_module.html http://nginx.org/en/docs/http/ngx_http_secure_link_module.ht...:
secure_link_md5 "$secure_link_expires$uri$remote_addr secret";
The Nginx doc is also at fault because it fails to explain why it is important to append the secret and not prepend it. I just emailed security-alert@nginx.org to let them know.
- nly 11y agoLength extension attacks work for both append and prepend. I don't know if you're right, or whether or not either of them are vulnerable, but the correct solution to this problem is to use the HMAC[0] construction. [0] https://en.wikipedia.org/wiki/Hash-based_message_authentication_code https://en.wikipedia.org/wiki/Hash-based_message_authenticat...
- mrb 11y agoYes some other attacks can be performed if the secret is appended (we don't call them "length extensions attacks"), however they do not apply in this guy's case because the attacker does not control the URI that is hashed. But yes, when in doubt, and to future-proof your code, it is good practice to use an HMAC anyway. Or use SHA-3 which is not vulnerable to any attack when prepending/appending a secret.
- coleifer 11y agoThanks, I've updated my post to append the secret key.