4 ms·

Kudos to JetBrains for awarding the very generous $50,000 bounty (and to the author for donating the bulk of it). The YouCompleteMe project had a similar vulne

by agency 10y ago

Kudos to JetBrains for awarding the very generous $50,000 bounty (and to the author for donating the bulk of it). The YouCompleteMe project had a similar vulnerability[1]. I suppose a lesson here is that if your development environment/tools expose services over HTTP on localhost you should be really careful with CORS headers. [1]: https://github.com/Valloric/ycmd#is-hmac-auth-for-requestsresponses-really-necessary https://github.com/Valloric/ycmd#is-hmac-auth-for-requestsre...

revelation 10y ago
No, that can not be at all the conclusion to make from this. Security can not come from sending magic strings back and hoping whoever is facilitating the attack respects them.
- mintplant 10y ago
  Agreed, local IPC endpoints should be equipped with some form of authentication at minimum. For a live preview server where the endpoint has to be viewable in a browser, this may be a rare case where HTTP Basic Auth is a good solution, launching a URL like http://<random_nonce>:<random_nonce>@localhost:1337/index.html http://<random_nonce>:<random_nonce>@localhost:1337/index.ht... (with rate limiting on the server side, of course)
- agency 10y ago
  I'm not sure if I follow this criticism. Having the server validate an HMAC of the request does not require the attacker to respect any magic strings. The attacker cannot craft a correctly authenticated request (since they do not know the shared secret used to construct the HMAC) and thus cannot issue requests that the server will honor.
  - revelation 10y ago
    I understood your comment to say they should do CORS properly, which amounts to just magic strings sent back to a potential attacker. HMAC is separate from CORS, or did I miss something?
    - agency 10y ago
      I think I'm confused myself. I was interpreting the main issue in the JetBrains case to be their use of very permissive CORS headers on the locally running server, but their solution added an auth token in addition to removing the CORS policies. ycmd also doesn't appear to set any CORS headers, in addition to validating the HMAC of the request. Is a sane cross-origin policy not enough on its own to prevent evil.com from being able to communicate with a web server running on localhost? Or is the message authentication to protect from attack vectors other than the user navigating to a malicious site?
      - revelation 10y ago
        CORS seems like a nice-to-have. You're relying on other software to always indicate something is a cross origin request, browsers should always do that but then there is a whole host of software that uses embedded web controls and the like and may navigate to webpages on the basis of external and not user input.

by agency 10y ago

revelation 10y ago

No, that can not be at all the conclusion to make from this. Security can not come from sending magic strings back and hoping whoever is facilitating the attack respects them.

mintplant 10y ago
Agreed, local IPC endpoints should be equipped with some form of authentication at minimum. For a live preview server where the endpoint has to be viewable in a browser, this may be a rare case where HTTP Basic Auth is a good solution, launching a URL like http://<random_nonce>:<random_nonce>@localhost:1337/index.html http://<random_nonce>:<random_nonce>@localhost:1337/index.ht... (with rate limiting on the server side, of course)
agency 10y ago
I'm not sure if I follow this criticism. Having the server validate an HMAC of the request does not require the attacker to respect any magic strings. The attacker cannot craft a correctly authenticated request (since they do not know the shared secret used to construct the HMAC) and thus cannot issue requests that the server will honor.
- revelation 10y ago
  I understood your comment to say they should do CORS properly, which amounts to just magic strings sent back to a potential attacker. HMAC is separate from CORS, or did I miss something?
  - agency 10y ago
    I think I'm confused myself. I was interpreting the main issue in the JetBrains case to be their use of very permissive CORS headers on the locally running server, but their solution added an auth token in addition to removing the CORS policies. ycmd also doesn't appear to set any CORS headers, in addition to validating the HMAC of the request. Is a sane cross-origin policy not enough on its own to prevent evil.com from being able to communicate with a web server running on localhost? Or is the message authentication to protect from attack vectors other than the user navigating to a malicious site?
    - revelation 10y ago
      CORS seems like a nice-to-have. You're relying on other software to always indicate something is a cross origin request, browsers should always do that but then there is a whole host of software that uses embedded web controls and the like and may navigate to webpages on the basis of external and not user input.