5 ms·

tl;dr: they requested a URL and wanted it to echo a token passed in the query string. They accepted 404 pages that echoed the token as valid, too! "In case any

tl;dr: they requested a URL and wanted it to echo a token passed in the query string. They accepted 404 pages that echoed the token as valid, too! "In case anyone is wondering why this is problematic, during the Ballot 169 review process, Peter Bowen ran a check against the top 10,000 Alexa domains and noted that more than 400 sites returned a HTTP 200 response for a request to http://www.$DOMAIN/.well-known/pki-validation/4c079484040e32529577b6a5aade31c5af6fe0c7 http://www.$DOMAIN/.well-known/pki-validation/4c079484040e32... [1]. A number of those included the URL in the response body, which would presumably be good enough for GoDaddy's domain validation process if they indeed only check for a HTTP 200 response. [1]: https://cabforum.org/pipermail/public/2016-April/007506.html https://cabforum.org/pipermail/public/2016-April/007506.html "

akjainaj 10y ago
They needed the page to return just the token or something with the token in it? Because then I could validate this: http://google.com/this_is_my_token http://google.com/this_is_my_token
- duskwuff 10y ago
  Just something with the token in it. So, yes. You probably wouldn't have been able to validate google.com, as GoDaddy would have (hopefully) flagged any domains containing major trademarks like "google" for manual review, but that's hardly a strong protection.
  - akjainaj 10y ago
    Everybody who's used the Internet for more than two days knows that many 404 pages have the URL inside the html (Apache default 404 comes to my mind), so I suppose this was made by someone who simply didn't give a fuck. Which is kinda big deal if you're generating SSL certs...
    - geofft 10y ago
      1. It sounds like this was originally implemented correctly, and a code change caused the check for status 200 to stop working. (See the first message, sentence starting "A configuration change to the library") 2. There are a number of "404" pages that are sent with HTTP status 200 and also echo the URL inside the HTML. See https://cabforum.org/pipermail/public/2016-April/007506.html https://cabforum.org/pipermail/public/2016-April/007506.html , which Patrick Figel linked to in the thread.
- deleted 10y ago
  [deleted]
djsumdog 10y ago
So, in in this particular exploit, LetsEncrypt offers more verification, correct? How does the ACME spec mitigate this?
- ceejayoz 10y ago
  From my reading of the spec, LE requires a valid JSON response (and only that valid JSON). Looks pretty hard to accidentally spit out.
- bisby 10y ago
  Based on what I know of a high level overview of ACME: The client says "Hey, i have a cert here, and I want to verify i control domain.com" The server says "Ok, take this [set of challenge data], encrypt it with your cert, and put it at .well-known/acme-challenge." The client takes the challenge data. encrypts it. puts it at the challenge point and informs the server. The server verifies that the encrypted data matches what they were expecting to get. They then sign the cert because only a person with the webserver/domain and the cert could pull off this magic. The important part here, is that since the client already has the cert in hand when the verification is taking place - it can be used as part of the verification. Use the cert to do cert stuff. Only that cert can do those things. If I can't even get a cert until AFTER I've proven I control a location, then this obviously doesnt work and another "proof" has to be made - hence godaddy's issue.
  - deleted 10y ago
    [deleted]
  - EGreg 10y ago
    Google Apps just asked you to upload random text files to certain locations or add DNS TEXT records to verify you own the domain. So does Amazon with SES. You just make an account with them and they give you the stuff. Why isn't that good enough? No need to use a cert to verify it.
    - closeparen 10y ago
      Well, this is "upload random text files to certain locations." Let's Encrypt is meant to be renewed by cronjob, and most web servers probably don't have programatic control over their DNS records.
cortesoft 10y ago
An http 200 response is not a 404 page. Why are websites returning 200s on their 404 pages?
- reustle 10y ago
  Sure, but they're referencing 'page not found' pages as 404 pages, like most people do. I wouldn't be surprised if a majority of sites returned the wrong status codes for some pages.
- peteretep 10y ago
  > Why are websites returning > 200s on their 404 pages The behaviour for the user is identical in most cases, and "user" here includes "inexperienced or non-diligent person who set it up"

akjainaj 10y ago

They needed the page to return just the token or something with the token in it? Because then I could validate this: http://google.com/this_is_my_token http://google.com/this_is_my_token

duskwuff 10y ago
Just something with the token in it. So, yes. You probably wouldn't have been able to validate google.com, as GoDaddy would have (hopefully) flagged any domains containing major trademarks like "google" for manual review, but that's hardly a strong protection.
- akjainaj 10y ago
  Everybody who's used the Internet for more than two days knows that many 404 pages have the URL inside the html (Apache default 404 comes to my mind), so I suppose this was made by someone who simply didn't give a fuck. Which is kinda big deal if you're generating SSL certs...
  - geofft 10y ago
    1. It sounds like this was originally implemented correctly, and a code change caused the check for status 200 to stop working. (See the first message, sentence starting "A configuration change to the library") 2. There are a number of "404" pages that are sent with HTTP status 200 and also echo the URL inside the HTML. See https://cabforum.org/pipermail/public/2016-April/007506.html https://cabforum.org/pipermail/public/2016-April/007506.html , which Patrick Figel linked to in the thread.
deleted 10y ago
[deleted]

djsumdog 10y ago

So, in in this particular exploit, LetsEncrypt offers more verification, correct? How does the ACME spec mitigate this?

ceejayoz 10y ago
From my reading of the spec, LE requires a valid JSON response (and only that valid JSON). Looks pretty hard to accidentally spit out.
bisby 10y ago
Based on what I know of a high level overview of ACME: The client says "Hey, i have a cert here, and I want to verify i control domain.com" The server says "Ok, take this [set of challenge data], encrypt it with your cert, and put it at .well-known/acme-challenge." The client takes the challenge data. encrypts it. puts it at the challenge point and informs the server. The server verifies that the encrypted data matches what they were expecting to get. They then sign the cert because only a person with the webserver/domain and the cert could pull off this magic. The important part here, is that since the client already has the cert in hand when the verification is taking place - it can be used as part of the verification. Use the cert to do cert stuff. Only that cert can do those things. If I can't even get a cert until AFTER I've proven I control a location, then this obviously doesnt work and another "proof" has to be made - hence godaddy's issue.
- deleted 10y ago
  [deleted]
- EGreg 10y ago
  Google Apps just asked you to upload random text files to certain locations or add DNS TEXT records to verify you own the domain. So does Amazon with SES. You just make an account with them and they give you the stuff. Why isn't that good enough? No need to use a cert to verify it.
  - closeparen 10y ago
    Well, this is "upload random text files to certain locations." Let's Encrypt is meant to be renewed by cronjob, and most web servers probably don't have programatic control over their DNS records.

cortesoft 10y ago

An http 200 response is not a 404 page. Why are websites returning 200s on their 404 pages?

reustle 10y ago
Sure, but they're referencing 'page not found' pages as 404 pages, like most people do. I wouldn't be surprised if a majority of sites returned the wrong status codes for some pages.
peteretep 10y ago
> Why are websites returning > 200s on their 404 pages The behaviour for the user is identical in most cases, and "user" here includes "inexperienced or non-diligent person who set it up"