4 ms·
mods, if this is bad just delete it but it is public info now so i think quite an interesting vulnerability. Just had a very quick look over the relevant code
by morrbo 9y ago
mods, if this is bad just delete it but it is public info now so i think quite an interesting vulnerability.
Just had a very quick look over the relevant code bits... it does look like it would just be an attacker-specified domain.. i.e. the following code is used for the default (new mvc app) uses:
var callbackUrl = Url.ResetPasswordCallbackLink(user.Id, code, Request.Scheme);
await _emailSender.SendEmailAsync(model.Email, "Reset Password",
$"Please reset your password by clicking here: <a href='{callbackUrl}'>link</a>");
which alllll the way down buried within the mvc or kestrel codebase (i forget which) is plucked directly from the host header. As kestrel listens globally, then i'd guess that the attacker would just sub out the regular domain with mynastydomain.com, and it would send someone an email with mynastydomain.com/reset?link=xxx. To fix this as they've recommended you'd wanna validate the domain via middleware (or just regex the password reset link before sending it out) or just not use the inbuilt authentication functionality/helpers whatsoever to reset passwords (and/or hardcode your domain).
looking at the actual code fix itself, is quite interesting. Apparently the following special characters are allowed in valid domains:
// Matches Http.Sys
// Matches RFC 3986 except "*" / "+" / "," / ";" / "=" and "%" HEXDIG HEXDIG which are not allowed by Http.Sys
HostCharValidity['!'] = true;
HostCharValidity['$'] = true;
HostCharValidity['&'] = true;
HostCharValidity['\''] = true;
HostCharValidity['('] = true;
HostCharValidity[')'] = true;
HostCharValidity['-'] = true;
HostCharValidity['.'] = true;
HostCharValidity['_'] = true;
HostCharValidity['~'] = true;
looking at the link generated, it is possible to close off the <a href='{callbackUrl}' by adding in a single quote on a specified domain (even after the fix)... before the fix i'd imagine you could cause potential XSS or something as "=" would have been valid, meaning that you can add an event handler. All of these would get stripped off anyway from all major email clients so ¯\_(ツ)_/¯
* edit * reason i wrote this and went into so much detail is that looking at the (imo pretty poor) advisory, i'd be vulnerable to this. Whereas in reality i am not. Others using their own authentication schemes or hard-coding values everywhere (as opposed to using the helper functions to generate URLs) would also be ok, i think.