4 ms·

An interesting attack for any website that allows customers to choose their own string for use in the url would be to choose the name ".well-known" - I'm sure I

An interesting attack for any website that allows customers to choose their own string for use in the url would be to choose the name ".well-known" - I'm sure I've seen sites that take user input and create a folder based on that name. Similar to reddit.com/r/.well-known except as a top-level folder but I can't find a good example right now. Once that happens, they could put up a malicious security.txt file and get free security reports sent to an email of their choice.

Dylan16807 7y ago
Minimizing that risk is the entire point of .well-known. Instead of securing a hundred different magic URLs, everything goes into a single spot.
DyslexicAtheist 7y ago
you can use CNAME records to mitigate this though https://github.com/securitytxt/security-txt/issues/91 https://github.com/securitytxt/security-txt/issues/91
tialaramex 7y ago
But as you hint, r/.well-known does NOT in fact exist and you can't make it The /.well-known/ paths were reserved by RFC specifically because this doesn't really happen. You could _make_ a site with the defect you imagine on purpose and perhaps somewhere in the vast galaxy of sites there's already one that can be abused to do this, but they're vanishingly rare. To the point where I don't know of one even though I went looking. One reason this prefix would be expected to be especially rare is that dot directories are both illegal in Windows (though the NT kernel has no problem with them) and special in Unix systems (they're legal but they're treated differently because it was convenient) and so any developer or administrator working with file paths for their web server is likely to disable names starting with dot at about the same time they disable names starting with slash and other shenanigans which blow stuff up. Now of course a URL doesn't have to reflect a path on disk, but as soon as it doesn't we're talking about a slightly more clued in developer, maybe someone who has heard about security and thinks it might be a good idea.
- Cogito 7y ago
  And for anyone who doesn't know why .files are treated differently: In every Unix folder there are two special files, named '.' and '..' - the first is a link to the current folder, the second to the parent. It was annoying to see these two files listed every time you wanted to see what was in a folder (using ls) so `ls` learnt to not show these files by default. The way that was coded was (erroneously) to not show any file whose name started with a '.' People eventually realised that this had the unintended side effect of hiding files that start with '.' and found it useful, so the bug became a feature.
  - itsjloh 7y ago
    Thats super interesting! Thanks for sharing.
- Dylan16807 7y ago
  > dot directories are both illegal in Windows (though the NT kernel has no problem with them) No they're not. They're mildly annoying at most. Explorer wouldn't let you directly name a file or folder ".foo", but you have always been able to type ".foo." and it would save the name as ".foo". You could also use the command prompt, or any non-explorer interface. And they removed that annoyance entirely in Windows 10 version 1903.
Boulth 7y ago
Funny thing that you mention it here as one of the authors of security.txt found this exact issue on several sites: https://edoverflow.com/2018/logic-flaws-in-wot-services/ https://edoverflow.com/2018/logic-flaws-in-wot-services/ section "Attack Vector Two – Namespace attacks"
- Dylan16807 7y ago
  It's the opposite. They found the issue .well-known exists to solve. In that section they got /security.txt and /keybase.txt and explained why validating based off a file in the root directory is a terrible idea. Also, the issue was not on those sites. The issue was with keybase's logic.

Dylan16807 7y ago

Minimizing that risk is the entire point of .well-known. Instead of securing a hundred different magic URLs, everything goes into a single spot.

DyslexicAtheist 7y ago

you can use CNAME records to mitigate this though https://github.com/securitytxt/security-txt/issues/91 https://github.com/securitytxt/security-txt/issues/91

tialaramex 7y ago

But as you hint, r/.well-known does NOT in fact exist and you can't make it The /.well-known/ paths were reserved by RFC specifically because this doesn't really happen. You could _make_ a site with the defect you imagine on purpose and perhaps somewhere in the vast galaxy of sites there's already one that can be abused to do this, but they're vanishingly rare. To the point where I don't know of one even though I went looking. One reason this prefix would be expected to be especially rare is that dot directories are both illegal in Windows (though the NT kernel has no problem with them) and special in Unix systems (they're legal but they're treated differently because it was convenient) and so any developer or administrator working with file paths for their web server is likely to disable names starting with dot at about the same time they disable names starting with slash and other shenanigans which blow stuff up. Now of course a URL doesn't have to reflect a path on disk, but as soon as it doesn't we're talking about a slightly more clued in developer, maybe someone who has heard about security and thinks it might be a good idea.

Cogito 7y ago
And for anyone who doesn't know why .files are treated differently: In every Unix folder there are two special files, named '.' and '..' - the first is a link to the current folder, the second to the parent. It was annoying to see these two files listed every time you wanted to see what was in a folder (using ls) so `ls` learnt to not show these files by default. The way that was coded was (erroneously) to not show any file whose name started with a '.' People eventually realised that this had the unintended side effect of hiding files that start with '.' and found it useful, so the bug became a feature.
- itsjloh 7y ago
  Thats super interesting! Thanks for sharing.
Dylan16807 7y ago
> dot directories are both illegal in Windows (though the NT kernel has no problem with them) No they're not. They're mildly annoying at most. Explorer wouldn't let you directly name a file or folder ".foo", but you have always been able to type ".foo." and it would save the name as ".foo". You could also use the command prompt, or any non-explorer interface. And they removed that annoyance entirely in Windows 10 version 1903.

Boulth 7y ago

Funny thing that you mention it here as one of the authors of security.txt found this exact issue on several sites: https://edoverflow.com/2018/logic-flaws-in-wot-services/ https://edoverflow.com/2018/logic-flaws-in-wot-services/ section "Attack Vector Two – Namespace attacks"

Dylan16807 7y ago
It's the opposite. They found the issue .well-known exists to solve. In that section they got /security.txt and /keybase.txt and explained why validating based off a file in the root directory is a terrible idea. Also, the issue was not on those sites. The issue was with keybase's logic.