7 ms·
I tried to send the bad curl request to our servers (test env, obviously) and I didn't get any error. It seems I should be getting "Requested Range Not Satisfia
by Khao 12y ago
I tried to send the bad curl request to our servers (test env, obviously) and I didn't get any error. It seems I should be getting "Requested Range Not Satisfiable" if the server is vulnerable and "The request has an invalid header name" if it's patched. I'm getting neither, simply a normal response HTTP 200 with the requested page. Anyone knows how to really test it?
EDIT : It is indeed related to "Output Cache" setting in IIS as I said I was suspecting in another comment. I managed to crash our servers by going to IIS Management, select the website I wanted to test, go to Output Caching, enable the feature AND also add a rule (I added a rule for .png just to test). If you have NO rules it is the same as having the feature disabled so you are safe. If you add a rule and check "Enable Kernal Caching" you are vulnerable!
EDIT 2 : As some have asked, this is the command I used to crash our test server. I tested it after having created a new Output Caching rule to cache all .png files in kernel mode.
curl -v http://example.com/image.png http://example.com/image.png -H "Range: bytes=18-18446744073709551615"
I didn't take a screenshot of the BSOD and I don't plan on crashing our test env a second time today because people are using it (I tested it early enough that not a lot of people were at the office yet).
- pjc50 12y agoAre you sure that curl is sending the request properly? (Check with tcpdump)
- Khao 12y agoYep. I tried curl -v to get all the raw headers line by line and the payload is there, and I also tried in telnet, both return a 200 page. I read the microsoft security bulletin and it says that your IIS server is protected if Kernal Caching is off, maybe that's why our servers are neither blocking the request nor crashing with the request.
- pweissbrod 12y agoI have tried this with kernel caching enabled. (kernel caching IS enabled by default from what I can see). Still unable to reproduce using curl.
- Khao 12y agoEven if you have Kernel Caching enabled (as it is by default) if you haven't created any rule for it you're safe. I created a rule to cache all .png files and I changed the curl request to request a .png image on the server. I got a BSOD!
- eqkosch 12y agoCan you please provide example of CURL syntax you used to produce this please?
- trentnelson 12y agoDo you remember what the fault being reported on the BSOD was? (If you could take a screenshot/snapshot that'd be great.) I'm really curious to see what bugcheck is being hit.
- davman 12y agoI just get the standard "Your PC ran into a problem and needs to restart. We're just collecting some error info, and then we'll restart for you." Edit: Actually sometimes you get additional info: http://imgur.com/zRHUV8o http://imgur.com/zRHUV8o
- trentnelson 12y agoAh, page fault in non-paged area! Interesting.
- pweissbrod 12y ago+1. Also tried this on multiple web servers. Unable to reproduce under several different scenarios using curl
- pweissbrod 12y agoEDIT: adding the output caching rules confirms it. BSOD :(
- amarraja 12y agoHave tried on all our production facing domains (with and without CDN and get 200 responses also. One server (our development server) has proven vulnerable. Maybe reverse proxies are sanitizing the results? $ curl -v 10.100.0.40/ -H "Host: irrelevant" -H "Range: bytes=0-18446744073709551615" * About to connect() to 10.100.0.40 port 80 (#0) * Trying 10.100.0.40... * Adding handle: conn: 0x1d83278 * Adding handle: send: 0 * Adding handle: recv: 0 * Curl_addHandleToPipeline: length: 1 * - Conn 0 (0x1d83278) send_pipe: 1, recv_pipe: 0 * Connected to 10.100.0.40 (10.100.0.40) port 80 (#0) > GET / HTTP/1.1 > User-Agent: curl/7.30.0 > Accept: */* > Host: irrelevant > Range: bytes=0-18446744073709551615 > < HTTP/1.1 416 Requested Range Not Satisfiable < Content-Type: text/html < Last-Modified: Wed, 27 Aug 2014 14:56:23 GMT < Accept-Ranges: bytes < ETag: "885fe5117c2cf1:0" * Server Microsoft-IIS/7.5 is not blacklisted < Server: Microsoft-IIS/7.5
- ftcHn 12y agoI've just tried on AWS Elastic Beanstalk https servers and not been able to BSOD. We don't have output caching enabled.
- guiomie 12y agoAre you sure you have IIS on an OS with the vulnerability? It seems like windows 2008 R2 has it, but not 2008. My work is all on windows 2008, not R2.
- functionCall 12y agoI can confirm what Khao is saying from my own testing.
- Khao 12y agoDo you happen to have a screenshot of the BSOD, or could test it a second time to take a screenshot? I don't really have a free test server that I can crash anymore since I tested this morning when not a lot of people were at the office yet.
- functionCall 12y agohttp://imgur.com/RTbw7co http://imgur.com/RTbw7co
- el_duderino 12y agoProof of BSoD: https://www.youtube.com/watch?v=BlBXREzsytc https://www.youtube.com/watch?v=BlBXREzsytc
- eqkosch 12y agoAs all our servers are behind a traffic manager product like F5/ZXTM I'm experimenting with removing the range header so it never reaches the webserver as some app's rely on kernel mode caching to achieve performance. Also my tests seem to indicate that just having kernel mode caching enabled even if you dont have any rules still seem to cause a BSOD.
- Khao 12y agoYou're right! Even with no rule having kernal caching enabled will crash it! I think IIS assumes it should cache all static content even when there are no rules specifically for them. Somehow I can't edit my comment anymore but I'll leave this here : EVEN WITH NO RULES, YOU ARE VULNERABLE! My previous answer has been proven to be wrong!
- tracker1 12y agoThat was my case as well... initialized IIS on a fresh server to test against. (took me a while to figure out that IIS wasn't even setup, since the IIS manager was on the server) ... accidentally crashed my local machine too (forgot to change the localhost to the ip of the server whyn copy/pasting the url from the browser on the server) This is pretty wild.
- lontivero 12y agoIf I understood well, the HTTP request with the Range header is just a way to CHECK for the vulnerability and it is not THE vulnerability. The vulnerability allows execute code remotly under the Syetem account. Am I wrong?
- cbrevik 12y agoI just crashed a 2008 R2 server without a rule, just with "Enable Kernel Caching". Not sure if it is relevant, but I first added a rule for .png, and then removed it again. Still worked.
- Khao 12y agoCan't edit the top comment anymore :( but it has been found that indeed no rules are needed to exploit this (my previous answer is outdated and wrong!) If you can't afford to reboot your servers right now to install the patch, at least you can add this to your web.config and deploy your websites ASAP : <configuration> <system.webServer> <caching enableKernelCache="false"/> </system.webServer> </configuration>
- mandeepj 12y agoInstead of updating every single web.config of your website I think it is better to just update once and for all by updating machine.config. What you say ?
- Khao 12y agoSeems like you can't add a system.webServer node on the machine.config, but you could add it to applicationHost.config (source: http://www.iis.net/learn/get-started/planning-your-iis-architecture/the-configuration-system-in-iis-7 http://www.iis.net/learn/get-started/planning-your-iis-archi... ) so yes, that would be faster. You have to make sure that none of your web.config files override that setting though!
- JonBons 12y agoI believe IIS supports locking attributes (source: http://www.iis.net/learn/get-started/planning-for-security/how-to-use-locking-in-iis-configuration http://www.iis.net/learn/get-started/planning-for-security/h...) so you should be able to lock at applicationHost.config and restrict further modifications. (I'm testing this now) EDIT: It causes a config error when a lock violation occurs which means the site gets an error 500 so its not an ideal fix.
- hitgeek 12y agoconfirmed the above command crashed my win 2012 r2 server on AWS with no output cache rules. I found a png being served by my home page, and after 2 of the above requests the server crashed. I installed the pending windows updates and after a restart the problem seems to be gone.
- vdnkh 12y agoI'm getting "Range requested not satisfiable" but no crash. Am I vulnerable or just doing it wrong?