Saturday, August 22, 2020

Probing For XML Encryption Weaknesses In SAML With EsPReSSO

Security Assertion Markup Language (SAML) is an XML-based standard commonly used in Web Single Sign-On (SSO) [1]. In SAML, the confidentiality of transferred authentication statements against intermediaries can be provided using XML Encryption [2]. However, implementing XML Encryption in a secure way can be tricky and several attacks on XML Encryption have been identified in the past [3] [4]. Therefore, when auditing a SAML endpoint, one should always consider testing for vulnerabilities in the XML Encryption implementation.

This blog post introduces our latest addition to the SAML Attacker of our BurpSuite extension EsPReSSO: the Encryption Attack tab. The new tab allows for easy manipulation of the encrypted parts within intercepted SAML responses and can, therefore, be used to quickly assess whether the SAML endpoint is vulnerable against certain XML Encryption attacks.


Weaknesses of XML Encryption

Implementations of XML Encryption can be vulnerable to adaptive chosen ciphertext attacks. This is a class of attacks in which the attacker sends a sequence of manipulated ciphertexts to a decryption oracle as a way to gain information about the plaintext content.
Falsely implemented XML Encryption can be broken using:
  • an attack against the CBC-mode decryption (quite similar to a padding oracle attack) [3] or
  • a Bleichenbacher attack against the RSA-PKCS#1 encryption of the session key  [4].
SAML makes use of XML Encryption and its implementations could, therefore, also be vulnerable to these attacks.

XML Encryption in SAML

To support confidential transmission of sensitive data within the SAML Assertion, assertions can be encrypted using XML Encryption. An EncryptedAssertion is shown in the abridged example below.

<EncryptedAssertion>
  <EncryptedData>
    <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/>
    <KeyInfo>
      <EncryptedKey>
        <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/>
        <CipherData>
          <CipherValue>
            [...]
          </CipherValue>
        </CipherData>
      </EncryptedKey>
    </KeyInfo>
    <CipherData>
        <CipherValue>
          [...]
        </CipherValue>
    </CipherData>
  </EncryptedData>
</EncryptedAssertion>

The EncryptedAssertion contains an EncryptedData element, which in turn is the parent of the EncryptionMethod, KeyInfo, and CipherData elements.  SAML makes use of what is referred to as a hybrid encryption scheme. This is done using a session key which symmetrically encrypts the payload data (the example uses AES-128 in CBC mode), resulting in the ciphertext contained in the EncryptedAssertion/EncryptedData/CipherData/CipherValue child element. The session key itself is encrypted using an asymmetric encryption scheme. In our example, RSA-PKCS#1.5 encryption is used with the public key of the recipient, allowing the contents of the the EncryptedKey child element to be derived from the KeyInfo element. 

Encryption Attacker

Our BurpSuite extension EsPReSSO can help detect vulnerable implementations with the newly integrated Encryption Attacker within EsPReSSO's SAML module.

Once a SAML response which contains an EncryptedAssertion has been intercepted, open the SAML tab, select the Attacks pane, and choose Encryption from the dropdown menu. This works in Burp's Proxy, as well as in the Repeater tool, and is depicted below.
As sketched out above, the symmetric session key is encrypted using the recipient's public key. Since the key is public, anybody can use it to encrypt a selected symmetric key and submit a valid encryption of arbitrary messages to the recipient. This is incredibly helpful because it allows us to produce ciphertexts that decrypt the chosen plaintexts. To accomplish this, one can purposefully send invalidly padded messages, or messages containing invalid XML, as a method to trigger and analyze the different reactions of the decryption endpoint (i.e, turning the endpoint into a decryption oracle). To facilitate these investigations, the new Encryption Attacker makes this process dead simple.
The screenshot above shows the essential interface of the new encryption tab:
At the top, the certificate used to encrypt the symmetric session key can be pasted into the text field. This field will be pre-filled automatically if the intercepted SAML message includes a certificate in the KeyInfo child element of the EncryptedData element. The Update Certificate checkboxes above the text area can be used to include the certificate in the manipulated SAML message.
In the Symmetric Key text field, the hexadecimal value of the symmetric session key can be set. Choose the asymmetric algorithm from the dropdown menu and click Encrypt key -- this will update the corresponding KeyInfo elements of the intercepted SAML message. 

The payload in the text area labeled XML data can now be entered. Any update in the XML data field will also be reflected in the hexadecimal representation of the payload (found on right of the XML data field). Note that this is automatically padded to the blocklength required by the symmetric algorithm selected below. However, the payload and the padding can be manually adjusted in the hex editor field.

Eventually, click the Encrypt content button to generate the encrypted payload. This will apply the changes to the intercepted SAML message, and the manipulated message using Burp's Forward or Go button can now be forwarded, as usual.

Probing for Bleichenbacher Oracles

Bleichenbacher's attack against RSA-PKCS1 v1.5 encryption abuses the malleability of RSA to draw conclusions about the plaintext by multiplying the ciphertext with adaptively chosen values, and observing differences in the received responses. If the (error-) responses differ for valid and invalid PKCS1 v1.5 ciphertexts, Bleichenbachers' algorithm can be used to decrypt the ciphertext without knowing the private key [6].

To determine whether or not a SAML endpoint is vulnerable to Bleichenbacher's Attack, we simply need to check if we can distinguish those responses received when submitting ciphertexts that are decrypted into invalidly formatted PKCS1 v1.5 plaintexts, from the responses we receive when sending ciphertexts that are decrypted into validly formatted plaintexts. 

Recall that PKCS1 v1.5 mandates a certain format of the encrypted plaintext, namely a concatenation of a BlockType 00 02, a randomized PaddingString (PS) that includes no 00 bytes, a 00 (NULL-byte) as delimiter, and the actual plaintext message. The whole sequence should be equal in size to the modulus of the RSA key used. That is, given the byte length k of the RSA modulus and the message length |m|, PS has the length |PS| = k - 3 - |m|. Furthermore, PKCS1 v1.5 demands that |PS| to be at least eight bytes long [5]. 

In SAML, the recipient's public key is usually known because it is published in the metadata, or even included in the EncryptedAssertion. For this reason, we do not need to fiddle around with manipulated ciphertexts. Instead, we simply submit a validly formatted RSA-PKCS1 v1.5 encrypted message and an encrypted message which deciphers into an invalidly formatted plaintext. As an example, assume an RSA public key of 2048 bits which we want to use to encrypt a 16 byte session key `01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10` (hexadecimal representation). |PS|$ is $2048/8 - 3 - 16 = 237, so a valid PKCS1 v1.5 plaintext, ready to be encrypted using `AA` for all 237 padding bytes, could look like the listing shown below.

00 02 AA AA AA AA AA AA AA AA AA AA AA AA AA AA
AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA
AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA
AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA
AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA
AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA
AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA
AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA
AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA
AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA
AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA
AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA
AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA
AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA
AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA 00
01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10
In the Encryption attack pane of EsPReSSO, ensure that the correct public key certificate has been added to the Certificate field. Insert a valid plaintext, such as the one above, into the Symmetric Key field and select Plain RSA encryption from the Algorithm drop down menu. Click the Encrypt button to compute the RSA transformation and apply the new EncryptedKey element to the intercepted SAML message. Now, submit the message by clicking Burp's Go or Forward button and carefully inspect the response.

Next, repeat the steps outlined above, but this time submit an invalid PKCS1 v1.5 message. For example, consider using an invalid BlockType of `12 34` instead of `00 02`, or replace the `00` delimiter so that the decryptor is unable to determine the actual message after decrypting the ciphertext. If you are able to determine from the recieved responses whether or not the submitted ciphertext decrypted into a valid PKCS1 v1.5 formatted plaintext, chances are high that the decryptor can be used as a Bleichenbacher oracle. Don't forget to take into account the actual XML data, i.e., the assertion encrypted with the new session key; by submitting valid or invalid XML, or by removing signatures from the SAML message or the assertion you may increase your chances of detecting differences in the returned responses.

Probing for Oracles in CBC-Mode Decryption

Another known attack on XML Encryption is aimed at the Cipher Block Chaining (CBC) mode, which can be used with the block ciphers AES or 3DES [2]. The attack is described in detail in this referenced paper [3] and is quite similar to Padding-Oracle attacks on CBC mode; the malleability of CBC mode encryption enables the attacker to perform a bytewise, adaptive manipulation of the ciphertext blocks which are subsequently sent to the decryptor. In most cases, the manipulated ciphertext will not decrypt to valid XML and an error will be returned. Sometimes, however, the plaintext will be parsed as valid XML, in which cases an error is thrown later on at the application layer. The attacker observes the differences in the responses in order to turn the decryptor into a ciphertext validity oracle which can be used to break the encryption.  Due to some particularities of the XML format, this attack can be very efficient, enabling decryption with about 14 requests per byte, and it is even possible to fully automate the process [7].

In order to determine if a particular SAML service provider is vulnerable to this attack, we can avoid the cumbersome ciphertext manipulation, if we are in possession of the decryptor's public key:
In the Encryption Attacker tab of EsPReSSO, add the public key certificate to the Certificate field (if necessary) and insert a symmetric key of your own devising into the  Symmetric Key text field. Select an appropriate RSA encryption method and click the Encrypt button to apply the new EncryptedKey element to the original SAML message. 

An XML message can now be inserted into the XML data text field. Select a CBC mode encryption algorithm and click Encrypt to apply the changes. As in the example above, press Burp's Go or Forward button to send the message and carefully inspect the response. Try sending invalid XML, e.g., by not closing a tag or using the `&` character without a valid entity and keep an eye open for differences in the returned responses. To manipulate the padding, the text field on the right side shows the hexadecimal representation of the plaintext, including the CBC padding. If you send a single block and set the last byte, which indicates the padding length to the blocksize, i.e. 16 or 0x10 for AES, the ciphertext should decrypt into an empty string and is generally considered "valid" XML.

Please refer to the original paper for more details, tips, and tricks for performing the actual attack [3]. 

Summary

The new XML Encryption attacker included in EsPReSSO can help security auditors to quickly assess if a SAML endpoint is vulnerable to known attacks against XML Encryption. To this end, the decryptor's public key is used in order to send suitable test vectors that can be provided in plaintext. Ciphertext manipulation is, therefore, not required. The actual process of decrypting an intercepted SAML message is, however, considered out of scope and not implemented in EsPReSSO.

In case you wonder how XML Encryption can be used in a secure fashion, here are some considerations [6]:
  • Always use an authenticated encryption mode such as AES-GCM instead of the CBC-mode encryption.
  • Using RSA-PKCS1 v1.5 within XML Encryption is particularly difficult to do in a secure manner, and it is recommended to use RSA with Optimal Asymmetric Encryption Padding (OAEP) instead [2].
  • Apply a digital signature over the whole SAML response, and ensure it is properly validated before attempting to decrypt the assertion. This should thwart the attack as a manipulated response can be recognized as such and should be rejected.
----------
More information

  1. Hacker Techniques Tools And Incident Handling
  2. Hacker Tools List
  3. Hacking Tools And Software
  4. Black Hat Hacker Tools
  5. Hacker Tools 2019
  6. Hacking Tools Windows 10
  7. Nsa Hack Tools Download
  8. Bluetooth Hacking Tools Kali
  9. Growth Hacker Tools
  10. Install Pentest Tools Ubuntu
  11. Hacker Tools Linux
  12. Hack And Tools
  13. Hack Tools For Ubuntu
  14. Hacker Tools For Ios
  15. Hacker Tools List
  16. Hacker Tools List
  17. How To Make Hacking Tools
  18. Hacker Tools Mac
  19. Computer Hacker
  20. Pentest Tools For Mac
  21. Hacker Tools Linux
  22. Wifi Hacker Tools For Windows
  23. World No 1 Hacker Software
  24. Github Hacking Tools
  25. Pentest Tools Free
  26. Hack Tool Apk
  27. Hacker Hardware Tools
  28. Hacking Tools For Mac
  29. Hacker Tool Kit
  30. Hacker Tools Online
  31. Game Hacking
  32. Pentest Tools For Ubuntu
  33. Hack Tool Apk No Root
  34. Pentest Tools Website Vulnerability
  35. Hacking Tools Online
  36. New Hacker Tools
  37. Pentest Tools Bluekeep
  38. Pentest Tools Tcp Port Scanner
  39. Black Hat Hacker Tools
  40. Hackrf Tools
  41. Hacking Tools Online
  42. Hacker Tools Linux
  43. Hacking Tools For Kali Linux
  44. Hacking Tools For Games
  45. Hacker Tools Mac
  46. Hacker Tools For Pc
  47. Hacking App
  48. Hack Website Online Tool
  49. Pentest Tools Nmap
  50. Beginner Hacker Tools
  51. Hacking Tools Usb
  52. Hacking Tools For Mac
  53. Pentest Tools Free
  54. Top Pentest Tools
  55. Hacker Tools Free
  56. Easy Hack Tools
  57. Hacker Tools Free Download
  58. Pentest Tools Free
  59. Hacking Tools
  60. Pentest Tools Bluekeep
  61. How To Hack
  62. Hacker Tool Kit
  63. Tools Used For Hacking
  64. How To Install Pentest Tools In Ubuntu
  65. Best Hacking Tools 2019
  66. Wifi Hacker Tools For Windows
  67. Hacking Tools Software
  68. Pentest Tools Framework
  69. Hacker Tools For Ios
  70. Hack Tools For Ubuntu
  71. Hacking Tools Pc
  72. Hacking Tools For Pc
  73. Hacker Tools 2019
  74. Hacker Tools Windows
  75. Pentest Tools Subdomain
  76. Nsa Hack Tools
  77. Hacking Tools For Beginners
  78. Pentest Tools Tcp Port Scanner
  79. Hack Rom Tools
  80. Hacker Tools Software
  81. What Are Hacking Tools
  82. Hacking Tools For Windows Free Download
  83. Nsa Hack Tools
  84. Hacker Search Tools
  85. Hacking Tools Free Download
  86. Pentest Tools Alternative
  87. Beginner Hacker Tools
  88. Hacking Tools Free Download
  89. Pentest Tools Linux
  90. Pentest Reporting Tools
  91. Hacking Tools Windows 10
  92. Easy Hack Tools
  93. Hacker Tools Free Download
  94. Hacker Tools For Windows
  95. Hacker Tools Hardware
  96. Hack Tools Github
  97. Hacking Tools Mac
  98. Pentest Tools Windows
  99. Pentest Tools Find Subdomains
  100. Hacking Tools Download
  101. Hack Tools Github
  102. Nsa Hacker Tools
  103. Hacker Security Tools
  104. Blackhat Hacker Tools
  105. Pentest Tools For Ubuntu
  106. Pentest Tools List
  107. Hack Tools Pc
  108. What Are Hacking Tools
  109. Pentest Tools Subdomain
  110. Hack Tool Apk
  111. Pentest Tools Alternative
  112. Hacking Tools For Games
  113. Pentest Recon Tools
  114. Blackhat Hacker Tools
  115. Hacking Tools Mac
  116. Hacking Tools Hardware
  117. Pentest Tools Url Fuzzer
  118. Underground Hacker Sites
  119. New Hack Tools
  120. Nsa Hack Tools
  121. Hack Apps
  122. Tools For Hacker
  123. Hacking Tools For Windows 7
  124. Hack Tools For Windows
  125. Hacker Tools Linux
  126. Hacker Tools For Windows
  127. Hacker Tool Kit
  128. Wifi Hacker Tools For Windows
  129. Hacking Tools Free Download
  130. Growth Hacker Tools
  131. Pentest Automation Tools
  132. Hacker Tools For Ios
  133. Hack Tools For Ubuntu
  134. Nsa Hack Tools
  135. Hack Tools Mac
  136. Termux Hacking Tools 2019
  137. Hacker Tools For Windows
  138. New Hack Tools
  139. Pentest Tools For Mac
  140. Hackrf Tools
  141. Hacker Tool Kit
  142. Pentest Tools Windows
  143. Kik Hack Tools
  144. Hack And Tools
  145. Hack Tools For Pc
  146. Hacker Tools Apk
  147. Android Hack Tools Github
  148. Usb Pentest Tools
  149. What Are Hacking Tools
  150. Pentest Tools For Ubuntu
  151. Hacker Tools Mac
  152. Bluetooth Hacking Tools Kali
  153. Hacking Tools 2019
  154. What Is Hacking Tools
  155. Hackrf Tools
  156. Hacking Tools For Games
  157. Hacker Tools Free Download
  158. Pentest Tools Free
  159. Hacker Tools Hardware
  160. Hacking Tools For Mac
  161. Hacking Tools 2020
  162. Hacker Tools 2019
  163. How To Make Hacking Tools
  164. Pentest Tools Nmap
  165. Pentest Tools Url Fuzzer
  166. Game Hacking
  167. Hacking Tools Pc
  168. What Is Hacking Tools
  169. Black Hat Hacker Tools
  170. Usb Pentest Tools
  171. How To Make Hacking Tools
  172. Hacking Tools For Pc

No comments:

Post a Comment