IBM Application Security Insider

toStaticHTML: The Second Encounter (CVE-2012-1858)

HTML Sanitizing Bypass - CVE-2012-1858

Introduction

The toStaticHTML component, which is found in Internet Explorer > 8, SharePoint and Lync is used to sanitize HTML fragments from dynamic and potentially malicious content.

If an attacker is able to break the filtering mechanism and pass malicious code through this function, he/she may be able to perform HTML injection based attacks (i.e. XSS).

It has been a year since the first encounter was published, we've now returned with a new bypass method.

Vulnerability

An attacker is able to create a specially formed CSS that will overcome toStaticHTML's security logic; therefore, after passing the specially crafted CSS string through the toStaticHTML function, it will contain an expression that triggers a JavaScript call.

XSS Analyzer Gives You 700 Million Reasons To Feel Secure

When it comes to detecting Cross-Site Scripting (XSS), AppScan is the industry's #1 tool. Today we're making it even better.

AppScan's "XSS Analyzer" is one of the most significant DAST innovations in recent years. It breaks the mold of the standard way of doing black-box testing, that has been essentially unchanged for the last twelve years, and really does something new. Something fresh. Something exciting.

Here's why we believe XSS Analyzer sets itself apart from any other scanner out there: XSS Analyzer works and thinks like a human pentester does. We've packaged the experience and expertise of the best pentesters in the industry, together with the broadest possible knowledge about the different ways to exploit XSS. Essentially, we've created an "expert human pentester in a box".

Automated Blackbox Crawling: The Next Generation

Automated crawling of web applications is the first step in automating web application security analysis. Without a proper crawl, automated testing of vulnerabilities will reveal incomplete results (AKA "False Negatives").

Modern web technologies, like AJAX, result in more responsive and usable web applications, sometimes called Rich Internet Applications (RIAs). Traditional crawling techniques are not sufficient for crawling RIAs.

Our security research team has proposed several crawling methods in the past and is constantly enhancing the research. We present a new strategy for crawling RIAs. This new strategy is designed based on the concept of “Model-Based Crawling” (previously introduced by our team) and uses statistics accumulated during the crawl to select what to explore next with a high probability of uncovering some new information. The performance of our strategy is compared with our previous strategy, as well as the classical Breadth-First and Depth-First on two real RIAs and two test RIAs. The results show this new strategy is significantly better than the Breadth-First and the Depth-First strategies (which are widely used to crawl RIAs), and outperforms our previous strategy while being much simpler to implement.

Our research paper:

A Statistical Approach for Efficient Crawling of Rich Internet Applications
A Statistical Approach for Efficient Crawling of Rich Internet Applications (Long version)

(Research by: Mustafa Emre Dincturk, Suryakant Choudhary, Gregor von Bochmann, Guy-Vincent Jourdan, and Iosif Viorel Onut)

This summer (27.7.2012), we are presenting our latest results at ICWE 2012 in Germany, as part of the Web Crawling Track.

A spotlight on JSA, the amazing hybrid security analysis for JavaScript

By now you have probably heard about JSA. Introduced in AppScan Standard 8.0 in Oct '10, and now included in AppScan Enterprise 8.6, JSA is a component that does static analysis of JavaScript to detect a range of client-side security issues. Issues such DOM-based XSS, Open Redirect, and many others.

Why is this significant? 

Client-side code percentage in web applications grew from around 5% five years ago, to an amazing 25% today. Driven by the Web 2.0 explosion, JavaScript is now everywhere, on every web page. And guess what -- it's painfully full of security holes. Evil, nasty ones, that are particularly difficult to catch.

We were really surprised when we discovered that nearly 1 in 6 of the Fortune 500 websites have serious, exploitable security issues in their JavaScript code. You can imagine this got a lot of attention when we shared these news with the world. It quickly become the #1 downloaded whitepaper in IBM Rational.

AppScan’s new Application Discovery Assistant (ADA) saves the Day!!

The next release of AppScan was announced June 5^th and while it will not be ready for customers until June 12^th, I was able to obtain a pre-release copy and started to exercise some of the new capabilities.  I was specifically interested in checking out some of the new tools for on-boarding applications quickly.

Have you ever had to perform a static analysis security assessment of an application, but didn’t know where or what all the parts and pieces are?  Most reviews start when the developer gives you a massive zip file of the “application” or you check-out the source code directly from the source code repository.  As a security guy, with a development background and who has built and reviewed hundreds of applications, it’s always a daunting task to find all the buildable source code and the dependent libraries from distributions like these.  

Enhancing Web Application Security Testing with IBM Security AppScan Glass Box

I have already blogged about AppScan's Glass box (IAST / Runtime Analysis) capabilities a while ago, but I've recently recorded a short demonstration of how to install and run a Glass box scan with IBM Security AppScan Standard.

Here's the Youtube movie (don't forget to watch it in 720p/HD, full screen)

 

Android SQLite Journal Information Disclosure (CVE-2011-3901)

Recently we detected a security vulnerability in Android’s SQLite engine which can be exploited by a non-privileged application in order to disclose sensitive information. It enables a malicious application to eavesdrop on database activities performed by any other application using SQLite, allowing unauthorized access to information such as URL history, messages, and contacts.

The complete advisory can be found here.

Demo of the PoC:

 

We would like to thank the Android Security Team for the efficient and quick way in which they handled this security issue.

Handling Complex Scenarios with AppScan's Custom Parameters

If you are familiar with web technologies, either from assessing them for security, or from developing them, you are probably aware of the many innovative ways developers choose to implement web applications. The days of following the HTTP RFC are long gone - developers do whatever they need to do, in order to make things work.

For example, HTTP Parameters are passed as a part of the URL (e.g. REST), tokens are passed as HTTP headers (e.g. CSRF protection) instead of as cookies or parameters, parameter values are concatenated with weird strings instead of ampersand (&), XML islands inside HTTP request body, JSON, etc.

Microsoft Anti-XSS Library Bypass (MS12-007)

Introduction:

Microsoft Anti-XSS Library is used to protect applications from Cross-Site Scripting attacks, by providing methods for input sanitization.

Vulnerability:

Microsoft Anti-XSS Library 3.0 and 4.0 are vulnerable to an attack in which an attacker is able to create a specially formed CSS, that after passing through the GetSafeHTML or GetSafeHTMLFragment methods, contains an expression that triggers a JavaScript call in Internet Explorer.

The following ASP.NET code demonstrates the vulnerability:

1. string data = Microsoft.Security.Application.Sanitizer.GetSafeHtml("<html>a<style><!--div{font-family:Foo,Bar\\,'a\\a';font-family:';color:expression(alert(1));y'}--></style><div>b</div></html>");

2. string data = Microsoft.Security.Application.Sanitizer.GetSafeHtmlFragment("<div style=\"font-family:Foo,Bar\\,'a\\a';font-family:';color:expression(alert(1));y'\">aaa</div>");

Testing RESTful Services with AppScan Standard

By Ory Segal

As much as I love SOAP web services (not!), it seems like RESTful web services really caught on and became a de-facto standard these days – you see them everywhere, in the cloud, in AJAX or Web 2.0 applications, mobile applications and so forth.

Unlike SOAP services, RESTful services are lightweight. They are extremely easy to understand and also to develop. Nevertheless, there seem to be a million different definitions as to what they really are, but I think the simplest way to understand them is by using the following four definitions, which I’ve found in this DeveloperWorks article:

1. RESTful services use HTTP methods explicitly
2. RESTful services are stateless
3. RESTful services expose directory structure-like URIs
4. RESTful services transfer XML, JSON or both

Simple right?