A Tale of Two Bugs

This Fall has been bad Let’s look at two CVE AKA “Shellshock” CVE AKA “Drupalgeddon”

shellshock “Remotely exploitable bug in bash” Run away, everything I knew is wrong Just saying this blew peoples minds

What is bash? A shell? A language? A command interpreter? When bash is operating as a command interpreter, what does it do? What could a vulnerability be?

bash invocation bash will scan the environment If it finds functions in the environment variables, it will try and parse the function What if there is trailing code after the function definition? env x=‘() { :;}; echo vuln’

Impact Attackers can run arbitrary bash programs These programs run with permissions of the invoker This is a big problem Site defacement Download and exec privilege escalation Start a shell

Mass scans Rob Graham ran mass scans on the Internet Commanded remote systems to ping him Was this ethical? Legal? Discovered “thousands” of vulnerable systems Declared probability for worm “high”

Web servers If a web server uses CGI, and the request handler is a bash script OR a CGI script that invokes bash / a shell using system The attacker can set an environment variable HTTP_USER_AGENT Then bash will execute code found in that environment variable

SSH server User has a “restricted shell” Command to be executed by an ssh command invocation stored in an environment variable SSH_ORIGINAL_COMMAND If this environment variable is attacker controlled (it is, post-auth) then bash will scan it for functions and execute commands

DHCP server DHCP options from clients get stored in environment variables bash is invoked by the DHCP server during registration Join a network with DHCP, set the right options in your DHCP client config, get a shell on the DHCP server

drupalgeddon “SQL injection in a CMS” oh we’ve heard this before

What is SQL injection? At the heart, program injection Concatenate a program (SQL query) with data If the concatenation creates a different program, there is a problem

What can you do with SQL injection? Depends on the application but usually everything Totally compromise an application Inject new content into web pages Add users / roles / etc

What is Drupal? A content management system (CMS) used on a large amount of the Internet Blogs, knowledge management systems, everything

What does the exploit look like? POST /?q=node&destination=node HTTP/1.1" "sucuri.net" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0;.NET CLR )" Payload: name [0%20and%20extractvalue(1, concat(0x5c, (select md5(1122) from information_schema.tables limit 1)));%23%20%20]=removed&name[0]=removed&pass=removed& removed=removed&form_build_id=&form_id=user_login_block&op=Log+in

What were the outcomes? Shellshock will probably keep pentesters employed for years The Drupal vulnerability compromised 12 million websites We heard about one a lot more than the other

What can we learn? Don’t listen to hype Consider data Data about attack surface Data about installation base What is the exposure? What is the risk?