oss-security - shellinabox - DNS rebinding attack due to HTTP fallback

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20151202102921.GQ2610@core.inversepath.com>
Date: Wed, 2 Dec 2015 11:29:21 +0100
From: Andrea Barisani <andrea@...ersepath.com>
To: oss-security@...ts.openwall.com
Subject: shellinabox - DNS rebinding attack due to HTTP fallback

Hello,

Stephen Roettger from the Google Security Team reported to us that the
shellinabox package allows HTTP fallback, even when configured for HTTPS, via
the "/plain" URL.

This fallback is quite easy to be overlooked and it gives the opportunity for
a DNS rebinding attacks against systems that use the service and have default
credentials for a certain time window.

I've opened an issue on what appears to be the only maintained fork of
shellinabox at this time:

https://github.com/shellinabox/shellinabox/issues/355

Also we removed the package from the Debian image that we publish for the USB
armory project (http://dev.inversepath.com/download/usbarmory/), here's the
relevant CHANGELOG entry:

* security fix: removed shellinabox package

  The shellinabox web server was originally added to ease connection on hosts
  that do not have an SSH client. The server, while using the HTTPS protocol,
  allows HTTP fallback through the "/plain" URL. This exposes the opportunity
  for a potential DNS rebinding attack, by malicious JavaScript loaded in the
  context of the user browser, that would allow connection to shellinabox in
  the time window between server startup and user reconfiguration of default
  credentials.

  While the opportunity for a successful attack is quite limited, it is
  nonetheless present. For this reason the shellinabox package is removed.

Cheers

-- 
Andrea Barisani                             Inverse Path Srl
Chief Security Engineer                     -----> <--------

<andrea@...ersepath.com>          http://www.inversepath.com
0x864C9B9E 0A76 074A 02CD E989 CE7F AC3F DA47 578E 864C 9B9E
       "Pluralitas non est ponenda sine necessitate"

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.