A group of researchers from several universities in Germany has developed a new method for MITM attacks on HTTPS, which allows the extraction of cookies containing session IDs and other confidential data, as well as the execution of arbitrary JavaScript code in the context of another site. The attack is called ALPACA and can be applied to TLS servers implementing various application layer protocols (HTTPS, SFTP, SMTP, IMAP, POP3) that use common TLS certificates.
The essence of the attack is that if the attacker has control over a network gateway or wireless access point, they can redirect web traffic to another network port and establish a connection with an FTP or mail server that supports TLS encryption and uses a common TLS certificate with the HTTP server. The user's browser will believe that it has established a connection with the requested HTTP server. Since the TLS protocol is universal and not tied to specific application layer protocols, establishing an encrypted connection for all services is identical, and an error in sending a request to the wrong service can only be detected after the encrypted session has been established during the processing of the commands in the sent request.
Accordingly, if, for example, a user's connection initially directed to HTTPS is redirected to a mail server that uses a common certificate with the HTTPS server, the TLS connection will be successfully established, but the mail server will be unable to process the forwarded HTTP commands and will return an error response. This response will be processed by the browser as a response from the requested site, transmitted within a correctly established encrypted communication channel.
Three variants of the attack have been proposed:
- "Upload" to extract cookies with authentication parameters. This method is applicable if the FTP server covered by the TLS certificate allows data to be uploaded and extracted. In this variant of the attack, the attacker can achieve the retention of parts of the original HTTP request from the user, such as the content of the Cookie header, for instance, if the FTP server interprets the request as a file to be saved or fully logs incoming requests. For a successful attack, the attacker then needs to somehow extract the saved content. This attack is applicable to Proftpd, Microsoft IIS, vsftpd, FileZilla, and Serv-U.
- "Download" for organizing cross-site scripting (XSS). This method implies that the attacker, as a result of certain manipulations, can place data in a service that uses a shared TLS certificate, which can then be returned in response to a user request. This attack is applicable to the aforementioned FTP servers, IMAP servers, and POP3 servers (Courier, Cyrus, Kerio-Connect, and Zimbra).
- "Reflection" for executing JavaScript in the context of another site. This method is based on returning to the client part of the request that contains the JavaScript code sent by the attacker. This attack is applicable to the aforementioned FTP servers, IMAP servers Cyrus, Kerio-Connect, and Zimbra, as well as to the SMTP server Sendmail.
For example, when a user opens a page controlled by the attacker, a request for a resource can be initiated from that page to a site where the user has an active account (for example, bank.com). During a MITM attack, this request, addressed to the web site bank.com, can be redirected to a mail server that uses a shared TLS certificate with bank.com. Since the mail server does not end the session after the first error, service headers and commands like "POST / HTTP/1.1" and "Host:" will be processed as unknown commands (the mail server will return "500 unrecognized command" for each header).
The mail server does not parse the specifics of the HTTP protocol, and for it, service headers and the POST request data block are processed the same way, so it is possible to specify a line with a command to the mail server in the body of the POST request. For example, one could pass: MAIL FROM: to which the mail server would return an error message 501 : malformed address: alert(1); may not follow
This response will be received by the user's browser, which will execute the JavaScript code in the context of the site bank.com that the request was sent to, rather than the attacker’s original site, as the response is received within a valid TLS session, whose certificate confirmed the authenticity of the response from bank.com.
Scanning the global network revealed that approximately 1.4 million web servers are generally vulnerable to attacks involving mixing requests across different protocols. The possibility of a real attack has been identified for 119,000 web servers, which had accompanying TLS servers based on other application protocols.
Examples of exploits have been prepared for ftp servers such as pureftpd, proftpd, microsoft-ftp, vsftpd, filezilla, and serv-u, IMAP and POP3 servers such as dovecot, courier, exchange, cyrus, kerio-connect, and zimbra, and SMTP servers like postfix, exim, sendmail, mailenable, mdaemon, and opensmtpd. Researchers have studied the possibility of conducting the attack only in conjunction with FTP, SMTP, IMAP, and POP3 servers, while it is not ruled out that the issue may manifest in other application protocols using TLS.
To block the attack, it is recommended to use the ALPN (Application Layer Protocol Negotiation) extension to negotiate the TLS session considering the application protocol, and the SNI (Server Name Indication) extension to bind to the host name in the case of TLS certificates covering multiple domains. domain namesOn the application side, it is advisable to limit the number of errors when processing commands, after which the connection should be terminated. The process of developing measures to block the attack began back in October of last year. Similar protective measures have already been implemented in Nginx 1.21.0 (mail proxy), Vsftpd 3.0.4, Courier 5.1.0, Sendmail, FileZilla, crypto/tls (Go), and Internet Explorer.
Source: opennet.ru
