Onderwerp: Bypassing URL Authentication and Authorization with HTTP Verb Tampering

Internetizens,

Many URL authentication and authorization mechanisms make security
decisions based on the HTTP verb in the request. Many of these
mechanisms work in a counter-intuitive way. This fact, in combination
with some oddities in the way that both web and application servers
handle unexpected HTTP verbs causes the rules dictated by those
mechanisms to be bypassable.

Many of us rely on the mechanisms I'm talking about. The Internet is not
exactly going to burn down when this email goes out, but there is
probably a fair number of externally facing web applications out there
that are relying on the shaky security provided by these configurations.

We have written a whitepaper that goes into some detail discussing the
vulnerability and how the various vendors are affected. You can grab the
whitepaper from Aspect Security's website:

http://www.aspectsecurity.com/docume...th_HTTP_Verb_T
ampering.pdf

Jeff Williams and Jim Manico also put together a demo that shows the
attack in progress:

http://www.aspectsecurity.com/docume...AAC_Bypass.swf

Cheers,

Arshan Dabirsiaghi

Director of Research

Aspect Security

http://www.aspectsecurity.com/

Interesting (and serendipitous, at that <g>).

ISA Server 2004+ allows you to configure "allowed / denied methods" in any rule for which the web proxy is involved; effectively nullifying this attack.

...of course, this requires the web devs to communicate the minimum requiredmethods for their site - something I've rarely seen expressed with any real authority.

Jim

-----Original Message-----
From: Arshan Dabirsiaghi [mailto:arshan.dabirsiaghi@aspectsecurity.com]
Sent: Wednesday, May 28, 2008 12:29 PM
To: bugtraq@securityfocus.com
Subject: Bypassing URL Authentication and Authorization with HTTP Verb Tampering

Internetizens,

Many URL authentication and authorization mechanisms make security
decisions based on the HTTP verb in the request. Many of these
mechanisms work in a counter-intuitive way. This fact, in combination
with some oddities in the way that both web and application servers
handle unexpected HTTP verbs causes the rules dictated by those
mechanisms to be bypassable.

Many of us rely on the mechanisms I'm talking about. The Internet is not
exactly going to burn down when this email goes out, but there is
probably a fair number of externally facing web applications out there
that are relying on the shaky security provided by these configurations.

We have written a whitepaper that goes into some detail discussing the
vulnerability and how the various vendors are affected. You can grab the
whitepaper from Aspect Security's website:

http://www.aspectsecurity.com/docume...th_HTTP_Verb_T
ampering.pdf

Jeff Williams and Jim Manico also put together a demo that shows the
attack in progress:

http://www.aspectsecurity.com/docume...AAC_Bypass.swf

Cheers,

Arshan Dabirsiaghi

Director of Research

Aspect Security

http://www.aspectsecurity.com/