Skip to content

Commit 632f3da

Browse files
paul-ionpaul-ion
authored
Merge pull request #148 from timmyteo/feature/CWE-347
Feature/CWE 347
2 parents e14ab59 + 07f2a49 commit 632f3da

File tree

10 files changed

+192
-1
lines changed

10 files changed

+192
-1
lines changed

‎AttackGrams.pptx‎

32.6 KB
Binary file not shown.

‎insecureinc/pom.xml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,11 @@
3939
<artifactId>nashorn-core</artifactId>
4040
<version>15.4</version>
4141
</dependency>
42+
<dependency>
43+
<groupId>com.auth0</groupId>
44+
<artifactId>java-jwt</artifactId>
45+
<version>4.4.0</version>
46+
</dependency>
4247
</dependencies>
4348
<build>
4449
<plugins>

‎insecureinc/src/main/webapp/cwe347.jsp‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
<%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%>
2+
<%@ page import="inc.insecure.*" %>
3+
<%@ page import="java.util.Date" %>
4+
<%@ page import="java.util.UUID" %>
5+
<%@ page import="insecure.inc.Constants" %>
6+
<%@ page import="com.auth0.jwt.JWT" %>
7+
<%@ page import="com.auth0.jwt.algorithms.Algorithm" %>
8+
<%
9+
String alertVisibility = "hidden";
10+
String usr = request.getParameter("usr");
11+
String pwd = request.getParameter("pwd");
12+
13+
if(usr!=null && pwd!=null) {
14+
alertVisibility="";
15+
if(usr.equals("demo") && pwd.equals("demo1234")) {
16+
Algorithm algorithm = Algorithm.HMAC256("secret");
17+
String jwtToken = JWT.create()
18+
.withIssuer("Insecure Inc.")
19+
.withSubject("demo")
20+
.withClaim("role", "read-only")
21+
.withIssuedAt(new Date())
22+
.withExpiresAt(new Date(new Date().getTime() + 100000L))
23+
.withJWTId(UUID.randomUUID().toString())
24+
.sign(algorithm);
25+
26+
Cookie auth = new Cookie("auth", jwtToken);
27+
auth.setHttpOnly(true);
28+
29+
response.addCookie(auth);
30+
response.sendRedirect("cwe347loggedin.jsp");
31+
}
32+
}
33+
%>
34+
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
35+
<html>
36+
<head>
37+
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
38+
<title>Improper Verification of Cryptographic Signature</title>
39+
<link rel="stylesheet" href="public/bootstrap/css/bootstrap.min.css">
40+
<script src="public/jquery.min.js"></script>
41+
<script src="public/bootstrap/js/bootstrap.min.js"></script>
42+
43+
</head>
44+
<body>
45+
<nav class="navbar navbar-inverse">
46+
<div class="container-fluid">
47+
<div class="navbar-header">
48+
<a class="navbar-brand" href="index.jsp">Insecure Inc.</a>
49+
</div>
50+
<ul class="nav navbar-nav">
51+
<li class="active"><a href="#">cwe347 - Improper Verification of Cryptographic Signature</a></li>
52+
</ul>
53+
</div>
54+
</nav>
55+
<div class="container">
56+
<p>Welcome to cwe347 - Improper Verification of Cryptographic Signature! You can use the following guest account credentials to login,
57+
user: <code>demo</code>, password: <code>demo1234</code> </p>
58+
<form action="cwe347.jsp" autocomplete="off" method="POST">
59+
<div class="form-group">
60+
<label for="usr">Name:</label>
61+
<input type="text" class="form-control" id="usr" name="usr">
62+
</div>
63+
<!-- disables autocomplete --><input type="text" style="display:none">
64+
<div class="form-group">
65+
<label for="pwd">Password:</label>
66+
<input type="password" class="form-control" id="pwd" name="pwd">
67+
</div>
68+
<input type="submit" id="submit" class="btn" value="Submit">
69+
<br><br>
70+
<div class="alert alert-danger <%=alertVisibility%>">
71+
Invalid credentials!
72+
</div>
73+
</form>
74+
</div>
75+
</body>
76+
</html>

‎insecureinc/src/main/webapp/cwe347loggedin.jsp‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
<%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%>
2+
<%@ page import="inc.insecure.*" %>
3+
<%@ page import="insecure.inc.Constants" %>
4+
<%@ page import="com.auth0.jwt.JWT" %>
5+
<%@ page import="com.auth0.jwt.interfaces.DecodedJWT" %>
6+
<%@ page import="com.auth0.jwt.algorithms.Algorithm" %>
7+
<%
8+
9+
String authCookieValue = null;
10+
Cookie[] cookies = request.getCookies();
11+
12+
if(request.getParameter("logout") != null) {
13+
Cookie auth = new Cookie("auth", "");
14+
auth.setMaxAge(0);
15+
response.addCookie(auth);
16+
response.sendRedirect("cwe347.jsp?loggedin=false");
17+
}
18+
19+
if (cookies != null) {
20+
for (Cookie cookie : cookies) {
21+
if (cookie.getName().equals("auth")) {
22+
authCookieValue = cookie.getValue();
23+
}
24+
}
25+
}
26+
27+
if(authCookieValue != null) {
28+
String role;
29+
30+
try {
31+
DecodedJWT jwt = JWT.decode(authCookieValue);
32+
role = jwt.getClaim("role").asString();
33+
34+
if (role.equals("admin")) {
35+
session.setAttribute(Constants.CHALLENGE_ID,"cwe347");
36+
response.sendRedirect(Constants.SECRET_PAGE);
37+
}
38+
} catch(Exception e) {
39+
role = e.toString();
40+
}
41+
42+
%>
43+
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
44+
<html>
45+
<head>
46+
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
47+
<title>Guest</title>
48+
<link rel="stylesheet" href="public/bootstrap/css/bootstrap.min.css">
49+
<script src="public/jquery.min.js"></script>
50+
<script src="public/bootstrap/js/bootstrap.min.js"></script>
51+
52+
</head>
53+
<body>
54+
<nav class="navbar navbar-inverse">
55+
<div class="container-fluid">
56+
<div class="navbar-header">
57+
<a class="navbar-brand" href="index.jsp">Insecure Inc.</a>
58+
</div>
59+
<ul class="nav navbar-nav">
60+
<li class="active"><a href="#">Guest</a></li>
61+
</ul>
62+
63+
<ul class="nav navbar-nav navbar-right">
64+
<li><a href="cwe347loggedin.jsp?logout=true"><span class="glyphicon glyphicon-log-out"></span> Logout</a></li>
65+
</ul>
66+
67+
</div>
68+
</nav>
69+
<div class="container">
70+
<h1>Welcome to the guest section of the site. </h1>
71+
<p>Nothing to do here.</p>
72+
<p>User role: <%=role%></p>
73+
</div>
74+
</body>
75+
</html>
76+
<%
77+
}
78+
else {
79+
response.sendRedirect("cwe347.jsp?loggedin=false");
80+
}
81+
%>

‎insecureinc/src/main/webapp/index.jsp‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,7 @@ body {
6666
<li><a href="cwe798.jsp">Use of Hard-coded Credentials</a></li>
6767
<li><a href="cwe209.jsp">Generation of Error Message Containing Sensitive Information</a></li>
6868
<li><a href="cwe94.jsp">Improper Control of Generation of Code ('Code Injection')</a></li>
69+
<li><a href="cwe347.jsp">Improper Verification of Cryptographic Signature</a></li>
6970
<li><a href="cwe307.jsp">Improper Restriction of Excessive Authentication Attempts</a></li>
7071
<li><a href="cwe190.jsp">Integer Overflow or Wraparound</a></li>
7172
<li><a href="cwe494.jsp">Download of Code Without Integrity Check</a></li>

‎trainingportal/static/lessons/attack-grams/cryptosignature.png‎

56.7 KB
Loading

‎trainingportal/static/lessons/blackBelt/cwe347.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
The purpose of this challenge is to demonstrate the MITRE Top 25 programming flaw: 'Improper Verification of Cryptographic Signature'.
2+
3+
> *"The product does not verify, or incorrectly verifies, the cryptographic signature for data."*
4+
> - From MITRE [CWE 347](https://cwe.mitre.org/data/definitions/347.html)
5+
6+
The developer of the vulnerable application has implemented authentication using JSON Web Tokens (JWT), but has missed an important aspect of the token verification process. Find a way to elevate your privileges after you have logged in, so that you assume the role of "admin" in the application.

‎trainingportal/static/lessons/blackBelt/cwe347.sol.md‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
### Solution for "Improper Verification of Cryptographic Signature" challenge
2+
3+
Systems that utilize JWT authentication must perform several checks on the token supplied in the request to have a robust authentication mechanism:
4+
5+
- The supplied token signature matches the signature calculated for the body based on the secret only available to the server side application
6+
- The token is not expired
7+
- If the system implements token revocation, that the token is not revoked
8+
9+
To pass this challenge:
10+
11+
- Locate the JWT associated to your login
12+
- Modify the token so that the role assigned to the token is "admin" - one useful tool that may help here is [jwt.io](https://jwt.io/)
13+
- Submit the modified token to the server to elevate your permissions to admin - notice that the application doesn't validate the JWT signature calculated for the body

‎trainingportal/static/lessons/blackBelt/definitions.json‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,15 @@
2929
"solution":"cwe352.sol.md",
3030
"playLink":"/cwe352.jsp",
3131
"codeBlockIds":["requestForgeryPrevention"]
32+
},
33+
{
34+
"id":"cwe347",
35+
"name":"Improper Verification of Cryptographic Signature",
36+
"description": "cwe347.md",
37+
"attackGram":"cryptosignature.png",
38+
"solution":"cwe347.sol.md",
39+
"playLink":"/cwe347.jsp",
40+
"codeBlockIds":["serverSideValidation"]
3241
}
3342
]
3443
},

‎trainingportal/static/lessons/modules.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@
3030
"name":"Black Belt",
3131
"summary":"Common software security flaws - part 2",
3232
"description":"Lessons are entry level difficulty aimed at introducing the concepts of vulnerability, exploit and software defense.",
33-
"description2":"Includes 13 lessons. Estimated duration 2 hours.",
33+
"description2":"Includes 14 lessons. Estimated duration 2 hours.",
3434
"badgeInfo":{
3535
"line1":"Secure Coding",
3636
"line2":"Black Belt",

0 commit comments

Comments
 (0)