Skip to content

Commit 436fd9e

Browse files
owen-mcowen-mc
authored
Merge pull request github#14775 from aydinnyunus/main
Golang: Web Cache Deception Vulnerability
2 parents 561b769 + ca56b01 commit 436fd9e

File tree

7 files changed

+325
-0
lines changed

7 files changed

+325
-0
lines changed

‎go/ql/src/experimental/CWE-525/WebCacheDeception.qhelp

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
2+
<qhelp>
3+
<overview>
4+
<p>
5+
Web Cache Deception is a security vulnerability where an attacker tricks a web server into caching sensitive information and then accesses that cached data.
6+
</p>
7+
<p>
8+
This attack exploits certain behaviors in caching mechanisms by requesting URLs that trick the server into thinking that a non-cachable page is cachable. If a user then accesses sensitive information on these pages, it could be cached and later retrieved by the attacker.
9+
</p>
10+
</overview>
11+
<recommendation>
12+
<p>
13+
To prevent Web Cache Deception attacks, web applications should clearly define cacheable and non-cacheable resources. Implementing strict cache controls and validating requested URLs can mitigate the risk of sensitive data being cached.
14+
</p>
15+
</recommendation>
16+
<example>
17+
<p>
18+
Vulnerable code example: A web server is configured to cache all responses ending in '.css'. An attacker requests 'profile.css', and the server processes 'profile', a sensitive page, and caches it.
19+
</p>
20+
<sample src="WebCacheDeceptionBad.go" />
21+
</example>
22+
<example>
23+
<p>
24+
Secure code example: The server is configured with strict cache controls and URL validation, preventing caching of dynamic or sensitive pages regardless of their URL pattern.
25+
</p>
26+
<sample src="WebCacheDeceptionGood.go" />
27+
</example>
28+
<references>
29+
<li>
30+
OWASP Web Cache Deception Attack:
31+
<a href="https://owasp.org/www-community/attacks/Web_Cache_Deception">Understanding Web Cache Deception Attacks</a>
32+
</li>
33+
<!-- Additional references can be added here -->
34+
</references>
35+
</qhelp>

‎go/ql/src/experimental/CWE-525/WebCacheDeception.ql

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
/*
2+
* @name Web Cache Deception
3+
* @description A caching system has been detected on the application and is vulnerable to web cache deception. By manipulating the URL it is possible to force the application to cache pages that are only accessible by an authenticated user. Once cached, these pages can be accessed by an unauthenticated user.
4+
* @kind problem
5+
* @problem.severity error
6+
* @security-severity 9
7+
* @precision high
8+
* @id go/web-cache-deception
9+
* @tags security
10+
* external/cwe/cwe-525
11+
*/
12+
13+
import go
14+
15+
from
16+
DataFlow::CallNode httpHandleFuncCall, DataFlow::ReadNode rn, Http::HeaderWrite::Range hw,
17+
DeclaredFunction f
18+
where
19+
httpHandleFuncCall.getTarget().hasQualifiedName("net/http", "HandleFunc") and
20+
httpHandleFuncCall.getArgument(0).getStringValue().matches("%/") and
21+
httpHandleFuncCall.getArgument(1) = rn and
22+
rn.reads(f) and
23+
f.getParameter(0) = hw.getResponseWriter() and
24+
hw.getHeaderName() = "cache-control"
25+
select httpHandleFuncCall.getArgument(0),
26+
"Wildcard Endpoint used with " + httpHandleFuncCall.getArgument(0) + " and '" + hw.getHeaderName()
27+
+ "' Header is used"

‎go/ql/src/experimental/CWE-525/WebCacheDeceptionBad.go

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
package bad
2+
3+
import (
4+
"fmt"
5+
"html/template"
6+
"log"
7+
"net/http"
8+
"os/exec"
9+
"strings"
10+
"sync"
11+
)
12+
13+
var sessionMap = make(map[string]string)
14+
15+
var (
16+
templateCache = make(map[string]*template.Template)
17+
mutex = &sync.Mutex{}
18+
)
19+
20+
type Lists struct {
21+
Uid string
22+
UserName string
23+
UserLists []string
24+
ReadFile func(filename string) string
25+
}
26+
27+
func parseTemplateFile(templateName string, tmplFile string) (*template.Template, error) {
28+
mutex.Lock()
29+
defer mutex.Unlock()
30+
31+
// Check if the template is already cached
32+
if cachedTemplate, ok := templateCache[templateName]; ok {
33+
fmt.Println("cached")
34+
return cachedTemplate, nil
35+
}
36+
37+
// Parse and store the template in the cache
38+
parsedTemplate, _ := template.ParseFiles(tmplFile)
39+
fmt.Println("not cached")
40+
41+
templateCache[templateName] = parsedTemplate
42+
return parsedTemplate, nil
43+
}
44+
45+
func ShowAdminPageCache(w http.ResponseWriter, r *http.Request) {
46+
47+
if r.Method == "GET" {
48+
fmt.Println("cache called")
49+
sessionMap[r.RequestURI] = "admin"
50+
51+
// Check if a session value exists
52+
if _, ok := sessionMap[r.RequestURI]; ok {
53+
cmd := "mysql -h mysql -u root -prootwolf -e 'select id,name,mail,age,created_at,updated_at from vulnapp.user where name not in (\"" + "admin" + "\");'"
54+
55+
// mysql -h mysql -u root -prootwolf -e 'select id,name,mail,age,created_at,updated_at from vulnapp.user where name not in ("test");--';echo");'
56+
fmt.Println(cmd)
57+
58+
res, err := exec.Command("sh", "-c", cmd).Output()
59+
if err != nil {
60+
fmt.Println("err : ", err)
61+
}
62+
63+
splitedRes := strings.Split(string(res), "\n")
64+
65+
p := Lists{Uid: "1", UserName: "admin", UserLists: splitedRes}
66+
67+
parsedTemplate, _ := parseTemplateFile("page", "./views/admin/userlists.gtpl")
68+
w.Header().Set("Cache-Control", "no-store, no-cache")
69+
err = parsedTemplate.Execute(w, p)
70+
}
71+
} else {
72+
http.NotFound(w, nil)
73+
}
74+
75+
}
76+
77+
func main() {
78+
fmt.Println("Vulnapp server listening : 1337")
79+
80+
http.Handle("/assets/", http.StripPrefix("/assets/", http.FileServer(http.Dir("assets/"))))
81+
82+
http.HandleFunc("/adminusers/", ShowAdminPageCache)
83+
err := http.ListenAndServe(":1337", nil)
84+
if err != nil {
85+
log.Fatal("ListenAndServe: ", err)
86+
}
87+
}

‎go/ql/src/experimental/CWE-525/WebCacheDeceptionGood.go

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
package good
2+
3+
import (
4+
"fmt"
5+
"html/template"
6+
"log"
7+
"net/http"
8+
"os/exec"
9+
"strings"
10+
"sync"
11+
)
12+
13+
var sessionMap = make(map[string]string)
14+
15+
var (
16+
templateCache = make(map[string]*template.Template)
17+
mutex = &sync.Mutex{}
18+
)
19+
20+
type Lists struct {
21+
Uid string
22+
UserName string
23+
UserLists []string
24+
ReadFile func(filename string) string
25+
}
26+
27+
func parseTemplateFile(templateName string, tmplFile string) (*template.Template, error) {
28+
mutex.Lock()
29+
defer mutex.Unlock()
30+
31+
// Check if the template is already cached
32+
if cachedTemplate, ok := templateCache[templateName]; ok {
33+
fmt.Println("cached")
34+
return cachedTemplate, nil
35+
}
36+
37+
// Parse and store the template in the cache
38+
parsedTemplate, _ := template.ParseFiles(tmplFile)
39+
fmt.Println("not cached")
40+
41+
templateCache[templateName] = parsedTemplate
42+
return parsedTemplate, nil
43+
}
44+
45+
func ShowAdminPageCache(w http.ResponseWriter, r *http.Request) {
46+
47+
if r.Method == "GET" {
48+
fmt.Println("cache called")
49+
sessionMap[r.RequestURI] = "admin"
50+
51+
// Check if a session value exists
52+
if _, ok := sessionMap[r.RequestURI]; ok {
53+
cmd := "mysql -h mysql -u root -prootwolf -e 'select id,name,mail,age,created_at,updated_at from vulnapp.user where name not in (\"" + "admin" + "\");'"
54+
55+
// mysql -h mysql -u root -prootwolf -e 'select id,name,mail,age,created_at,updated_at from vulnapp.user where name not in ("test");--';echo");'
56+
fmt.Println(cmd)
57+
58+
res, err := exec.Command("sh", "-c", cmd).Output()
59+
if err != nil {
60+
fmt.Println("err : ", err)
61+
}
62+
63+
splitedRes := strings.Split(string(res), "\n")
64+
65+
p := Lists{Uid: "1", UserName: "admin", UserLists: splitedRes}
66+
67+
parsedTemplate, _ := parseTemplateFile("page", "./views/admin/userlists.gtpl")
68+
w.Header().Set("Cache-Control", "no-store, no-cache")
69+
err = parsedTemplate.Execute(w, p)
70+
}
71+
} else {
72+
http.NotFound(w, nil)
73+
}
74+
75+
}
76+
77+
func main() {
78+
fmt.Println("Vulnapp server listening : 1337")
79+
80+
http.Handle("/assets/", http.StripPrefix("/assets/", http.FileServer(http.Dir("assets/"))))
81+
82+
http.HandleFunc("/adminusers", ShowAdminPageCache)
83+
err := http.ListenAndServe(":1337", nil)
84+
if err != nil {
85+
log.Fatal("ListenAndServe: ", err)
86+
}
87+
}

‎go/ql/test/experimental/CWE-525/WebCacheDeception.expected

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
| WebCacheDeceptionBad.go:82:18:82:31 | "/adminusers/" | Wildcard Endpoint used with "/adminusers/" and 'cache-control' Header is used |

‎go/ql/test/experimental/CWE-525/WebCacheDeception.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
experimental/CWE-525/WebCacheDeception.ql

‎go/ql/test/experimental/CWE-525/WebCacheDeceptionBad.go

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
package bad
2+
3+
import (
4+
"fmt"
5+
"html/template"
6+
"log"
7+
"net/http"
8+
"os/exec"
9+
"strings"
10+
"sync"
11+
)
12+
13+
var sessionMap = make(map[string]string)
14+
15+
var (
16+
templateCache = make(map[string]*template.Template)
17+
mutex = &sync.Mutex{}
18+
)
19+
20+
type Lists struct {
21+
Uid string
22+
UserName string
23+
UserLists []string
24+
ReadFile func(filename string) string
25+
}
26+
27+
func parseTemplateFile(templateName string, tmplFile string) (*template.Template, error) {
28+
mutex.Lock()
29+
defer mutex.Unlock()
30+
31+
// Check if the template is already cached
32+
if cachedTemplate, ok := templateCache[templateName]; ok {
33+
fmt.Println("cached")
34+
return cachedTemplate, nil
35+
}
36+
37+
// Parse and store the template in the cache
38+
parsedTemplate, _ := template.ParseFiles(tmplFile)
39+
fmt.Println("not cached")
40+
41+
templateCache[templateName] = parsedTemplate
42+
return parsedTemplate, nil
43+
}
44+
45+
func ShowAdminPageCache(w http.ResponseWriter, r *http.Request) {
46+
47+
if r.Method == "GET" {
48+
fmt.Println("cache called")
49+
sessionMap[r.RequestURI] = "admin"
50+
51+
// Check if a session value exists
52+
if _, ok := sessionMap[r.RequestURI]; ok {
53+
cmd := "mysql -h mysql -u root -prootwolf -e 'select id,name,mail,age,created_at,updated_at from vulnapp.user where name not in (\"" + "admin" + "\");'"
54+
55+
// mysql -h mysql -u root -prootwolf -e 'select id,name,mail,age,created_at,updated_at from vulnapp.user where name not in ("test");--';echo");'
56+
fmt.Println(cmd)
57+
58+
res, err := exec.Command("sh", "-c", cmd).Output()
59+
if err != nil {
60+
fmt.Println("err : ", err)
61+
}
62+
63+
splitedRes := strings.Split(string(res), "\n")
64+
65+
p := Lists{Uid: "1", UserName: "admin", UserLists: splitedRes}
66+
67+
parsedTemplate, _ := parseTemplateFile("page", "./views/admin/userlists.gtpl")
68+
w.Header().Set("Cache-Control", "no-store, no-cache")
69+
err = parsedTemplate.Execute(w, p)
70+
}
71+
} else {
72+
http.NotFound(w, nil)
73+
}
74+
75+
}
76+
77+
func main() {
78+
fmt.Println("Vulnapp server listening : 1337")
79+
80+
http.Handle("/assets/", http.StripPrefix("/assets/", http.FileServer(http.Dir("assets/"))))
81+
82+
http.HandleFunc("/adminusers/", ShowAdminPageCache)
83+
err := http.ListenAndServe(":1337", nil)
84+
if err != nil {
85+
log.Fatal("ListenAndServe: ", err)
86+
}
87+
}

0 commit comments

Comments
 (0)