Auth Bypass to RCE in Airflow #456

am0o0 · 2024-04-06T09:59:08Z

Hi, it is according to this PRP issue #428

leonardo-doyensec

Hi @am0o0,
Thank you for your contribution! I did a review of this plugin, and I've noticed that it is missing the require Java formatting. I highly recommend to run Google's Java formatter in order to be compliant with the standards.

You can do it by following the guidelines in the following repo https://github.com/google/google-java-format

Also, you can find my comments on your contribution below.
Feel free to reach out.

~ Leonardo (Doyensec)

...e_2020_17526/src/main/java/com/google/tsunami/plugins/cve202017526/Cve202017526Detector.java

..._17526/src/main/java/com/google/tsunami/plugins/cve202017526/Cve202017526DetectorModule.java

...20_17526/src/test/java/com/google/tsunami/plugins/cve202017526/Cve202017526DetectorTest.java

fix wildcard imports fix recommendation and title of detection report set a constant for session cookie payload

leonardo-doyensec

Hello @am0o0,
Thank you for your changes. I'm noticing that the package statements are still missing a space from the line above. I've also found some minor stylistic issues to address, you can find them below.

~ Leonardo (Doyensec)

...e_2020_17526/src/main/java/com/google/tsunami/plugins/cve202017526/Cve202017526Detector.java

...20_17526/src/test/java/com/google/tsunami/plugins/cve202017526/Cve202017526DetectorTest.java

maoning · 2024-04-25T21:41:03Z

@am0o0 Please update your PR according to the feedback, so that we can merge your PR in asap.

…ase for switch statement

am0o0 · 2024-04-26T19:57:51Z

Hi, @leonardo-doyensec, apologize for the delay.

leonardo-doyensec · 2024-05-07T09:40:40Z

Hi @am0o0 ,
thank you for your changes. However after the last commits, the plugins no longer builds.

~ Leonardo (Doyensec)

am0o0 · 2024-05-07T10:12:20Z

@leonardo-doyensec I fixed the issue.

leonardo-doyensec · 2024-05-07T10:35:07Z

LGTM - Approved
@maoning you can merge it.

Reviewer: Leonardo, Doyensec

Plugin: Auth Bypass Lead to RCE in Apache Airflow
Feedback: The overall quality is good. The security testbed was easy to deploy. Although some aspects of the formatting were missing, the plugin detection and exploitation phases were nicely done.
Drawbacks: None

...e_2020_17526/src/main/java/com/google/tsunami/plugins/cve202017526/Cve202017526Detector.java

maoning · 2024-05-08T02:29:01Z

...e_2020_17526/src/main/java/com/google/tsunami/plugins/cve202017526/Cve202017526Detector.java

+              .build(),
+          networkService);
+
+      Uninterruptibles.sleepUninterruptibly(Duration.ofSeconds(25));


Could you make the time here injected via guice? So that the unit test can inject a different value to make the test run faster.

I tried a lot to work with Guice but I couldn't succeed :(
If necessary please confirm it and I can put my time into learning Guice as a first step :).

How did you choose the value of 25 here? At least for now, let's switch to 20 if there is no constraint to it, that allows the test to pass. I will give a quick go at having the guice binding.

...20_17526/src/test/java/com/google/tsunami/plugins/cve202017526/Cve202017526DetectorTest.java

maoning · 2024-05-08T22:05:37Z

@am0o0 Could you check if the vulnerable configuration of the service recorded at https://github.com/google/security-testbeds/blob/6022938f728d5114f4b9c1d55bb498872018bd03/apache/airflow/CVE-2020-17526/README.md is still working as intended. I tried to do the manual verification and run the plugin, neither works.

am0o0 · 2024-05-09T07:26:39Z

@maoning as this PR took one and half months to be reviewed there is a benefit for this :)
the sessions will expire after a while and I can't set the expiration date anyway.
but the good news and the most interesting part is that I found a very helpful burp suite extension that can be used to sign and unsign different kinds of tokens like Flask session tokens Django session tokens Expressjs session tokens and more.
I copied parts of the crypto signer that we need to generate a fresh session cookie signed by a constant secret key each time.

the source code of the burp suite plugin:
https://github.com/d0ge/sign-saboteur/blob/main/src/main/java/one/d4d/signsaboteur/itsdangerous/crypto/DangerousTokenSigner.java

if you are interested as a bounty PRP I can wrap all of these into very simple and smaller Java classes because it is really helpful. After all, we have submissions that need to sign a flask session key with a constant secret key.

you can look at the TokenSigner class as an example of what I'm explaining.

Remove logging of cookie values

…javaguide.html#s4.8.4-switch)

tooryx

Made some additional comments. This PR is almost ready though. Thank you for your contribution!

tooryx · 2024-05-15T13:44:38Z

...26/src/main/java/com/google/tsunami/plugins/cve202017526/flasksessionsigner/TokenSigner.java

+import com.google.common.primitives.Bytes;
+import java.security.InvalidKeyException;
+import java.security.NoSuchAlgorithmException;
+import java.util.*;


Please add the explicit list of import, do not use wildcards

tooryx · 2024-05-15T15:36:58Z

...e_2020_17526/src/main/java/com/google/tsunami/plugins/cve202017526/Cve202017526Detector.java

+              .build(),
+          networkService);
+
+      Uninterruptibles.sleepUninterruptibly(Duration.ofSeconds(25));


How did you choose the value of 25 here? At least for now, let's switch to 20 if there is no constraint to it, that allows the test to pass. I will give a quick go at having the guice binding.

am0o0 · 2024-05-15T15:52:38Z

How did you choose the value of 25 here?

The 10 seconds was the time to get an out-of-band callback for a fresh server, so I thought it should be more for an airflow application with multiple deployments.

tooryx · 2024-05-16T11:20:38Z

Ack, thank you! I will give a try at the guice change when I have a bit of time (probably early next week) and come back to you. Otherwise we will just reduce the value so that unit tests pass.

tooryx · 2024-05-16T14:36:16Z

Hi @am0o0,

I found a plugin that you can use to implement the Guice injection. See the phpunit detector

Here are the required steps:

You need to define an annotation for the wait time that will be used in the plugin, see Annotations.java
You will need to define a provider for this value, in the BootstrapModule
Ensure that the parameter is injected in the Detector
You will then be able to bind a specific value in the tests

Let me know if you encounter any issue in the process.

Cheers,
~tooryx

am0o0 · 2024-05-17T15:27:34Z

@tooryx thank you a lot for helping me on this!

...e_2020_17526/src/main/java/com/google/tsunami/plugins/cve202017526/Cve202017526Detector.java

...17526/src/main/java/com/google/tsunami/plugins/cve202017526/Cve202017526DetectorConfigs.java

...20_17526/src/test/java/com/google/tsunami/plugins/cve202017526/Cve202017526DetectorTest.java

tooryx · 2024-05-20T12:51:19Z

Thank you for your work on this @am0o0. I asked a second member of the team to take a quick look. I expect this should be merged before the end of the week.

Cheers,
~tooryx

tooryx · 2024-05-20T15:47:11Z

Hi @am0o0,

Your PR has been merged. This usually means a reward will be granted. Google will start the internal QC process and the reward amount will be determined based on the quality of the detector report. Please be patient and allow up to a week for the QC process to finish. You'll be notified once the decision is made.

Thanks!

am0o0 added 2 commits April 6, 2024 13:56

v1

786e023

increase sleep duration

068ec9d

leonardo-doyensec self-assigned this Apr 12, 2024

leonardo-doyensec reviewed Apr 12, 2024

View reviewed changes

am0o0 added 2 commits April 13, 2024 12:37

fix formatting

a39ad86

fix wildcard imports fix recommendation and title of detection report set a constant for session cookie payload

fix tests

3d76869

leonardo-doyensec reviewed Apr 15, 2024

View reviewed changes

maoning assigned am0o0 and unassigned leonardo-doyensec Apr 25, 2024

fix redundent spaces, make CSRF_PATTERN static final, put a default c…

3ad19fe

…ase for switch statement

am0o0 added 2 commits April 27, 2024 00:06

remove redundant space in test

cff965f

Merge branch 'google:master' into airflow-CVE-2020-17526

cbd4978

update to gradle 7

251cdd2

maoning reviewed May 8, 2024

View reviewed changes

am0o0 added 2 commits May 9, 2024 06:16

add fall through for switch statement

47691c8

flask signer for fresh flask sessions :)

8d193da

am0o0 added 2 commits May 9, 2024 09:28

we don't want another same Exception

3cc6213

remove digestMethod parameter from constructor because it is constant

0e44c2d

am0o0 mentioned this pull request May 13, 2024

PRP: CVE-2023-27524 Apache Superset Auth bypass lead to RCE #317

Open

tooryx added 3 commits May 15, 2024 15:42

Remove logging of cookie values in Cve202017526Detector.java

dbb5467

Remove logging of cookie values

Remove space between impots in Cve202017526Detector.java

8367fb5

Fix fall through directives (see https://google.github.io/styleguide/…

e408c17

…javaguide.html#s4.8.4-switch)

tooryx reviewed May 15, 2024

View reviewed changes

make sleep time 20 instead of 25, remove wildcard imports

8671818

inject delay time to pass tests faster

2b69c14

finish the guice inject

10b848c

tooryx reviewed May 20, 2024

View reviewed changes

initialize oobSleepDuration by using @provides

d80f205

copybara-service bot merged commit af19eb6 into google:master May 20, 2024
5 checks passed

JamesFoxxx mentioned this pull request May 24, 2024

CVE-2022-29165 Argo CD Auth Bypass, publicly exposed UI with admin access #452

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Auth Bypass to RCE in Airflow #456

Auth Bypass to RCE in Airflow #456

am0o0 commented Apr 6, 2024

leonardo-doyensec left a comment •

edited

leonardo-doyensec left a comment •

edited

maoning commented Apr 25, 2024

am0o0 commented Apr 26, 2024

leonardo-doyensec commented May 7, 2024

am0o0 commented May 7, 2024

leonardo-doyensec commented May 7, 2024

maoning May 8, 2024

am0o0 May 8, 2024

tooryx May 15, 2024

maoning commented May 8, 2024

am0o0 commented May 9, 2024

tooryx left a comment

tooryx May 15, 2024

tooryx May 15, 2024

am0o0 commented May 15, 2024 •

edited

tooryx commented May 16, 2024

tooryx commented May 16, 2024 •

edited

am0o0 commented May 17, 2024

tooryx commented May 20, 2024

tooryx commented May 20, 2024

Auth Bypass to RCE in Airflow #456

Auth Bypass to RCE in Airflow #456

Conversation

am0o0 commented Apr 6, 2024

leonardo-doyensec left a comment • edited

Choose a reason for hiding this comment

leonardo-doyensec left a comment • edited

Choose a reason for hiding this comment

maoning commented Apr 25, 2024

am0o0 commented Apr 26, 2024

leonardo-doyensec commented May 7, 2024

am0o0 commented May 7, 2024

leonardo-doyensec commented May 7, 2024

maoning May 8, 2024

Choose a reason for hiding this comment

am0o0 May 8, 2024

Choose a reason for hiding this comment

tooryx May 15, 2024

Choose a reason for hiding this comment

maoning commented May 8, 2024

am0o0 commented May 9, 2024

tooryx left a comment

Choose a reason for hiding this comment

tooryx May 15, 2024

Choose a reason for hiding this comment

tooryx May 15, 2024

Choose a reason for hiding this comment

am0o0 commented May 15, 2024 • edited

tooryx commented May 16, 2024

tooryx commented May 16, 2024 • edited

am0o0 commented May 17, 2024

tooryx commented May 20, 2024

tooryx commented May 20, 2024

leonardo-doyensec left a comment •

edited

leonardo-doyensec left a comment •

edited

am0o0 commented May 15, 2024 •

edited

tooryx commented May 16, 2024 •

edited