Drupal Security Dive Into the Code

Dive into
Drupal Security
@greggles

Friday, May 18, 2012

Greg Knaddison
Pair programmer
@greggles
Acquian
Drupal Security Team


US$15 on kindle, US$26 paperback
crackingdrupal.com


Agenda

Overview

Warm up

CSRF, XSS, SQLi code


think like a diver


be the attacker

Say hello to $user_data


Drupal vulnerabilities by type

12%

7%

4%

3% 48%

10%

16%

XSS Access Bypass CSRF
Authentication/Session Arbitrary Code Execution SQL Injection
Others
reported in core and contrib SAs from 6/1/2005 through 3/24/2010


Eddy Out: Deﬁnitions

A1 - Injection

A2 - XSS

A3 - Broken Authentication and Session Mgmt

A4 - Insecure Direct Object References

A5 - Cross Site Request Forgery


Eddy Out: Definitions

A6 - Security Misconfiguration

A7 - Insecure Cryptographic Storage

A8 - Failure to Restrict URL Access

A9 - Insufficient Transport Layer Protection

A10 - Unvalidated Redirects and Forwards


Eddy Out: Freebies

A3 - Broken Authentication and Session Mgmt

A7 - Insecure Cryptographic Storage

A9 - Insufﬁcient Transport Layer Protection

But don’t stop at the top 10...or today’s 3


The basics
Toes in the water


Security Review module

Free

Automated check of conﬁgurations

drupal.org/project/security_review

Demo

http://crackingdrupal.com/n/32


Captaining your ship

ssh or sftp, but never ftp

shared wiﬁ? https if you can, vpn if you can’t

Least privilege

Audit roles


Stay up to date

Seriously


Modernize your vessel

Update module (can email you)

Mailing list

@drupalsecurity

rss: d.o/security/ d.o/security/contrib etc.


Head for the lifeboats

Have backups

Test them periodically

Be able to restore them

Sanitize before traveling with them

http://crackingdrupal.com/n/53


XSS
aka: Cross Site Scripting
code in browser using your session


XSS
Code

Running in your browser

Using your cookies on your site

Requesting, sending, reading responses

Browser context

Does that sound familiar?


Ajax

HTML
Drupal User
JS


Cross Site Scripting

HTML
Attacker JS Drupal Victim
JS

= Bad


Validate input

“Why would I ever want
javascript in a node title?”
-developer who forgot to ﬁlter on output


Validate input
Is it an email?

Is it a nid (right type? that they have access to?)

Is this my beautiful wife?

Is this my beautiful house?

Validation is NOT ﬁltering

Validation is “yes or no” - user ﬁxes it


Filter on output

“output”

“ﬁlter”

“on”


Output Contexts
Mail context

Database context

Web context

Server context

http://acko.net/blog/safe-string-theory-for-
the-web


Filtering XSS

Input untrusted data

Output browser appropriate data

check_plain, check_markup

ﬁlter_xss, ﬁlter_xss_admin

free: l(), t() @ and %, drupal_set_title


html
html
blah
html
<? print $node_title ?>
html


html
html
blah
html
<script>
alert(‘xss’);
<script>
html


html
html html
blah html
html blah
<script> html
alert(‘xss’); alert(‘xss’);
</script> html
html


Are you my XSS?

drupal_set_message($user_data);

$output .= $node->title;

FAPI checkboxes, radios,
descriptions, etc.


Identifying XSS

<script>alert(‘xss’);</script>

<img src=”asdf.png” onerror=”alert(‘xss’)”>


Deep Dive on XSS

http://drupalscout.com/tags/xss

XSS Resources

SQL Injection


User modiﬁed data

Included into a query

Without ﬁltering


php
php
sql $user_data
php
php


php
php
sql ‘’;delete from
users;
php
php


Fixing SQL Injection

“Use Drupal’s database API”

Placeholders

DBTNG, ORM, Methods (not that complex)


Dive on SQL Injection

CSRF
Cross Site Request Forgery
Taking action without confirming intent.


Taking action without conﬁrming intent.

How do we conﬁrm intent?

WTF is intent?


<a href=”/delete/user/1”>Delete user 1</a>


<a href=”/delete/1”>Delete user 1</a>

<img src=”/delete/1”>


CSRF Flow
/user
html

cookie
Victim Drupal


CSRF Flow
node/1
html

Victim Drupal


CSRF Flow
node/1
html
jquery.js

Victim js Drupal
foo.css
cookie
css
delete/1
object deleted
etc. in db


How do you exploit it?

URL Shorteners

<img src=”http://example.com/delete/2”>

Send a message to a site admin

What is my email address or twitter?


Are you my CSRF?

menu call back with an action verb and not
drupal_get_form

directly use $_POST, $_GET, arg(), menu object

not using form_submit OR drupal_get_token


Tokens (aka nonce)

Form API includes tokens by default

do form, form_validate, form_submit

don’t $_POST

OR: drupal_get_token, drupal_valid_token


Deep Dive on CSRF

http://drupalscout.com/tags/csrf

CSRF Resources

Resources
drupal.org/security

groups.drupal.org/best-practices-drupal-
security

drupalscout.com

acquia.com

crackingdrupal.com


Thanks!
questions?
contact?
@greggles
greg.knaddison@acquia.com


Drupal Security Dive Into the Code

Recomendados

Recomendados

Mais conteúdo relacionado

Semelhante a Drupal Security Dive Into the Code

Semelhante a Drupal Security Dive Into the Code (20)

Último

Último (20)

Drupal Security Dive Into the Code