Preventing XSS and CSRF vulnerabilities in WSO2 ESB


INTRODUCTION
In this article I will explain you how to prevent Cross Site Scripting and Cross-Site Request Forgery (CSRF) attacks in WSO2 ESB. First let me explain you what are those vulnerabilities.
What is XSS
Cross Site Scripting (XSS) is a client side code injection attack where an attacker can execute malicious scripts into a legitimate website or web application. XSS is a very common vulnerability exists in web applications and occurs when a web application makes use of unvalidated or unencoded user input within the output it generates. For an example an attacker can inject a malicious script into an input textfield of your web application, and once the form is submitted that malicious script get executed, leading to catastrophic consequences.

What is Cross-Site Request Forgery (CSRF)

CSRF is an attack that tricks the victim into submitting a malicious request. It inherits the identity and privileges of the victim to perform an undesired function on the victim's behalf. For most sites, browser requests automatically include any credentials associated with the site, such as the user's session cookie, IP address, Windows domain credentials, and so forth. Therefore, if the user is currently authenticated to the site, the site will have no way to distinguish between the forged request sent by the victim and a legitimate request sent by the victim. CSRF attacks target functionality that causes a state change on the server, such as changing the victim's email address or password, or purchasing something [2].
For an instance consider an online banking system where users carrying out their transactions such as paying bills, fund transfer etc. Suppose the victim has logged in, and his session is there with all the necessary credentials. An attacking web application running on victim's machine can make use of these information to send a POST request to the banking endpoint with these credentials if the required parameters are known priory.




WORKSHOP
Exploiting XSS Vulnerability
Now let us try to exploit XSS vulnerability in WSO2 ESB. I am going to use ESB 4.7.0 version which can be downloaded from [3]. Unzip the ESB 4.7.0 and start it by running following command.
ESB_HOME/bin/./wso2server.sh


Login to the ESB admin web console using the following url.

Go to configure tab, under users and roles click on the Users link and enter the following script into the search text box and click on the search button.
<script>alert('XSS')</script>
It searches users with the injected script. Moreover you can create a user by giving above script as password. An attacker can easily use this to inject a malicious script into our administrative web console and exploit vulnerabilities.
How to Prevent the vulnerabilities
To prevent those vulnerabilities we need to unzip and apply the patch (named as patch0450) [4] to our ESB. To apply the patch merely unzip and copy the given patch directory into the ESB_HOME/repository/components/patches directory.


Then locate the catalina-server.xml  file under the  $ESB_HOME/repository/conf/tomcat directory and add the following elements under <Host> element.



Then locate the carbon.xml file under the <ESB_HOME>/repository/conf/ directory and add the following configuration under the <Security> element.





Now start the ESB instance. Once started try to access the ESB administrative web console using the following url.

You may get the following error when you login to the admin web console.


ERROR - CompositeValve Could not handle request: /carbon/admin/images/menu_header.gif
javax.servlet.ServletException: Possible CSRF attack. Refer header : https://10.100.5.120:9443/carbon/styles/css/main.css
at org.wso2.carbon.ui.valve.CSRFValve.validateRefererHeader(CSRFValve.java:130)
at org.wso2.carbon.ui.valve.CSRFValve.validatePatterns(CSRFValve.java:87)
This is similar to CSRF attack which is going to connect to our ESB. If you are pretty much sure about this request url and really need to allow this you need to add this url into <WhiteList> element resides inside the  <CSRFPreventionConfig> element. For that first shut down the ESB instance and add the following element into the <WhiteList> element of the <CSRFPreventionConfig> element.

Now start the ESB again and now you should be able to access the admin web console via the above url since we have added that to our whitelist, which instructs the security framework that we are going to trust this as a legitimate request.
Now as we did above move into the Users and Roles under Configure menu and try to search for users giving the following string value.
<script>alert('XSS')</script>
You may get an error and ended  up with a blank white screen. Now you can not inject scripts as you did before any more. Hurrah, we have secured our ESB now!
Next let us go ahead and create a Proxy service with script mediator which contains a simple java script.


Go to Main menu → Proxy Service → Custom Proxy, and give it a name ‘XSSProxy’ in my case. Leave others as it is and move on to the next step. In step 2, under define in sequence click on Define Inline → Create. Under Add Child → Extensions → Script. Then make sure script type is set to inline and language is set to javascript. Copy the following script into the Source Script text area.
alert('Hello');
Click on update, you may end up with a white blank screen and notice the following error in ESB console.
javax.servlet.ServletException: Possible XSS Attack. Suspicious code : <script>alert('XSS')</script>
at org.wso2.carbon.ui.valve.XSSValve.validateParameters(XSSValve.java:130)
at org.wso2.carbon.ui.valve.XSSValve.invoke(XSSValve.java:106)
After applying our security patch and necessary configuration changes it suspects this as a potential XSS attack. But this is not an XSS attack and we should be able to add scripts inside script mediators within our Proxy services, APIs etc. Therefore we need to allow this. For that we need to shut down the ESB and add this pattern under the <Patterns> element of the <XSSPreventionConfig> element. I have already added them but they are commented at the moment, hence you are getting this error. So you merely go ahead and uncomment those patterns under the <Patterns> element of the <XSSPreventionConfig> element. Then start the ESB again and try to create a Proxy service with a script mediator which consists of a simple java script as above. Now you should be able to create it without any errors.

Conclusion
In this article I have walked you through XSS and CSRF vulnerabilities in WSO2 ESB. First I gave a brief introduction to XSS and CSRF vulnerabilities. Then we exploited XSS and CSRF vulnerabilities with a fresh ESB 4.7.0 pack. Then I discussed about how to prevent those XSS and CSRF vulnerabilities in WSO2 ESB and gave you necessary configurations. Then I have proven you that after applying these patches and configurations, the XSS and CSRF vulnerabilities were avoided by using few sample use cases.





References


Comments

Post a Comment

Popular posts from this blog

Introducing Java Reactive Extentions in to a SpringBoot Micro Service

Image
Introduction Today we are going to take a look at Reactive Programming using Java8 and RxJava, which is a library for composing asynchronous and event-based programs by using observable sequences. RxJava stands for Reactive Extensions for the JVM. It extends the observer pattern [Gamma95] to support sequences of data/events and adds operators that allow you to compose sequences together declaratively while abstracting away concerns about things like low-level threading, synchronization, thread-safety and concurrent data structures [1]. Pre-Requisites : Having a good knowledge about Java8, Functional Programming and spring boot microservices. What is Reactive programming? In essence, Reactive programming is an asynchronous programming paradigm concerned with data streams. The system time, a list of entries from the DB/API, user clicks, everything can be a stream of data. Data from different streams can easily be combined and transformed, and in the end processed/observed by the ...
Read more

Optimal binary search trees

Image
Suppose that we are designing a program to translate text from English to French. For each occurrence of each English word in the text, we need to look up its French equivalent. We could perform these lookup operations by building a binary search tree with $n$ English words as keys and their French equivalents as satellite data. Because we will search the tree for each individual word in the text, we want the total time spent searching to be as low as possible. We could ensure an $Θ(log_2 \;n)$ search time per occurrence by using a red-black tree or any other balanced binary search tree. Words appear with different frequencies, however, and a frequently used word such as the may appear far from the root while a rarely used word appears near the root. Such an organization would slow down the translation, since the number of nodes visited when searching for a key in a binary search tree equals one plus the depth of the node containing the key. We want words that occur frequently in the t...
Read more

Combining the emissions of multiple Observables together using RxJava Zip operator in a Spring Boot Micro service

Image
Introduction Well, today we are going to discuss an advanced RxJava operator called Zip. Let’s first take a look at the zip operator at a glance and then move on to a real world example that leverages the capabilities of the operator. In fact, zip is a very powerful and useful operator provided in the RxJava library. Prerequisites : Good knowledge of Java8, Functional Programming, RxJava, Spring Boot, Microservices. User Level : Advanced Since this is an advanced article, I am not going to walk you through the basics of RxJava or Spring Boot microservices. If you need to get some basic understanding of RxJava, I thoroughly recommend you to go through one of my previous blog posts [1] [2] or any other good introductory article about RxJava. If you need to learn more about Spring Boot microservices please go through some of the spring tutorials which are really comprehensive and impressive. RxJava Zip Operator Combines the emissions of multiple Observables together via a speci...
Read more