TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Coordinated disclosure of XML roundtrip vulnerabilities in Go’s standard library

223 点作者 jupenur超过 4 年前

11 条评论

tedunangst超过 4 年前
I&#x27;ve never liked (nor understood the popularity) of signature schemes that require parsing before verification. This has also led to problems with X.509. And DKIM. And plists. And package managers. And more.<p>It&#x27;s much simpler to sign the entire message, unparsed, and it&#x27;s immune to these issues.<p>We went through a decade of debate before deciding that &quot;encrypt then mac&quot; is the only right way to do things. That knowledge hasn&#x27;t trickled down to other domains.
评论 #25425082 未加载
评论 #25424881 未加载
评论 #25428264 未加载
评论 #25425279 未加载
评论 #25423231 未加载
评论 #25428633 未加载
russell_h超过 4 年前
I&#x27;m the maintainer of one of the affected SAML libraries.<p>People need to stop using SAML. This needs to be a priority. A little background, for those who haven&#x27;t had the displeasure of working with it:<p>When a user wants to log into an application (the &quot;Service Provider&quot;), and is required to SSO against an &quot;Identity Provider&quot;, the Identity Provider basically generates an XML document with information about the user, then signs that document using a thing known as an XML Digital Signature, or XMLDSIG.<p>When you think of &quot;signing&quot; a document, normally you would serialize that document out to bytes, apply your signature scheme over the bytes, then send along both the bytes and the signature. But for reasons which are irrelevant to modern implementations, XMLDSIG prefers to stuff the signature metadata back inside the XML document that was just signed. Obviously this invalidates the signature, so you also inject some metadata instructing receivers on how to put the document back how it was. There are several algorithms available for this. Then you ship around that XML document. Basically means that when the Identity Provider receives one of these documents it needs to:<p><pre><code> 1. Parse the XML document (which cannot yet be trusted) 2. Find the signature inside the document 3. Find the metadata about what algorithm(s) to use to restore the document 4. Run the document through whatever transforms are described in that metadata (keep in mind that up to this point the document might well have been supplied by an attacker) 5. Serialize the transformed document back out to bytes, being careful not to touch any whitespace, etc 6. Verify the signature over the re-serialized document </code></pre> If all of this succeeds and was implemented perfectly, you can trust the output of step 5. Ideally you should re-parse it. A common failure mode is trusting the original input instead, so be careful about that.<p>Obviously this is a crazy approach to one of the most security-critical parts of an application on the internet, and it breaks all the time.<p>Unfortunately people persist in using this fundamentally broken protocol, so huge thank you to the team at Mattermost for their research in this area.
评论 #25425134 未加载
评论 #25424425 未加载
评论 #25428057 未加载
评论 #25425094 未加载
评论 #25426003 未加载
评论 #25429649 未加载
tannhaeuser超过 4 年前
XML namespaces were controversial when introduced, and their implementation as privileged &quot;xmlns:...&quot; attributes with complex scoping, layering, and defaulting rules have been criticized many times; see [1] for a reflection from 2010 by an insider admitting to the fact that &quot;every step on the process that led to the current situation with XML Namespaces seems reasonable&quot;.<p>When in 1996-98 W3C&#x2F;The SGML Extended Review Board subset XML from SGML to define a generic markup convention for use with the expected wealth of upcoming vocabularies on the web, the issue of name collisions between elements (and attributes) from different vocabularies was deemed significant. Of course, in hindsight, with only SVG and MathML (and rarely HTML 5 in XHTML serialization) left on the web and having been incorporated as foreign elements directly into HTML, this seems overkill (even though there are actually collisions between eg. the title element in SVG vs HTML).<p>There&#x27;s an alternative (and saner IMHO) approach for dealing with XML namespaces in ISO&#x2F;IEC 19757-9 [2] by just presenting a canonical (ie. always the same) namespace prefix as part of an element name by a parser API to an app, guided by processing instructions for binding canonical namespace prefixes to namespace URLs, which might also help enterprise-y XML with lots of XML Schema use. Of course, this doesn&#x27;t help with roundtripping xmlns-bindings (eg. with their exact ordering, possible redundancy, temporary&#x2F;insignificant namespace prefixes, re-binding in document fragments etc.) through DOM representations, which seems the problem here.<p>[1]: <a href="https:&#x2F;&#x2F;blog.jclark.com&#x2F;2010&#x2F;01&#x2F;xml-namespaces.html" rel="nofollow">https:&#x2F;&#x2F;blog.jclark.com&#x2F;2010&#x2F;01&#x2F;xml-namespaces.html</a><p>[2]: <a href="https:&#x2F;&#x2F;www.iso.org&#x2F;obp&#x2F;ui&#x2F;#iso:std:iso-iec:19757:-9:ed-1:v1:en" rel="nofollow">https:&#x2F;&#x2F;www.iso.org&#x2F;obp&#x2F;ui&#x2F;#iso:std:iso-iec:19757:-9:ed-1:v1...</a>
warp超过 4 年前
&gt; Despite significant efforts by the Go security team, it has not been possible to patch the vulnerabilities discussed in this blog post.<p>Well, that is not something you want to see in a public disclosure.
评论 #25422111 未加载
评论 #25422143 未加载
jarym超过 4 年前
Glad this got found. I remember when XML was being widely adopted that there&#x27;d be frequent vulnerabilities found in Java-based parsers.<p>A large part of this stems from how complicated XML can get - if it were only elements and attributes it might have been fine. Namespaces made it a bit more complicated. Processing Instructions made it hideous.
评论 #25425392 未加载
评论 #25421910 未加载
chrsig超过 4 年前
It&#x27;s worth noting that the go1 compatibility promise[1] allows for breaking compatibility in the name of security issues:<p>&gt;Security. A security issue in the specification or implementation may come to light whose resolution requires breaking compatibility. We reserve the right to address such security issues.<p>If the go team decides that this issue is worth a breaking change is another question entirely.<p>[1]<a href="https:&#x2F;&#x2F;golang.org&#x2F;doc&#x2F;go1compat" rel="nofollow">https:&#x2F;&#x2F;golang.org&#x2F;doc&#x2F;go1compat</a>
jerf超过 4 年前
Anyone have examples of XML that can be mutated? My guess is that it wouldn&#x27;t take much.<p>I expect that a similar problem will be found in many other libraries, if the XML was publicized. XML namespaces made a critical... &quot;mistake&quot; is probably too strong, but &quot;design choice that deviated too far from people&#x27;s mental model&quot; is about right... that has prevented them from being anywhere near as useful or safe as they could be. In an XML document using XML namespaces, &quot;ns1:tagname&quot; may not equal &quot;ns1:tagname&quot;, and &quot;ns1:tagname&quot; can be equal to &quot;ns2:tagname&quot;. This breaks people&#x27;s mental models of how XML works, and correspondingly, breaks people&#x27;s code that manipulates XML.<p>(I actually used the Go XML library as an SVG validator in the ~1.8 timeframe and had to fork it to fix namespaces well enough to serve in that role. I didn&#x27;t know about how to exploit it in a specific XML protocol but I&#x27;ve know about the issues for a while. &quot;Why didn&#x27;t you upstream it then?&quot; Well, as this security bulletin implies, the data structures in encoding&#x2F;xml are fundamentally wrong for namespaced XML to be round-tripped and there is no backwards-compatible solution to the problem, so it was obvious to me without even trying that it would be rejected. This has also been discussed on a number of tickets subsequently over the years, so that XML namespace handling is weak in the standard library is not news to the Go developers. Note also that it&#x27;s &quot;round-tripping&quot; that is the problem; if you parse &amp; consume you can write correct code, it&#x27;s the sending it back out that can be problematic.)<p>Namespaces fundamentally rewrite the nature of XML tag and attribute names. No longer are they just strings; now they are tuples of the form (namespace URL, tag name)... and namespace URL is <i>NOT</i> the prefix that shows up before the colon! The prefix is an abbreviation of an earlier tag declaration. So in the XML<p><pre><code> &lt;tag xmlns=&quot;https:&#x2F;&#x2F;sample.com&#x2F;1&quot; xmlns:example1=&quot;https:&#x2F;&#x2F;blah.org&#x2F;1&quot;&gt; &lt;example1:tag xmlns:example2=&quot;https:&#x2F;&#x2F;blah.org&#x2F;2&quot;&gt; &lt;example2:tag xmlns:example1=&quot;https:&#x2F;&#x2F;anewsite.com&#x2F;xmlns&quot;&gt; &lt;example1:tag &#x2F;&gt; &lt;&#x2F;example2:tag&gt; &lt;&#x2F;example1:tag&gt; &lt;&#x2F;tag&gt; </code></pre> not a SINGLE ONE of those &quot;tag&quot;s is the same! They are, respectively, actually (<a href="https:&#x2F;&#x2F;sample.com&#x2F;1" rel="nofollow">https:&#x2F;&#x2F;sample.com&#x2F;1</a>, tag), (<a href="https:&#x2F;&#x2F;blah.org&#x2F;1" rel="nofollow">https:&#x2F;&#x2F;blah.org&#x2F;1</a>, tag), (<a href="https:&#x2F;&#x2F;blah.org&#x2F;2" rel="nofollow">https:&#x2F;&#x2F;blah.org&#x2F;2</a>, tag), and (<a href="https:&#x2F;&#x2F;anewsite.com&#x2F;xmlns" rel="nofollow">https:&#x2F;&#x2F;anewsite.com&#x2F;xmlns</a>, tag). There&#x27;s a ton of code, and indeed, even quite a few standards, that will get that wrong. (Note the redefinition of &#x27;example1&#x27; in there; that is perfectly legal.) Even more excitingly,<p><pre><code> &lt;tag xmlns=&quot;https:&#x2F;&#x2F;sample.com&#x2F;1&quot; xmlns:example1=&quot;https:&#x2F;&#x2F;sample.com&#x2F;1&quot;&gt; &lt;example1:tag&#x2F;&gt; &lt;example2:tag xmlns:example2=&quot;https:&#x2F;&#x2F;sample.com&#x2F;1&quot; &#x2F;&gt; &lt;&#x2F;tag&gt; </code></pre> <i>ARE</i> all the exact tag and should be treated as such, despite the different &quot;tag names&quot; appearing.<p>Reserializing these can be exciting, because A: Your XML library, in principle, ought to be presenting you the (XMLNS, tagname) tuple with the abbreviation stripped away, to discourage you from paying too much attention to the abbreviation but B: humans in general and a lot of code expect the namespace abbreviations to stay the same in a round trip, and may even standardize on what the abbreviations should be. There&#x27;s a LOT of code out there in the world looking for &quot;&#x27;p&#x27; or &#x27;xhtml:p&#x27;&quot; as the tag name and not (&quot;<a href="http:&#x2F;&#x2F;www.w3.org&#x2F;1999&#x2F;xhtml" rel="nofollow">http:&#x2F;&#x2F;www.w3.org&#x2F;1999&#x2F;xhtml</a>&quot;, &quot;p&quot;).<p>In general, to maintain roundtrip equality, you have to either A: maintain a table of the abbreviations you see, when they were introduced, and also which was used or B: just use the (XMLNS, tagname) and ensure that while outputing that the relevant namespaces have always been declared. Generally for me I go for option B as it&#x27;s generally easier to get correct and I pair it with a table of the most common namespaces for what I&#x27;m working in, so that, for example, XHTML gets a hard-coded &quot;xhtml:&quot; prefix. It is very easy if you try to implement A to screw it up in a way that can corrupt the namespaces on some input.<p>(Option B has its own pathologies. Consider:<p><pre><code> &lt;tag xmlns:sample=&quot;https:&#x2F;&#x2F;example.com&#x2F;1&quot;&gt; &lt;sample:tag1 &#x2F;&gt; &lt;sample:tag2 &#x2F;&gt; &lt;&#x2F;tag&gt; </code></pre> It&#x27;s really easy to write code that will drop the xmlns specification on all of the children of &quot;tag&quot;, since it didn&#x27;t use it there, and if your code throws away where the XMLNS was declared and just looks to whether the NS is currently declared, it&#x27;ll see a new declaration of the &quot;sample&quot; namespace on every usage. Technically correct if the downstream code handles namespaces correctly (big if!), but visually unappealing.)<p>Not defending Go here, except inasmuch as it&#x27;s such a common error to make that I have a hard time naming libraries and standards that get namespaces <i>completely</i> correct, for as simple as they are in principle. (I think SVG and XHTML have it right. XMPP is very, very close, but still has a few places where the &quot;stream&quot; tag is placed in different namespaces and you&#x27;re just supposed to know to handle it the same in all the namespaces it appears it... which most people do only because it doesn&#x27;t occur to them that technically these are separate tags, so it all kinda works out in the end.... libxml2 is correct but I&#x27;ve seen a lot of things that build on top of it and they almost all screw up namespaces.)
评论 #25422579 未加载
评论 #25422270 未加载
评论 #25422612 未加载
评论 #25435654 未加载
评论 #25429720 未加载
评论 #25422049 未加载
GauntletWizard超过 4 年前
I&#x27;d like to ask everyone here who&#x27;s familiar with SAML to take a look at SPIFFE[1], which underlies Istio.<p>I&#x27;m biased in this regard, but I view SPIFFE&#x27;s inclusion of JWT Tokens as an authentication method as fundamentally flawed - By allowing bearer tokens, you are no longer verifying identity, but passing identity around. JWT has also been susceptible in the past[2] to the same kinds of attacks here - Poorly defined verification semantics.<p>I suspect that buried in the semantics around SPIFFE&#x27;s SPIRE Server and Agent are a number of vulnerabilities or other ways that trust doesn&#x27;t mean quite what you think it means. I&#x27;d love for someone with interest to take a look. Besides the obvious downsides fundamental to Isitio&#x27;s MITM Proxy architecture, I think there&#x27;s more lurking on that edge.<p>[1] <a href="https:&#x2F;&#x2F;spiffe.io&#x2F;" rel="nofollow">https:&#x2F;&#x2F;spiffe.io&#x2F;</a> [2] <a href="https:&#x2F;&#x2F;auth0.com&#x2F;blog&#x2F;critical-vulnerabilities-in-json-web-token-libraries&#x2F;" rel="nofollow">https:&#x2F;&#x2F;auth0.com&#x2F;blog&#x2F;critical-vulnerabilities-in-json-web-...</a>
nimish超过 4 年前
`encoding&#x2F;xml` has had broken handling of namespaces for a long time. It’s possible to hack it on but the only reasonable choice is to use a libxml2 binding which also gets you canonicalization, another can of worms.<p>Unsurprised it can cause security issues, especially in XML-DSig which is a nightmare to handle correctly.
评论 #25424581 未加载
random5634超过 4 年前
XML<p>I&#x27;m amazed people can get it as right as they do half the time? I do think Go will get fixed eventually. It&#x27;s just too weird if they couldn&#x27;t fix the core issue? But I&#x27;ve never used XML if I can help it, so I&#x27;m absolutely no expert on what would make it impossible to fix something like this.
评论 #25422071 未加载
forrestthewoods超过 4 年前
Can we just consider XML itself an unsolvable vulnerability and call it day?
评论 #25422647 未加载