Welcome back to insecurity. Serialization session in
the second part. We will exploit insecurity serialization in
our Target application. We
will jump straight to our intentionally vulnerable application, and
then move on to the mitigation part. We
are about to exploit insecurities serialization in our Target
intentionally, vulnerable application and we will
do it in a specific address API. Dashed box.
This is a common API address where Swagger is
made available to find common addresses. You
can use specific word lists. There are plenty of them
available as well as several tools to run through their entries. Swagger
is an open-source software framework backed by
a large ecosystem of tools, that helps developers design build
document and consume restful web
services.
What we have here is the Swagger you why which
provides documentation of available API methods. What's
expected as request payloads and possible responses?
This tool also allows us to test the API issuing
requests and watching responses data
in place.
We will need an account to test API. We
will create one and grab the authorization token to provide
it to Swagger. Ey.
We can now pick the three session token from browsers, local
storage. It is just a matter of copy
and paste it into Swagger ey.
We should now be able to successfully execute the example
request.
Let's have a closer. Look at the example. Request payload.
Order lines and Order lines. Data properties are
quite similar. But while the former is a Json array. The
later is a string. In fact, the
later looks to be a Json, stringify, the ray.
We can check request data, schemas documentation provided by
Swagger ey.
Regarding order lines data property. It says
it is a customer specific, Json format. Let's
change the request and see what happens when we send a
malformed order lines data property.
This time, we got a 500 internal server error response
and the response body includes a lot of details such
as a stack Trace commonly leaked on unhandled errors.
The message says a is not defined. What sounds
that they Pi server was looking for a variable called
a meaning that the property value was executed
as JavaScript, the stack
Trace shows that the error was thrown by the not evil
node package. Let's check its documentation.
In fact, bays are not evil documentation order
lines data property is evaluated as JavaScript. It
doesn't sound right. But it might have been used to convert the
string back to array for some reason. Not
only we have found an insecurity serialization, but also
a remote code execution issue.
Let's change our request and try some valid JavaScript.
We've got two successful HTTP response, we
can now try to crash the server with an
infinite Loop.
This time, we've got an internal server error response.
Our infinite Loop was detected and
Max iterations reached. This would
have been enough to cause a denial of service. If there was no
protection in place, next, we
will discuss what makes the application vulnerable, and
how to prevent it.