In this post, we show a proof-of-concept attack that gives us root access to a victim's VM in the Cloud Management Platform OpenNebula, which means that we can read and write all its data, install software, etc. The interesting thing about the attack is, that it allows an attacker to bridge the gap between the cloud's high-level web interface and the low-level shell-access to a virtual machine.

Like the latest blogpost of this series, this is a post about an old CSRF- and XSS-vulnerability that dates back to 2014. However, the interesting part is not the vulnerability itself but rather the exploit that we were able to develop for it.

An attacker needs the following information for a successful attack.

• ID of the VM to attack
  OpenNebula's VM ID is a simple global integer that is increased whenever a VM is instantiated. The attacker may simply guess the ID. Once the attacker can execute JavaScript code in the scope of Sunstone, it is possible to use OpenNebula's API and data structures to retrieve this ID based on the name of the desired VM or its IP address.
• Operating system & bootloader
  There are various ways to get to know a VMs OS, apart from simply guessing. For example, if the VM runs a publicly accessible web server, the OS of the VM could be leaked in the HTTP-Header Server (see RFC 2616). Another option would be to check the images or the template the VM was created from. Usually, the name and description of an image contains information about the installed OS, especially if the image was imported from a marketplace.
  Since most operating systems are shipped with a default bootloader, making a correct guess about a VMs bootloader is feasible. Even if this is not possible, other approaches can be used (see below).
• Keyboard layout of the VM's operating system
  As with the VMs bootloader, making an educated guess about a VM's keyboard layout is not difficult. For example, it is highly likely that VMs in a company's cloud will use the keyboard layout of the country the company is located in.

Overview of the Attack

The key idea of this attack is that neither Sunstone nor noVNC check whether keyboard related events were caused by human input or if they were generated by a script. This can be exploited so that gaining root access to a VM in OpenNebula requires five steps:

1. Using CSRF, a persistent XSS payload is deployed.
2. The XSS payload controls Sunstone's API.
3. The noVNC window of the VM to attack is loaded into an iFrame.
4. The VM is restarted using Sunstone's API.
5. Keystroke-events are simulated in the iFrame to let the bootloader open a root shell.

Figure 1: OpenNebula's Sunstone Interface displaying the terminal of a VM in a noVNC window.

The following sections give detailed information about each step.

Executing Remote Code in Sunstone

In Sunstone, every account can choose a display language. This choice is stored as an account parameter (e.g. for English LANG=en_US). In Sunstone, the value of the LANG parameter is used to construct a <script> tag that loads the corresponding localization script. For English, this creates the following tag:

<script src="locale/en_US/en_US.js?v=4.6.1" type="text/javascript"></script>

Setting the LANG parameter to a different string directly manipulates the path in the script tag. This poses an XSS vulnerability. By setting the LANG parameter to LANG="onerror=alert(1)//, the resulting script tag looks as follows:

<script src="locale/"onerror=alert(1)///"onerror=alert(1)//.js?v=4.6.1" type="text/javascript"></script>

For the web browser, this is a command to fetch the script locale/ from the server. However, this URL points to a folder, not a script. Therefore, what the server returns is no JavaScript. For the browser, this is an error, so the browser executes the JavaScript in the onerror statement: alert(1). The rest of the line (including the second alert(1)) is treated as comment due to the forward slashes.

When a user updates the language setting, the browser sends an XMLHttpRequest of the form

{ "action" : { "perform" : "update", "params" : { "template_raw" : "LANG=\"en_US\"" } }}

to the server (The original request contains more parameters. Since these parameters are irrelevant for the technique, we omitted them for readability.). Forging a request to Sunstone from some other web page via the victim's browser requires a trick since one cannot use an XMLHttpRequest due to restrictions enforced by the browser's Same-Origin-Policy. Nevertheless, using a self-submitting HTML form, the attacker can let the victim's browser issue a POST request that is similar enough to an XMLHttpRequest so that the server accepts it.

An HTML form field like

<input name='deliver' value='attacker' />

is translated to a request in the form of deliver=attacker. To create a request changing the user's language setting to en_US, the HTML form has to look like

<input name='{"action":{"perform":"update","params":{"template_raw":"LANG' value='\"en_US\""}}}' />

Notice that the equals sign in LANG=\"en_US\" is inserted by the browser because of the name=value format.

Figure 2: OpenNebula's Sunstone Interface displaying a user's attributes with the malicious payload in the LANG attribute.

Using this trick, the attacker sets the LANG parameter for the victim's account to "onerror=[remote code]//, where [remote code] is the attacker's exploit code. The attacker can either insert the complete exploit code into this parameter (there is no length limitation) or include code from a server under the attacker's control. Once the user reloads Sunstone, the server delivers HTML code to the client that executes the attacker's exploit.

Prepare Attack on VM

Due to the overwritten language parameter, the victim's browser does not load the localization script that is required for Sunstone to work. Therefore, the attacker achieved code execution, but Sunstone breaks and does not work anymore. For this reason, the attacker needs to set the language back to a working value (e.g. en_US) and reload the page in an iFrame. This way Sunstone is working again in the iFrame, but the attacker can control the iFrame from the outside. In addition, the attack code needs to disable a watchdog timer outside the iFrame that checks whether Sunstone is correctly initialized.

From this point on, the attacker can use the Sunstone API with the privileges of the victim. This way, the attacker can gather all required information like OpenNebula's internal VM ID and the keyboard layout of the VM's operating system from Sunstone's data-structures based on the name or the IP address of the desired VM.

Compromising a VM

Using the Sunstone API the attacker can issue a command to open a VNC connection. However, this command calls window.open, which opens a new browser window that the attacker cannot control. To circumvent this restriction, the attacker can overwrite window.open with a function that creates an iFrame under the attacker's control.

Once the noVNC-iFrame has loaded, the attacker can send keystrokes to the VM using the dispatchEvent function. Keystrokes on character keys can be simulated using keypress events. Keystrokes on special keys (Enter, Tab, etc.) have to be simulated using pairs of keydown and keyup events since noVNC filters keypress events on special keys.

Getting Root Access to VM

To get root access to a VM the attacker can reboot a victim's VM using the Sunstone API and then control the VM's bootloader by interrupting it with keystrokes. Once the attacker can inject commands into the bootloader, it is possible to use recovery options or the single user mode of Linux based operating systems to get a shell with root privileges. The hardest part with this attack is to get the timing right. Usually, one only has a few seconds to interrupt a bootloader. However, if the attacker uses the hard reboot feature, which instantly resets the VM without shutting it down gracefully, the time between the reboot command and the interrupting keystroke can be roughly estimated.

Even if the bootloader is unknown, it is possible to use a try-and-error approach. Since the variety of bootloaders is small, one can try for one particular bootloader and reset the machine if the attack was unsuccessful. Alternatively, one can capture a screenshot of the noVNC canvas of the VM a few seconds after resetting the VM and determine the bootloader.

A video of the attack can be seen here. The browser on the right hand side shows the victim's actions. A second browser on the left hand side shows what is happening in OpenNebula. The console window on the bottom right shows that there is no user-made keyboard input while the attack is happening.

Players on PlayStation 4 and Xbox One can now experience and craft their very own sprawling RPG adventure and explore the infinite possibilities that await them from detailed character customization to the individual meaningful choices they make in-game.

"Console gamers can fully immerse themselves in an RPG adventure of exploration and discovery in what will be one of the definitive tabletop role-playing experiences available in 2020," said Steve Escalante, General Manager of Versus Evil.

Consumers can digitally purchase the Pillars of Eternity II: Deadfire Ultimate Edition through the Microsoft Store and PlayStation Store fronts today. Deadfire is also available as a physical release from today in the form of a Standard Edition and the Ultimate Collector's Edition courtesy of THQ Nordic for Xbox One and PlayStation 4 at an SRP of €59.99 | $59.99 | £49.99 and €129.99 | $129.99 | £119.99, respectively. The Ultimate Collector's Edition will contain the following items.

• Pillars of Eternity 2: Deadfire [including the 5.0 PC patch], and all DLCs: Beast of Winter, The Forgotten Sanctum, Seeker, Slayer, Survivor
• 10"/25cm Od Nua Statue
• Spacepig Keychain
• Metal-optic 3D Sticker
• Premium Box

Read more...

Beach Fallacy

This month we celebrate our store's 15th anniversary. I am happy to report in year 15 I learned from failure. Failure means I'm still trying to innovate and change things up. This particular failure was one I recently realized while speaking with a friend who just sold his business. It comes down to this: The idea you can remotely manage your business with an installed manager is temporary at best. The 4-Hour Work Week may work for a turn key business, but most businesses are not even remotely turn key.

You may have a great manager, but they won't be there forever, and the process of getting a new one trained up, will be time consuming and not conducive to lying on a beach. So even if you have the skills to train them, how fast can they reasonably achieve mastery? In general, the concept of remote management for me has gone from something I might be able to do full time to something that may be possible half the time, that half determined by chaos in my business.

So I may be able to live in Mexico, for example, six months out of the year, a random six months at that, but I better have a place to stay when it all falls apart and I have to retrain staff for six months back home. The idea you can do this all remotely, living elsewhere, is a myth.

Here are the three areas that I see, that if I were a better owner or had magic powers, I would be able to solve to extend my six month theory. If you think you have skills in how to quickly train up candidates in these areas, this is where I would pay for a consultant:

• Gross versus Net. A bad manager will spend your business into the ground with no apparent benefit. An alright manager will spend your money on long term investments that pay off later, but still leave you in the poor house right now, as they usually don't understand cash flow. A great manager will always spend cautiously and be conscious of the bottom line and the cash needs of the business.

I was not a "great manager" of cash until I had distributions from the net profit. I became incentivized to focus on net. Unless you can incentivize someone with bonuses for producing net profit, you'll always be watching your back (which you will always do regardless). Or you may train someone to be so overly cautious with your money, they take no chances at all.

• Tight Employee Management. A good manager sets employee expectations via an accurate job description and solid training. The manager manages those expectations through the employees tenure by means of additional training and corrective action. Then they reward or penalize employee performance based on how those results are achieved. 

Most managers, most people, can't do this. They simply can't without some very good training, and even then it's not within most peoples personality range. I can tell you from the corporate world that most managers are untrained and awful. Training a manager to master this process will ensure you always have good people, but good luck finding someone skilled at this for what you can afford and good luck developing the skills in yourself when you've probably only had bad managers.

• Inventory Accuracy. Does anyone other than you really care if your POS system is only 90% accurate? Inventory accuracy results in better buying practices, higher sales, lower taxes, and happier customers. Yet, it is very difficult to have a manager who cares about this accuracy as much as you. It is very much tied to net profit. If you find someone outraged at inaccuracy, and they have skill in the other two areas, find a way to groom that employee for manager. 

So those are the three areas that require an owner to be involved in a store on a near daily basis. This does not mean your store sucks if this is the case. In fact, there's no reason this should harm the value of your business if, say, you wanted to sell it. Someone with these three concerns will always need to have their hand on the wheel, but it's unlikely to be an employee for very long.

Read more...