对ASP.NET的最新安全漏洞的详细分析

黑客可以下载ASP.NET网站的核心文件(WEB.CONFIG)，我估计还可以下载任意文件，例如数据库。

这个BUG基本上是致命的，可是博客园的描述却非常的少，我看了半天也没有明白什么意思，如何攻击，于是挖掘下去。现在把一些明细写出来。

微软原文：

http://weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspx

黑客如何发起攻击：

#div_code img { border: 0px none; }

To understand how this vulnerability works, you need to know about cryptographic oracles. An oracle in the context of cryptography is a system which provides hints as you ask it questions. In this case, there is a vulnerability in ASP.NET which acts as a padding oracle. This allows an attacker to send cipher text to the web server and learn if it was decrypted properly by examining which error code was returned by the web server. By making many such requests (and watching what errors are returned) the attacker can learn enough to successfully decrypt the rest of the cipher text.

大致意思是关于 cryptographic oracle. 黑客通过不断重复发送信息，检测返回的错误信息，然后了解加密算法，最后实现攻击。可是这段话还是没有明白，于是继续搜索：

http://visualstudiomagazine.com/articles/2010/09/14/aspnet-security-hack.aspx

这篇文章说明了大致的攻击流程。由于这个问题影响非常大，我就不翻译中文了，只是简单概述一下：

#div_code img { border: 0px none; }

they can repeatedly modify an ASP.NET Forms Authentication cookie encrypted using AES and, by examining the errors returned, determine the Machine Key used to encrypt the cookie. The process is claimed to be 100percent reliable and takes between 30 and 50 minutes for any site.

2个研究员发现，通过一个工具，能够 修改被AES加密过的 ASP.NET窗体验证cookie;然后检查返回错误信息;获取Machine Key。这个过程100%成功而且只需要30分钟。

#div_code img { border: 0px none; }

Once the Machine Key is determined, attackers can create bogus forms authentication cookies. If site designers have chosen the option to embed role information in the security cookie, then attackers could arbitrarily assign themselves to administrator roles. This exposure also affects other membership provider features, spoofing protection on the ViewState, and encrypted information that might be stored in cookies orotherwise be made available at the client.

一旦machine key被破解出来了，黑客就能够模拟出验证 cookie。如果网站设计者启动了选项，让安全信息放入 security cookie，那么攻击者就能够获取了 管理员权限。 包含的影响范围包括：membership provider, viewstate, 保存在security cookie里面的所有信息。

#div_code img { border: 0px none; }

While the exposure is both wide and immediate, the fix is simple. The hack exploits a bug in .NET‘s implementation of AES encryption. The solution is to switch to one of the other encryption mechanisms — to 3DES, for instance. Since encryption for the membership and roles providers is handled by ASP.NET, no modification of existing code should be required for Forms Authentication.

这个bug源于AES加密算法中的一个bug。因此解决方案就是：使用DES(后来被验证是错误的解决方案)。

第一部分小结
问题的关键字包括：

#div_code img { border: 0px none; }

security cookie, ASP.NET Forms Authentication cookie, Machine Key,role information in the security cookie.

大概意思就是，启动了asp.net的验证，并且启动了使用AES加密算法保存敏感信息在验证框架的cookie中后，黑客能够获取machinekey，然后获得管理员权限。

现在问题就是，具体是asp.net中什么操作、部署、框架会受到这个影响。于是我进一步搜索。

攻击方式：padded oracle attack

—————————————

文章下载地址：http://usenix.org/events/woot10/tech/full_papers/Rizzo.pdf

我没有太明白，也不知道和oracle是什么关系。不过有个回复说的比较详细：

#div_code img { border: 0px none; }

Before worrying too much, go to http://usenix.org/events/woot10/tech/full_papers/Rizzo.pdf and read the original paper from Rizzo and Duong (May 25th, 2010). The “padded oracle attack“ relies on a chaining block cypher (common) but also requires the “oracle“. As some have correctly pointed out above, we need to have ASP.NET (or Java since this is not unique to .NET) return the padding error exception. Without that information, the exploit doesn‘t work. By default, this exception information is not reported by ASP.NET and this is configurable behavior for Java. If you go to the aforementioned link, I think you’ll find more interesting reading related to cracking CAPTCHA using this exploit. However, that too requires cooperation from the web site. It’s great learning about exploits and even a little fun but the media sure scares a lot of people (and scares up a lot of clicks) by providing this hyperbole. One guy above said he was happy he used Java. Read the PDF above and you will find Rizzo and Duong found the problem with Java (JSF but also Ruby on Rails) and then turned to see if the same exploit would work with ASP.NET. Technically, it is an exploit but if it doesn’t happen with properly configured servers (or the default ASP.NET configuration), it’s much ado about nothing.

大致意思是，这个问题不仅仅存在在asp.net,而且还有java等。技术上，如果使用了asp.net的默认配置，是不需要担心的(所谓默认配置，就是新建一个asp.net项目的配置，没有做任何修改)。

窗体验证：Asp.net Form Authentication:

————————————————–

http://www.codeproject.com/KB/aspnet/Forms_Auth_Internals.aspx

这次受影响的，主要是因为启动了asp.net的权限框架，就是这个所谓的窗体验证。 这个窗体验证的原理在上面的连接给出了。

全文小结

————————————

问题在于如果用户使用了微软提供的窗体验证框架，就会出现安全漏洞，被黑客破解了保存安全信息的算法(machine key), 然后获取了管理员权限，下载服务器的文件。

如果你使用了微软提供的窗体验证框架，暂时有提供的解决办法。

看如下文章：http://weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspx 

主要的方法有两种，分版本号，大致是设置

customErrors mode="On" defaultRedirect="~/error.html"

所有的错误都是有指向到一个错误页面，这样黑客就没法根据不同状态返回不同的错误状态来攻击了。

具体大家可以进去了解方法。

如果整个权限框架是自己写的，那么就不需要担心了。

-----------------------------------------------------------------------------------

ASP.NET 惊爆新安全漏洞 攻击者可访问任意文件

微软安全响应中心发布最新安全预警, 提醒广大ASP.NET用户防范一处新安全漏洞. 攻击者可利用存在于ASP.NET加密模块的一处最新漏洞访问到包括web.config在内的任何文件. 此漏洞存在于ASP.NET所有已发布的版本中, 其影响程度不容小视. 目前尚无补丁发布. 请广大开发和维护人员加强防范.
据悉, ASP.Net 加密模块中新公开的漏洞可使攻击者解密并篡改任意加密数据。 如果 ASP.Net 应用程序使用的是 ASP.Net 3.5 SP1 或更高版本，攻击者可以使用此加密漏洞请求 ASP.Net 应用程序中的任意文件的内容。 网络上一些已流传开的攻击案例显示出攻击者可以利用该加密漏洞获取 web.config 文件的内容。 实际上一旦攻击者获取了web应用程序worker process的访问权限, 他即有权访问的应用程序中的任意文件。

有关该漏洞的详细信息, 请访问:  http://www.microsoft.com/technet/security/advisory/2416728.mspx