Subject: Proposed resolution for Issue 237 (new attack scenario based on XmlHttpRequest object)

From: Julian Reschke <[email-masked]>
Date: Sun, 04 Mar 2007 14:46:16 +0100

Proposed Changes (see also 
<http://ietf.osafoundation.org:8080/bugzilla/show_bug.cgi?id=237> and 
<http://greenbytes.de/tech/webdav/draft-reschke-webdav-rfc2518bis-latest.html#rfc.issue.bz237>:

Proposed changes:

+++
NEW (add to 20.8)

    One specific attack scenario deserves special mention here: with the
    arrival of the "XMLHttpRequest" API (see [WD-XMLHttpRequest]), user
    agents have acquired the capability to submit arbitrary HTTP requests
    against the server the content was obtained from.  With the well-
    known semantics of HTTP verbs such as PUT and DELETE, the following
    attack becomes possible:

    1.  Alice prepares an HTML page with embedded Javascript code that
        will submit a DELETE request against the URI
        http://www.example.com/users/bob/ (a resource she has not write
        access to).

    2.  Alice stores this HTML page at
        http://www.example.com/users/alice/readme.html, a resource she
        has write access to.

    3.  Alice emails Bob a link to
        http://www.example.com/users/alice/readme.html, for which he has
        read access once authenticated.

    4.  Bob follows the link, authenticates, and the embedded script code
        executes the DELETE request against
        http://www.example.com/users/bob/ while being authenticated as
        Bob.

    This attack relies on the common risk of collaboratively authoring
    resources on the same server, which requires a certain amount of
    trust between the users.  However, even an action usually considered
    as "safe", such as opening an HTML page in a web browser, can cause
    arbitrary HTTP methods to be invoked.  Note that WebDAV isn't the
    root cause for this vulnerability, it just makes it more visible.

    Potential steps to reduce the risks associated with this attack
    include:

    o  Separating server domains for authoring (read/write) and publicly
       serving content.

    o  Disallowing certain content (such as scripts in HTML pages)
       altogether, as discussed above.

    o  Using user agents that follow Section 9.1.1 of [RFC2616], in that
       they do not allow unsafe methods to be executed without making the
       user aware of the consequences - unfortunately, none of today's
       browsers is doing that.

NEW (add to informative references):

    [WD-XMLHttpRequest]
               van Kesteren, A., "The XMLHttpRequest Object", W3C WD-
               XMLHttpRequest-20070227, February 2007,
               <http://www.w3.org/TR/2007/WD-XMLHttpRequest-20070227/>.

               Work in progress.
+++

Best regards, Julian

---

From: Bjoern Hoehrmann <[email-masked]>
Date: Sun, 04 Mar 2007 20:22:13 +0100

>        http://www.example.com/users/bob/ while being authenticated as

You should say Bob has write access to http://www.example.com/users/bob/
I missed that at first and wondered what the point here might be.

>       user aware of the consequences - unfortunately, none of today's

I don't think this is the best way to put it, but I don't have much
better text at hand right now.
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
Weinh. Str. 22 · Telefon: +49(0)621/4309674 · http://www.bjoernsworld.de
68309 Mannheim · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

---

From: Julian Reschke <[email-masked]>
Date: Sun, 04 Mar 2007 20:56:02 +0100

Bjoern Hoehrmann schrieb:
> ...

OK, how about:

         access to, but Bob has).

> better text at hand right now.

Proposals welcome. I think it's worthwhile to mention that RCF2616 is 
very clear about the user agent never to invoke an unsafe method without 
the user's consent, a principle that very clearly isn't followed by 
today's browsers when they allow unsafe methods without any user 
confirmation.

Best regards, Julian