April 11, 2014 - Warren Held

Hijacking User Sessions Utilizing The Heartbleed Vulnerability (CVE-2014-0160)

heartbleedI’m sure by now everyone and their grandmother has heard of the Heartbleed vulnerability that exists in certain versions of OpenSSL and that it can be used to steal information.  While this vulnerability was just publicly announced I’m sure that intelligence agencies and possibly cyber-criminals have been exploiting this for quite some time.  The Heartbleed vulnerability (CVE-2014-0160) is caused by a small bug in the logic that OpenSSL used to implement the TLS heartbeat mechanism.  A user sends a heartbeat message with random data to the server, and the server is supposed to reply back with the same data supplied by the user.  A malicious user can craft a heartbeat message that contains one byte of information but set the payload length flag to 64 kilobytes.  The server will take the user at his word and reserve a 64KB chunk of memory without checking to see if the heartbeat message actually contains the 64KB of payload data.  The server then sends back this 64KB chunk of memory that was supposed to contain the 64KB of payload data that the user claimed they were sending.  By sending many of these heartbeat requests an attacker can gather many 64KB chunks of memory from the server potentially exposing encryption keys, usernames, passwords, and session ids.

I’m going to demonstrate how an attacker could take advantage of this vulnerability to steal session IDs and then masquerade as an already logged-in user of a web site in order to bypass authentication.  Please note that attempting this exploit unauthorized on computer systems that you don’t own is a federal crime.  I’m running a WAMP stack on my local Windows host: Windows 7, MySQL, PHP, and Apache with OpenSSL 1.0.1e which is one of the OpenSSL versions vulnerable to this attack.  I have downloaded and installed the Magento eCommerce platform on my computer.

The first order of business is to verify that my web server is vulnerable to the Heartbleed bug.  To do that I am using this Python script:

 

If I execute this script against my own machine I can see that it has returned way more information in the heartbeat response than I sent it in my request:
Heartbleed Test

You can see that the web server I’m running is indeed vulnerable to the Heartbleed memory leak.  Now lets log into the administrative back-end of Magento.

Logging In To Magento

And take a look at the session cookie it has assigned me.

Magento Session Cookie

We’ll be looking for adminhtml in the memory data that we leak through Heartbleed.  If we can get the server to leak the adminhtml session id through the Heartbleed exploit we can craft a duplicate cookie on a differnt computer and trick the web server into thinking we are the administrator.  To do this I am going to boot up a Windows 7 virtual computer and use another Python script to flood my web server with malicious TLS heartbeat requests, and filter the returned data for the adminhtml cookie.  This script is a modification of Jared Stafford’s script by Michael Davis.  You can specify a string of text to look for and it will repeatedly send heartbeat requests and parse the responses for the text you are looking for.

Now I’ll start up my Windows 7 virtual machine and see if I can get the server to leak the session cookie.  While I run the Heartbleed session script from the virtual machine I log into the administrative backend for Magento that is running on my local pc.  You can see below I was able to access the administrative user’s session id.

Heartbleed adminhtml Session ID

Now I on my virtual machine I will open up Cookies Manager+ in Firefox and craft a duplicate session cookie.  When I reload the administrator login page it will see that I have session id cookie from the admin that is logged in and let me through.

Hijacked Session Login

You can see that after adding the session cookie to web browser I was able to bypass the login screen.  If you run a web server you can check and see if it is vulnerable by using this online tool.

Security Heartbleed / Security / Vulnerability /