U.S. Dept Of Defense · Report #736391
[HTA2] Authorization Bypass on https://██████ leaks confidential aircraft/missile information
How it was found
Summary:
There is an authorization bypass on https://██████ which allows a remote, unauthenticated attacker to bypass the "██████Single Sign-On" and view the application as an authenticated user.
Details:
The host at ████ uses Akamai as a load balancer and routes traffic back to an internal server:
root@doggos:~# dig A ████
-- snip --
;; ANSWER SECTION:
███. 2386 IN CNAME █████.
████. 1554 IN CNAME ███.
███████. 180 IN CNAME e1010.d.akamaiedge.akamai.█████████.
e1010.d.akamaiedge.akamai.██████. 20 IN A ██████████
When attempting to hit the website, you are redirected to https://█████████/pool/sso/authenticate/l/2?m=GET&r=t&u=https%3A%2F%2F████████%2F and requires the visitor to authenticate via SSO.
However, I was able to find the Origin IP of this server. Hitting this Origin IP completely circumvents the ████████ SSO and allows the visitor to use the application as an authenticated user.
Steps To Reproduce:
- Try visiting the application here: https://███. You'll see you are redirected to login via SSO.
█████████
- Run the following command to verify that ████ is the Origin IP for
█████████by pulling the names from the SSL certificate:
root@doggos:~# true | openssl s_client -connect ██████:443 2>/dev/null | openssl x509 -noout -text | perl -l -0777 -ne '@names=/\bDNS:([^\s,]+)/g; print join("\n", sort @names);'
█████████
- Now visit the application: https://█████
- You'll see that you can now use the application as an authenticated user by clicking through the sidebar:
███
You can search through past messages / updates on aircraft and missles here:
https://███/Guest/MessageSearch.aspx
Impact
Critical. A remote, unauthenticated attacker can view and download confidential information from this application. For instance, I clicked on one of the messages at https://████████/Guest/MessagesDetails.aspx and it downloaded a document containing sensitive information about some issues with some██████████:
█████████
████████
Best, Corben Leo (@cdl)