Server flaw to be revealed at Black Hat

A technique that allows visibility to a username, password and credit-card number that is temporarily stored on a server during a session will be demonstrated at next week's Black Hat conference in Washington DC.

According to Dark Reading, the technique, which is used in web application development platforms that provide a constant look-and-feel across multiple web pages, can potentially expose sensitive user data, and will be demonstrated along with new vulnerabilities in Apache MyFaces, Sun Mojarra and Microsoft ASP.NET.

What is called the ‘view state' technique is a method for tracking changes to visual components on a web page that lets the web server update a web page without moving from that page.

Trustwave's SpiderLabs will demonstrate the types of attacks that can be waged using this class of vulnerabilities. David Byrne, senior security consultant, and security consultant Rohini Sulatycki will also release a security advisory about the vulnerabilities, along with steps to prevent them from exploitation.

Byrne said: “This is a fairly complicated vulnerability. View state is something most people have heard of, but they are not familiar with its inner workings. The tool we're going to release will help reveal those inner workings.

“This is the first time a vulnerability of this nature has been discovered. Until now, developers have had the option of deploying best practices offered by all three framework vendors in how they configure the framework.

“But [some developers] have not taken these recommendations seriously because there were not any specific vulnerabilities associated with them before. Our findings demonstrate that these best practices are there to protect you. Organisations already following them will not be affected by this [type of vulnerability or attack].”

He claimed that the best protection is to encrypt view state so data cannot be read or modified. The research will reveal that Apache MyFaces and Sun Mojarra can be exploited to read session data stored on the server while a user is interacting with a website. Microsoft's ASP.NET has a less-critical vulnerability that could result in a cross-site scripting (XSS) attack.

Byrne told Dark Reading that with a targeted attack, a hacker would be able to steal the user's credentials to do further damage. He said: “View state would be a viable mechanism for a targeted attack.”

See original article on scmagazineuk.com