Home > CAPEC List > CAPEC-461: Web Services API Signature Forgery Leveraging Hash Function Extension Weakness (Version 2.10)  

CAPEC-461: Web Services API Signature Forgery Leveraging Hash Function Extension Weakness

 
Web Services API Signature Forgery Leveraging Hash Function Extension Weakness
Definition in a New Window Definition in a New Window
Attack Pattern ID: 461
Abstraction: Standard
Status: Draft
Completeness: Stub
Presentation Filter:
+ Summary

When web services require callees to authenticate, they sometimes issue a token / secret to the caller that the caller is to use to sign their web service calls. In one such scheme the caller when constructing a request would concatenate all of the parameters passed to the web service with the provided authentication token and then generate a hash of the concatenated string (e.g., MD5, SHA1, etc.). That hash then forms the signature that is passed to the web service which is used on the server side to verify the origin authenticity and integrity of the message. There is a practical attack against an authentication scheme of this nature that makes use of the hash function extension / padding weakness. Leveraging this weakness, an attacker, who does not know the secret token, is able to modify the parameters passed to the web service by generating their own call and still generate a legitimate signature hash. For instance, consider the message to be passed to the web service is M (this message includes the parameters passed to the web service concatenated with the secret token / key bytes). The message M is hashed and that hash is passed to the web service and is used for authentication. The attacker does not know M, but can see Hash (M) and Length (M). The attacker can then compute Hash (M || Padding (M) II M') for any M'. The attacker does not know the entire message M, specifically the attacker does not know the secret bytes, but that does not matter. The attacker is still able to sign their own message M' and make the called web service verify the integrity of the message without an error. Because of the iterative design of the hash function, it is possible, from only the hash of a message and its length, to compute the hash of longer messages that start with the initial message and include the padding required for the initial message to reach a multiple of 512 bits. It is important to note that the attack not limited to MD5 and will work just as well with another hash function like SHA1.

+ Attack Prerequisites
  • Web services check the signature of the API calls

    Authentication tokens / secrets are shared between the server and the legitimate client

    The API call signature is generated by concatenating the parameter list with the shared secret and hashing the result.

    An iterative hash function like MD5 and SHA1 is used.

    An attacker is able to intercept or in some other way gain access to the information passed between the legitimate client and the server in order to retrieve the hash value and length of the original message.

    The communication channel between the client and the server is not secured via channel security such as TLS

+ Typical Severity

High

+ Attacker Skills or Knowledge Required

Skill or Knowledge Level: Medium

Medium level of cryptography knowledge, specifically how iterative hash functions work. This is needed to select proper padding.

+ Resources Required

Access to a function to produce a hash (e.g., MD5, SHA1)

Tools that allow the attacker to intercept a message between the client and the server, specifically the hash that is the signature and the length of the original message concatenated with the secret bytes

+ Solutions and Mitigations

Design: Use a secure message authentication code (MAC) function such as an HMAC-SHA1

+ References
[R.461.1] Thai Duong and Juliano Rizzo. "Flickr's API Signature Forgery Vulnerability". September 28, 2009. <http://netifera.com/research/flickr_api_signature_forgery.pdf>.
+ Content History
Submissions
SubmitterOrganizationDateSource
CAPEC Content TeamThe MITRE Corporation2014-06-23Internal_CAPEC_Team
More information is available — Please select a different filter.
Page Last Updated or Reviewed: May 01, 2017