Re: [hybi] Handshake was: The WebSocket protocol issues.

[Adam Barth <[e-mail]>]

On Fri, Oct 8, 2010 at 5:37 PM, Greg Wilkins <[e-mail]> wrote:
> On 9 October 2010 10:03, Adam Barth <[e-mail]> wrote:
>> This is a virtual hosting environment.  That's what I meant when I
>> said "consider, for example, a virtual hosting environment in which
>> the attacker can place PHP scripts on the server."  The attacker has
>> access to one virtual host on the server but does not own the entire
>> server.
>>
>> Concretely, consider http://www.adambarth.com/.  My web site is a
>> virtual host on a physical server in a 1and1 datacenter.  I'm
>> perfectly capable of placing a PHP script on my virtual host.  If the
>> PHP script is able to complete the web socket handshake, then I can
>> open a WebSocket connection to www.adambarth.com on port 80 from the
>> user's browser.  Once the WebSocket handshake completes, I can now
>> talk directly to the 1and1 server over more-or-less a raw socket,
>> which means I can spoof further HTTP requests and potentially attack
>> other virtual hosts that happen to be on the same physical machine,
>> which is bad news bears.
>
> the key phrase in this description is "Once the Websocket handshake completes".
> That just glosses over several defences:
>
>  + It is not certain that the HTTP server will allow a PHP script to
> generate a 101 response.

I don't know why you think that's so hard to set the response status.
There's a PHP function does exactly that:

http://php.net/manual/en/function.http-send-status.php

According to the documentation it can set any status between 100 and 599.  Etc.

Anyway, we have a handshake that nukes these vulnerabilities from
orbit.  We should just use that instead of crossing our fingers and
hoping for the best.

Adam