Hi,
I'm writing a web app framework which stores pickles in client cookies.
The obvious security risk is that some 5cr1p7 X1ddi35 will inevitably try
tampering with the cookie and malforming it in an attempt to get the
server-side python code to run arbitrary code, or something similarly
undesirable.
To protect against this, I've subclassed pickle.Unpickle r, and added
overrides of the methods load_global, load_inst, load_obj and find_class.
My override methods simply raise exceptions unconditionally , which causes
any unpickle to fail if the pickle tries to unpack anything even
resembling code or an object.
I did this in preference to using the reputable 'bencode' module from
BitTorrent, because bencode doesn't support floats.
My question - have I done enough, or are there still ways where my hobbled
unpickler could be subverted by a malformed cookie?
Cheers
David 17 4764
On Fri, 11 Jul 2003 13:20:48 +1200, David McNab wrote: I'm writing a web app framework which stores pickles in client cookies.
Sounds like a waste of bandwidth, in addition to the security concerns
you raise.
Why not store the pickles on the server, and set a session cookie to
refer to them? That way, you only send a short session ID instead of
the whole pickle, and messing with the cookie doesn't alter the pickles.
(Mmm, all this talk of food...)
--
\ "I don't know anything about music. In my line you don't have |
`\ to." -- Elvis Aaron Presley (1935-1977) |
_o__) | http://bignose.squidly.org/ 9CFE12B0 791A4267 887F520C B7AC2E51 BD41714B
Paul Rubin wrote: Because now you need a mechanism to store the session info on the server, and you might want it to work across multiple load-balanced servers that fail over to one another, etc.
That's far superior to presenting the opportunity to exploits in the
first place, in my opinion. Depending on the contents of the contents
of that cookie, what you suggest may not be a problem at all (depending
on how critical the data contained therein is).
--
Erik Max Francis && ma*@alcyone.com && http://www.alcyone.com/max/
__ San Jose, CA, USA && 37 20 N 121 53 W && &tSftDotIotE
/ \ I would rather understand one cause than be king of Persia.
\__/ Democritus
Erik Max Francis <ma*@alcyone.co m> writes: Because now you need a mechanism to store the session info on the server, and you might want it to work across multiple load-balanced servers that fail over to one another, etc.
That's far superior to presenting the opportunity to exploits in the first place, in my opinion. Depending on the contents of the contents of that cookie, what you suggest may not be a problem at all (depending on how critical the data contained therein is).
I'm not sure what you're saying here. My suggestion is to
authenticate the cookies with a cryptographic checksum and verify the
authentication before deserializing the cookies. That's probably the
simplest approach. Keeping session info on a multi-process server (or
worse, a multi-server network) needs some kind of concurrent storage
mechanism. I don't see a robust, secure, low-overhead way to do that
with out-of-the-box Python. Any suggestions?
On Thu, 2003-07-10 at 20:20, David McNab wrote: I'm writing a web app framework which stores pickles in client cookies.
The obvious security risk is that some 5cr1p7 X1ddi35 will inevitably try tampering with the cookie and malforming it in an attempt to get the server-side python code to run arbitrary code, or something similarly undesirable.
To protect against this, I've subclassed pickle.Unpickle r, and added overrides of the methods load_global, load_inst, load_obj and find_class.
A much easier way to secure your pickle is to sign it, like:
cookie = dumps(object)
secret = 'really secret!'
hasher = md5.new()
hasher.update(s ecret)
hasher.update(c ookie)
cookie_signatur e = md5.digest()
You may then wish to base64 encode both (.encode('base6 4')), pop them
into one value, and you're off. Though I suppose at that point you may
be hitting the maximum value of a cookie. Hidden fields will work
nicely, though.
Decoding and verifying is an exercise left to the reader.
Ian
On Thu, 2003-07-10 at 20:52, Erik Max Francis wrote: Because now you need a mechanism to store the session info on the server, and you might want it to work across multiple load-balanced servers that fail over to one another, etc.
That's far superior to presenting the opportunity to exploits in the first place, in my opinion. Depending on the contents of the contents of that cookie, what you suggest may not be a problem at all (depending on how critical the data contained therein is).
Security isn't a big deal -- or rather, securing cookies isn't a big
deal. I think reliability will be a bigger problem. Cookies can cause
problems even when you are just storing a simple session ID. If you
start storing more information you're likely to run up against other
problems -- cookies can be hard to dispose of, who knows where they'll
get chopped off to preserve storage (it happens quickly), and IE has a
bug where you can't redirect and set a cookie at the same time, which
can really drive you crazy if you don't know about it.
Hidden fields are a much better way of keeping information on the
client. They tend to make for more navigable pages too. But if you
really want session, not transaction data, then you just need to figure
out server-side sessions. The biggest advantage of a web application is
that it runs in a controlled environment (the server) and you should
take advantage of that.
Ian
Ian Bicking <ia**@colorstud y.com> writes: A much easier way to secure your pickle is to sign it, like:
cookie = dumps(object) secret = 'really secret!' hasher = md5.new() hasher.update(s ecret) hasher.update(c ookie) cookie_signatur e = md5.digest()
That method is vulnerable to an "appending" attack against md5. I'll
spare the gory details, but you should call md5 through the HMAC
module to make the signature instead of using md5 directly. HMAC is
designed to stop that attack.
You may then wish to base64 encode both (.encode('base6 4')), pop them into one value, and you're off. Though I suppose at that point you may be hitting the maximum value of a cookie. Hidden fields will work nicely, though.
You could split the session info into several cookies, but in that
situation you should authenticate the whole cookie set with a single
signature. Otherwise someone could paste together several cookies
from separate sessions, and possibly confuse your server. On Thu, 2003-07-10 at 20:20, David McNab wrote: I'm writing a web app framework which stores pickles in client cookies.
The obvious security risk is that some 5cr1p7 X1ddi35 will inevitably try tampering with the cookie and malforming it in an attempt to get the server-side python code to run arbitrary code, or something similarly undesirable.
To protect against this, I've subclassed pickle.Unpickle r, and added overrides of the methods load_global, load_inst, load_obj and find_class.
A much easier way to secure your pickle is to sign it, like:
cookie = dumps(object) secret = 'really secret!' hasher = md5.new() hasher.update(s ecret) hasher.update(c ookie) cookie_signatur e = md5.digest()
You may then wish to base64 encode both (.encode('base6 4')), pop them into one value, and you're off. Though I suppose at that point you may be hitting the maximum value of a cookie. Hidden fields will work nicely, though.
Decoding and verifying is an exercise left to the reader.
That is exactly what Albatross does with pickles sent to the browser.
In case it is interesting to anyone, here is the class that does the
work of signing and checking the sign.
- Dave
class PickleSignMixin :
def __init__(self, secret):
self.__secret = secret
def pickle_sign(sel f, text):
m = md5.new()
m.update(self._ _secret)
m.update(text)
text = m.digest() + text
return text
def pickle_unsign(s elf, text):
digest = text[:16]
text = text[16:]
m = md5.new()
m.update(self._ _secret)
m.update(text)
if m.digest() == digest:
return text
return ''
-- http://www.object-craft.com.au
Dave Cole <dj*@object-craft.com.au> writes: I have been googling for information on the "appending" attack against md5 and cannot find anything that clearly describes it. Do you have any links handy?
I think RFC 2104 (the HMAC spec) might describe it. Basically, think
about how md5 works. You load the md5 context with the secret key
(say 20 bytes) then your data (say 20 bytes), then some padding to
fill the 64 byte context, and run the compression function:
md5_compress(ke y + data + 24 bytes of padding)
Call the 24 padding bytes P. They are just 16 0's plus an 8 byte
length, iirc.
The hash output is just the md5 chaining variables after running the
compression function.
Now look at the 100 byte string
E = your data + P (same as above) + 36 bytes of evil stuff
Even without knowing your secret key, if the attacker knows your data
(which may not be secret), and md5(key+data) (which you've included in
the cookie), he can compute the signature of E. It's just the result
of running the compression function on his evil stuff plus appropriate
additional padding, with the chaining variables set to the original
md5 hash that you already sent him.
This is not really a failure of md5, which is supposed to be a message
digest algorithm, not a MAC. Rather, the authentication fails because
md5 is being used in a way it was not intended to be used.
The solution is to use HMAC. See RFC 2104 for details.
Ian Bicking <ia**@colorstud y.com> writes:
[...] Security isn't a big deal -- or rather, securing cookies isn't a big deal.
I don't understand. The problem is that pickles can be constructed
that can damage systems when unpickled, is that right? If that's
true, then surely unpickling cookie data is unsafe, because stuff
coming in from the network has to be regarded as malevolent. Are you
saying that web server environments are sufficiently-well bolted down
that no pickle attack will work? But belt-and-braces is the best
policy, isn't it?
and IE has a bug where you can't redirect and set a cookie at the same time, which can really drive you crazy if you don't know about it.
[...]
Hah. There's a slight irony there, given that they fought against
restrictions on setting cookies from 'unverified' third parties when
the (more-or-less stillborn) cookie RFCs were being written. So they
argue against that, then end up partially implementing it by
accident...
John This thread has been closed and replies have been disabled. Please start a new discussion. Similar topics |
by: Stephen VanDahm |
last post by:
I'm looking for a way to install Python on a UNIX machine in a way such
that any user on the system can use it, but only to execute scripts that
are located in a certain directory. I do not have root access on the
machine that will be running Python, so my options are limited. I thought
about hacking the Python interpreter itself so that it will examine the
argument array and exit with an error if the script to be executed isn't
in the...
|
by: Michael Hohn |
last post by:
Hi,
under python 2.2, the pickle/unpickle sequence incorrectly restores
a larger data structure I have.
Under Python 2.3, these structures now give an explicit exception from
Pickle.memoize():
assert id(obj) not in self.memo
I'm shrinking the offending data structure down to find the problem
|
by: Mike P. |
last post by:
Hi all,
I'm working on a simulation (can be considered a game) in Python where I
want to be able to dump the simulation state to a file and be able to load
it up later. I have used the standard Python pickle module and it works fine
pickling/unpickling from files.
However, I want to be able to use a third party tool like an XML editor (or
other custom tool) to setup the initial state of the simulation, so I have
been playing around...
|
by: Jim Lewis |
last post by:
Pickling an instance of a class, gives "can't pickle instancemethod
objects". What does this mean? How do I find the class method creating
the problem?
|
by: crystalattice |
last post by:
I'm creating an RPG for experience and practice. I've finished a
character creation module and I'm trying to figure out how to get the
file I/O to work.
I've read through the python newsgroup and it appears that shelve
probably isn't the best option for various reasons. This lead me to
try messing w/ pickle, but I can't figure out how to use it with
classes. I've found many examples of using pickle w/ non-OOP code but
nothing that...
| |
by: Chris |
last post by:
Why can pickle serialize references to functions, but not methods?
Pickling a function serializes the function name, but pickling a
staticmethod, classmethod, or instancemethod generates an error. In
these cases, pickle knows the instance or class, and the method, so
what's the problem? Pickle doesn't serialize code objects, so why can't
it serialize the name as it does for functions? Is this one of those
features that's feasible, but...
|
by: fizilla |
last post by:
Hello all!
I have the following weird problem and since I am new to Python I somehow cannot figure out an elegant solution. The problem reduces to the following question:
How to pickle a collections.defaultdict object that has set the default_factory property?
For Example (from the IDLE console):
>>> words = collections.defaultdict(lambda: 1)
>>> f = file("temp","w")
|
by: Michele Simionato |
last post by:
Can somebody explain what's happening with the following script?
$ echo example.py
import pickle
class Example(object):
def __init__(self, obj, registry):
self._obj = obj
self._registry = registry
|
by: IceMan85 |
last post by:
Hi to all, I have spent the whole morning trying, with no success to pickle an object that I have created.
The error that I get is : Can't pickle 'SRE_Match' object: <_sre.SRE_Match object at 0x2a969c0ad0>
the complete stack is the following :
Traceback (most recent call last):
File "manager.py", line 305, in ?
commandLineExec (log, parser)
File "manager.py", line 229, in commandLineExec
|
by: Hystou |
last post by:
Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can effortlessly switch the default language on Windows 10 without reinstalling. I'll walk you through it.
First, let's disable language synchronization. With a Microsoft account, language settings sync across devices. To prevent any complications,...
|
by: jinu1996 |
last post by:
In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven tapestry of website design and digital marketing. It's not merely about having a website; it's about crafting an immersive digital experience that captivates audiences and drives business growth.
The Art of Business Website Design
Your website is...
| |
by: Hystou |
last post by:
Overview:
Windows 11 and 10 have less user interface control over operating system update behaviour than previous versions of Windows. In Windows 11 and 10, there is no way to turn off the Windows Update option using the Control Panel or Settings app; it automatically checks for updates and installs any it finds, whether you like it or not. For most users, this new feature is actually very convenient. If you want to control the update process,...
|
by: tracyyun |
last post by:
Dear forum friends,
With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each protocol has its own unique characteristics and advantages, but as a user who is planning to build a smart home system, I am a bit confused by the choice of these technologies. I'm particularly interested in Zigbee because I've heard it does some...
|
by: conductexam |
last post by:
I have .net C# application in which I am extracting data from word file and save it in database particularly. To store word all data as it is I am converting the whole word file firstly in HTML and then checking html paragraph one by one.
At the time of converting from word file to html my equations which are in the word document file was convert into image.
Globals.ThisAddIn.Application.ActiveDocument.Select();...
|
by: adsilva |
last post by:
A Windows Forms form does not have the event Unload, like VB6. What one acts like?
|
by: 6302768590 |
last post by:
Hai team
i want code for transfer the data from one system to another through IP address by using C# our system has to for every 5mins then we have to update the data what the data is updated we have to send another system
|
by: muto222 |
last post by:
How can i add a mobile payment intergratation into php mysql website.
| |
by: bsmnconsultancy |
last post by:
In today's digital era, a well-designed website is crucial for businesses looking to succeed. Whether you're a small business owner or a large corporation in Toronto, having a strong online presence can significantly impact your brand's success. BSMN Consultancy, a leader in Website Development in Toronto offers valuable insights into creating effective websites that not only look great but also perform exceptionally well. In this comprehensive...
| |