A Look into Netty’s Recent Security Update (CVE­-2015­-2156)

LinkedIn logo
LinkedIn
•
Luca Carettoni
•4 min read•intermediate•
--
•View Original
CSRFHTMLXSS

Overview

The article discusses a security vulnerability identified in Netty's cookie parsing code, which can lead to a universal HttpOnly bypass in the Play Framework and potentially other frameworks. It details the nature of the vulnerability, its implications, and the necessary patches to mitigate the risk.

What You'll Learn

1

How to identify security vulnerabilities in cookie parsing routines

2

Why upgrading to the latest version of Netty is critical for security

3

When to apply patches to mitigate security risks in applications using Netty

Prerequisites & Requirements

  • Understanding of HTTP cookies and security flags
  • Familiarity with Netty and Play Framework(optional)

Key Questions Answered

What vulnerability was discovered in Netty's cookie parsing code?
The vulnerability allows for a universal HttpOnly bypass in the Play Framework and potentially other frameworks using Netty. It arises from improperly terminated cookie values not being discarded, leading to sensitive cookie information being exposed within the application.
How does the vulnerability affect the Play Framework's CSRF protection?
The vulnerability can be exploited to bypass HttpOnly flag restrictions, allowing sensitive cookie values to be reflected in the HTML response. This can lead to security risks, especially in the context of Cross-Site Scripting (XSS) attacks.
What versions of Netty and Play Framework were patched to fix the vulnerability?
The vulnerability was fixed in Netty versions 3.9.8.Final, 3.10.3.Final, 4.1.0.Beta5, and 4.0.28.Final, as well as Play Framework version 2.3.9.
What steps should developers take to mitigate the risk of this vulnerability?
Developers should upgrade to the latest versions of Netty and Play Framework to ensure compliance with RFC6265 and to mitigate the risks associated with the vulnerability.

Technologies & Tools

Backend
Netty
Used for handling network applications and protocols.
Backend
Play Framework
Utilized for building web applications and handling HTTP requests.

Key Actionable Insights

1
Developers should regularly audit their applications for vulnerabilities, especially in cookie handling.
Regular audits can help identify potential security flaws before they are exploited, ensuring the integrity of user data and application security.
2
Always keep dependencies up to date to leverage security patches and improvements.
Using outdated libraries can expose applications to known vulnerabilities, making it essential to stay current with updates.
3
Implement strict cookie handling practices in your applications.
Properly handling cookies according to standards can prevent vulnerabilities and enhance the overall security posture of your applications.

Common Pitfalls

1
Assuming that cookie handling is secure without proper validation.
Many developers overlook the importance of validating cookie values, which can lead to severe security vulnerabilities if not properly handled.

Related Concepts

HTTP Security
Cookie Handling Best Practices
Cross-site Scripting (xss)