Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I tried to send the bad curl request to our servers (test env, obviously) and I didn't get any error. It seems I should be getting "Requested Range Not Satisfiable" if the server is vulnerable and "The request has an invalid header name" if it's patched. I'm getting neither, simply a normal response HTTP 200 with the requested page. Anyone knows how to really test it?

EDIT : It is indeed related to "Output Cache" setting in IIS as I said I was suspecting in another comment. I managed to crash our servers by going to IIS Management, select the website I wanted to test, go to Output Caching, enable the feature AND also add a rule (I added a rule for .png just to test). If you have NO rules it is the same as having the feature disabled so you are safe. If you add a rule and check "Enable Kernal Caching" you are vulnerable!

EDIT 2 : As some have asked, this is the command I used to crash our test server. I tested it after having created a new Output Caching rule to cache all .png files in kernel mode.

curl -v http://example.com/image.png -H "Range: bytes=18-18446744073709551615"

I didn't take a screenshot of the BSOD and I don't plan on crashing our test env a second time today because people are using it (I tested it early enough that not a lot of people were at the office yet).



I just crashed a 2008 R2 server without a rule, just with "Enable Kernel Caching". Not sure if it is relevant, but I first added a rule for .png, and then removed it again. Still worked.


Can't edit the top comment anymore :( but it has been found that indeed no rules are needed to exploit this (my previous answer is outdated and wrong!)

If you can't afford to reboot your servers right now to install the patch, at least you can add this to your web.config and deploy your websites ASAP :

<configuration> <system.webServer> <caching enableKernelCache="false"/> </system.webServer> </configuration>


Instead of updating every single web.config of your website I think it is better to just update once and for all by updating machine.config. What you say ?


Seems like you can't add a system.webServer node on the machine.config, but you could add it to applicationHost.config (source: http://www.iis.net/learn/get-started/planning-your-iis-archi... ) so yes, that would be faster. You have to make sure that none of your web.config files override that setting though!


I believe IIS supports locking attributes (source: http://www.iis.net/learn/get-started/planning-for-security/h...) so you should be able to lock at applicationHost.config and restrict further modifications. (I'm testing this now)

EDIT:

It causes a config error when a lock violation occurs which means the site gets an error 500 so its not an ideal fix.


Site to check: https://lab.xpaw.me/MS15-034


And doesn't check for static content first. Try http://ms15-034.azurewebsites.net/ (disclaimer: my app)


Sadly, only http is checked; won't work for https-only server.


As all our servers are behind a traffic manager product like F5/ZXTM I'm experimenting with removing the range header so it never reaches the webserver as some app's rely on kernel mode caching to achieve performance.

Also my tests seem to indicate that just having kernel mode caching enabled even if you dont have any rules still seem to cause a BSOD.


You're right! Even with no rule having kernal caching enabled will crash it! I think IIS assumes it should cache all static content even when there are no rules specifically for them. Somehow I can't edit my comment anymore but I'll leave this here :

EVEN WITH NO RULES, YOU ARE VULNERABLE! My previous answer has been proven to be wrong!


That was my case as well... initialized IIS on a fresh server to test against. (took me a while to figure out that IIS wasn't even setup, since the IIS manager was on the server) ... accidentally crashed my local machine too (forgot to change the localhost to the ip of the server whyn copy/pasting the url from the browser on the server)

This is pretty wild.


If I understood well, the HTTP request with the Range header is just a way to CHECK for the vulnerability and it is not THE vulnerability.

The vulnerability allows execute code remotly under the Syetem account.

Am I wrong?


Have tried on all our production facing domains (with and without CDN and get 200 responses also.

One server (our development server) has proven vulnerable. Maybe reverse proxies are sanitizing the results?

    $ curl -v 10.100.0.40/ -H "Host: irrelevant" -H "Range: bytes=0-18446744073709551615"
    * About to connect() to 10.100.0.40 port 80 (#0)
    *   Trying 10.100.0.40...
    * Adding handle: conn: 0x1d83278
    * Adding handle: send: 0
    * Adding handle: recv: 0
    * Curl_addHandleToPipeline: length: 1
    * - Conn 0 (0x1d83278) send_pipe: 1, recv_pipe: 0
    * Connected to 10.100.0.40 (10.100.0.40) port 80 (#0)
    > GET / HTTP/1.1
    > User-Agent: curl/7.30.0
    > Accept: */*
    > Host: irrelevant
    > Range: bytes=0-18446744073709551615
    >
    < HTTP/1.1 416 Requested Range Not Satisfiable
    < Content-Type: text/html
    < Last-Modified: Wed, 27 Aug 2014 14:56:23 GMT
    < Accept-Ranges: bytes
    < ETag: "885fe5117c2cf1:0"
    * Server Microsoft-IIS/7.5 is not blacklisted
    < Server: Microsoft-IIS/7.5


I've just tried on AWS Elastic Beanstalk https servers and not been able to BSOD. We don't have output caching enabled.


Proof of BSoD: https://www.youtube.com/watch?v=BlBXREzsytc


I can confirm what Khao is saying from my own testing.


Do you happen to have a screenshot of the BSOD, or could test it a second time to take a screenshot? I don't really have a free test server that I can crash anymore since I tested this morning when not a lot of people were at the office yet.


http://imgur.com/RTbw7co


+1. Also tried this on multiple web servers. Unable to reproduce under several different scenarios using curl


EDIT: adding the output caching rules confirms it. BSOD :(


Are you sure that curl is sending the request properly? (Check with tcpdump)


Yep. I tried curl -v to get all the raw headers line by line and the payload is there, and I also tried in telnet, both return a 200 page.

I read the microsoft security bulletin and it says that your IIS server is protected if Kernal Caching is off, maybe that's why our servers are neither blocking the request nor crashing with the request.


I have tried this with kernel caching enabled. (kernel caching IS enabled by default from what I can see). Still unable to reproduce using curl.


Even if you have Kernel Caching enabled (as it is by default) if you haven't created any rule for it you're safe.

I created a rule to cache all .png files and I changed the curl request to request a .png image on the server. I got a BSOD!


Do you remember what the fault being reported on the BSOD was?

(If you could take a screenshot/snapshot that'd be great.)

I'm really curious to see what bugcheck is being hit.


I just get the standard "Your PC ran into a problem and needs to restart. We're just collecting some error info, and then we'll restart for you."

Edit:

Actually sometimes you get additional info:

http://imgur.com/zRHUV8o


Ah, page fault in non-paged area! Interesting.


I second that.. If you could provide a screenshot and Curl example it would be great.


Can you please provide example of CURL syntax you used to produce this please?


Thanks my syntax was slightly off I'm now able to reproduce.


Specifically after enabling Output Caching for all .png files I send this :

curl -v http://example.com/image.png -H "Range: bytes=18-18446744073709551615"


I was able to crash mine (local win8.1 and win2012 server) without any rules specified, only the checkbox enabled for kernel caching... it may vary based on windows version.


One other possibility, is that your systems have already been compromised and are giving you back incorrectly safe-looking output. I'm not saying its probable, just possible.


Are you sure you have IIS on an OS with the vulnerability? It seems like windows 2008 R2 has it, but not 2008. My work is all on windows 2008, not R2.


I'm getting "Range requested not satisfiable" but no crash. Am I vulnerable or just doing it wrong?


confirmed the above command crashed my win 2012 r2 server on AWS with no output cache rules. I found a png being served by my home page, and after 2 of the above requests the server crashed.

I installed the pending windows updates and after a restart the problem seems to be gone.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: