Some of the unique vulnerabilities in Python Rest Framework, and How to fix those vulnerabilities.

1. Unique ways to Hack into a
Python Web Service
Copyright - we45, 2019

2. Copyright - we45, 2019 @ti1akt
YOURS TRULY
● Senior Solutions Engineer at we45
● Full Stack Developer
● Developer of Open source Projects
● Trainer and Speaker

3. @ti1akt
Outline
● Why web services aren’t secure
● Unique vulnerabilities
● Demo !
● Security Pipeline
Copyright - we45, 2019

4. @ti1akt
Why web services aren't secure
Copyright - we45, 2019

5. @ti1akt Copyright - we45, 2019

6. @ti1akt Copyright - we45, 2019

7. @ti1akt
Unique Vulnerabilities
● JWT Manipulation
● Insecure Deserialization
● Server Side Template Injection
● Click Jacking
● Etc …

8. @ti1akt Copyright - we45, 2019

9. JWT Manipulation
OWASP-2017 A5 Broken Access Control
Copyright - we45, 2019

10. Copyright - we45, 2019 @ti1akt
Why JWT
● Stateless Application
● Authorization Mechanism
● Transfers information between
server and client
● Scalable and decoupled

11. Copyright - we45, 2019 @ti1akt
JSON Web Token(JWT)
● The process is relatively simple (typically):
● Once a user authenticates, the server generates some JSON payload
(with some info) and signs the JSON payload with a key
● This can be a HMAC Based Key (HS256) or a Asymmetric System
(RS256)
● The token is sent by the client (like a session cookie)
● The server attempts to verify the token based on the signature and
allows/disallows the user to perform actions

12. Copyright - we45, 2019 @ti1akt
Lots of ways to get JWT wrong
● Modify the algorithm to `none`
● Leakage of sensitive information
● Algorithm Confusion
● Cracking Secret Keys

13. Copyright - we45, 2019 @ti1akt

14. Copyright - we45, 2019 @ti1akt

15. Copyright - we45, 2019 @ti1akt
Mitigation for JWT
● Know the Algorithms
● Ensure that JWT implementation doesn’t support ‘None’ signature
● Secret key size must be strong
● JWT lifetime relatively short
● Check library flaw
● Validate using Unique ID

16. Server Side Template
Injection
Copyright - we45, 2019

17. @ti1akt
Why Template Engine
● Readability
● Separation
● Auto-Escaping
● Template Caching
● Template Inheritance
Copyright - we45, 2019

18. @ti1aktCopyright - we45, 2019

19. @ti1akt

20. Copyright - we45, 2019 @ti1akt

21. @ti1akt
Mitigation
● Sanitise and then render
● Sandboxing the application
Copyright - we45, 2019

22. Insecure Direct Object
Reference
OWASP-2017 A8 Broken Access Control
Copyright - we45, 2019

23. @ti1akt
Insecure Direct Object reference
● “id”,”pid”,”uid” are often seen in HTTP parameter
● Accessing other user privilege
● Backend not properly validated users
Copyright - we45, 2019

24. Copyright - we45, 2019 @ti1akt
How it works

25. Copyright - we45, 2019 @ti1akt
Yahoo Breach
Source:https://thehackernews.com/2014/03/yahoo-vulnerability-allows-hacker-to_1.html

26. Copyright - we45, 2019 @ti1akt

27. @ti1akt
Mitigation
● Validate user using requested query
● Check database is that user is genuine or not
● Custom validation in server side as well as client side
● JWT should be invalidated once the user is logout
Copyright - we45, 2019

28. Copyright - we45, 2019 @ti1akt

29. Copyright - we45, 2019 @ti1akt

30. Copyright - we45, 2019 @ti1akt
Basic Pipeline Demo

31. Copyright - we45, 2019 @ti1akt
SecDevOps Jenkins pipeline

32. @ti1akt
Thank you
Copyright - we45, 2019
@ti1akt
ti1akt
https://github.com/we45/pyconth2019