4

I recently audited a website with three hosts: the main site (example.com), and two subdomains (let's call them portal.example.com, and welcome.example.com).

According to the response headers, HSTS is properly set for each host: 

strict-transport-security: max-age=2592000; includeSubDomains

When loading the hosts into Burp, I was unable to create a security exception in Firefox to accept Burp's self-signed SSL cert to proxy HTTPS traffic (as expected). Both of the subdomains, however, let me create a security exception in Firefox with no issues. Additionally, this allowed me to bypass the HSTS on the main site, since once a security exception had been created for either of the subdomains I was able to proxy HTTPS traffic for example.com with no issues.

What am I missing? I thought HSTS would prohibit this activity, especially if it is set to includeSubDomains.

|improve this question|||||
5

Q: Why did HSTS allow me to override?
A: HSTS is A TOFU (Trust-on-first-use) mechanism. And that means: if you're intercepted that first time, you're screwed. And since (as Austin pointed out) the includeSubDomains header is incorrect on the parent domain your user agent knew nothing about the subdomains. And the TLS setup is in a lower layer than the HTTP header. So the browser only got word of the server's No funny business with overriding certificate errors! order after you had already done that.

I thought HSTS would prohibit this activity

No. Once you have accepted a bad CA as trusted (and Firefox does exceptions differently, but I think this is what this amounts to) all bets are off.

Q: Will a HPKP pinned cert be immune?
A: No. Firefox will by default BREAK a pin/not enforce the pin if it is overridden by a locally installed non-standard CA. (This is to allow SSL inspection.) (But you can manually configure Firefox to never break pins by changing the setting from 1 to 2.)

|improve this answer|||||
  • 1
    Thanks for mentioning the TOFU mechanism involved in HSTS -- I think this is the most important point to be made in this context. Am I correct in assuming the reason I couldn't set an exception for example.com was due to the fact I had previously visited the site so the valid cert was pinned, and that the two subdomains allowed the exception because I accepted a bad CA on my first visit to them? – user83426 Nov 7 '15 at 20:16
  • 1
    Yes and no. HSTS is not about cert pinning. It'll happily accept any valid cert that chains up to any valid CA. If you want pinning, then look into HPKP. – StackzOfZtuff Nov 8 '15 at 18:52
7

With HSTS, the browser will automatically convert HTTP links to HTTPS links. However, to prevent mistakes and abuse, browsers will only accept the HSTS header on a secured page.

As it relates to your case, HSTS will not allow users to manually accept a self-signed certificate once HSTS has been enabled (which can only be done from a secure page). That explains why example.com does not allow you to accept the invalid certificate.

Furthermore, I suspect that the subdomains are not being properly protected because the header says include SubDomains rather than includeSubDomains (as defined in the specification).

On a related note, HPKP can provide additional protection against malicious certificates.

|improve this answer|||||
  • The header should have read includeSubDomains, as you pointed out. That was a mistake I made when drafting the question, thanks for catching it. – user83426 Nov 7 '15 at 20:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.