Lab 08 Insecure Deserialization

Challenge "Give a devastating zero-star feedback to the store"

The Juice Shop allows customers to give feedback in the form of comments and a 1-5 star "rating" of their experience. But would it be possible to deface the store by giving it less than one star?

Attempt to submit a zero-star rating from the web UI

1. Go to the "Contact us" section.
2. Open the Developer tools (F12) in your browser.
3. Enter a comment and solve the CAPTCHA equation, but do not select any stars for your rating.
4. Notice how the submit button is disabled? Go to the Elements tab of the Developer tools and select the corresponding <button> tag.
5. Use Devtools to enable the button.
6. Submit the review.
7. Go to the Network tab of the developer tools and inspect the request.
8. Do you think the rating was accepted by the system?

Attempt to submit a three-star rating from the web UI

9. Click the stars to give a three-star rating.
10. Solve the CAPTCHA and submit as normal
11. Inspect the corresponding request.
12. Notice any difference? Do you think this rating was accepted by the system?
13. Keep the request open in devtools for the next step!

Forge a zero-star rating using Postman

14. Copy the request payload JSON from your previously created three-star rating.
15. Open Postman and create a new request (save it to your previous collection if you want).
16. Change the request type to POST.
17. Set the Body content type to Raw and change the mime type from Text to JSON(application/json).
18. Paste the request payload as the body, but change the rating to 0.
19. Copy the request URL from the developer tools into Postman.
20. Send the request from Postman.

Questions

• How could the application be protected against this type of attacks?
• What do you think of the CAPTCHA implementation in this application?

Challenge "Upload a file that has no .pdf extension"

The Juice Shop also allows customers to send more formal complaints, requests for refunding etc. through a form. To supplement their claim, customers are permitted to send PDF documents containing receipts etc. For security purposes, the files are limited to 100Kb in size, and must be PDF documents. Let's see if there's a way around the format restriction.

Upload a valid PDF file using the web UI

1. Log in as any user.
2. Go to the complaints section.
3. Open the Developer tools (F12) and go to the Network tab.
4. Submit a valid complaint (i.e. use a PDF file smaller than 100Kb).
5. Inspect the corresponding request(s) in the network tab.
6. Keep the request open in devtools for the next part!

Forge a complaint upload using Postman

7. Create a new request in Postman.
8. Set the type to POST
9. Copy the request URL from the request in devtools
10. Set the Body type to form-data
11. Add a new row with the key file.
12. Set the row type to "File" and set it to a non-pdf file.
13. Send the request.

Questions

• What is the risk posed to the application here?
• How could the risk be mitigated?
• If you have the time, try experimenting with the developer tools and the UI to see if you can upload a non-pdf file without using Postman.

Recommended reading

• OWASP Top 10-2017:A8 Insecure Deserialization
• Defensive Programming (Wikipedia)