Network-based Origin Confusion Attacks against HTTPS Virtual Hosting

We investigate current deployment practices for virtual host-ing, a widely used method for serving multiple HTTP and HTTPS origins from the same server, in popular content delivery networks, cloud-hosting infrastructures, and web servers. Our study uncovers a new class of HTTPS origin confusion attacks: when two virtual hosts use the same TLS certificate, or share a TLS session cache or ticket encryption key, a network attacker may cause a page from one of them to be loaded under the other’s origin in a client browser. These attacks appear when HTTPS servers are configured to allow virtual host fallback from a client-requested, se-cure origin to some other unexpected, less-secure origin. We present evidence that such vulnerable virtual host configura-tions are widespread, even on the most popular and security-scrutinized websites, thus allowing a network adversary to hijack pages, or steal secure cookies and single sign-on to-kens. To prevent our virtual host confusion attacks and re-cover the isolation guarantees that are commonly assumed in shared hosting environments, we propose fixes to web server software and advocate conservative configuration guidelines for the composition of HTTP with TLS. 1