Package: raven-cycode
Raven - CI/CD Security AnalyzerRAVEN (Risk Analysis and Vulnerability Enumeration for CI/CD)is a powerful security tool designed to perform massive scans for GitHub Actions CI workflows and digest the discovered data into a Neo4j database. Developed and maintained by theCycoderesearch team.With Raven, we were able to identify and report security vulnerabilities in some of the most popular repositories hosted on GitHub, including:FreeCodeCamp(the most popular project on GitHub)Storybook(One of the most popular frontend frameworks)Fluent UIby Microsoftand much moreWe listed all vulnerabilities discovered using Raven in the toolHall of Fame.What is RavenThe tool provides the following capabilities to scan and analyze potential CI/CD vulnerabilities:⏬Downloader:You can download workflows and actions necessary for analysis. Workflows can be downloaded either for multiple accounts (user/organization) simultaneously or for public GitHub repositories, sorted by star count. Performing this step is a prerequisite for analyzing the workflows.📊Indexer:Digesting the downloaded data into a graph-based Neo4j database. This process involves establishing relationships between workflows, actions, jobs, steps, etc.📚Query Library:We created a library of pre-defined queries based on research conducted by the community.❗Reporter:Raven has a simple way of reporting suspicious findings. As an example, it can be incorporated into the CI process for pull requests and run there.Possible usages for Raven:Scanner for your own organization's securityScanning specified organizations for bug bounty purposesScan everything and report issues found to save the internetResearch and learning purposesThis tool provides a reliable and scalable solution for CI/CD security analysis, enabling users to query bad configurations and gain valuable insights into their codebase's security posture.Why RavenIn the past year, Cycode Labs conducted extensive research on fundamental security issues of CI/CD systems. We examined the depths of many systems, thousands of projects, and several configurations. The conclusion is clear – the model in which security is delegated to developers has failed. This has been proven several times in our previous content:A simple injection scenario exposed dozens of public repositories, including popular open-source projects.We found that one of the most popular frontend frameworks was vulnerable to the innovative method of branch injection attack.We detailed a completely different attack vector, 3rd party integration risks, the most popular project on GitHub, and thousands more.Finally, the Microsoft 365 UI framework, with more than 300 million users, is vulnerable to an additional new threat – an artifact poisoning attack.Additionally, we found, reported, and disclosed hundreds of other vulnerabilities privately.Each of the vulnerabilities above has unique characteristics, making it nearly impossible for developers to stay up to date with the latest security trends. Unfortunately, each vulnerability shares a commonality – each exploitation can impact millions of victims.It was for these reasons that Raven was created, a framework for CI/CD security analysis workflows (and GitHub Actions as the first use case). In our focus, we examined complex scenarios where each issue isn't a threat on its own, but when combined, they pose a severe threat.Setup && RunTo get started with Raven, follow these installation instructions:Step 1: Install the Raven packagepip3installraven-cycodeStep 2: Setup a local Redis server and Neo4j databasedockerrun-d--nameraven-neo4j-p7474:7474-p7687:7687--envNEO4J_AUTH=neo4j/123456789--volumeraven-neo4j:/dataneo4j:5.12
dockerrun-d--nameraven-redis-p6379:6379--volumeraven-redis:/dataredis:7.2.1Another way to setup the environment is by running our provided docker compose file:gitclonehttps://github.com/CycodeLabs/raven.gitcdraven
makesetupStep 3: Run Raven DownloaderAccount mode:ravendownloadaccount--token$GITHUB_TOKEN--account-nameRavenDemoCrawl mode:ravendownloadcrawl--token$GITHUB_TOKEN--min-stars1000Step 4: Run Raven IndexerravenindexStep 5: Inspect the results through the reporterravenreport--formatrawAt this point, it is possible to inspect the data in the Neo4j database, by connectinghttp://localhost:7474/browser/.PrerequisitesPython 3.9+Docker Compose v2.1.0+Docker Engine v1.13.0+InfrastructureRaven is using two primary docker containers: Redis and Neo4j.make setupwill run adocker composecommand to prepare that environment.UsageThe tool contains three main functionalities,downloadandindexandreport.DownloadDownload Account Repositoriesusage:ravendownloadaccount[-h]--tokenTOKEN[--debug][--redis-hostREDIS_HOST][--redis-portREDIS_PORT][--clean-redis]--account-nameACCOUNT_NAME

options:-h,--helpshowthishelpmessageandexit--tokenTOKENGITHUB_TOKENtodownloaddatafromGithubAPI(Neededforeffectiverate-limiting)--debugWhethertoprintdebugstatements,default:False--redis-hostREDIS_HOSTRedishost,default:localhost--redis-portREDIS_PORTRedisport,default:6379--clean-redis,-crWhethertocleancacheintheredis,default:False--account-nameACCOUNT_NAMEAccountnamefordownloadingtheworkflowsDownload Public Repositoriesusage:ravendownloadcrawl[-h]--tokenTOKEN[--debug][--redis-hostREDIS_HOST][--redis-portREDIS_PORT][--clean-redis][--max-starsMAX_STARS][--min-starsMIN_STARS]options:-h,--helpshowthishelpmessageandexit--tokenTOKENGITHUB_TOKENtodownloaddatafromGithubAPI(Neededforeffectiverate-limiting)--debugWhethertoprintdebugstatements,default:False--redis-hostREDIS_HOSTRedishost,default:localhost--redis-portREDIS_PORTRedisport,default:6379--clean-redis,-crWhethertocleancacheintheredis,default:False--max-starsMAX_STARSMaximumnumberofstarsforarepository--min-starsMIN_STARSMinimumnumberofstarsforarepository,default:1000Indexusage:ravenindex[-h][--redis-hostREDIS_HOST][--redis-portREDIS_PORT][--clean-redis][--neo4j-uriNEO4J_URI][--neo4j-userNEO4J_USER][--neo4j-passNEO4J_PASS][--clean-neo4j][--debug]options:-h,--helpshowthishelpmessageandexit--redis-hostREDIS_HOSTRedishost,default:localhost--redis-portREDIS_PORTRedisport,default:6379--clean-redis,-crWhethertocleancacheintheredis,default:False--neo4j-uriNEO4J_URINeo4jURIendpoint,default:neo4j://localhost:7687--neo4j-userNEO4J_USERNeo4jusername,default:neo4j--neo4j-passNEO4J_PASSNeo4jpassword,default:123456789--clean-neo4j,-cnWhethertocleancache,andindexfromscratch,default:False--debugWhethertoprintdebugstatements,default:FalseReportusage:ravenreport[-h][--redis-hostREDIS_HOST][--redis-portREDIS_PORT][--clean-redis][--neo4j-uriNEO4J_URI][--neo4j-userNEO4J_USER][--neo4j-passNEO4J_PASS][--clean-neo4j][--tag{injection,unauthenticated,fixed,priv-esc,supply-chain,best-practice,endoflife,reconnaissance}][--severity{info,low,medium,high,critical}][--query_idsRQ-1,..,RQ-16][--queries-pathQUERIES_PATH][--format{raw,json}]{slack}...

positionalarguments:{slack}slackSendreporttoslackchannel

options:-h,--helpshowthishelpmessageandexit--redis-hostREDIS_HOSTRedishost,default:localhost--redis-portREDIS_PORTRedisport,default:6379--clean-redis,-crWhethertocleancacheintheredis,default:False--neo4j-uriNEO4J_URINeo4jURIendpoint,default:neo4j://localhost:7687--neo4j-userNEO4J_USERNeo4jusername,default:neo4j--neo4j-passNEO4J_PASSNeo4jpassword,default:123456789--clean-neo4j,-cnWhethertocleancache,andindexfromscratch,default:False--tag{injection,unauthenticated,fixed,priv-esc,supply-chain,best-practice,endoflife,reconnaissance},-t{injection,unauthenticated,fixed,priv-esc,supply-chain,best-practice,endoflife,reconnaissance}Filterquerieswithspecifictag--severity{info,low,medium,high,critical},-s{info,low,medium,high,critical}Filterqueriesbyseveritylevel(default:info)--query_idsRQ-1,..,RQ-16,-idRQ-1,..,RQ-16Filterqueriesbyqueryids(example:RQ-2,RQ-8)--queries-pathQUERIES_PATH,-dpQUERIES_PATHQueriesfolder(default:library)--format{raw,json},-f{raw,json}Reportformat(default:raw)ExamplesRetrieve all workflows and actions associated with any account (user/organization).ravendownloadaccount--token$GITHUB_TOKEN--account-namemicrosoft--account-namegoogle--debugScrape all publicly accessible GitHub repositories.ravendownloadcrawl--token$GITHUB_TOKEN--min-stars100--max-stars1000--debugAfter finishing the download process or if interrupted using Ctrl+C, proceed to index all workflows and actions into the Neo4j database.ravenindex--debugNow, we can generate a report using our query library.ravenreport--severityhigh--taginjection--tagunauthenticatedRate LimitingFor effective rate limiting, you should supply a Github token.
For authenticated users, the next rate limiting applies:Code search - 30 queries per minuteAny other API - 5000 per hourResearch Knowledge BaseIssue InjectionsPull Request InjectionsWorkflow Run InjectionsCodeSee InjectionsCurrent LimitationsIt is possible to run external action by referencing a folder with aDockerfile(withoutaction.yml). Currently, this behavior isn't supported.It is possible to run external action by referencing a docker container through thedocker://...URL. Currently, this behavior isn't supported.It is possible to run an action by referencing it locally. This creates complex behavior, as it may come from a different repository that was checked out previously. The current behavior is trying to find it in the existing repository.We aren't modeling the entire workflow structure. If additional fields are needed, please submit a pull request according to thecontributionguidelines.Future Research WorkImplementation of taint analysis. Example use case - a user can pass a pull request title (which is controllable parameter) to an action parameter that is nameddata. That action parameter may be used in a run command:- run: echo ${{ inputs.data }}, which creates a path for a code execution.Expand the research for findings of harmful misuse ofGITHUB_ENV. This may utilize the previous taint analysis as well.Research whetheractions/github-scripthas an interesting threat landscape. If it is, it can be modeled in the graph.LicenseApache License 2.0Hall of Fame - Vulnerabilities Found and Disclosed Using RavenNameStarsFixAdditional SourcesfreeCodeCamp/freeCodeCampCodeSee package update,0871341BlogSignificant-Gravitas/AutoGPTcdae7f8tiangolo/fastapi9efab1bLinkedInwithastro/astro650fb1aBlogstatelyai/xstateCodeSee package updateBlogdocker-slim/docker-slimCodeSee package updateBlogmicrosoft/fluentui2ea6195Blogtiangolo/sqlmodelcf36b2dLinkedIntiangolo/typer0c106a1LinkedInjuspay/hyperswitcha052f9aautogluon/autogluonca18fa9apache/camel02e512aossf/scorecardc9f582bOmbi-app/Ombi5cc0d77Blogwireapp/wire-ios9d39d6cBlogcloudscape-design/components2921d2dDynamoDS/DynamoDisabled workflowBlogfauna/faunadb-jsee6f53fBlogapache/incubator-kie-kogito-runtimes53c18e5BlogWant more of CI/CD Security, AppSec, and ASPM? Check out CycodeIf you liked Raven, you would probably love ourCycodeplatform that offers even more enhanced capabilities for visibility, prioritization, and remediation of vulnerabilities across the software delivery.If you are interested in a robust, research-driven Pipeline Security, Application Security, or ASPM solution, don't hesitate to get in touch with us or request a demo using the formhttps://cycode.com/book-a-demo/.