Penetration Test Report (ShielderSec): [OSTIF] Bref   Report v1.2

Nome del documento
Autore e data [Digitare qui]
Technical
Report
Bref
Security Assessment
Prepared for:
OSTIF
Via Palestro 1/C, Pinerolo (TO) – info@shielder.it – P.I.[PII_REDACTED]3
1
www.shielder.it
Technical Report – Bref
Abdel Adim Oisfi – March 26, 2024
1. Document Details
Classification Public – CC BY-SA 4.0
Last review March 26, 2024
Author Abdel Adim Oisfi
1.1. Version
Identifier Date Author Note
v1.0 January 08, 2024 Abdel Adim Oisfi First version
v1.1 January 09, 2024 Pietro Tirenna Peer review
v1.2 March 26, 2024 Abdel Adim Oisfi Public release
1.2. Contacts Information
Company Name Position Contact
Shielder Abdel Adim Oisfi CEO abdeladim.oisfi@shielder.com
Shielder Pietro Tirenna Consultant pietro.tirenna@shielder.com
OSTIF Derek Zimmer CEO derek@ostif.org
OSTIF Amir Montazery Managing Director amir@ostif.org
Bref Matthieu Napoli Main Maintainer matthieu@mnapoli.fr
Via Palestro 1/C, Pinerolo (TO) – info@shielder.it – P.I.[PII_REDACTED]3
2
www.shielder.it
Technical Report – Bref
Abdel Adim Oisfi – March 26, 2024
2. Summary
1. Document Details ................................................................................................................................ 2
1.1. Version .......................................................................................................................................... 2
1.2. Contacts Information ................................................................................................................. 2
2. Summary ................................................................................................................................................ 3
3. Executive Summary ............................................................................................................................. 4
3.1. Overview ....................................................................................................................................... 4
3.2. Context and Scope ..................................................................................................................... 4
3.3. Methodology ................................................................................................................................ 5
3.4. Audit Summary ............................................................................................................................ 6
3.5. Recommendations ...................................................................................................................... 6
3.6. Long Term Improvements ......................................................................................................... 7
3.7. Results Summary ......................................................................................................................... 8
3.8. Findings Severity Classification ............................................................................................... 9
3.9. Remediation Status Classification ........................................................................................ 10
4. Findings Details ................................................................................................................................. 11
4.1. Uploaded Files Not Deleted in Event-Driven Functions ................................................ 11
4.2. Slow String Operations via MultiPart Requests in Event-Driven Functions .............. 15
4.3. Query String Parsing Inconsistency ..................................................................................... 19
4.4. Multiple Value Headers Not Supported in ApiGatewayFormatV2 .............................. 21
4.5. Body Parsing Inconsistency in Event-Driven Functions ................................................. 23
Via Palestro 1/C, Pinerolo (TO) – info@shielder.it – P.I.[PII_REDACTED]3
3
www.shielder.it
Technical Report – Bref
Abdel Adim Oisfi – March 26, 2024
3. Executive Summary
The document aims to highlight the findings identified during the “Security Assessment” against
the "Bref" project described in section “3.2 Context and Scope”.
For each detected finding, the following information is provided:
§ Severity: the finding’s score ("3.8 Findings Severity Classification").
§ Affected resources: in which components the finding lies.
§ Status: remediation status ("3.9 Remediation Status Classification").
§ Description: type and context of the detected finding.
§ Impact: attack preconditions and information about the loss of confidentiality, data
integrity and/or availability in case of a successful attack.
§ Proof of Concept: evidence and/or reproduction steps.
§ Suggested remediation: configurations or actions needed to remediate the finding.
§ References: useful external resources.
3.1. Overview
In December 2023, Shielder was hired by the Open Source Technology Improvement Fund
(OSTIF) to perform a Security Audit of Bref (bref.sh), an open-source project that helps you
go serverless on AWS with PHP.
Bref comes as:
§ A Composer package which can be used with every PHP framework
(https://github.com/brefphp/bref).
§ A Laravel-specific bridge (https://github.com/brefphp/laravel-bridge).
§ A Symfony-specific bridge (https://github.com/brefphp/symfony-bridge).
§ An AWS Lambda custom runtime (https://github.com/brefphp/aws-lambda-layers).
A team of 1 (one) Shielder engineer worked on this project for a total of 2 (two) person-
weeks of audit effort.
3.2. Context and Scope
The main targets of the audit were the Composer package, where the logic is implemented,
and the AWS Lambda custom runtime, that provides the base system configuration for the
Lambda environment and which acts as an entry point for each Lambda execution.
The scope of this audit is the Bref version 2.1.9 released on November 23, 2023.
Coincidentally, during the audit two new versions of Bref got released, 2.1.10 on December
22, 2023 and 2.1.22 on January 01, 2023. The new versions were not audited in depth, but
the differences were analyzed to ensure that any discovered findings also affected the
latest version.
Via Palestro 1/C, Pinerolo (TO) – info@shielder.it – P.I.[PII_REDACTED]3
4
www.shielder.it
Technical Report – Bref
Abdel Adim Oisfi – March 26, 2024
It is important to note that Security Assessments are time-boxed activities performed at a
specific point in time; thus, they are unable to guarantee that a software is or will be free of
bugs.
The Security Audit was driven by an initial threat analysis intended to establish which are
the security boundaries of Bref. The analysis highlighted that:
§ Bref is meant to be transparent and allows developers to port their projects to AWS
Lambda without changing the source code.
§ Bref does not handle the AWS resources creation. Instead, it provides a serverless
plugin which injects Bref-specific commands into it. The AWS resources creation is
managed by serverless itself and it’s a developer responsibility to set them up
correctly and grant any role needed to the various services.
§ The Bref runtime comes in different flavors based on the needed execution
environment and could be easily customized by the developers. It provides the base
system where PHP is installed, bundled with the entry point invoked during the
Lambda bootstrap.
§ The Bref Composer package is invoked by the Bref runtime and it is responsible for
fetching the event data from the Lambda runtime API and converting it (according
to its type) to a PHP object (i.e. PHP FPM, PSR object, etc.). After the event is
consumed by the application, the Bref Composer serializes the response to an event
JSON object, sending it back to the Lambda runtime API.
3.3. Methodology
The source code audit was carried out following a standard Shielder methodology
developed during years of experience. Different testing techniques and approaches were
employed.
While the project source code was available, all the processing done by AWS was a black-
box, therefore a pure static analysis approach was not possible. F