Penetration Test Report (Doyensec): Doyensec Gravitational Teleport FeaturesTesting Q32021

TODO
Security Auditing Report
Teleport - Features Testing Q3 2021
Advanced Access Workflows
Slack, Mattermost Plugins
Terraform Provider
Prepared for: Gravitational, Inc. DBA Teleport
Prepared by: Lorenzo Stella
Date: July 23rd, 2021
WWW.DOYENSEC.COM © DOYENSEC
Gravitational, Inc. (DBA Teleport) - Security Auditing Report
Table of Contents
Table of Contents 1
Revision History 2
Contacts 2
Executive Summary 3
Methodology 5
Project Findings 6
Appendix A - Vulnerability Classification 36
Appendix B - Remediation Checklist 37
1 of 37 WWW.DOYENSEC.COM
Gravitational, Inc. (DBA Teleport) - Security Auditing Report
Revision History
Version Date Description Author
1 07/23/2021 First release of the final report Lorenzo Stella
2 07/23/2021 Peer Review Ben Caller
3 07/23/2021 Peer Review Luca Carettoni
4 07/15/2022 Retesting Lorenzo Stella
Contacts
Company Name Email
Gravitational, Inc Russell Jones rjones@gravitational.com
Gravitational, Inc Sasha Klizhentas sasha@gravitational.com
Gravitational, Inc Alexey Kontsevoy alexey@gravitational.com
Doyensec, LLC Luca Carettoni luca@doyensec.com
Doyensec, LLC John Villamil john@doyensec.com
2 of 37 WWW.DOYENSEC.COM
Gravitational, Inc. (DBA Teleport) - Security Auditing Report
Executive Summary • Evaluate the overall security posture and
feature design
Overview
Based on the information provided and through
conversation with the Teleport team, Doyensec
Gravitational, Inc (DBA "Teleport") engaged included in the scope the following components:
Doyensec to perform a security assessment on
some of the recent Teleport platform features. • Teleport Advanced Access Workflows
Teleport is a cloud-native SSH gateway for • github.com/gravitational/teleport#5441
managing access to clusters of Linux servers via
SSH or Kubernetes APIs. • Predicate Logic Library used by AAW
• github.com/vulcand/predicate
The project commenced on 07/05/2021 and
ended on 07/23/2021 requiring two (2) security • Teleport Plugins (Slack, Mattermost)
researchers, for a total of fifteen (15) person/ • github.com/gravitational/teleport-plugins
days. The project resulted in twelve (12) findings
of which one (1) was rated with high severity. • Teleport Terraform provider
• github.com/gravitational/teleport-plugins/
In July 2022, Doyensec performed a retesting of pull/197
the Teleport Features in scope and confirmed the
effectiveness of the applied mitigations. All The testing took place in a development
issues with direct security impact have been environment using the latest version of the
addressed by Gravitational. software at the time of testing.
The project consisted of a manual web In detail, this activity was performed on the
application security assessment, source code following commits:
review, and dynamic instrumentation of the target.
Testing focused exclusively on the features listed • https://github.com/gravitational/teleport
in scope below. f475425bb88054e7f[PII_REDACTED]720fbd6b87e24
Testing was conducted remotely from Doyensec • https://github.com/vulcand/predicate
EMEA and US offices. 8fbfb3ab0e94276b6b58bec378600829adc7a203
Scope • https://github.com/gravitational/teleport-
plugins
Through meetings with Teleport, the scope of the b671c3dc3c458bc4ba1d553a3d96c475fab77cbf
project was clearly defined.
Scoping Restrictions
• Identify misconfigurations and vulnerabilities
in the new Teleport's Advanced Access During the engagement, Doyensec did not
Workflows feature and Slack+Mattermost encounter any difficulties testing the
plugins functionalities of the application. Teleport
engineering team was very responsive in
• Identify misconfigurations in the Terraform debugging any issue to ensure a smooth
provider assessment.
3 of 37 WWW.DOYENSEC.COM
Gravitational, Inc. (DBA Teleport) - Security Auditing Report
Testing focused on Teleport's new Advanced
Access Workflows feature and its Slack and
Mattermost plugins. Additionally, Teleport
included the “Terraform provider” in the scope for
the engagement.
It is also important to notice that Teleport is a
highly flexible platform in which several Recommendations
configurations can be customized by the end-
user. For instance, permissions for roles/users are The following recommendations are proposed
completely customizable, hence Doyensec based on studying the Teleport security posture
focused on vulnerabilities in the core logic instead and vulnerabilities discovered during this
of enumerating potential misconfigurations in engagement.
user-defined policies.
Short-term improvements
Findings Summary
• Work on mitigating the discovered
vulnerabilities. You can use Appendix B -
Doyensec researchers discovered and reported
Remediation Checklist to make sure that you
twelve (12) vulnerabilities in the selected Teleport
have covered all areas.
features.
Long-term improvements
While most of the issues are departures from best
practices and low-severity flaws, Doyensec
• At the time of writing, Teleport's custom
identified one (1) high severity and two (2)
approval feature has been designed and
medium severity issues that can be leveraged to
implemented accepting the following risks.
compromise the confidentiality, integrity, and
Future releases could attempt to mitigate
availability of the solution.
such minor intrinsic risks:
• Temporary, approved roles are also
It is important to reiterate that this report
considered when evaluating the
represents a snapshot of the security posture of
approval conditions for other roles
the environment at a point in time.
• If the attacker has view permissions
on the access requests, it is possible
Major findings included an injection flaw that
to leak the roles of the users
allows terminal escape sequences and new lines
approving a request
to be injected within approval request messages.
• The request reason and reviewer traits
The ability to use Markdown in approval
are available at the same time inside
messages was also reported as a potential area
of the threshold filter context, which
of concern since it can be easily abused to setup
allows the definition of predicates
social engineering traps. A Denial of Service (DoS)
having arbitrary user-input, potentially
vulnerability was discovered in the way HTTP
leading to the disclosure of traits (e.g.
request bodies are parsed by approval bots.
declaring a predicate having
contains(reviewer.traits["foo"]
Considering the overall complexity of the targeted
, request.reason))
features, the security posture was found to be in
line with industry best practices.
It is important to note that Doyensec performed a
design review on all features included for testing,
prior to their implementation.
4 of 37 WWW.DOYENSEC.COM
Gravitational, Inc. (DBA Teleport) - Security Auditing Report
Methodology Web Application and API
Techniques
Overview
Web assessments are centered around the data
sent between clients and servers. In this realm,
Doyensec treats each engagement as a fluid
the principle audit tool is the Burp Suite, however
entity. We use a standard base of tools and
we also use a large set of custom scripts and
techniques from which we built our own unique
extensions to perform specific audit tasks. We
methodology. Our 30 years of information security
focus on authorization, authentication, integrity
experience has taught us that mixing offensive
and trust. We study how data is interpreted,
and defensive philosophies is the key for standing
parsed, stored, and relayed between producers
against threats, thus we recommend a graybox
and consumers.
approach combining dynamic fault injection with
an in-depth study of source code to maximize the
We subvert the client with malicious data through
ROI on bug hunting.
reflected and DOM based Cross Site Scripting and
by breaking assumptions in trust. We test the
During this assessment, we have employed
server endpoints for injection style flaws
standard testing methodologies (e.g. OWASP
including, but not limited to, SQL, template, XML,
Testing guide recommendations) as well as
and command injection fl