Penetration Test Report (X41 D-Sec): X41 OSTIF TUF Audit 2022 Final Report PUBLIC

SourceCodeAuditonTheUpdateFramework
forOpenSourceTechnologyImprovementFund(OSTIF)
FinalReportandManagementSummary
2022-09-09
X41 D-SEC GmbH
Krefelder Str. 123
D-52070 Aachen
Amtsgericht Aachen: HRB19989
https://x41-dsec.de/
info@x41-dsec.de
OrganizedbytheOpenSourceTechnologyImprovementFund
SourceCodeAuditonTheUpdateFramework forOpenSourceTechnologyImprovementFund(OSTIF)
Revision Date Change Author(s)
1 2022-08-25 FinalReport E.Sesterhenn,L.Gommans,N.Abel,
Y.Klawohn
2 2022-09-09 Setstatustopublic L.Gommans
X41D-SecGmbH PUBLIC Page1of29
SourceCodeAuditonTheUpdateFramework forOpenSourceTechnologyImprovementFund(OSTIF)
Contents
1 ExecutiveSummary 4
2 Introduction 6
2.1 Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.2 FindingsOverview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.3 Coverage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.4 RecommendedFurtherTests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
3 RatingMethodologyforSecurityVulnerabilities 9
3.1 CommonWeaknessEnumeration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
4 Results 11
4.1 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
4.2 InformationalNotes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
5 AboutX41D-SecGmbH 28
X41D-SecGmbH PUBLIC Page2of29
SourceCodeAuditonTheUpdateFramework forOpenSourceTechnologyImprovementFund(OSTIF)
Dashboard
Target
Customer OpenSourceTechnologyImprovementFund(OSTIF)
Name TheUpdateFramework
Type SourceCodeandSpecification
Version v2.0.0(7ada2af384442f1c3775a4bcbd9f33270c1c8fa0)
Engagement
Type SourceCodeAudit
4: Eric Sesterhenn, Luc Gommans, Niklas Abel and Yasar
Consultants
Klawohn
EngagementEffort 18person-days,2022-08-08to2022-08-19
Totalissuesfound 4
Critical - 0
High - 0
CWE-400(1)
Medium - 1 CWE-345(2)
Low - 3 CWE-732(1)
None - 8
0 1 2 3 4 5 6 7 8
Figure1:IssueOverview(l:Severity,r:CWEDistribution)
X41D-SecGmbH PUBLIC Page3of29
SourceCodeAuditonTheUpdateFramework forOpenSourceTechnologyImprovementFund(OSTIF)
1 Executive Summary
InAugust2022,X41D-SecGmbHperformedasourcecodeauditagainstTheUpdateFramework
(TUF) to identify vulnerabilities and weaknesses in the source code and specification. The test
wasorganizedbytheOpenSourceTechnologyImprovementFund1.
AtotaloffourvulnerabilitieswerediscoveredduringtheauditbyX41.Nonewereratedashaving
acriticalorhighseverity,oneasmedium,andthreeaslow. Additionally, eightissueswithouta
directsecurityimpactwereidentified.
Low - 3
Medium - 1
Figure1.1:IssuesandSeverity
The Update Framework is a specification with a reference implementation designed to provide
developers with a framework for delivering updates to their applications securely. Vulnerabili-
ties in the specification or an implementation could allow an attacker to take over the update
mechanism of many other projects, deliver malicious updates, and gain control of the targeted
systems.
1https://ostif.org
X41D-SecGmbH PUBLIC Page4of29
SourceCodeAuditonTheUpdateFramework forOpenSourceTechnologyImprovementFund(OSTIF)
Inasourcecodeaudit,thetestersreceiveallavailableinformationaboutthetarget.Thetestwas
performedbyfourexperiencedsecurityexpertsbetween2022-08-08and2022-08-19.
Themostsevereissuediscoveredpertainstofilepermissionssetonprivatekeyfileswhenusing
thebasicusageinstructions. Anattackerwhoalreadyhasaccesstothelocalsystemasanother
usercouldreadthesefiles,forexampleasatenantonasharedserversystem,andusethekeys
tosignfalseupdates.
Another weakness exists in Python’s JSON parser, where an attacker could supply a document
atthesizelimitandtriggertheparsertohangforacertainamountoftime.Thetimedependson
the size limit andCPU speed; by default, the timeis on theorder ofa few minutes. Thismight
frustrateusersandcausethemtoaborttheupdateprocess,leavingthemonanoldrelease.
Severalotherimprovementswereidentifiedtoimprovedefense-in-depthandreduceambiguity
inthespecification.
X41 recommends to apply further hardening to the code and to evaluate supply chain attacks
risksinfurthertests. Suchattackscould,forexample,occurduetoacompromiseoftheGitHub
repository,whichisconsideredfullytrustedbytheprojectteam.
Overall,theprojectshowsahighmaturityintermsofsecurity.Havingaspecificationasahuman-
readable description of what the code should do makes it possible to better reason about and
moreeasilyverifythecode.
X41D-SecGmbH PUBLIC Page5of29
SourceCodeAuditonTheUpdateFramework forOpenSourceTechnologyImprovementFund(OSTIF)
2 Introduction
X41reviewedTheUpdateFramework,consistingofaspecification1 andaPythonreferenceim-
plementation. The system allows developers to securely manage updates of software and to
minimizetheimpactonusersintheeventofasupplychainsecurityevent.
It is intended to be widely used, which would make it an important target for any supply chain
attacksonotherprojects.
2.1 Scope
Themainscopeandfocusofthisworkis:
• TheimplementationofthedetailedclientworkflowoftheTUFspecification2,
• thesafetyofthengclientlibrary3
• andtheMetadataAPI4.
Excludedfromthescopearedependencies. Theseconsistofthewell-knownrequests library,
aswellasapackagecalledsecuresystemslib whichisdevelopedbyanoverlappingsetofde-
velopers.
AparticularconcernexpressedbythedevelopersistheJSON5 parsing,sincethisisarelatively
complexoperationandoperatesonuntrustedinputfromthenetwork.
1https://theupdateframework.github.io/specification/v1.0.30/index.html
2https://theupdateframework.github.io/specification/v1.0.30/index.html
3https://theupdateframework.readthedocs.io/en/latest/api/tuf.ngclient.html
4https://theupdateframework.readthedocs.io/en/latest/api/tuf.api.html
5JavaScriptObjectNotation
X41D-SecGmbH PUBLIC Page6of29
SourceCodeAuditonTheUpdateFramework forOpenSourceTechnologyImprovementFund(OSTIF)
2.2 Findings Overview
DESCRIPTION SEVERITY ID REF
PrivateKeyWorld-Readable MEDIUM TUF-CR-22-01 4.1.1
ShallowBuildArtifactVerification LOW TUF-CR-22-02 4.1.2
QuadraticComplexityinJSONNumberParsing LOW TUF-CR-22-03 4.1.3
ReleaseSignaturesAddNoProtection LOW TUF-CR-22-04 4.1.4
FileNotClosedOrFlushed NONE TUF-CR-22-100 4.2.1
GitHub2FAGuidelines NONE TUF-CR-22-101 4.2.2
PyPI2FAGuidelines NONE TUF-CR-22-102 4.2.3
PermissiveVerification NONE TUF-CR-22-103 4.2.4
UpdateCycleAmbiguityinSpecification NONE TUF-CR-22-104 4.2.5
CleanupProcedureNotSpecified NONE TUF-CR-22-105 4.2.6
UnversionedCryptographicPrimitives NONE TUF-CR-22-106 4.2.7
BranchProtectionSecurity NONE TUF-CR-22-107 4.2.8
Table2.1:Security-RelevantFindings
2.3 Coverage
Asecurityassessmentattemptstofindthemostimportantorsometimesasmanyoftheexisting
problemsaspossible,thoughitispracticallyneverpossibletoruleoutthepossibilityofadditional
weaknessesbeingfoundinthefuture.
A manual approach for code review is used by X41. This process is supported by tools such as
staticcodeanalyzersandindustrystandardsecuritytools.
ThetimeallocatedtoX41forthiscodereviewwassufficienttoyieldareasonablecoverageof
thegivenscope.Coveredtopicsinclude:
• JSONparsing(identifiedbythedevelopersasapointofconcern)
• GeneralPythoncodingproblems,usingvariousstaticanalysistools
• ‘Gettingstarted’documentation
• Filesystempermissions
• Third parties which the project depends on (both software and services) and how these
riskscanbereduced
• Releaseverification
• Settinginvalidthresholdvaluestomanipulatethesignaturevalidation
X41D-SecGmbH PUBLIC Page7of29
SourceCodeAuditonTheUpdateFramework forOpenSourceTechnologyImprovementFund(OSTIF)
• Cryptographicprimitivesused
• Practicaltestingofcomputationalcomplexity,downloadsizelimits,anddownloadtimelim-
its
Suggestionsfornextstepsinsecuringthisscopecanbefoundinsection2.4.
2.4 Recommended Further Tests
It is recommended to do a source code audit on the parts that TUF uses from the dependency
securesystemslib. SupplychainvulnerabilitiesheremaycascadetoTUFandhardeningadvice
providedinthisreportcouldalsobeappliedtothedependency’sprojects