Penetration Test Report (Cure53): analysis report Pomerium

Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
Pentest-Report Pomerium 03.2021
Cure53, Dr.-Ing. M. Heiderich, N. Hippert, BSc. B. Walny, BSc. T.-C. “Filedescriptor” Hong
Index
Introduction
Scope
Test Methodology
WP1: Thorough Source Code Audits against latest version of Pomerium
WP2: Penetration Tests against Pomerium Integration & Setup
Identified Vulnerabilities
POM-01-001 WP1: JWT leak via Open Redirect in programmatic access (High)
POM-01-002 WP1: No verification of pomerium_signature in middleware (High)
Miscellaneous Issues
POM-01-003 WP2: Hardening recommendations for file-handling (Medium)
POM-01-004 WP2: Cross-Origin HTTP security headers missing (Info)
POM-01-005 WP2: Missing SameSite flag for cookie security (Info)
Conclusions
Cure53, Berlin · 03/31/21 1/13
Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
Introduction
“Use identity, device-state, and request context to implement zero-trust, achieve
compliance, and secure access to your applications, clusters, and servers without a
VPN.”
From https://www.pomerium.com/
This report documents the results of a security assessment targeting the Pomerium
complex. Carried out by Cure53 in 2021, this project entailed a thorough penetration test
and a dedicated source code audit featuring the Pomerium codebase and a deployed
setup running the latest version of Pomerium in a real-life and live environment.
To give some context, the work was requested by Pomerium, Inc. in January 2021 and
then promptly scheduled. Cure53 has punctually executed the project in March 2021,
namely in CW10 and CW11. As for the resources, a total of twenty person-days were
invested to reach the coverage expected for this project, which was prepared,
conducted, documented and finalized by a team of four testers, all selected on the basis
of their skills and experience matching the Pomerium’s technical traits and objectives.
In terms of optimizing structure, the work was split into two separate work packages
(WPs). In WP1, Cure53 performed a thorough source code audit on the latest version of
the Pomerium’s codebase, whereas WP2 focused on penetration tests against the
Pomerium’s integration and broader setup. Methodology-wise, a white-box approach
was chosen and deployed. In particular, Cure53 was given access to the deployed
environment as well as all relevant sources and documentation. The environment was
rolled-out on GCP and Cure53 was furnished with appropriate access instructions and
setups.
The project moved forward efficiently. All preparations were done in late February and
early March 2021, namely in CW08 and CW09, indicating that Cure53 could have a
smooth start. Communications during the test were done in a dedicated and shared
Slack channel which connected the workspaces of Cure53 and Pomerium. All relevant
personnel from both teams could partake in the discussion which were very productive.
Since the scope was well-prepared and clear, no noteworthy roadblocks were
encountered during the test. Nevertheless, Cure53 relayed frequent status updates
about the test and the emerging findings.
Very good coverage over the WP1-2 scope items was arguably achieved. Five security-
relevant issues were spotted and documented: two representing security vulnerabilities
and three classified as general weaknesses with lower exploitation potential. Live-
reporting was utilized and the Pomerium team managed to fix the tracked issues while
Cure53, Berlin · 03/31/21 2/13
Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
the test was still ongoing. Moreover, the Cure53 team was given all necessary info to
also look at the fixes and either verified them or added remarks about possible bypasses
and similar problems.
Commenting on the findings, the overall number of items is rather small, which is a great
sign for Pomerium and its codebase. However, the severity levels are quite elevated.
Although no issues were marked as Critical, two discoveries were seen as High risks.
One of them enveloped a JWT leak and the other pertained to a missing signature
verification within middleware.
In the following sections, the report will first shed light on the scope, material available
for testing, key examination parameters, as well as the structure and content of the WPs.
After that, the document offers a distinct section on testing coverage and methodology,
so as to facilitate tracking of the areas covered during the assessment, even if the tests
yielded no findings in a given realm.
Next, all findings will be discussed in grouped vulnerability and miscellaneous
categories, then following a chronological order in each array. Alongside technical
descriptions, PoC and mitigation advice, as well as fix notes, are supplied when
applicable. Finally, the report will close with broader conclusions about this March 2021
project. Cure53 elaborates on the general impressions and reiterates the verdict based
on the testing team’s observations and collected evidence. Tailored hardening
recommendations for the Pomerium complex are also incorporated into the final section.
Cure53, Berlin · 03/31/21 3/13
Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
Scope
• Penetration-Tests and Source Code Audits against Pomerium
◦ Access to rolled out application
▪ https://verify.audit.pomerium.io /
◦ GCP Access
▪ https://console.cloud.google.com/invitation?project=pomerium-audit-2021q1
◦ Public Source Code Repository
▪ https://github.com/pomerium/pomerium
◦ Test-supporting material was shared with Cure53
◦ All relevant sources were shared with Cure53
Cure53, Berlin · 03/31/21 4/13
Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
Test Methodology
This section documents the testing methodology applied during this engagement and
sheds light on various areas of the Pomerium application complex. Tests were
performed both in the form of the server-side API, as well as frontend and infrastructure
components. The section further clarifies which areas were examined by Cure53 but did
not yield any findings.
WP1: Thorough Source Code Audits against latest version of Pomerium
The enumeration below describes the tests and coverage areas checked through source
code audits and focused on the network-based components of Pomerium. The listed
areas were investigated through the approaches described per item. Note that the
specific commit hash for the version of the Pomerium software examined by Cure53
was: 50dc15de283fc0e864e7e96acce3d4acc346e77c
• Starting with the Pomerium config, the parsing logic was reviewed for potential
injections or general unexpected behaviors. The policy from and to routes are
being passed through the whole software complex, so this needed investigation.
These and other parsing and path handling routines which, for instance, match
the host of requests to the proxy, have been reviewed for parsing differentials. If
found, those would lead to a potential proxy bypass.
• While making requests which go through the proxy, other inputs were reviewed.
For example, Cure53 looked at inputs sent through HTTP headers, e.g.
authorization or cookie headers.
• Lua scripts responsible for handling requests, as well as responses from an
upstream server through the proxy have been reviewed. In scope were mostly
weaknesses that could leak authorization tokens to upstream services, or
problems due to responses of upstream servers being handled in an improper
manner.
• Exposed Pomerium APIs and sites of the proxy, authentication and authorization
services have been reviewed for typical web security vulnerabilities like XSS and
CSRF.
• The general HTTP security header configuration of the exposed services has
been reviewed.
• The employed JWT has been checked for common mistakes, such as improper
signature verification due to the “None” algorithm, key