Penetration Test Report (Doyensec): Doyensec Gravitational Teleport Testing Q22019

Security Auditing Report
Gravitational - Teleport Testing 2019
Prepared for: Gravitational, Inc.
Prepared by: Luca Carettoni
WWW.DOYENSEC.COM © DOYENSEC
Gravitational, Inc. - Security Auditing Report
Table of Contents
Table of Contents 1
Revision History 2
Contacts 2
Executive Summary 3
Methodology 5
Project Findings 6
Appendix A - Vulnerability Classification 44
Appendix B - Remediation Checklist 45
1 of 45 WWW.DOYENSEC.COM
Gravitational, Inc. - Security Auditing Report
Revision History
Version Date Description Author
1 07/08/2019 First release of the final report Luca Carettoni
2 07/11/2019 Peer Review Lorenzo Stella
3 07/12/2019 Peer Review John Villamil
4 01/10/2020 Retesting Update Lorenzo Stella
Contacts
Company Name Email
Gravitational, Inc. Russell Jones rjones@gravitational.com
Gravitational, Inc. Sasha Klizhentas sasha@gravitational.com
Gravitational, Inc. Alexey Kontsevoy alexey@gravitational.com
Doyensec, LLC. Luca Carettoni luca@doyensec.com
Doyensec, LLC. John Villamil john@doyensec.com
2 of 45 WWW.DOYENSEC.COM
Gravitational, Inc. - Security Auditing Report
Executive Summary
We list the agreed-upon targets below:
Overview
• Teleport Community
• https://github.com/gravitational/teleport
Gravitational engaged Doyensec to perform a
security assessment of the Teleport platform. • Teleport Enterprise
Gravitational Teleport is a cloud-native SSH • https://github.com/gravitational/teleport.e
gateway for managing access to clusters of Linux
servers via SSH or Kubernetes APIs. • Teleport internal dependencies
The project commenced on 06/18/2019 and Testing took place in a production-like
ended on 07/05/2019 requiring two (2) security environment using the latest version of the
researchers. The project resulted in fourteen (14) software at the time of testing. In detail, this
findings of which one (1) was rated as High activity was performed on the following releases:
severity and three (3) were rated as Medium
severity. • Teleport v4.0.0
• https://github.com/gravitational/teleport/
In January 2020, Doyensec performed a retesting releases/tag/v4.0.0
of the Teleport platform and confirmed the • c7f55ac373099fe301814ffd5523952edca
04723
effectiveness of the applied mitigations. All
issues with direct security impact have been
• Teleport Enterprise
addressed by Gravitational.
• d8b3d899a75d0969880ae670f5ac84481d
d6fadc
This deliverable represents the state of all
discovered vulnerabilities as of 01/10/2020.
Scoping Restrictions
The project consisted of a manual web
During the engagement, Doyensec did not
application security assessment, source code
encounter any difficulties with testing the
review and dynamic instrumentation of the
application. The Gravitational engineering team
command line tools.
was very responsive in debugging any issues to
ensure a smooth assessment.
Testing was conducted remotely from Doyensec
EMEA and US offices.
While testing included the review of the Teleport
internal dependencies, Doyensec did not perform
Scope
a complete source code review for all packages.
Through meetings with Gravitational, the scope of
It is also important to notice that Teleport is a
the project was clearly defined:
highly flexible platform in which several
configurations can be customized by the end-
• Identify misconfigurations and vulnerabilities
user. For instance, permissions for roles/users are
in Teleport Community and Enterprise
completely customizable, hence Doyensec
focused on vulnerabilities in the core logic instead
• Evaluate the overall security posture and best
of enumerating potential misconfigurations in
practices compared to other industry
user-defined policies.
peers
3 of 45 WWW.DOYENSEC.COM
Gravitational, Inc. - Security Auditing Report
Findings Summary • Granted and implicit trust on data exchanged
between the nodes and the authentication
Doyensec researchers discovered and reported server. Insufficient mitigations are in place
fourteen (14) vulnerabilities in Teleport. While preventing abuses from compromised or
several issues are departure from best practices malicious nodes.
and low-severity flaws, Doyensec identified one
(1) issue rated as High and three (3) issues rated Recommendations
as Medium that can be leveraged to compromise
the confidentiality, integrity and availability of the The following recommendations are proposed
platform. based on studying the Teleport security posture
and the vulnerabilities discovered during this
It is important to reiterate that this report engagement.
represents a snapshot of the security posture of
the product at a point in time. Short-term improvements
The findings included multiple vulnerabilities in • Work on mitigating the discovered
both the design and implementation of some vulnerabilities. You can use Appendix B -
features. Several SSH session recording bypasses Remediation Checklist to make sure that you
were found abusing both the SSH web and have covered all areas
terminal features. Insecure decompression of
recording events and log files led to arbitrary file Long-term improvements
read and write vulnerabilities affecting the
authentication server. An unauthenticated user • Design and implement a certificate revocation
creation method was also identified, along with an system (e.g. a Certificate Revocation List or
account takeover through Github username an Online Cer tificate Status
change. Doyensec also reported several missing Protocol implementation) for certificate
best practices that would make the platform more rotation and invalidation
resilient against certain attack scenarios.
• Design and implement a solution to ensure
Considering the overall complexity of the platform integrity of the audit trails. Additionally, this
and the numerous endpoints, the security posture solution should also ensure that the sender of
of the Internet-facing APIs was found to be in line the audit events is the actual source of such
with industry best practices. events
At the design level, Doyensec has found the • Design and implement an attribution system
system to be well architected with the exclusion for actions performed by different users
of the following aspects: sharing an SSH session, uniquely identifying
input from any connected tty (See #27011,
• The recording capabilities of the platform can #23242)
inherently be bypassed due to the underlying
complexity of the terminal software. Having
said that, Gravitational has implemented
extensive countermeasures in the Teleport
design that does block several techniques
1 https://github.com/gravitational/teleport/issues/2701
2 https://github.com/gravitational/teleport/issues/2324
4 of 45 WWW.DOYENSEC.COM
Gravitational, Inc. - Security Auditing Report
Methodology • Openssl
• Curl, netcat and other Linux utilities
• Gosec
Overview • Protoc
• SQLite client
Doyensec treats each engagement as a fluid
entity. We use a standard base of tools and Web Application and API
techniques from which we built our own unique Techniques
methodology. Our 30 years of information security
experience has taught us that mixing offensive
Web assessments are centered around the data
and defensive philosophies is the key for standing
sent between clients and servers. In this realm,
against threats, thus we recommend a graybox
the principle audit tool is the Burp Suite, however
approach combining dynamic fault injection with
we also use a large set of custom scripts and
an in-depth study of source code to maximize the
extensions to perform specific audit tasks. We
ROI on bug hunting.
focus on authorization, authentication, integrity
and trust. We study how data is interpreted,
During this assessment, we employed standard
parsed, stored, and relayed between producers
testing methodologies (e.g. OWASP Testing guide
and consumers.
recommendations) as well as custom checklists
to ensure full coverage of both code and
We subvert the client with malicious data through
vulnerabilities classes.
reflected and DOM based Cross Site Scripting and
by breaking assumptions in tr