Penetration Test Report (Doyensec): Doyensec Gravitational GravityPlatform Q22019

Security Auditing Report
Gravitational - Gravity Platform
Prepared for: Gravitational, Inc.
Prepared by: Luca Carettoni
WWW.DOYENSEC.COM © DOYENSEC
Gravitational, Inc. - Security Auditing Report
Table of Contents
Table of Contents 1
Revision History 2
Contacts 2
Executive Summary 3
Methodology 6
Project Findings 7
Appendix A - Vulnerability Classification 48
Appendix B - Remediation Checklist 49
Appendix C - From XSS To Infra RCE - A Case Study 50
1 of 53 WWW.DOYENSEC.COM
Gravitational, Inc. - Security Auditing Report
Revision History
Version Date Description Author
1 06/18/2019 First release of the final report Luca Carettoni
2 06/19/2019 Peer Review Andrea Brancaleoni
3 02/26/2020 Retesting Update Luca Carettoni
Contacts
Company Name Email
Gravitational, Inc. Kevin Nisbet kevin@gravitational.com
Gravitational, Inc. Sasha Klizhentas sasha@gravitational.com
Gravitational, Inc. Alexey Kontsevoy alexey@gravitational.com
Doyensec, LLC. Luca Carettoni luca@doyensec.com
Doyensec, LLC. John Villamil john@doyensec.com
2 of 53 WWW.DOYENSEC.COM
Gravitational, Inc. - Security Auditing Report
Executive Summary • Evaluate the overall security posture and best
practices compared to other industry
peers
Overview
We list the agreed upon targets below:
Gravitational engaged Doyensec to perform a
security assessment of the Gravity platform. • Gravity Community
Gravity can be described as a packaging and • https://github.com/gravitational/gravity
management solution for Kubernetes clusters
that integrates with the Teleport secure access • Gravity Enterprise
gateway.
• Gravity internal dependencies
The project commenced on 06/03/2019 and
ended on 06/17/2019 requiring two (2) security Testing took place in a production-like
researchers. The project resulted in sixteen (16) environment using the latest version of the
findings of which four (4) were rated as High software at the time of testing. In detail, this
severity. activity was performed on the following releases:
Few weeks after the end of the project, Doyensec • Gravity Community v6.0.0-rc.1
performed a code review of the fixes for the • https://github.com/gravitational/gravity/
vulnerabilities discovered during this engagement. releases/tag/6.0.0-beta.1
Besides finding #4 - Missing Signature Verification
in Application Bundles, all issues with significant • Gravity Enterprise
security impact have been addressed by • b8e63fe1d52abe693a4e4b15e211dd15ae
Gravitational. dd9972
Scoping Restrictions
This deliverable represents the state of all
discovered vulnerabilities as of 02/26/2020.
During the engagement, Doyensec did not
The project consisted of a manual web encounter significant difficulties in testing the
application security assessment, source code application. The Gravitational engineering team
review and dynamic instrumentation of the was very responsive in debugging any issue to
command line tools. ensure a smooth assessment.
Testing was conducted remotely from Doyensec While testing included the review of the Gravity
EMEA and US offices. internal dependencies, Doyensec did not perform
a complete source code review for all packages.
Scope
It is also important to notice that Gravity is a
highly flexible platform in which the vast majority
Through meetings with Gravitational, the scope of
of the configuration is customized by the user
the project was clearly defined:
(system integrators and end-users). For instance,
permissions for roles/users are completely
• Identify misconfigurations and vulnerabilities
controlled by the customer, hence Doyensec
in Gravity Community and Enterprise
focused on vulnerabilities in the core logic instead
of enumerating potential misconfigurations in
user-defined policies.
3 of 53 WWW.DOYENSEC.COM
Gravitational, Inc. - Security Auditing Report
leveraged to bypass two-factor
Findings Summary
• Kubernetes nodes running in AWS usually
Doyensec researchers discovered and reported need access to internal cloud services to
sixteen (16) vulnerabilities in Gravity. While operate. By default, Gravity does not employ
several issues are departure from best practices any Kubernetes AWS instance metadata
and low-severity flaws, Doyensec identified four firewall hence untrusted nodes can access
(4) issues rated as High that can be leveraged to IAM credentials that can be used to modify
compromise the confidentiality, integrity and security groups
availability of the platform.
• Not enough granularity in the current
It is important to reiterate that this report permission model. In fact, read/write access
represents a snapshot of the security posture of to the cluster resource is often required by
the product at a point in time. non-admin users but it exposes the system to
systemic privilege escalation
The findings included multiple injection flaws
within the web application API endpoints, the As mentioned above, these design issues are
command-line tele utility and the application often mitigated by the specific configurations and
bundle archives. Missing ACLs in the API keys operational security practices established by the
end-users; Doyensec did however report those
management endpoints allow horizontal and
vertical privilege escalation. A Cross-Site Scripting issues as findings since the default configuration
(XSS) vulnerability via content sniffing on Internet of the platform does not mitigate those attack
Explorer was also discovered. By combining some scenarios.
of those issues together, Doyensec demonstrated
how a malicious actor can craft a 1-click exploit
that would hijack a low-privileged user session,
perform privilege escalation and take-over the
entire cluster as root. Please refer to Appendix C
for more details.
Considering the overall complexity of the platform
and the numerous endpoints, the security posture
of the Internet-facing APIs was found to be in line
with industry best practices.
At the design level, Doyensec has found the
system to be well architected with the exclusion
of the following aspects:
• Missing signature verification in application
bundles. While the product resembles a
package manager, it doesn’t provide standard
features such as package verification due to
the way customers are generally deploying
clusters and applications
• Use of legacy authentication mechanisms
(such as HTTP Basic Authentication) can be
4 of 53 WWW.DOYENSEC.COM
Gravitational, Inc. - Security Auditing Report
Recommendations
The following recommendations are proposed
based on studying Gravity security posture and
vulnerabilities discovered during this engagement.
Short-term improvements
• Work on mitigating the discovered
vulnerabilities. You can use Appendix B -
Remediation Checklist to make sure that you
have covered all areas
• Define a clear guideline on how to properly
setup and configure a secure Gravity system,
for example by including hardening tips and
in-depth documentation of potential risks that
the user would need to mitigate with custom
configurations
Long-term improvements
• Expand the current permissioning model to
include more granularity in the resources /
verbs mapping. Additionally, consider to
create pre-defined roles with different level of
authorization and permissions
5 of 53 WWW.DOYENSEC.COM
Gravitational, Inc. - Security Auditing Report
Methodology • Openssl
• Curl, netcat and other Linux utilities
Overview Web Application and API
Techniques
Doyensec treats each engagement as a fluid
entity. We use a standard base of tools and
Web assessments are centered around the data
techniques from which we built our own unique
sent between clients and servers. In this realm,
methodology. Our 30 years of information security
the principle audit tool is the Burp Suite, however
experience has taught us that mixing offensive
we also use a large set of custom scripts and
and defensive philosophies is the key for standing
extensions to perform specific audit tasks. We
against threats, thus we recommend a graybox
focus on authorization, authentication, integrity
approach combi