Penetration Test Report (X41 D-Sec): X41 OSTIF in toto Audit 2023 Public

SourceCodeAuditonthein-totoFramework
forOpenSourceTechnologyImprovementFund(OSTIF)
FinalReportandManagementSummary
2023-05-16
PUBLIC
X41 D-SEC GmbH
Krefelderstr. 123
D-52070 Aachen
Amtsgericht Aachen: HRB19989
https://x41-dsec.de/
info@x41-dsec.de
OrganizedbytheOpenSourceTechnologyImprovementFund
SourceCodeAuditonthein-totoFramework OpenSourceTechnologyImprovementFund(OSTIF)
Revision Date Change Author(s)
1 2023-02-24 FinalReport EricSesterhenn,J.M.,andLucGommans
2 2023-03-16 Clarifications LucGommans
3 2023-05-16 PublicReport LucGommans
X41D-SecGmbH PUBLIC Page1of33
SourceCodeAuditonthein-totoFramework OpenSourceTechnologyImprovementFund(OSTIF)
Contents
1 ExecutiveSummary 4
2 Introduction 6
2.1 Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.2 FindingsOverview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.3 Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.4 Coverage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.5 RecommendedFurtherTests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
3 RatingMethodologyforSecurityVulnerabilities 10
3.1 CommonWeaknessEnumeration . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
4 Results 12
4.1 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
4.2 InformationalNotes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
5 AboutX41D-SecGmbH 32
X41D-SecGmbH PUBLIC Page2of33
SourceCodeAuditonthein-totoFramework OpenSourceTechnologyImprovementFund(OSTIF)
Dashboard
Target
Customer OpenSourceTechnologyImprovementFund(OSTIF)
Name in-totoFramework
Type SpecificationandReferenceImplementations
1.3.1 (Python implementation) and 0.6.0 (Go implementa-
Version
tion)
Engagement
Type SourceCodeAudit
Consultants 3:EricSesterhenn,J.M.andLucGommans
EngagementEffort 24person-days,2023-02-06to2023-02-24
Totalissuesfound 8
Critical - 0
High - 1 CWE-1328(1)
CWE-15(1) CWE-295(3)
Medium - 4
CWE-349(1)
Low - 3
CWE-345(2)
None - 9
0 1 2 3 4 5 6 7 8 9
Figure1:IssueOverview(l:Severity,r:CWEDistribution)
X41D-SecGmbH PUBLIC Page3of33
SourceCodeAuditonthein-totoFramework OpenSourceTechnologyImprovementFund(OSTIF)
1 Executive Summary
InFebruary2023,X41D-SecGmbHperformedasourcecodesecurityauditagainstthein-toto
PythonandGoimplementationsalongwiththearchitecturalspecificationstoidentifyvulnerabil-
itiesandweaknessesintheframework.
AtotalofeightvulnerabilitieswerediscoveredduringthetestbyX41.Nonewereratedascritical,
one was classified as high severity, four as medium, and three as low. Additionally, nine issues
withoutadirectsecurityimpactwereidentified.
Medium - 4
Low - 3
High - 1
Figure1.1:IssuesandSeverity
in-toto is a framework that helps to secure the software supply chain from initiation to end-
user installation. Vulnerabilities in the framework or specification would allow an attacker to
compromisethesoftwaresupplychainandthereforetheproductrelyingonit.
In a source code audit, the testers receive all available information about the target, including
sourcecodeandspecification.
X41D-SecGmbH PUBLIC Page4of33
SourceCodeAuditonthein-totoFramework OpenSourceTechnologyImprovementFund(OSTIF)
Thetestwasperformedbythreeexperiencedsecurityexpertsbetween2023-02-06and2023-
02-24.
The code quality for the source code analyzed was very good and most issues identified are
relatedtothedesignorarchitecturallimitsofin-toto.
Themostsevereissuediscoveredallowsthesupplychaintobecompromiseduntilthefinalveri-
fication,sinceindividualfunctionariescannotverifytheintermediatedatasuppliedusingin-toto.
Additionally,filemetadataisnotverifiedwhichmightleadtosecurityissuesunlessacontainer
formatisused.
SeveralissueswerefoundinthePythonimplementationwhicharerelatedtotheverificationof
datasignedwithPGPkeysthathavebeenimportedfromGnuPGtothelayoutfile.
Althoughnodirectsecurityimplicationwasidentified,theambiguityofJSONparsingisaconcern
totheauditorsandmightleadtoissuesinspecificsetupsorwhenadditionalimplementationsof
thespecificationsarecreated.
X41recommendstomakeuseofGnuPGforverificationofsignatures,andtomovefromJSON-
basedformatsthatarepronetodifferentinterpretationstoastrictlydefinedformatforallmeta-
data. Additionally,X41recommendstoclearlydescribetheattackscenarioandgoalsofin-toto
aswellasthelimitationsofwhattheframeworkprovides.Furthermore,anauditofthesecuresys-
temslibdependencyshouldbeperformed.
Inconclusion, in-totooffersarobustcodebasebutisabletoimproveonthegeneraldesignar-
chitecture.
X41D-SecGmbH PUBLIC Page5of33
SourceCodeAuditonthein-totoFramework OpenSourceTechnologyImprovementFund(OSTIF)
2 Introduction
X41 reviewed the in-toto Python and Go implementations as well as the specification. These
ensurethatnountrustedthirdpartiesaddedmaliciouscodeordataaspartofthesoftwaresupply
chain.
Attackerscouldtrytoattackthesupplychaininvariousstages,rangingfromalteringcommitsof
individualdevelopersinacoderepositorytocompromisingtheCI/CD1 pipeline.
2.1 Methodology
Theauditwasbasedonasourcecodeandspecificationreview.
AmanualapproachforpenetrationtestingandforcodereviewisusedbyX41. Thisprocessis
supportedbytoolssuchasstaticcodeanalyzers.
X41adherestoestablishedstandardsforsourcecodereviewingandpenetrationtesting. These
areinparticulartheCERTSecureCoding2 standardsandtheStudy-APenetrationTestingModel3
oftheGermanFederalOfficeforInformationSecurity.
1ContinuousIntegration/ContinuousDelivery
2https://wiki.sei.cmu.edu/confluence/display/seccode/SEI+CERT+Coding+Standards
3https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Penetration/penetrati
on_pdf.pdf?__blob=publicationFile&v=1
X41D-SecGmbH PUBLIC Page6of33
SourceCodeAuditonthein-totoFramework OpenSourceTechnologyImprovementFund(OSTIF)
Ini�al Design Threat Code
Workshop Modelling Review
Fixing and GAP / Performance
Documenta�on
Mi�ga�on Analysis
Figure2.1:CodeReviewMethodology
2.2 Findings Overview
DESCRIPTION SEVERITY ID REF
FileMetadataIgnored MEDIUM TOTO-PT-23-01 4.1.1
ConfigurationReadFromLocalDirectory MEDIUM TOTO-PT-23-02 4.1.2
LayoutReplay LOW TOTO-PT-23-03 4.1.3
LinkFileReuse MEDIUM TOTO-PT-23-04 4.1.4
FunctionariesDoNotPerformVerification HIGH TOTO-PT-23-05 4.1.5
PGPKeyCreationTimeNotValidated LOW TOTO-PT-23-06 4.1.6
PGPKeyRevocationNotConsidered MEDIUM TOTO-PT-23-07 4.1.7
PGPKeyUsageFlagsNotConsidered LOW TOTO-PT-23-08 4.1.8
BrokenFilenameMangling NONE TOTO-PT-23-100 4.2.1
NoUserIDforVulnerabilityReportPGPKey NONE TOTO-PT-23-101 4.2.2
ArgumentSilentlyIgnored NONE TOTO-PT-23-102 4.2.3
KeyManagement NONE TOTO-PT-23-103 4.2.4
InconsistentUseofGnuPG NONE TOTO-PT-23-104 4.2.5
UndefinedPatternMatching NONE TOTO-PT-23-105 4.2.6
ExpirationDateMightPreventInstallation NONE TOTO-PT-23-106 4.2.7
JSONParsingDifferences NONE TOTO-PT-23-107 4.2.8
ComplicatedSignatureCount NONE TOTO-PT-23-108 4.2.9
Table2.1:Security-RelevantFindings
X41D-SecGmbH PUBLIC Page7of33
SourceCodeAuditonthein-totoFramework OpenSourceTechnologyImprovementFund(OSTIF)
2.3 Scope
ThescopeofthistestwerethePython1.3.1(5.5KLOC4)5 andGo0.6.0(9KLOC)6 implementa-
tions.Additionally,thereviewcoveredthespecification7 andattestationdefinition8.
Thethreatmodelofin-totoisdescribedinapaper9. Sincein-totoprovidestheframework,the
actual threat model might be different for the project using it and needs to be reflected in the
layoutrules. Forthisaudit, itisassumedthatattackersareabletomodifydata, layoutandlink
filesthatareexchangedbetweenfunctionariesorbeforebeingpassedtotheuser.
2.4 Coverage
Asecurityassessmentattemptstofindthemostimportantorsometimesasmanyoftheexisting
problemsaspossible,thoughitispracticallyneverpossibletoruleoutthepossibilityofadditional
weaknessesbeingfoundinthefuture.
ThetimeallocatedtoX41forthisassessmentwassufficienttoyieldagoodcoverageofthegiven
scope.
Bandit10 andSemgrep11 wereusedtoperformstaticanalysisonthePythoncodeanditsdepen-
dencies. Semgrepandstaticcheck12 wer