Penetration Test Report (Doyensec): Doyensec Gravitational Teleport Testing Q42020

TODO
Security Auditing Report
Teleport Testing Q4 2020
Prepared for: Gravitational, Inc. DBA Teleport
Prepared by: Lorenzo Stella
Date: March 18th, 2021
WWW.DOYENSEC.COM © DOYENSEC
Gravitational, Inc. (DBA Teleport) - Security Auditing Report
Table of Contents
Table of Contents 1
Revision History 2
Contacts 2
Executive Summary 3
Methodology 6
Project Findings 7
Appendix A - Vulnerability Classification 59
Appendix B - Remediation Checklist 60
Appendix C - Hardening Recommendations 62
1 of 65 WWW.DOYENSEC.COM
Gravitational, Inc. (DBA Teleport) - Security Auditing Report
Revision History
Version Date Description Author
1 12/04/2020 First release of the final report Lorenzo Stella
2 12/09/2020 Peer Review Luca Carettoni
3 12/10/2020 Peer Review John Villamil
4 03/18/2021 Retesting Update Mohamed Ouad
Contacts
Company Name Email
Gravitational, Inc Russell Jones rjones@gravitational.com
Gravitational, Inc Sasha Klizhentas sasha@gravitational.com
Gravitational, Inc Alexey Kontsevoy alexey@gravitational.com
Doyensec, LLC Luca Carettoni luca@doyensec.com
Doyensec, LLC John Villamil john@doyensec.com
2 of 65 WWW.DOYENSEC.COM
Gravitational, Inc. (DBA Teleport) - Security Auditing Report
Executive Summary
We list the agreed upon assets below:
Overview
• Teleport Community
• https://github.com/gravitational/teleport
Gravitational, Inc (DBA "Teleport") engaged
Doyensec to perform a security assessment of
• Teleport Enterprise
the Teleport platform. Gravitational Teleport is a
• https://github.com/gravitational/teleport.e
cloud-native SSH gateway for managing access
to clusters of Linux servers via SSH or Kubernetes
• Teleport internal dependencies
APIs.
The testing took place in a development
The project commenced on 11/09/2020 and
environment using the latest version of the
ended on 12/04/2020 requiring two (2) security
software at the time of testing.
researchers, for a total of twenty-five (25) person/
days. The project resulted in eighteen (18)
In detail, this activity was performed on the
findings of which five (4) were rated as medium or
following releases:
high severity.
• Teleport v5.0.0-beta.10
In March 2021, Doyensec performed a retesting of
• https://github.com/gravitational/teleport/releases/
the Teleport platform and confirmed the
tag/v5.0.0-beta.10
effectiveness of the applied mitigations. All • 3279a1b9da706c6dc583a560bab46aff9d329c63
issues with direct security impact have been
addressed by Gravitational. • Teleport Enterprise
• 441c6b110e13d71a34badd3d2e8cf774c19536d6
This deliverable represents the state of all
Scoping Restrictions
discovered vulnerabilities as of 03/18/2021.
The project consisted of a manual web During the engagement, Doyensec did not
application security assessment, source code encounter any major difficulties testing the
review, and dynamic instrumentation of the functionalities of the application. The
command line tools. Gravitational engineering team was very
responsive in debugging any issue to ensure a
Testing was conducted remotely from Doyensec smooth assessment.
EMEA and US offices.
While testing included the review of the Teleport
Scope internal dependencies, Doyensec did not perform
a complete source code review for all packages.
The U2F authentication feature utilizing hardware
Through meetings with Gravitational, the scope of
FIDO tokens as a second factor of authentication
the project was clearly defined.
was also excluded from the scope of this project.
• Identify misconfigurations and vulnerabilities
Auth connectors were also tested in this review,
in Teleport Community and Enterprise
limited to SAML, OIDC, and Github.
• Evaluate the overall security posture and
It is also important to notice that Teleport is a
best practices compared to other industry
highly flexible platform in which several
peers
3 of 65 WWW.DOYENSEC.COM
Gravitational, Inc. (DBA Teleport) - Security Auditing Report
configurations can be customized by the end- • Lack of consistent opaque responses for
user. For instance, permissions for roles/users are resources restricted by labels on the API.
completely customizable, hence Doyensec
focused on vulnerabilities in the core logic instead • Inconsistencies in the applications' session
of enumerating potential misconfigurations in invalidations practices. While the different
user-defined policies. session expirations between AAP-protected
applications and the auth server appear to be
Findings Summary carefully considered in the solution's design, a
robust revocation system is still missing.
Doyensec researchers discovered and reported
eighteen (18) vulnerabilities in the Teleport • Request body unmarshalling is missing
platform. While most of the issues are departures content length checks. The widespread usage
from best practices and low-severity flaws, of a single function to parse requests'
Doyensec identified two (2) medium severity and payloads turned out to be prone to Denial of
two (2) high severity issues that can be leveraged Service (DoS).
to compromise the confidentiality, integrity, and
availability of the solution.
It is important to reiterate that this report
represents a snapshot of the security posture of
the environment at a point in time.
The findings included multiple vulnerabilities in
both the design and implementation of some
features. Several Denial Of Service (DoS) issues
were identified during the engagement,
exploitable both from authenticated and
unauthenticated attack positions. A number of
Insecure Design practices were highlighted,
related to Content Spoofing or Unsafe Error
Handling. The project also brought to light an
outstanding issue concerning Teleport's AAP
login mechanism, which if exploited can result in
a full authentication bypass. Doyensec also
proposed several hardening improvements that
would make the overall platform more resilient
against attacks.
Considering the overall complexity of the platform
and the numerous endpoints, the security posture
of the reviewed APIs was found to be in line with
industry best practices.
At the design level, Doyensec found the system to
be well architected with the exclusion of the
following aspects:
4 of 65 WWW.DOYENSEC.COM
Gravitational, Inc. (DBA Teleport) - Security Auditing Report
Recommendations
The following recommendations are proposed
based on studying the Teleport security posture
and vulnerabilities discovered during this
engagement.
Short-term improvements
• Work on mitigating the discovered
vulnerabilities. You can use Appendix B -
Remediation Checklist to make sure that you
have covered all areas.
Long-term improvements
• Design and implement an invalidation system
for sessions, possibly based on an automatic
signature rotation mechanism or on a
dedicated revocation list for tokens also
accounting for the signature date.
• Design and implement a more robust JSON
parsing function, which does not eagerly read
the whole request body or headers.
• Limit content injection attacks by returning
predefined error messages or always setting
a maximum accepted length and a restricted
character set on user-provided inputs.
• Consider implementing hardening, following
Appendix C - Hardening Recommendations
5 of 65 WWW.DOYENSEC.COM
Gravitational, Inc. (DBA Teleport) - Security Auditing Report
Methodology • Nmap
• Gosec
• golangci-lint
Overview • Curl, netcat and other Linux utilities
Doyensec treats each engagement as a fluid Web Application and API
entity. We use a standard base of tools and
Techniques
techniques from which we built our own unique
methodology. Our 30 years of information security
Web assessments are centered around the data
experience has taught us that mixing offensive
sent between clients and servers. In this realm,
and defensive philosophies is the key for standing
the principle audit tool is the Burp Suite, however
against threats, thus we recommend a graybox
we also use a large set of custom scripts and
approach combining dynamic fault injection with
extensions to perform specific audit tasks. We