Penetration Test Report (Doyensec): Doyensec Gravitational Teleport FeaturesTesting Q42021

TODO
Security Auditing Report
Teleport Features Testing Q4 2021
BPF-based Restricted Session
Simplified Node Joining for AWS (RFD 41)
Account Life-cycle: Recovery and Cancellation (RFD 29)
Hardware security module (HSM) support (RFD 25)
ThalesIgnite’s crypto11 library for PKCS#11
Prepared for: Gravitational, Inc. DBA Teleport
Prepared by: Lorenzo Stella
Date: October 15th, 2021
WWW.DOYENSEC.COM © DOYENSEC
Gravitational, Inc. (DBA Teleport) - Security Auditing Report
Table of Contents
Table of Contents 1
Revision History 2
Contacts 2
Executive Summary 3
Methodology 6
Project Findings 8
Appendix A - Vulnerability Classification 37
Appendix B - Remediation Checklist 38
Appendix C - Control Groups Evasion PoC 40
Appendix D - FD Stealer PoC 41
Appendix E - Other Threats & Assets Covered During The Security Audit 43
1 of 43 WWW.DOYENSEC.COM
Gravitational, Inc. (DBA Teleport) - Security Auditing Report
Revision History
Version Date Description Author
1 10/15/2021 First release of the final report Lorenzo Stella
2 10/15/2021 Peer Review Luca Carettoni
3 06/24/2022 Retesting Update Lorenzo Stella
Contacts
Company Name Email
Gravitational, Inc Russell Jones rjones@gravitational.com
Gravitational, Inc Sasha Klizhentas sasha@gravitational.com
Gravitational, Inc Alexey Kontsevoy alexey@gravitational.com
Doyensec, LLC Luca Carettoni luca@doyensec.com
Doyensec, LLC John Villamil john@doyensec.com
2 of 43 WWW.DOYENSEC.COM
Gravitational, Inc. (DBA Teleport) - Security Auditing Report
Executive Summary B. Simplified Node Joining for AWS (RFD
41) (https://github.com/gravitational/
teleport/commit/2d10515f)
Overview
C. Account Life-cycle: Recovery and
Cancellation (RFD 29) (https://
Gravitational, Inc (DBA "Teleport") engaged github.com/gravitational/teleport/blob/
Doyensec to perform a security assessment of d160ee1e/rfd/0029-account-lifecycle.md)
the Teleport platform. Gravitational Teleport is a D. Hardware security module (HSM) support
cloud-native SSH gateway for managing access (RFD 25) (https://github.com/
to clusters of Linux servers via SSH or Kubernetes gravitational/teleport/blob/c48ee9f06/
APIs. rfd/0025-hsm.md)
E. ThalesIgnite's crypto11 library for
The project commenced on 10/04/2021 and PKCS#11 (github.com/ThalesIgnite/
ended on 10/15/2021 requiring two (2) security crypto11)
researchers, for a total of twenty (20) person/
days. The project resulted in ten (10) findings of • Evaluate the overall security posture and
which one (1) was rated as having high severity. best practices compared to other industry
peers
In June 2022, Doyensec performed a retesting of
the Teleport Cloud platform and confirmed the
We list the agreed-upon assets below:
effectiveness of the applied mitigations. All
issues with direct security impact have been
• Teleport Community
addressed by Gravitational.
• https://github.com/gravitational/teleport
This deliverable represents the state of all • Teleport Enterprise
discovered vulnerabilities as of 10/15/2021.
• https://github.com/gravitational/teleport.e
The project consisted of a manual web • Teleport Cloud
application security assessment, source code • https://github.com/gravitational/cloud
review, and dynamic instrumentation of the
command line tools. The testing took place in multiple development
environments using the latest version of the
Testing was conducted remotely from Doyensec software features at the time of testing.
EMEA and US offices.
In detail, this activity was performed on the
Scope following releases:
Through meetings with Gravitational, the scope of • Teleport v7.3.0-dev.2
the project was clearly defined. • Cloned at commit SHA 659516a (master) on
10/04/2021
• Identify misconfigurations and vulnerabilities
in a focused set of Teleport Community, • Teleport Enterprise v7.3.0-dev.2
Enterprise, and Cloud features: • Cloned at commit SHA 455a9ea (master) on
10/04/2021
A. BPF-based Restricted Sessions (https://
github.com/gravitational/teleport/
• Teleport Cloud v1.1.16
commit/67c0eb3b)
• Cloned at commit SHA c2f84157 (master) on
10/04/2021
3 of 43 WWW.DOYENSEC.COM
Gravitational, Inc. (DBA Teleport) - Security Auditing Report
It is important to reiterate that this report
Scoping Restrictions represents a snapshot of the security posture of
the environment at a point in time.
During the engagement, Doyensec did not
encounter any major difficulties testing the The findings included multiple vulnerabilities in
functionalities of the application. The both the design and implementation of some
Gravitational engineering team was very features. Several Insufficient Authentication and
responsive in debugging any issue to ensure a Session Management issues were identified
smooth assessment. during the engagement, exploitable both from
authenticated and unauthenticated attack
At the time of testing, the following aspects of the positions. A number of Injection Flaws were
features in scope were still not implemented: highlighted, related to the new Account Recovery
features, which could be abused to mask an
• Cloud Support for AWS node joining attacker's IP or spoof the content of recovery
• Session Locks integration into Account emails from the Teleport. The project also brought
Recovery Flow to light an outstanding issue concerning the new
BPF-based Restricted Sessions, which if exploited
While testing included the review of the Teleport can result in a full bypass of the set restrictions or
internal dependencies, Doyensec did not perform audit logging. Doyensec also proposed several
a complete source code review for all packages hardening improvements that would make the
involved in the scoped features. novel features more resilient against attacks.
It is also important to notice that Teleport is a Considering the overall complexity of the platform
highly flexible platform in which several and the numerous endpoints, the security posture
configurations can be customized by the end- of the reviewed APIs was found to be in line with
user. For instance, permissions for roles/users are industry best practices.
completely customizable, hence Doyensec
focused on vulnerabilities in the core logic instead At the design level, Doyensec found the system to
of enumerating potential misconfigurations in be well architected with the exclusion of the
user-defined policies. following aspects:
Ultimately, Doyensec audited how the Hardware • Lack of complete protection for BPF-based
security module (HSM) feature of Teleport Restricted Sessions in certain scenarios
operates the ThalesIgnite/crypto11 library and its
internal interaction with the PKCS#11 API through • Header-based and Content Injection risks in
miekg/pkcs11, rather than looking for weaknesses the Cloud account recovery features.
in their cryptographic primitives or architecture.
Recommendations
Findings Summary
The following recommendations are proposed
Doyensec researchers discovered and reported based on studying the Teleport security posture
ten (10) vulnerabilities in the Teleport platform. and vulnerabilities discovered during this
While most of the issues are departures from best engagement.
practices and low-severity flaws, Doyensec
identified one (1) high severity issue that can be Short-term improvements
leveraged to compromise the confidentiality,
• Work on mitigating the discovered
integrity, and availability of the solution.
vulnerabilities. You can use Appendix B -
Remediation Checklist to make sure that you
4 of 43 WWW.DOYENSEC.COM
Gravitational, Inc. (DBA Teleport) - Security Auditing Report
have covered all areas.
Long-term improvements
• Improve the preliminary checks to ensure the
HSM setup is secure, including integrity and
permissions checks on the PKCS#11 shared
library checks and PIN files.
• Improve the logging collection for failed
recovery attempts. The exploitation of
insufficient logging and monitoring is the
bedrock of nearly every major incident. A
compromised user, an insider threat, or other
access control failures can all be detected
and recorde