Penetration Test Report (X41 D-Sec): X41 OSTIF RSTUF Audit 2024 Final Report Public

CodeReviewofRSTUF
fortheOpenSourceTechnologyImprovementFund(OSTIF)
FinalReportandManagementSummary
2025-03-07
PUBLIC
X41 D-Sec GmbH
Krefelder Str. 123
D-52070 Aachen
Amtsgericht Aachen: HRB19989
https://x41-dsec.de/
info@x41-dsec.de
OrganizedbytheOpenSourceTechnologyImprovementFund
CodeReviewofRSTUF OpenSourceTechnologyImprovementFund(OSTIF)
Revision Date Change Author(s)
1 2025-02-14 FinalReportandManagement L. Gommans, E. Sesterhenn, A.
Summary Basma
X41D-SecGmbH PUBLIC Page1of43
CodeReviewofRSTUF OpenSourceTechnologyImprovementFund(OSTIF)
Contents
1 ExecutiveSummary 4
2 Introduction 6
2.1 Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.2 FindingsOverview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.3 Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.4 Coverage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
2.5 RecommendedFurtherTests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
3 RatingMethodology 11
3.1 CVSS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
3.2 SeverityMapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
3.3 CommonWeaknessEnumeration . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
4 ThreatModel 15
4.1 AssetOverview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
4.2 SecurityBoundaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
4.3 ThreatsandMitigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
4.4 Limitations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
5 Results 25
5.1 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
5.2 InformationalNotes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
6 AboutX41D-SecGmbH 42
X41D-SecGmbH PUBLIC Page2of43
CodeReviewofRSTUF OpenSourceTechnologyImprovementFund(OSTIF)
Dashboard
Target
Customer OpenSourceTechnologyImprovementFund(OSTIF)
Name RepositoryServiceforTUF
Type ServerApplications
Version Commit9ec018d
Engagement
Type WhiteBox
Consultants 3:AliBasma,EricSesterhennandLucGommans
EngagementEffort 22person-days,2025-01-30to2025-02-14
Totalissuesfound 0
Critical - 0
High - 0
Medium - 0
Low - 0
None - 13
0 1 2 3 4 5 6 7 8 9 10 11 12 13
Figure1:IssueOverview(l:Severity,r:CWEDistribution)
X41D-SecGmbH PUBLIC Page3of43
CodeReviewofRSTUF OpenSourceTechnologyImprovementFund(OSTIF)
1 Executive Summary
InFebruary2025,X41D-SecGmbHconductedasourcecodeauditofRSTUFtoidentifyvulner-
abilitiesandweaknessesinthesoftware,basedonadevelopedthreatmodelthatisincludedin
thisreport. TheworkissponsoredbytheOpenSourceTechnologyImprovementFund(OSTIF)
aspartoftheirongoingeffortstosecuretheopensourceworld.
Nodirectsecurityissueswerediscoveredduringthistest,but13informationalnoteswereiden-
tifiedthatcanberesolvedtofurtherhardenthesystem.
RepositoryServiceforTUF(RSTUF)implementstheservercomponentsneededtocreatearepos-
itoryfromwhichclientsthatimplementTUF(TheUpdateFramework)candownloadfiles,safe
againsttamperingbetweentherepositoryandtheclient.
Inasourcecodeaudit,allinformationaboutthesystemismadeavailabletothetesters.Thetest
wasperformedbythreeexperiencedsecurityexpertsbetween2025-01-30and2025-02-14.
Severaloutdatedcomponentsarespecifiedinthedeploymentguidesanddependencies,includ-
ingservicessuchasRedisandlibrariessuchasJinja.Mostcomponentsarenotdirectlyexposed
totheInternetwhichlimitstheexploitability.Still,anattackerwhocompromisedadifferentpart
oftheinfrastructurecouldabuseanyknownvulnerabilities.
Thedeploymentscouldfurtherbehardenedbydefiningwhichinterfacesneedtobeexposedto
othercontainers.RedisandPostgreSQLarecurrentlyopentoallothercontainers(includingthe
publicwebserver)intheDockersetup. Thiscouldberestrictedtoonlythenecessaryexposure
byaddingnetworkisolationandsettingsecurepasswords. Enablingencryptedcommunications
furtherhardensthesystemwhenthecontainersaredeployedondifferentphysicalhosts.
Finally,itwasnoticedthatnotimelimitissetfortasks. TheRESTAPIcomponentsubmitstasks
via a message queue to the Worker component. If such a task gets stuck in an infinite loop or
otherwisetakestoolong,thismightleadtoadenialofservicesituation. However,nowaywas
foundtoexploitthispotentialissue.
Overall,thesystemsappeartomaintainastrongsecurityposturecomparedtosystemsofsimilar
X41D-SecGmbH PUBLIC Page4of43
CodeReviewofRSTUF OpenSourceTechnologyImprovementFund(OSTIF)
sizeandcomplexity.Whileitisunderstoodthatrate-limitingandauthenticationhavetobeadded
totheRSTUFsetup,itiscrucialthatthesefunctionsareimplementedsecurely.X41furthermore
recommendstoapplyupdatesandhardeningtothesystem.
X41D-SecGmbH PUBLIC Page5of43
CodeReviewofRSTUF OpenSourceTechnologyImprovementFund(OSTIF)
2 Introduction
TheUpdateFramework1 (TUF)isaspecificationdesignedtosecurelydeliversoftwareassetsto
clients. Servers that implement TUF2 need to cryptographically sign metadata files, certifying
what the size and contents of the files should be. Trust is grounded in a set of ‘root’ keys that
canbeprovidedoutofband.
Repository Service for TUF (RSTUF) is an implementation for server-side aspects of the frame-
work,providinganAPI3forservicesthatwishtoprovideassetsforclientsthatimplementTUF.It
aimstofacilitatedeploymentsofanysize;forexample,forPyPI4tobeabletoprovidesignatures
foritsclientspertheTUFspecification.
X41performedasourcecodeauditofRSTUF,includingsetupdocumentation.Securityissuesin
RSTUF or a deployment environment could enable an attacker to distribute malicious versions
ofthesoftwareorotherassets.
2.1 Methodology
X41reviewedRSTUFasdefinedinthescopebelow. Thereviewwasmainlybasedonasource
code review alongside analyses of local installations of the software. A manual approach for
penetrationtestsandforcodereviewsisusedbyX41. Thisprocessissupportedbytoolssuch
asstaticcodeanalyzersandindustrystandardwebapplicationsecuritytools5.
X41adherestoestablishedstandardsforsourcecodereviewingandpenetrationtesting. These
areinparticulartheCERTSecureCoding6 standardsandtheStudy-APenetrationTestingModel7
1https://theupdateframework.org
2TheUpdateFramework
3ApplicationProgrammingInterface
4https://pypi.org
5https://portswigger.net/burp
6https://wiki.sei.cmu.edu/confluence/display/seccode/SEI+CERT+Coding+Standards
7https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Penetration/penetrati
on_pdf.pdf?__blob=publicationFile&v=1
X41D-SecGmbH PUBLIC Page6of43
CodeReviewofRSTUF OpenSourceTechnologyImprovementFund(OSTIF)
oftheGermanFederalOfficeforInformationSecurity.
The workflow of source code reviews is shown in figure 2.1. In an initial, informal workshop
regardingthedesignandarchitectureoftheapplicationabasicthreatmodeliscreated. Thisis
used to explore the source code for interesting attack surface and code paths. These are then
audited manually and with the help of tools such as static analyzers. The identified issues are
documentedandcanbeusedinaGAPanalysistohighlightchangestopreviousaudits.
Ini�al Design Threat Code
Workshop Modelling Review
Fixing and GAP / Performance
Documenta�on
Mi�ga�on Analysis
Figure2.1:CodeReviewMethodology
X41D-SecGmbH PUBLIC Page7of43
CodeReviewofRSTUF OpenSourceTechnologyImprovementFund(OSTIF)
2.2 Findings Overview
DESCRIPTION SEVERITY ID REF
OutdatedJinja NONE RSTUF-CR-25-100 5.2.1
OutdatedDockerContainers NONE RSTUF-CR-25-101 5.2.2
DockerHardening NONE RSTUF-CR-25-102 5.2.3
OutdatedDocumentation NONE RSTUF-CR-25-103 5.2.4
IncorrectCSVParsing NONE RSTUF-CR-25-104 5.2.5
SetupIssueonLinuxOS NONE RSTUF-CR-25-105 5.2.6
NoTaskTimeLimit NONE RSTUF-CR-25-106 5.2.7
SSLNotEnabledforBroker NONE RSTUF-CR-25-107 5.2.8
RSTUF Ceremony Requests a Password for Unencrypted NONE RSTUF-CR-25-108 5.2.9
KeysandCrashesonIncorrectInput
MissingNetworkSegmentationforDockerExam