Penetration Test Report (TrailOfBits): CloudEvents

CloudEvents
Security Assessment
October 26, 2022
Prepared for:
Doug Davis,Cloud Native Computing Foundation
Open Source Technology Improvement Fund
Prepared by:Alex Useche and Hamid Kashfi
About Trail of Bits
Founded in 2012 and headquartered in New York, Trail of Bits provides technical security
assessment and advisory services to some of the world’s most targeted organizations. We
combine high- end security research with a real -world attacker mentality to reduce risk and
fortify code. With 100+ employees around the globe, we’ve helped secure critical software
elements that support billions of end users, including Kubernetes and the Linux kernel.
We maintain an exhaustive list of publications athttps://github.com/trailofbits/publications,
with links to papers, presentations, public audit reports, and podcast appearances.
In recent years, Trail of Bits consultants have showcased cutting-edge research through
presentations at CanSecWest, HCSS, Devcon, Empire Hacking, GrrCon, LangSec, NorthSec,
the O’Reilly Security Conference, PyCon, REcon, Security BSides, and SummerCon.
We specialize in software testing and code review projects, supporting client organizations
in the technology, defense, and finance industries, as well as government entities. Notable
clients include HashiCorp, Google, Microsoft, Western Digital, and Zoom.
Trail of Bits also operates a center of excellence with regard to blockchain security. Notable
projects include audits of Algorand, Bitcoin SV, Chainlink, Compound, Ethereum 2.0,
MakerDAO, Matic, Uniswap, Web3, and Zcash.
To keep up to date with our latest news and announcements, please follow@trailofbitson
Twitter and explore our public repositories athttps://github.com/trailofbits.To engage us
directly, visit our “Contact” page athttps://www.trailofbits.com/contact,or email us at
info@trailofbits.com.
Trail of Bits, Inc.
228 Park Ave S #80688
New York, NY 10003
https://www.trailofbits.com
info@trailofbits.com
Trail of Bits 1 CloudEvents Security Assessment
PUBLIC
Notices and Remarks
Copyright and Distribution
© 2022 by Trail of Bits, Inc.
All rights reserved. Trail of Bits hereby asserts its right to be identified as the creator of this
report in the United Kingdom.
This report is considered by Trail of Bits to be public information;it is licensed to the Linux
Foundation under the terms of the project statement of work and has been made public at
the Linux Foundation’s request.Material within thisreport may not be reproduced or
distributed in part or in whole without the express written permission of Trail of Bits.
Test Coverage Disclaimer
All activities undertaken by Trail of Bits in association with this project were performed in
accordance with a statement of work and agreed upon project plan.
Security assessment projects are time-boxed and often reliant on information that may be
provided by a client, its affiliates, or its partners. As a result, the findings documented in
this report should not be considered a comprehensive list of security issues, flaws, or
defects in the target system or codebase.
Trail of Bits uses automated testing techniques to rapidly test the controls and security
properties of software. These techniques augment our manual security review work, but
each has its limitations: for example, a tool may not generate a random edge case that
violates a property or may not fully complete its analysis during the allotted time. Their use
is also limited by the time and resource constraints of a project.
Trail of Bits 2 CloudEvents Security Assessment
PUBLIC
Table of Contents
About Trail of Bits 1
Notices and Remarks 2
Table of Contents 3
Executive Summary 5
Project Summary 7
Project Goals 8
Project Targets 9
Project Coverage 11
Threat Model 13
Data Types: 13
Components 13
Trust Zones 14
Trust Zone Connections 16
Threat Actors 17
Data Flow 17
High-Level Overview 17
CloudEvents SDK 18
Automated Testing 22
Summary of Findings 23
Detailed Findings 24
1. [Java SDK] Reliance on default encoding 24
2. [Java SDK] Outdated Vulnerable Dependencies 26
Trail of Bits 3 CloudEvents Security Assessment
PUBLIC
3. [JavaScript SDK] Potential XSS in httpTransport() 28
4. [Go SDK] Outdated Vulnerable Dependencies 29
5. [Go SDK] Downcasting of 64-bit integer 30
6. [Go SDK] ReadHeaderTimeout not configured 32
7. [CSharp SDK] Outdated Vulnerable Dependencies 33
Summary of Recommendations 35
A. Vulnerability Categories 36
B. Security Controls 38
C. Non-Security-Related Findings 39
D. Automated Analysis Tool Configuration 43
D.1. Semgrep 43
D.2. CodeQL 44
D.3. TruffleHog 44
D.4. snyk-cli 44
D.5. yarn audit 45
D.6. Intellij IDE Plugins 45
Trail of Bits 4 CloudEvents Security Assessment
PUBLIC
Executive Summary
Engagement Overview
The Linux Foundation, via strategic partner Open Source Technology Improvement Fund,
engaged Trail of Bits to review the security of its CloudEvents specification and SDKs. From
September 19 to September 30, 2022, a team of two consultants conducted a security
review of the client-provided source code, with four person-weeks of effort. Details of the
project’s timeline, test targets, and coverage are provided in subsequent sections of this
report.
Project Scope
Our testing efforts were focused on the identification of flaws that could result in a
compromise of confidentiality, integrity, or availability of the target system. We conducted
this audit with full knowledge of the system. We had access to the source code and
documentation. We performed dynamic automated and manual testing of the target
system, using both automated and manual processes.
Summary of Findings
The audit did not uncover any significant flaws or defects that could impact system
confidentiality, integrity, or availability. A summary of the findings and details on notable
findings are provided below.
Some of the findings in this report have their severity marking asUndetermined. This is
because in engagements of this nature, the code and vulnerabilities in its dependencies are
highly dependent on the context in which they are used. As a result, the severity of issues
cannot be determined and generalized. Moreover, due to time constraints, we did not
manually triage outdated, third-party dependencies or their vulnerabilities.
EXPOSURE ANALYSIS CATEGORY BREAKDOWN
Severity Count Category Count
Informational 1 Data Validation 1
Undetermined 6 Denial of Service 1
Patching 3
Trail of Bits 5 CloudEvents Security Assessment
PUBLIC
Undefined Behavior 2
Notable Findings
Significant flaws that impact system confidentiality, integrity, or availability are listed below.
● TOB-CE-{1,4,7}
Reviews of multiple SDKs as well as consulting with the team indicates that SDKs are
not actively and routinely maintained for security updates, leaving some of them
with multiple outdated and vulnerable dependencies. Maintenance of SDK health is
a subject that is already covered in theSDK Governancespecification.
Trail of Bits 6 CloudEvents Security Assessment
PUBLIC
Project Summary
Contact Information
The following managers were associated with this project:
Dan Guido, Account Manager Mary O’Brien, ProjectManager
dan@trailofbits.com mary.obrien@trailofbits.com
Derek Zimmer, Program Manager Amir Montazery, ProgramManager
derek@ostif.org amir@ostif.org
The following engineers were associated with this project:
Alex Useche, Consultant Hamid Kashfi, Consultant
alex.useche@trailofbits.com hamid.kashfi@trailofbits.com
Project Timeline
The significant events and milestones of the project are listed below.
Date Event
September 7, 2022 Pre-project kickoff call
September 26, 2022 Status update meeting #1
October 3, 2022 Delivery of report draft
October 3, 2022 Report readout meeting
October 26, 2022 Delivery of final report
Trail of Bits 7 CloudEvents Security Assessment
PUBLIC
Project Goals
The engagement was scoped to provide a security assessment of the CloudEvents
specification and SDKs, including a lightweight threat model. Specifically, we sought to
achieve the following n