Penetration Test Report (RadicallyOpenSecurity): 2022 CodeReview Homebrew project v1.1

Penetration Test Report
Secure Open Source Mozilla
V 1.1
Amsterdam, May 30th, 2022
Public
Document Properties
Client Secure Open Source Mozilla
Title Penetration Test Report
Targets Code Audit of https://github.com/Homebrew
CI/CD and Maintainer trust model at Homebrew
Content-Delivery
Version 1.1
Pentesters Fabian Freyer, Stefan Grönke
Authors Fabian Freyer, Stefan Grönke, Patricia Piolon, Marcus Bointon, Stefan Gröke
Reviewed by Patricia Piolon
Marcus Bointon
Approved by Melanie Rieback
Version control
Version Date Author Description
0.1 March 31st, 2021 Fabian Freyer Initial draft
0.2 March 31st, 2021 Stefan Grönke Initial draft
0.3 March 31st, 2021 Patricia Piolon Review
1.0 April 1st, 2021 Marcus Bointon Review
1.1 May 30th, 2022 Stefan Gröke Public report
Contact
For more information about this document and its contents please contact Radically Open Security B.V.
Name Melanie Rieback
Address Science Park 608
1098 XH Amsterdam
The Netherlands
Phone +31 (0)20 2621 255
Email info@radicallyopensecurity.com
Radically Open Security B.V. is registered at the trade register of the Dutch chamber of commerce under number 60628081.
Table of Contents
1 Executive Summary 4
1.1 Introduction 4
1.2 Scope of work 4
1.3 Project objectives 4
1.4 Timeline 4
1.5 Results In A Nutshell 5
1.6 Summary of Findings 5
1.6.1 Findings by Threat Level 6
1.6.2 Findings by Type 7
1.7 Summary of Recommendations 7
2 Methodology 9
2.1 Planning 9
2.2 Risk Classification 9
3 Threat and Trust Modeling 11
4 Findings 12
4.1 HBRW-011 — Path traversal in Cask versions 12
4.2 HBRW-004 — Automerge merges PR with code execution payloads 16
4.3 HBRW-010 — Code signing is not enforced for casks 19
4.4 HBRW-012 — CodeCov token in CI 20
4.5 HBRW-009 — Formulae are not Signed 21
4.6 HBRW-002 — Directory traversal in brew commands 22
4.7 HBRW-005 — Long Sudo 23
5 Non-Findings 25
5.1 NF-006 — Dangerous Output ::set-env 25
6 Future Work 27
7 Conclusion 28
Appendix 1 Testing team 29
1 Executive Summary
1.1 Introduction
Between August 17, 2020 and November 30, 2020 , Radically Open Security B.V. carried out a penetration test for
Secure Open Source Mozilla
This report contains our findings as well as detailed explanations of exactly how ROS performed the penetration test.
1.2 Scope of work
The scope of the penetration test was limited to the following targets:
• Code Audit of https://github.com/Homebrew
• CI/CD and Maintainer trust model at Homebrew
• Content-Delivery
The scoped services are broken down as follows:
• Code Audit of https://github.com/Homebrew from a user's perspective: 20 days
• CI/CD and Maintainer trust model at Homebrew: 10 days
• Content-Delivery: 2 days
• Directly address vulnerabilities (HackerOne, or direct contact with Mike): 5 days
• Public report of an audit of the trust model of Homebrew : 5 days
• Total effort: 42 days
1.3 Project objectives
ROS will perform a source code audit of the Homebrew project with Mozilla. The test is intended to gain insight into the
security of Homebrew package manager. To do so, ROS will access publicly available sources and guide Homebrew in
attempting to find vulnerabilities, exploiting any such found to try and gain further access and elevated privileges.
1.4 Timeline
The Security Audit took place between August 17, 2020 and November 30, 2020 .
4 Radically Open Security B.V.
Public
1.5 Results In A Nutshell
During this crystal-box penetration test we found 2 Extreme, 3 Moderate and 2 Low-severity issues.
Two critical findings related to automatic merging simple version bumps demonstrate how GitHub accounts that are
unrelated to the Homebrew GitHub organization are able to exploit path traversal HBRW-011 (page 12) and Ruby
string interpolation HBRW-004 (page 16) to execute remote code on clients updating Homebrew or installing affected
Casks.
The absence of code signing of Formulae and Casks HBRW-009 (page 21) leaves clients vulnerable to attacks on the
CDN or transport encryption. Additional packages downloaded in Casks do not enforce Apple Code Signing HBRW-010
(page 19), so downloaded assets can be subjected to manipulation, so long as the stored SHA256 hash matches the
asset.
A hard-coded code coverage token was found amongst CI assets HBRW-012 (page 20).
Although likely not exploitable, directory traversal in brew commands HBRW-002 (page 22) could invite remote code
execution in automated processes with user input. Open sudo sessions credentials from earlier commands HBRW-005
(page 23) can allow later commands to use root privileges without the user's knowledge or consent.
1.6 Summary of Findings
ID Type Description Threat level
HBRW-011 Path Traversal Automatically merged pull requests on the homebrew- Extreme
casks repository (see HBRW-004) allow path traversal
vulnerabilities in Casks that interpolate the version into
the download URL.
HBRW-004 Template Injection The review and automerge CI jobs will automatically Extreme
merge pull requests which only bump the version or alter
the hash of a Cask. The validation steps on the version
can be bypassed to include string interpolations, which
allow code execution upon loading of the relevant Cask.
HBRW-010 Insufficient Verification Casks lack fields to enforce code signing of downloaded Moderate
of Data Authenticity archives or to specify code signing identities.
HBRW-012 Unprotected Storage of An upload token for the codecov.io Code Coverage Moderate
Credentials service is included in the repository.
HBRW-009 Insufficient Verification Homebrew does not have a concept of cryptographically Moderate
of Data Authenticity guaranteeing the provenance of formulae or taps.
HBRW-002 Directory Traversal The first argument to brew is passed to require with a Low
path prefix, allowing directory traversal.
Executive Summary 5
HBRW-005 Insufficient Session After operations that required root privileges via sudo, Low
Expiration subsequent commands and processes can also elevate
their privileges without requiring a password.
1.6.1 Findings by Threat Level
Extreme (2)
Moderate (3)
Low (2)
28.6% 28.6%
42.9%
6 Radically Open Security B.V.
Public
1.6.2 Findings by Type
Insufficient verification of data authenticity
(2)
14.3%
Path traversal (1)
28.6%
Template injection (1)
Unprotected storage of credentials (1)
14.3%
Directory traversal (1)
Insufficient session expiration (1)
14.3% 14.3%
14.3%
1.7 Summary of Recommendations
ID Type Recommendation
HBRW-011 Path Traversal • Prevent path traversal by prohibiting .. in version strings.
• Restrict the changes recognized as a "simple version bump" to e.g.
just digit changes.
• Perform careful review of any changes on the review GitHub Action to
avoid future similar issues, and consider enforcing human review when
the corresponding workflow file is changed.
• Consider requiring human interaction either in the review or merge
stage instead of combining automatic review and merging.
HBRW-004 Template Injection • Enforce more stringent checks in GitHub actions before allowing
automated merges, see full finding description for more detail.
HBRW-010 Insufficient Verification • Allow casks to enforce code signing and specify a set of valid code-
of Data Authenticity signing identities.
• Do not automatically merge changes to the code-signing policy or valid
identities.
• Consider discontinuing the automatic merge of changes to a cask's
checksum.
HBRW-012 Unprotected Storage of • Revoke the upload token
Credentials • Set the token using an encrypted secret
HBRW-009 Insufficient Verification • Sign formulae and verify signatures on use
of Data Authenticity • Distribute formulae so signatures can be checked by consensus
across multiple sources
HBRW-002 Directory Traversal • Enforce that command code is included only from the relevant
directory.
Executive Summary 7
• Sanitize the cmd variable.
HBRW-005 Insufficient Session • Revoke sudo credentials immediately after an administrative brew
Expiration command.
8 Radically Open Security B.V.
Public
2 Methodology
2.1 Planning
O