Penetration Test Report (Doyensec): Doyensec Gravitational Teleport CloudTesting Q12021

Security Auditing Report
Teleport Cloud Testing
Q1 2021 Report
Prepared for: Gravitational, Inc. DBA Teleport
Prepared by: Lorenzo Stella, Mykhailo Baraniak
April 12th, 2021
WWW.DOYENSEC.COM © DOYENSEC
Gravitational, Inc. (DBA Teleport) - Security Auditing Report
Table of Contents
Table of Contents 1
Revision History 2
Contacts 2
Executive Summary 3
Methodology 6
Project Findings 7
Appendix A - Vulnerability Classification 45
Appendix B - Remediation Checklist 46
Appendix C - Hardening Recommendations 47
1 of 50 WWW.DOYENSEC.COM
Gravitational, Inc. (DBA Teleport) - Security Auditing Report
Revision History
Version Date Description Author
1 01/20/2021 First partial report Lorenzo Stella
2 01/29/2021 First release of the final report Lorenzo Stella
3 01/29/2021 Peer review Luca Carettoni
4 04/12/2021 Retesting Update Mohamed Ouad
Contacts
Company Name Email
Gravitational, Inc Russell Jones rjones@gravitational.com
Gravitational, Inc Sasha Klizhentas sasha@gravitational.com
Gravitational, Inc Alexey Kontsevoy alexey@gravitational.com
Doyensec, LLC Luca Carettoni luca@doyensec.com
Doyensec, LLC John Villamil john@doyensec.com
2 of 50 WWW.DOYENSEC.COM
Gravitational, Inc. (DBA Teleport) - Security Auditing Report
Executive Summary • Identify misconfigurations and vulnerabilities
in Teleport Cloud
Overview
• Evaluate the overall security posture and
best practices compared to other industry
Gravitational, Inc (DBA "Teleport") engaged peers
Doyensec to perform a security assessment of
the Teleport Cloud platform. Teleport Cloud is a
We list the agreed upon assets below:
SaaS offering of the existing Teleport Enterprise
solution, a cloud-native SSH gateway for
• Teleport Cloud and internal dependencies
managing access to clusters of Linux servers via
• https://github.com/gravitational/cloud
SSH or Kubernetes APIs. Individual instances of
Teleport Enterprise are deployed for each The testing took place both in a production and in
customer on a shared Kubernetes cluster running a staging environments using the latest version of
on AWS. the Teleport (v5.1.0) at the time of testing.
The project commenced on 01/11/2021 and In detail, this activity was performed on the
ended on 01/29/2021 requiring two (2) security following releases:
researchers, for a total of twenty-four (24) person/
days. The project resulted in twelve (12) findings • Teleport Cloud v1.0.0-beta.2
of which four (4) were rated as medium or high
• https://github.com/gravitational/cloud/releases/
severity. tag/v1.0.0-beta.2
• e10e5ec3b3606d3220e3cdca9e566fd056719cfe
In April 2021, Doyensec performed a retesting of
• Teleport cloud-ami v0.0.5
the Teleport Cloud platform and confirmed the
• https://github.com/gravitational/cloud-ami/
effectiveness of the applied mitigations. All
releases/tag/v0.0.5
issues with direct security impact have been
• ab9d5424a5d4b3577cc0bd926a84126e77557ba5
addressed by Gravitational.
• Teleport cloud-terraform
This deliverable represents the state of all • https://github.com/gravitational/cloud-terraform/
discovered vulnerabilities as of 04/12/2021. tree/1d0579
• 1d[PII_REDACTED]db6cbb4a58ecd4092f4a18138454
The project consisted of a manual web
• Teleport terraform-okta
application security assessment, source code
• https://github.com/gravitational/terraform-okta/
review, and dynamic instrumentation of the
tree/8845bf7
command line tools.
• 8845bf74da0d7a78de9ecbfd76fc23dab55d4844
Testing was conducted remotely from Doyensec Scoping Restrictions
EMEA and US offices.
During the engagement, Doyensec did not
Scope encounter any major difficulties testing the
functionalities of the application. The
Through meetings with Gravitational, the scope of Gravitational engineering team was very
the project was clearly defined. responsive in debugging any issue to ensure a
smooth assessment.
3 of 50 WWW.DOYENSEC.COM
Gravitational, Inc. (DBA Teleport) - Security Auditing Report
While testing included the review of the Teleport Considering the overall complexity of the platform
internal dependencies, Doyensec did not perform and the numerous endpoints, the security posture
a complete source code review for all packages. of the reviewed APIs was found to be in line with
At the time of testing, the RBAC and billing industry best practices.
features of SalesCenter and kubernetes Network
Policies resources were not yet implemented and At the design level, Doyensec found the system to
were consequently excluded from the scope of be well architected with the exclusion of the
this project. following aspects:
It is also important to notice that Teleport is a • Lack of solid network isolation between
highly flexible platform in which several cluster nodes and consequently between
configurations can be customized by the end- different tenants subsystems.
user. For instance, permissions for roles/users are
completely customizable, hence Doyensec • While Teleport Enterprise was designed and
focused on vulnerabilities in the core logic instead tested in the past years to account for an on-
of enumerating potential misconfigurations in premise & single-tenant threat model, with
user-defined policies. Teleport Cloud a number of features or issues
with a previously limited impact can now
Findings Summary become very dangerous in a multi-tenant
environment where Gravitational also
Doyensec researchers discovered and reported becomes responsible for the infrastructural
twelve (12) vulnerabilities in the Teleport platform. security of the solution.
While most of the issues are departures from best
practices and low-severity flaws, Doyensec Recommendations
identified three (3) medium severity and one (1)
high severity issues that can be leveraged to The following recommendations are proposed
compromise the confidentiality, integrity, and based on studying the Teleport security posture
availability of the solution. and vulnerabilities discovered during this
engagement.
It is important to reiterate that this report
represents a snapshot of the security posture of Short-term improvements
the environment at a point in time.
• Work on mitigating the discovered
The findings included multiple vulnerabilities in vulnerabilities. You can use Appendix B -
both the design and implementation of some Remediation Checklist to make sure that you
features. A number of Insecure Design practices have covered all areas.
were highlighted, related to cross-tenants abuses
in the context of Teleport Cloud SaaS. Several
existing Teleport features such as OID
integrations or dynamic port forwarding were
weaponized as SSRF to takeover or leak
information between different tenants. The
project also brought to light some issues caused
by a potential cookies manipulation from tenant-
controlled subdomains. Doyensec also proposed
several hardening improvements that would make
the overall platform more resilient against
attacks.
4 of 50 WWW.DOYENSEC.COM
Gravitational, Inc. (DBA Teleport) - Security Auditing Report
Long-term improvements
• Consider implementing strong Network
Policies, not as a catch-all SSRF mitigation
but rather as an additional layer of defense
after preventing requests to Gravitational's
internal network, since bypasses or sensible
reachable hosts can still exist in the isolation
configuration.
• Implement the platform hardening already
described on https://github.com/
gravitational/cloud/issues/230
• Consider implementing the Appendix C -
Hardening Recommendations
5 of 50 WWW.DOYENSEC.COM
Gravitational, Inc. (DBA Teleport) - Security Auditing Report
Methodology • Nmap
• Gosec
• golangci-lint
Overview • Curl, netcat and other Linux utilities
Doyensec treats each engagement as a fluid Web Application and API
entity. We use a standard base of tools and
Techniques
techniques from which we built our own unique
methodology. Our 30 years of information security
Web assessments are centered around the data
experience has taught us that mixing offensive
sent between clients and servers. In this realm,
and defensive philosophie