Kev Sib Koom Ua Ke Mus Ib Txhis thiab Kev Xa Mus Los Mus Ib Txhis (CI/CD) pipelines ua lub luag haujlwm tseem ceeb hauv kev pab txhawb kev tsim kho software. Txawm li cas los xij, raws li cov no pipelines dhau los ua qhov tseem ceeb zuj zus, qhov tseem ceeb los tiv thaiv lawv ntawm qhov tsis muaj zog tau dhau los ua qhov pom tseeb dua. Kev tshawb nrhiav tob tob no tsom mus rau kev daws teeb meem kev pheej hmoo tseem ceeb uas tau txheeb xyuas hauv OWASP Top-10 CI/CD Kev Pheej Hmoo Kev Ruaj Ntseg: Tshuaj Lom Pipeline Kev Ua Haujlwm (PPE).
Dab tsi yog lom Pipeline Kev Ua Haujlwm (PPE)
Raws li OWASP Top-10 CI/CD Kev Pheej Hmoo Kev Ruaj Ntseg, "Lom Pipeline tiav (PPE) kev pheej hmoo txhais tau hais tias tus neeg tawm tsam muaj peev xwm nkag mus rau cov txheej txheem tswj hwm qhov chaw - thiab tsis muaj kev nkag mus rau qhov chaw tsim kho - los tswj cov txheej txheem tsim los ntawm kev txhaj cov lej / cov lus txib phem rau hauv kev tsim pipeline configuration, qhov tseem ceeb 'lom' lub pipeline thiab khiav cov lej phem ua ib feem ntawm cov txheej txheem tsim kho "
Hauv ob peb lo lus, Lom zem Pipeline Kev ua tiav (PPE) yog tsim tawm thaum tus neeg tawm tsam tuaj yeem hloov kho qhov pipeline logic.
Muaj ob txawv:
- Cov Khoom Siv Tiv Thaiv Kab Mob Ncaj Qha (D-PPE): Hauv qhov xwm txheej D-PPE, tus neeg tawm tsam hloov kho cov ntaub ntawv teeb tsa CI hauv ib lub chaw cia khoom uas lawv muaj kev nkag mus rau, los ntawm kev thawb qhov kev hloov pauv ncaj qha mus rau ib ceg chaw nyob deb uas tsis muaj kev tiv thaiv ntawm lub repo, lossis los ntawm kev xa PR nrog qhov kev hloov pauv los ntawm ceg lossis rab rawg. Vim yog CI pipeline kev ua tiav yog txhais los ntawm cov lus txib hauv cov ntaub ntawv teeb tsa CI hloov kho, tus neeg tawm tsam cov lus txib phem thaum kawg khiav hauv lub node tsim thaum lub tsev tsim pipeline yog ua rau muaj teeb meem.
- Cov Khoom Siv Tiv Thaiv Kab Mob Tsis Ncaj Qha (I-PPE): Hauv qee kis, qhov ua tau ntawm D-PPE tsis muaj rau tus yeeb ncuab uas nkag mus rau SCM lub chaw khaws ntaub ntawv (piv txwv li yog tias pipeline tau teeb tsa los rub cov ntaub ntawv teeb tsa CI los ntawm ib ceg sib cais, tiv thaiv hauv tib lub chaw khaws ntaub ntawv). Hauv qhov xwm txheej zoo li no, es tsis txhob lom cov tshuaj lom pipeline nws tus kheej, tus neeg tawm tsam txhaj cov lej phem rau hauv cov ntaub ntawv uas tau hais txog pipeline (piv txwv li: cov ntawv sau uas tau hais los ntawm sab hauv pipeline cov ntaub ntawv teeb tsa)
Hauv ob qho xwm txheej, GitHub yuav ua qhov kev hloov kho tshiab pipeline tsis tas yuav tsum tau kev tshuaj xyuas lossis kev pom zoo ua ntej.
Kev kuaj pom thaum ntxov ntawm PPE
Peb yuav ua li cas thiaj nrhiav tau hom kev tsis muaj zog no?
Cia peb saib qhov piv txwv no pipeline :
Thiab cov ntsiab lus ntawm ib daim ntawv sau dummy shell (runtests.sh):
cov pipeline nws yooj yim heev: nws lub hom phiaj yog los muab qee cov lus qhia ua ntej rau tus neeg tshuaj xyuas Pull Request (PR) cov txheej txheem lees txais:
- Nws yuav raug qhib rau rub_qhov_thov (piv txwv li thaum twg PR raug tsim)
- Nws kuaj xyuas tus lej PR (piv txwv li tus lej uas tau muab)
- Nws yuav ua lub build
- Nws yuav khiav cov kev sim ntawm cov lej uas tau muab (piv txwv li los ntawm kev ua ib daim ntawv sau plhaub)
Cov Kauj Ruam #3 (ua qhov kev tsim kho) thiab #4 (khiav kev sim) yuav ua tsis tiav yog tias cov lej tsis sau ua ke lossis nws tsis dhau qhov kev sim. Yog li, cov kauj ruam no ua haujlwm ua qhov tsim nyog, tab sis tsis txaus, kom lees txais PR. Yog tias ua tiav, tus thawj coj repo yuav txuas ntxiv mus tshuaj xyuas cov lej uas tau muab thiab, raws li qhov ntawd, nws/nws yuav lees txais/tsis lees txais/tawm tswv yim PR.
Xygeni Scanner
Xygeni muab CLI (tus "Xygeni Scanner") uas tuaj yeem muab tso rau hauv ib qho pipeline los yog khiav hauv kab hais kom ua. Lub Xygeni Scanner yuav ua cov txheej txheem pipelines los xyuas seb puas muaj qhov tsis zoo thiab, yog tias muab GitHub PAT, nws yuav txuas rau GitHub kom pom qhov tsis zoo ntawm theem org/repo.
Cov Khoom Muag Xygeni
Thaum peb ua tiav Xygeni Scanner ntawm qhov repo no, nws pom ib pawg khoom muaj txiaj ntsig (tus Cov Khoom Muag Xygeni). Cov Khoom Muag yuav muaj ntau hom sib txawv CI/CD cuab tam, xws li:
- cov SCM system qhov twg repo khaws cia
- cov SCM plugins ntsia/siv lawm
- cov Chaw Khaws Cov Code nws tus kheej
- cov SCM Lub koom haum qhov twg repo koom nrog
- cov CI/CD Pipelines thiab Cov Haujlwm
- cov CI/CD system khiav lub pipelines
- IaC Cov Kev Pab Rau Cov Lag Luam txhais rau hauv repo
- Sab nraud dependencies
- thiab lwm yam ..
Hauv peb qhov piv txwv, peb tuaj yeem lim cov Khoom Muag los ntawm qee hom khoom muaj nqis tshwj xeeb (SCM- thiab cov khoom muaj nqis ntsig txog CICD), yog li peb tuaj yeem pom tias:
- SCM lub kaw lus yog GitHub Cloud
- Repo khaws cia rau hauv GitHub Cloud thiab yog ib feem ntawm GitHub Organization tshwj xeeb
- Muaj ob pipelines powered los ntawm GitHub (CI/CD qhov system)
- txhua pipeline muaj ib kauj ruam tshwj xeeb
Los ntawm kev xaiv cov saum toj no pipeline peb tuaj yeem pom qee qhov tsis muaj zog:
- At pipeline theem, nws yog qhov tsis muaj zog rau ob qho tib si Direct thiab Cov PPE tsis ncaj qha.
Peb tuaj yeem pom cov ntsiab lus ntawm cov neeg raug lom Pipeline Qhov tsis muaj zog ntawm kev ua haujlwm
Xygeni pom tias nws yog tsis muaj zog rau D-PPE vim nws tau tshwm sim rau ntawm ib qho Pull Request qhov xwm txheej thiab tsis muaj kev tswj hwm kev ruaj ntseg ntxiv, yog li txhua tus neeg siv repo tuaj yeem hloov kho qhov pipeline thiab cov kev hloov kho ntawd yuav raug ua tiav yam tsis muaj kev tshuaj xyuas lossis kev pom zoo.
Hauv tib lub ntsiab lus, Xygeni kuj pom tias nws yog tsis muaj zog rau I-PPE vim yog qhov kev hu rau lub plhaub script los ntawm pipeline: txhua tus neeg siv repo tuaj yeem hloov kho cov ntawv sau plhaub thiab cov kev hloov kho ntawd yuav raug ua tiav yam tsis muaj kev tshuaj xyuas lossis kev pom zoo.
Koj puas xav paub ntxiv?
Siv PPE tsis raug
Yuav kom siv tau cov PPE, cia peb xav txog qhov xwm txheej uas muaj ob hom neeg siv repo:
- An tus neeg siv sab hauv (tus tsim tawm sab hauv ua haujlwm rau ntawm qhov repo ntawd), nrog rau kev tso cai sau ntawv rau ntawm qhov repo
- An tus neeg siv sab nraud (tus neeg tsim khoom sab nraud ua haujlwm rau ntawm qhov repo ntawd tab sis muaj kev tso cai nyeem ntawm repo), piv txwv li tsis raug tso cai ceg repo thiab yuam kom ua haujlwm ntawm rab rawg.
Cia peb xav tias ob leeg yog cov neeg tawm tsam phem (lossis ua txuj ua li los ntawm tus neeg ua phem). Lub repo muaj qee qhov zais cia thiab ob leeg xav tau mus nyiag qhov zais cia ntawm repo thiab xa mus rau lub server uas hacker tswj hwm. Yuav ua li ntawd, lawv yuav siv qhov zoo ntawm Poisoned Pipeline Qhov tsis muaj zog ntawm kev ua haujlwm ntawm pipeline.
Hauv ob qho xwm txheej (tus neeg siv sab nraud thiab sab hauv), lawv qhib ib qho Pull Request nrog rau cov kev hloov kho tib yam:
- cov pipeline thiab cov ntawv sau plhaub raug hloov kho rau nyeem qhov zais cia los ntawm ib puag ncig thiab xa mus rau lub server uas hacker tswj hwm
Cov kev hloov kho yuav yog raws li nram no:
Ob tus neeg siv yuav tsim ib qho Pull Request nrog rau cov kev hloov khoThaum tsim tau PR, GitHub yuav ua ob qho kev hloov kho (tsis tas yuav tsum tau kev tshuaj xyuas lossis kev pom zoo ua ntej), ua rau cov hauv qab no:
Ib yam li ntawd rau cov neeg siv sau ntawv thiab nyeem ntawv, hauv ob qho tib si, D-PPE thiab I-PPE raug tua, nrog rau qhov sib txawv ntawd tus neeg nyeem ntawv tsis tuaj yeem nkag mus rau cov lus zais. (!!!!)
Qhov laj thawj no yog vim, nyob rau hauv cov ntaub ntawv ntawm PR los ntawm ib tug fork, GitHub tsis pub nkag mus rau repo secrets. Txawm hais tias tus neeg siv nyeem tsis tuaj yeem nyeem cov lus zais, nws tseem tuaj yeem khiav lwm yam kev pab cuam. Ib qho piv txwv ntawm kev tawm tsam yog tsim PRs uas rub tawm crypto miner, yog li GitHub khiav yuav ua tiav crypto miner thaum ua tiav cov tshuaj lom pipeline.
Qhov no tsis yog ib qho chaw nyab xeeb, tau kawg!! Tus thawj coj ntawm repo yuav ua li cas kom tsis txhob muaj qhov no?
Tom qab qee qhov googling, tus repo admin txiav txim siab hloov kho qhov pipeline yuav tsum tau ua kom raug rau ntawm ib qho rub_qhov_thov_lub_target kev tshwm sim. Vim li cas? Vim tias pipelines triggered ntawm pull_request_target tsis pub ua haujlwm pipeline kev hloov kho, piv txwv li txawm tias tus neeg siv hloov kho qhov "thawj" pipeline yuav raug tua pov tseg.
Ua raws li peb qhov piv txwv, qhov kev tawm tsam yuav zoo ib yam li ua ntej. Yuav muaj dab tsi tshwm sim tom qab qhov no pipeline kev hloov kho?
Raws li tau leej twg, D-PPE tsis tau ua tiav tab sis, vim tias I-PPE tseem nyob ntawd, tus neeg siv nyeem tam sim no tuaj yeem nkag mus rau qhov chaw khaws cia zais cia !!!
Vim li cas tus neeg nyeem ntawv thiaj li nkag mus rau cov lus zais tam sim no? Txawm hais tias pipeline tsis tuaj yeem hloov kho, nws tseem ua tau hloov kho cov ntawv sau plhaub. Thaum twg a pipeline yog triggered rau ntawm pull_request_target, nws yuav raug ua tiav hauv hom privileged so nws tseem yuav yog tsab ntawv plhaub, ua rau lub plhaub tsab ntawv muaj kev nkag mus rau repo secrets!!
Kev Tiv Thaiv Cov Tiv Thaiv
GitHub muab qee qhov kev ntsuas los tiv thaiv cov PRs phem.
Cov cai tiv thaiv ceg
Nrog GitHub koj tuaj yeem txhais cov Cai Tiv Thaiv Ceg ntawm cov ceg xaiv.
Rau koj cov ceg uas raug tiv thaiv, koj tuaj yeem teev ib txoj cai uas xav tau a pull request ua ntej sib koom ua ke (nrog rau cov xwm txheej ntxiv xws li tus lej ntawm kev pom zoo uas yuav tsum tau muaj, kev tshuaj xyuas los ntawm cov tswv code, thiab lwm yam.)
Ob peb yam mob uas tsim nyog tau txais kev xav tshwj xeeb yog:
- "Tso cai rau cov neeg ua yeeb yam tshwj xeeb kom hla dhau qhov yuav tsum tau ua pull requests".
- "Tsis pub hla dhau cov chaw saum toj no"
Txawm hais tias feem ntau ntawm cov xwm txheej ntxiv kev nruj rau txoj cai, cov no ua rau txoj cai so thiab qhov ntawd yuav ua rau muaj qhov rooj qhib rau kev ua phem, piv txwv li, yog tias cov ntaub ntawv pov thawj raug nyiag los ntawm cov neeg ua yeeb yam "muaj cai".
Txwv tsis pub GITHUB_TOKEN tso cai (tsawg tshaj plaws txoj cai)
Txwv tsis pub GitHub token permissions tsuas yog rau cov uas yuav tsum tau ua xwb; ua li no, txawm tias cov neeg tawm tsam ua tiav hauv kev cuam tshuam koj pipeline, lawv yuav ua tsis tau ntau yam.
Tsis txhob siv cov hlua interpolation pipeline cov hloov pauv env
Thaum twg koj siv qee cov input variables hauv koj lub pipeline, nco ntsoov tias lawv yuav tsum raug suav hais tias yog cov ntaub ntawv "tsis ntseeg siab" los ntawm lub neej ntawd (lawv cov ntsiab lus yog tswj hwm los ntawm tus neeg siv kawg). Saib Cov Kev Ua thiab Cov Haujlwm Tsis Ntseeg Siab Muaj Kev Ruaj Ntseg thiab Kawm Github Actions.
Koj yuav tsum siv cov hloov pauv ib puag ncig los ntxig cov hloov pauv nkag rau hauv cov ntawv sau es tsis txhob siv cov hlua interpolation.
Kev khiav haujlwm thiab cov kev cai pom zoo
rau pej xeem repos, GitHub tso cai rau kev teev cia yuav ua li cas ua haujlwm nrog "sab nraud" PRs.
GitHub Lub Koom Haum Chaw (“Org >> Chaw >> Kev Ua >> Dav Dav”) cia qhia meej txog yuav ua li cas tswj hwm PR sab nraud:
Los ntawm lub neej ntawd, GitHub yuav xav tau kev pom zoo los ntawm PR rau cov neeg pab txhawb thawj zaug, ua rau kev tawm tsam thov phem nyuaj dua. Txawm li ntawd los, tus neeg tawm tsam yuav tau txais kev ntseeg siab ntawm tus neeg saib xyuas qhov project piv txwv li los ntawm kev pab txhawb qee yam tsis muaj txim. pull request ua ntej qhov kev tawm tsam tiag tiag.
Hauv qhov kev xav no, cov Txoj kev xaiv thib 3 (Yuav tsum tau kev pom zoo los ntawm txhua tus neeg koom tes sab nraud) ntxiv qib kev tswj hwm siab dua.
rau private repos, GitHub kuj tseem muab kev tswj hwm pab tau ob qho tib si ntawm Lub Koom Haum- thiab Repo-level.
"Khiav cov haujlwm los ntawm Pull Requests”(tsis tau kuaj xyuas los ntawm lub neej ntawd) tso cai rau cov neeg siv khiav cov haujlwm los ntawm fork PRs (siv GITHUB_TOKEN nrog kev tso cai nyeem nkaus xwb thiab tsis muaj kev nkag mus rau cov lus zais). Los ntawm kev xaiv qhov kev xaiv no ua ke nrog qhov kawg (“Yuav tsum tau kev pom zoo rau cov txheej txheem ua haujlwm ntawm fork PRs”), koj tuaj yeem ncav cuag txoj cai zoo sib xws rau cov chaw khaws cia ntiag tug (raws li qhia saum toj no).
Raws li peb tau pom hauv PPE exploit los ntawm tus neeg siv nyeem, cia khiav cov workflows los ntawm fork pull requests tsis muaj kev nyab xeeb !!
Cov kev xaiv uas tseem tshuav (“Xa cov cim sau ntawv mus rau cov workflows los ntawm fork pull requests"Thiab"Xa cov lus zais thiab cov hloov pauv mus rau cov txheej txheem ua haujlwm los ntawm rau pull requests") txo qib kev ruaj ntseg siv rau cov PRs ntawm cov fork.
Koj tuaj yeem txhais txoj cai fork no ntawm Lub Koom Haum lossis ntawm Repo-level. Yog tias txoj cai raug kaw ntawm org-level, nws tsis tuaj yeem qhib ntawm repo. Tab sis, yog tias txoj cai raug qhib ntawm org-level, nws tuaj yeem kaw ntawm repo-level.
recap
Peb vam tias koj tau pom qhov cuam tshuam ntawm kev muaj qee yam pipeline yooj yim rau lom Pipeline Kev ua tiav. Nws yooj yim dhau rau commit ib tug neeg uas tsis muaj zog pipeline, thiab nws nyuaj rau sau ib qho kev nyab xeeb.
Yog li ntawd, nws muaj txiaj ntsig zoo heev rau kev siv Xygeni Scanner kom paub txog cov qhov tsis zoo no.
Koj tsis tuaj yeem daws qhov teeb meem vuln tshwj tsis yog tias koj paub txog nws muaj nyob !!
Tiam sis... Tseem muaj ib lo lus nug uas tseem tab tom tos... Yuav ua li cas kom tsis txhob siv I-PPE?
Qhov no yuav yog lub ntsiab lus ntawm peb cov ntawv tom ntej 🙂 … Tshuaj lom tsis ncaj qha Pipeline Kev Ua Haujlwm (I-PPE) !!
