-
-
Notifications
You must be signed in to change notification settings - Fork 404
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #1790 from Shubham-Patel07/fix/Issue812
Challenge: Add misconfiguration for mounting in secret in during build
- Loading branch information
Showing
15 changed files
with
220 additions
and
22 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
42 changes: 42 additions & 0 deletions
42
src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge52.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| package org.owasp.wrongsecrets.challenges.docker; | ||
|
|
||
| import edu.umd.cs.findbugs.annotations.SuppressFBWarnings; | ||
| import groovy.util.logging.Slf4j; | ||
| import java.nio.charset.StandardCharsets; | ||
| import java.nio.file.Files; | ||
| import java.nio.file.Paths; | ||
| import org.owasp.wrongsecrets.Challenges; | ||
| import org.owasp.wrongsecrets.challenges.FixedAnswerChallenge; | ||
| import org.slf4j.Logger; | ||
| import org.slf4j.LoggerFactory; | ||
| import org.springframework.beans.factory.annotation.Value; | ||
| import org.springframework.stereotype.Component; | ||
|
|
||
| @Slf4j | ||
| @Component | ||
| public class Challenge52 extends FixedAnswerChallenge { | ||
|
|
||
| private static final Logger log = LoggerFactory.getLogger(Challenge52.class); | ||
| private final String dockerMountsecret; | ||
|
|
||
| public Challenge52(@Value("${chalenge_docker_mount_secret}") String dockerMountsecret) { | ||
| this.dockerMountsecret = dockerMountsecret; | ||
| } | ||
|
|
||
| @Override | ||
| public String getAnswer() { | ||
| return getActualSecret(); | ||
| } | ||
|
|
||
| @SuppressFBWarnings( | ||
| value = "PATH_TRAVERSAL_IN", | ||
| justification = "The location of the dockerMountPath is based on an Env Var") | ||
| private String getActualSecret() { | ||
| try { | ||
| return Files.readString(Paths.get(dockerMountsecret, "secret.txt"), StandardCharsets.UTF_8); | ||
| } catch (Exception e) { | ||
| log.warn("Exception during file reading, defaulting to default without cloud environment", e); | ||
| return Challenges.ErrorResponses.OUTSIDE_DOCKER; | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| === Exposed Buildx Secrets Challenge | ||
|
|
||
| Acme Inc., a fast-growing SaaS company, is expanding its containerized deployments using Docker Buildx to streamline multi-platform builds. However, a serious security misconfiguration has occurred during the build process. | ||
|
|
||
| During their Docker Buildx process, a sensitive secret, meant to remain temporary and secure during the build phase of the container, was accidentally embedded into the container's filesystem due to a misconfiguration. This secret, now accessible within the running container and visible in its build scripts, poses a significant security risk if exploited. | ||
|
|
||
| As Acme Inc.'s newly hired Security Consultant, your task is clear: investigate the container, identify the exposed secret, and report it to the team. By uncovering this vulnerability, you will help Acme Inc. understand the risks and implement better practices to secure their deployment pipeline. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| This challenge can be solved using the following steps: | ||
|
|
||
| - *Acme Inc.* has misconfigured their Docker Buildx process, leading to sensitive secrets being embedded in the container's filesystem. Your task is to uncover these vulnerabilities. | ||
| 1. Clone the repository containing the challenge files: | ||
| ``` | ||
| git clone https://github.com/OWASP/wrongsecrets.git | ||
| cd wrongsecrets | ||
| ``` | ||
| 2. Locate the `docker-create.sh` file in the repository. This file contains the build logic used by Acme Inc. to create the Docker container. | ||
| 3. Build the Docker image by running the `docker-create.sh` script: | ||
| ``` | ||
| ./docker-create.sh | ||
| ``` | ||
| 4. Start the Docker container using the built image to access its environment: | ||
| ``` | ||
| docker run -it jeroenwillemsen/wrongsecrets:local-test-no-vault sh | ||
| ``` | ||
| 5. Investigate the container filesystem to locate the secret file: | ||
| ``` | ||
| / $ cat var/run/secrets2/secret.txt | ||
| ``` | ||
| 6. The content of the `secret.txt` file is your answer. | ||
| == OR | ||
|
|
||
| - You can directly access the hardcoded secret by accessing the `docker-create` script | ||
|
|
||
| 1. Clone the repository containing the challenge files: | ||
| ``` | ||
| git clone https://github.com/OWASP/wrongsecrets.git | ||
| cd wrongsecrets | ||
| ``` | ||
| 2. Locate the `docker-create.sh` file in the repository. This file contains the build logic used by Acme Inc. to create the Docker container. | ||
|
|
||
| 3. You can find the Hardcoded secret injected in the container `$SECRET_VALUE` in `create_containers` function | ||
|
|
||
|
|
||
| The misconfiguration demonstrates how secrets, passed securely during the Docker build process using `--secret`, can become exposed when improperly stored in the container. Your findings will help Acme Inc. understand and fix this critical issue. |
Oops, something went wrong.