Add misconfiguration for mounting in secret in during build #1790
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| package org.owasp.wrongsecrets.challenges.docker; | ||
|
|
||
| import edu.umd.cs.findbugs.annotations.SuppressFBWarnings; | ||
| import groovy.util.logging.Slf4j; | ||
| import java.nio.charset.StandardCharsets; | ||
| import java.nio.file.Files; | ||
| import java.nio.file.Paths; | ||
| import org.owasp.wrongsecrets.Challenges; | ||
| import org.owasp.wrongsecrets.challenges.FixedAnswerChallenge; | ||
| import org.slf4j.Logger; | ||
| import org.slf4j.LoggerFactory; | ||
| import org.springframework.beans.factory.annotation.Value; | ||
| import org.springframework.stereotype.Component; | ||
|
|
||
| @Slf4j | ||
| @Component | ||
| public class Challenge52 extends FixedAnswerChallenge { | ||
|
|
||
| private static final Logger log = LoggerFactory.getLogger(Challenge52.class); | ||
| private final String dockerMountsecret; | ||
|
|
||
| public Challenge52(@Value("$challengedockermtsecret") String dockerMountsecret) { | ||
| this.dockerMountsecret = dockerMountsecret; | ||
| } | ||
|
|
||
| @Override | ||
| public String getAnswer() { | ||
| return getActualSecret(); | ||
| } | ||
|
|
||
| @SuppressFBWarnings( | ||
| value = "PATH_TRAVERSAL_IN", | ||
| justification = "The location of the dockerMountPath is based on an Env Var") | ||
| private String getActualSecret() { | ||
| try { | ||
| return Files.readString(Paths.get(dockerMountsecret, "secret.txt"), StandardCharsets.UTF_8); | ||
| } catch (Exception e) { | ||
| log.warn("Exception during file reading, defaulting to default without cloud environment", e); | ||
| return Challenges.ErrorResponses.FILE_MOUNT_ERROR; | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| === Exposed Buildx Secrets Challenge | ||
|
|
||
| Acme Inc., a rising star in the SaaS industry, prides itself on delivering cutting-edge AI analytics to its global clientele. However, amidst their rapid deployment cycles and growing customer base, a critical security oversight has come to light. | ||
|
|
||
| During their Docker Buildx process, a sensitive secret, meant to remain temporary and secure during the build phase, was accidentally embedded into the container's filesystem due to a misconfiguration. This secret, now accessible within the running container, poses a significant security risk if exploited. | ||
|
|
||
| As Acme Inc.'s newly hired Security Consultant, your task is clear: investigate the container, identify the exposed secret, and report it to the team. By uncovering this vulnerability, you will help Acme Inc. understand the risks and implement better practices to secure their deployment pipeline. | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| This challenge can be solved using the following steps: | ||
|
|
||
| - *Acme Inc.* has misconfigured their Docker Buildx process, leading to sensitive secrets being embedded in the container's filesystem. Your task is to uncover these vulnerabilities. | ||
|
There was a problem hiding this comment. Can we maybe show 2 different paths for solutions:
|
||
|
|
||
| 1. Clone the repository containing the challenge files: | ||
| ``` | ||
| git clone https://github.com/OWASP/wrongsecrets.git | ||
| cd wrongsecrets | ||
| ``` | ||
|
|
||
| 2. Locate the `docker-create.sh` file in the repository. This file contains the build logic used by Acme Inc. to create the Docker container. | ||
|
|
||
| 3. Build the Docker image by running the `docker-create.sh` script: | ||
| ``` | ||
| ./docker-create.sh | ||
| ``` | ||
|
|
||
| 4. Start the Docker container using the built image to access its environment: | ||
| ``` | ||
| docker run -it jeroenwillemsen/wrongsecrets:local-test-no-vault sh | ||
| ``` | ||
|
|
||
| 5. Investigate the container filesystem to locate the secret file: | ||
| ``` | ||
| / $ cat /app/secret.txt | ||
| ``` | ||
|
|
||
| 6. The content of the `secret.txt` file is your answer. | ||
|
|
||
| The misconfiguration demonstrates how secrets, passed securely during the Docker build process using `--secret`, can become exposed when improperly stored in the container. Your findings will help Acme Inc. understand and fix this critical issue. | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| = Docker Buildx Secrets Misconfiguration Challenge | ||
|
|
||
| *Why Improper Secret Management in Docker Build Processes Can Lead to Vulnerabilities* | ||
|
|
||
| In modern DevOps workflows, Docker Buildx is a powerful tool for building multi-platform Docker images efficiently. It provides a secure way to pass sensitive information like API keys, database credentials, and certificates during the build process using the `--secret` flag. However, improper handling or storage of these secrets during or after the build process can introduce critical vulnerabilities. | ||
|
|
||
| A common mistake is to write these secrets into the container filesystem or to expose them in build scripts. This approach is flawed because: | ||
|
|
||
| 1. **Secrets become part of the container image**: If secrets are written to the container's filesystem during the build phase, they are included in the final image. Anyone with access to the image can extract these secrets by inspecting the container layers or accessing the filesystem. | ||
| 2. **Hardcoding secrets in build scripts**: Developers may hardcode secrets in scripts used to build images. When these scripts are stored in version control systems, the secrets are exposed to anyone with access to the repository. | ||
| 3. **Lack of cleanup during the build process**: Even if secrets are used temporarily, failing to securely clean up or remove these secrets before finalizing the image can leave them exposed. | ||
|
|
||
| *Why This Challenge?* | ||
|
|
||
| The purpose of this challenge is to demonstrate the risks of improperly handling secrets in Docker Buildx workflows. Specifically, it showcases how secrets intended to be temporary during the build process can end up being permanently stored in the container's filesystem due to misconfiguration. | ||
|
|
||
| This challenge simulates a scenario where: | ||
|
|
||
| - A sensitive secret is passed to the Docker build process using the `--secret` flag. | ||
| - Due to misconfiguration, the secret is written to a file in the container's filesystem (`/app/secret.txt`) during the build phase. | ||
| - The resulting image contains this secret, making it accessible to anyone who can run or inspect the container. | ||
|
|
||
| *Key Learning Points:* | ||
|
|
||
| - **Avoid embedding secrets in container images**: Secrets should never be baked into Docker images. Use mechanisms like runtime environment variables or external secret management tools to provide secrets dynamically. | ||
| - **Secure the build process**: Even with tools like `--secret`, ensure secrets are not permanently stored in intermediate or final image layers. | ||
| - **Do not hardcode secrets in build scripts**: Build scripts should not contain sensitive information. Store sensitive values securely and reference them dynamically during the build process. | ||
| - **Implement cleanup mechanisms**: If secrets must be written to temporary files during the build process, ensure they are securely removed before the image is finalized. | ||
|
|
||
| By completing this challenge, you will understand the implications of improper secret handling during Docker builds and learn best practices for managing secrets securely in containerized environments. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@bendehaan and @Shubham-Patel07 : should we be more explicit that it is about the WrongSecrets container? Instead of acme.inc we might want to make it more explicit so people know what to look for?