Skip to content

Latest commit

 

History

History
59 lines (55 loc) · 5.16 KB

vulnerabilities-workflow-1.md

File metadata and controls

59 lines (55 loc) · 5.16 KB

Combined Vulnerability List for prometheus/client_model

This list combines vulnerabilities identified across multiple analyses for the prometheus/client_model project. Duplicate entries have been removed to provide a consolidated view.

Insecure External Dependency Download in the Makefile

  • Vulnerability Name: Insecure External Dependency Download in the Makefile
  • Description: The Makefile downloads required build dependencies (namely the protoc compiler and the protoc-gen-go plugin) directly from GitHub using a plain curl command without any integrity or signature verification. An attacker who can position themselves to intercept the network traffic (for example, via a man‐in‐the-middle attack or DNS spoofing) could substitute a malicious zip file. When the build process unzips and installs these tools, the attacker’s payload could be executed as part of the code-generation or build process.
    • Steps to trigger:
      1. An attacker gains the ability to intercept or modify the network connection between the build environment (a CI/CD server or a developer’s machine) and GitHub.
      2. When the Makefile target for $(PROTOC) executes, the attacker intercepts the HTTPS request.
      3. The attacker serves a modified (malicious) version of the protoc zip file instead of the authentic version.
      4. The Makefile unzips the file without verifying its checksum and installs the malicious binary.
      5. The build process continues using the compromised binary, which may execute the embedded malicious code during code generation or later in the build chain.
  • Impact: If exploited, the attacker can compromise the build environment by achieving arbitrary code execution. This can lead to:
    • Injection of malicious code into the generated artifacts.
    • Unauthorized access or control over the CI/CD pipeline.
    • Propagation of malicious payloads to production builds that rely on the generated code.
  • Vulnerability Rank: High
  • Currently Implemented Mitigations:
    • The Makefile downloads files via HTTPS (using curl -sSL), which means that the communication channel is encrypted and HTTPS certificates are checked by default.
  • Missing Mitigations:
    • Integrity Verification: There is no checksum, cryptographic signature, or hash verification of the downloaded zip files or binaries before they are installed.
    • Additional Isolation: No further isolation or sandboxing of the download process is performed.
  • Preconditions:
    • The attacker must be able to intercept or tamper with the network traffic between the build environment and GitHub (e.g., via a compromised network or misconfigured CI environment).
    • The build process must be running in an environment in which external downloads are permitted and not further isolated or verified.
  • Source Code Analysis:
    • In the Makefile, the target for $(PROTOC) is defined as follows:
      • The Makefile checks that curl and unzip are available.
      • It creates a temporary directory using mktemp -d.
      • It then downloads the protoc zip using the command: 
        cd $(PROTOC_TMP); curl -sSL https://github.com/protocolbuffers/protobuf/releases/download/v$(PROTOC_VERSION)/protoc-$(PROTOC_VERSION)-$(PROTOC_OS)-$(PROTOC_ARCH).zip -o protoc.zip
      • The downloaded file is immediately unzipped: 
        cd $(PROTOC_TMP); unzip protoc.zip && mv bin/protoc $(PWD)/$(PROTOC_BIN) && mv include/google $(PWD)/$(PROTOC_INCLUDE)
      • No mechanism is present to validate the integrity of the downloaded file (for example, using a known checksum or digital signature check).
    • A similar pattern is used in the target for $(PROTOC_GEN_GO) where the protoc-gen-go plugin is installed using go install without additional verification.
  • Security Test Case:
    1. Setup a Controlled Environment:
      • Use a test CI/CD pipeline or a containerized build environment.
      • Configure a proxy or modify DNS/hosts so that requests to github.com (or the relevant download URLs) are redirected to a controlled server.
    2. Interception and Substitution:
      • Create a malicious version of the protoc zip file (for test purposes, include a marker file that indicates payload execution instead of actual harm).
      • When the Makefile runs and invokes the curl command, ensure that the proxy serves the malicious zip file.
    3. Run the Build:
      • Execute make so that the Makefile downloads and processes the file.
    4. Verification:
      • Check that the malicious payload has been installed (for example, by verifying that the marker file exists or that unexpected behavior is observed during code generation).
      • Then, implement a checksum verification step and run the build again to confirm that the build fails when the downloaded file does not match the expected checksum.
    5. Conclusion:
      • This test confirms that without proper integrity validation, an attacker with network-level access can substitute the download contents, thereby compromising the build process.

Implementing proper checksum validation or a cryptographic signature check for all downloaded dependencies is strongly recommended to mitigate this vulnerability.