Difference between revisions of "OWASP Serverless Goat"

Introduction

OWASP ServerlessGoat is a deliberately insecure realistic AWS Lambda serverless application, maintained by OWASP. You can install WebGoat, learn about the vulnerabilities, how to exploit them, and how to remediate each issue. The project also includes documentation explaining the issues and how they should be remediated with best-practices.

As serverless adoption is expected to continue growing and reach new audiences, we see the importance of education on topics such as how to build robust, secure and reliable AWS Lambda serverless applications. This project will expose developers and security practitioners to basic serverless security concepts, risks, attacks and mitigation best-practices.

There were a few key principles that we wanted to follow when designing this demo vulnerable application:

• Make the project open source and free for everyone to use
• Simple and straightforward deployment
• Demonstrate as many serverless security bad practices as possible (we will keep adding more issues, but also hope to see community contributions)
• Design the application to be realistic, and include common 'bad-practices', rather than forcing it to be vulnerable artificially

Given these key principles, we chose to develop and package the application an AWS SAM application that's available for deployment through the AWS Serverless Application Repository - however, this meant that we had to use the supported SAM policy templates. While this decision imposes some limitations on what capabilities were available for us, it presented two important benefits:

• The application uses "default" serverless application repository permissions, making it more realistic
• The deployment doesn't create custom IAM roles or resource policies

Details

The application is a service which receives a URL to a Word document (with a .doc extension - Office 97-2004), and will reply with an HTML page containing the extracted text.

The vulnerabilities that are included are: (* spoiler alert! *)

• Event-data injection, leading to OS command injection (SAS-01)
• Improper exception handling and verbose error messages (SAS-10), leading to sensitive information disclosure
• Insecure Serverless Deployment Configuration, leading to S3 bucket data exposure (SAS-03)
• Over-privileged function permissions & roles, leading to data leakage of information stored in a DynamoDB table (SAS-04)
• Inadequate function monitoring and logging (SAS-05) - the application doesn't properly log application layer attacks and errors (can be demonstrated through CloudWatch/CloudTrail)
• Insecure 3rd Party Dependencies (SAS-06) - can be detected by scanning the project with an OSS scanning tool
• Application layer Denial of Service (SAS-08), which can be easily demonstrated
• An undisclosed *critical* issue, as a bonus!

Licensing

The OWASP ServerlessGoat project is free for use. You can redistribute it and/or modify it under the terms of the link GNU Affero General Public License 3.0 as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

Roadmap

• 18-December-2018: Initial version / Alpha release. Collect feedback from the public
• 1-January-2019: Beta release with additional features.
• 15-January: v1.0 official launch

Project Sponsors

The project was initially developed and sponsored by PureSec:

Getting Involved

You do not have to be a security expert or a programmer to contribute. Contact the Project Leader(s) to get involved, we welcome any type of suggestions and comments.

Project Resources

TBD

Project Leader

Ory Segal (email)

Project Mailing List

TBD

Github Repo

Project GitHub

Classifications