This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "OWASP Serverless Goat"

From OWASP
Jump to: navigation, search
(→‎Cheat Sheet)
m (minor)
 
(9 intermediate revisions by the same user not shown)
Line 1: Line 1:
−
<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>
+
<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:Sgoatbanner.png|center|frameless|1950x1950px]]</div>
−
 
 
 
{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
 
{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
 
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |
 
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |
  
 
== Introduction==
 
== Introduction==
−
OWASP ServerlessGoat is a deliberately insecure realistic AWS Lambda serverless application, maintained by OWASP. You can install WebGoat, learn about the vulnerabilities, how to exploit them, and how to remediate each issue. The project also includes documentation explaining the issues and how they should be remediated with best-practices.
+
OWASP ServerlessGoat is a deliberately insecure realistic AWS Lambda serverless application, maintained by OWASP.  
 +
 
 +
You can install ServerlessGoat, learn about the vulnerabilities, how to exploit them, and how to remediate each issue. The project also includes documentation explaining the issues and how they should be remediated with best-practices.
  
 
As serverless adoption is expected to continue growing and reach new audiences, we see the importance of education on topics such as how to build robust, secure and reliable AWS Lambda serverless applications. This project will expose developers and security practitioners to basic serverless security concepts, risks, attacks and mitigation best-practices.
 
As serverless adoption is expected to continue growing and reach new audiences, we see the importance of education on topics such as how to build robust, secure and reliable AWS Lambda serverless applications. This project will expose developers and security practitioners to basic serverless security concepts, risks, attacks and mitigation best-practices.
 
   
 
   
−
There were a few key principles that we wanted to follow when designing this demo vulnerable application:
+
OWASP ServerlessGoat is packaged as an AWS SAM application that's available for deployment through the [https://aws.amazon.com/serverless/serverlessrepo/ AWS Serverless Application Repository] - this provides three important benefits:
−
* Make the project open source and free for everyone to use
+
* A single click installation process. No compilation, building or packaging required
−
* Simple and straightforward deployment
+
* The application uses default serverless application repository permissions (SAM policy templates), making it more realistic
−
* Demonstrate as many serverless security bad practices as possible (we will keep adding more issues, but also hope to see community contributions)
+
* The installation doesn't create custom IAM roles or resource policies on the account in which it is deployed in
−
* Design the application to be realistic, and include common 'bad-practices', rather than forcing it to be vulnerable artificially
 
  
−
Given these key principles, we chose to develop and package the application an AWS SAM application that's available for deployment through the [https://aws.amazon.com/serverless/serverlessrepo/ AWS Serverless Application Repository] - however, this meant that we had to use the supported SAM policy templates. While this decision imposes some limitations on what capabilities were available for us, it presented two important benefits:
+
== Disclaimer ==
−
* The application uses "default" serverless application repository permissions, making it more realistic
+
OWASP does not take responsibility for the way in which any one uses the ServerlessGoat application. OWASP made the purposes of the application clear and it should not be used maliciously. We have given warnings and taken measures to prevent users from installing ServerlessGoat on production accounts.
−
* The deployment doesn't create custom IAM roles or resource policies
 
  
 
==  Details==
 
==  Details==
Line 23: Line 22:
  
 
The vulnerabilities that are included are:
 
The vulnerabilities that are included are:
−
* Event-data injection, leading to OS command injection (SAS-01)
+
* Event-data injection (SAS-01)
−
* Improper exception handling and verbose error messages (SAS-10), leading to sensitive information disclosure
+
* Insecure Serverless Deployment Configuration (SAS-03)
−
* Insecure Serverless Deployment Configuration, leading to S3 bucket data exposure (SAS-03)
+
* Over-privileged function permissions & roles (SAS-04)
−
* Over-privileged function permissions & roles, leading to data leakage of information stored in a DynamoDB table (SAS-04)
+
* Inadequate function monitoring and logging (SAS-05)
−
* Inadequate function monitoring and logging (SAS-05) - the application doesn't properly log application layer attacks and errors (can be demonstrated through CloudWatch/CloudTrail)
+
* Insecure 3rd Party Dependencies (SAS-06)
−
* Insecure 3rd Party Dependencies (SAS-06) - can be detected by scanning the project with an OSS scanning tool
+
* Application layer Denial of Service (SAS-08)
−
* Application layer Denial of Service (SAS-08), which can be easily demonstrated
+
* Improper exception handling and verbose error messages (SAS-10)
−
* An undisclosed *critical* issue, as a bonus!
+
* Other undisclosed *critical* issues, as a bonus!
  
 
==Licensing==
 
==Licensing==
Line 46: Line 45:
 
# Click on 'View CloudFormation Stack'
 
# Click on 'View CloudFormation Stack'
 
# Under 'Outputs' you will find the URL for the application (WebsiteURL) ​
 
# Under 'Outputs' you will find the URL for the application (WebsiteURL) ​
 +
 +
You can find a live version of the application hosted by PureSec in the following URL: https://www.serverless-hack.me/
  
 
== Roadmap ==
 
== Roadmap ==
−
* 18-December-2018: Initial version / Alpha release. Collect feedback from the public  
+
* '''18-December-2018''': Initial release. Collect feedback from the public ('''done''')
−
* 1-January-2019: Beta release with additional features.  
+
* '''1-January-2019''': Beta release with additional features.  
−
* 15-January: v1.0 official launch
+
* '''15-January''': v1.0 official launch
  
 
== Project Sponsors ==
 
== Project Sponsors ==
−
The project was initially developed by PureSec:
+
The project was initially developed by Ory Segal & Yuri Shapira @ [https://www.puresec.io/ PureSec]:
  
 
[[File:PureSec-Logo.png|frameless|link=https://www.puresec.io/]]
 
[[File:PureSec-Logo.png|frameless|link=https://www.puresec.io/]]
Line 59: Line 60:
 
== Cheat Sheet ==
 
== Cheat Sheet ==
  
−
Note: you can find a full walkthrough (with spoilers of course) in the LESSONS.md file in the Git repo
+
You can find a full walkthrough (with spoilers of course) in the [https://github.com/OWASP/Serverless-Goat/blob/master/LESSONS.md LESSONS.md] file in the Git repo
−
 
 
−
The following security issues exist in the application: ​
 
−
* Event-data injection, leading to OS command injection (SAS-01)
 
−
* Users can invoke the API with a <code>document_url</code> parameter value containing Linux OS commands. E.g. <code>; ls -LF</code>
 
−
* Improper exception handling and verbose error messages (SAS-10), leading to sensitive information disclosure
 
−
* For example, invoking the API without the required parameter will return a verbose stack trace/exception
 
−
* Insecure Serverless Deployment Configuration (SAS-03)
 
−
* Publicly open S3 bucket (its name can be discovered from the subdomain/prefix of the URL)
 
−
* The parameter <code>document_url</code> is not defined as a 'required' parameter in API gateway and can be ommitted
 
−
* Over-privileged function permissions & roles, leading to data leakage of information stored in a DynamoDB table (SAS-04)
 
−
* The function has CRUD permissions on the Dynamo table, which can be abused for reading sensitive data, or manipulating data
 
−
* The function has FullAccess policy on the S3 bucket, leading to data tampering and data leakage, etc.
 
−
* Inadequate function monitoring and logging (SAS-05) - the application doesn't properly log application layer attacks and errors (can be demonstrated thro\ugh CloudWatch/CloudTrail)
 
−
* Insecure 3rd Party Dependencies (SAS-06) - can be detected by scanning the project with an OSS scanning tool
 
−
* The vulnerable package is <code>node-uuid</code>
 
−
* Application layer Denial of Service (SAS-08), which can be easily demonstrated
 
−
* An attacker may invoke the API recursively multiple times, essentially spawning enough instances to reach the function's reserved capacity limit (which is set to 5). Recursive invocation can be done by invoking the API with itself as the `document_url` parameter (URL-encoded), which by itself calls itself (double-URL encoded), etc. (x5 times).
 
−
* An undisclosed ''critical'' issue, as a bonus! ​
 
  
 
==Getting Involved==
 
==Getting Involved==
Line 85: Line 68:
  
 
== Project Resources ==
 
== Project Resources ==
−
Deployment via the [https://serverlessrepo.aws.amazon.com/applications/arn:aws:serverlessrepo:us-east-1:761130837472:applications~serverless-goat AWS Serverless App Repository]
+
'''1-click installation''' on your own AWS account via the [https://serverlessrepo.aws.amazon.com/applications/arn:aws:serverlessrepo:us-east-1:761130837472:applications~serverless-goat AWS Serverless App Repository]
 +
 
 +
A '''live version''' of the application is hosted by PureSec at: https://www.serverless-hack.me/
  
 
== Project Leader ==
 
== Project Leader ==
−
[[User:Orysegal|Ory Segal]] ([mailto:[email protected] email])
+
[[User:Orysegal|Ory Segal]] , [https://www.puresec.io/ PureSec] ([mailto:[email protected] email])
  
 
== Project Mailing List ==
 
== Project Mailing List ==

Latest revision as of 06:48, 18 January 2019

Sgoatbanner.png

Introduction

OWASP ServerlessGoat is a deliberately insecure realistic AWS Lambda serverless application, maintained by OWASP.

You can install ServerlessGoat, learn about the vulnerabilities, how to exploit them, and how to remediate each issue. The project also includes documentation explaining the issues and how they should be remediated with best-practices.

As serverless adoption is expected to continue growing and reach new audiences, we see the importance of education on topics such as how to build robust, secure and reliable AWS Lambda serverless applications. This project will expose developers and security practitioners to basic serverless security concepts, risks, attacks and mitigation best-practices.

OWASP ServerlessGoat is packaged as an AWS SAM application that's available for deployment through the AWS Serverless Application Repository - this provides three important benefits:

  • A single click installation process. No compilation, building or packaging required
  • The application uses default serverless application repository permissions (SAM policy templates), making it more realistic
  • The installation doesn't create custom IAM roles or resource policies on the account in which it is deployed in

Disclaimer

OWASP does not take responsibility for the way in which any one uses the ServerlessGoat application. OWASP made the purposes of the application clear and it should not be used maliciously. We have given warnings and taken measures to prevent users from installing ServerlessGoat on production accounts.

Details

The application is a service which receives a URL to a Word document (with a .doc extension - Office 97-2004), and will reply with an HTML page containing the extracted text.

The vulnerabilities that are included are:

  • Event-data injection (SAS-01)
  • Insecure Serverless Deployment Configuration (SAS-03)
  • Over-privileged function permissions & roles (SAS-04)
  • Inadequate function monitoring and logging (SAS-05)
  • Insecure 3rd Party Dependencies (SAS-06)
  • Application layer Denial of Service (SAS-08)
  • Improper exception handling and verbose error messages (SAS-10)
  • Other undisclosed *critical* issues, as a bonus!

Licensing

The OWASP ServerlessGoat project is free for use. You can redistribute it and/or modify it under the terms of the link GNU Affero General Public License 3.0 as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

Deployment

ServerlessGoat is a simple AWS Lambda application, which serves as a MS-Word .doc file to plain text converter service. It receives a URL to a .doc file as input, and will return the text inside the document back to the API caller. ​ The application is packaged and published for deployment through the AWS Serverless Application Repository. ​ Steps for deployment:

  1. Make sure you are logged into your AWS account
  2. Click on the following link: AWS Serverless Application Repository
  3. Click 'Deploy'
  4. Click 'Deploy' (again)
  5. Wait until you see the message 'Your application has been deployed'
  6. Click on 'View CloudFormation Stack'
  7. Under 'Outputs' you will find the URL for the application (WebsiteURL) ​

You can find a live version of the application hosted by PureSec in the following URL: https://www.serverless-hack.me/

Roadmap

  • 18-December-2018: Initial release. Collect feedback from the public (done)
  • 1-January-2019: Beta release with additional features.
  • 15-January: v1.0 official launch

Project Sponsors

The project was initially developed by Ory Segal & Yuri Shapira @ PureSec:

PureSec-Logo.png

Cheat Sheet

You can find a full walkthrough (with spoilers of course) in the LESSONS.md file in the Git repo

Getting Involved

You do not have to be a security expert or a programmer to contribute. Contact the Project Leader(s) to get involved, we welcome any type of suggestions and comments.

Project Resources

1-click installation on your own AWS account via the AWS Serverless App Repository

A live version of the application is hosted by PureSec at: https://www.serverless-hack.me/

Project Leader

Ory Segal , PureSec (email)

Project Mailing List

TBD

Github Repo

Project GitHub

Classifications

Project Type Files TOOL.jpg
Incubator Project Owasp-builders-small.png
Owasp-defenders-small.png
Affero General Public License 3.0
Retrieved from "https://wiki.owasp.org/index.php?title=OWASP_Serverless_Goat&oldid=246664"