Skip to content

Commit e170963

Browse files
elad-ptichaelad-pticha
authored
feat: enrich query library (#108)
* Added body, title, email, label, message, priv_esc, branch, self-hosted, unpinnable-actions queries. * Changed cli reporter from table to aggregated results under each query. * Changed queries ID to match Raven Policy (RP) schema. * Changed query schema to -> RQ (Raven Query). * Added visability tag to workflow and actions. * Added testing. * Fixed typo. * Changed self-hosted query to include only public workflows. * Changed tag type. * Added RQ-13. * Changed visibility property to is_public (bool).
1 parent fe70b2a commit e170963

30 files changed

+570
-94
lines changed

‎README.md‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -161,9 +161,11 @@ options:
161161

162162
### Report
163163
```bash
164-
usage: raven report [-h] [--redis-host REDIS_HOST] [--redis-port REDIS_PORT] [--clean-redis] [--neo4j-uri NEO4J_URI] [--neo4j-user NEO4J_USER] [--neo4j-pass NEO4J_PASS]
165-
[--clean-neo4j] [--tag TAG] [--severity SEVERITY] [--queries-path QUERIES_PATH]
166-
{slack} ...
164+
usage: raven report [-h] [--redis-host REDIS_HOST] [--redis-port REDIS_PORT] [--clean-redis] [--neo4j-uri NEO4J_URI]
165+
[--neo4j-user NEO4J_USER] [--neo4j-pass NEO4J_PASS] [--clean-neo4j]
166+
[--tag {injection,unauthenticated,fixed,priv-esc,supply-chain}]
167+
[--severity {info,low,medium,high,critical}] [--queries-path QUERIES_PATH] [--format {raw,json}]
168+
{slack} ...
167169

168170
positional arguments:
169171
{slack}
@@ -183,11 +185,14 @@ options:
183185
--neo4j-pass NEO4J_PASS
184186
Neo4j password, default: 123456789
185187
--clean-neo4j, -cn Whether to clean cache, and index from scratch, default: False
186-
--tag TAG, -t TAG Filter queries with specific tag
187-
--severity SEVERITY, -s SEVERITY
188+
--tag {injection,unauthenticated,fixed,priv-esc,supply-chain}, -t {injection,unauthenticated,fixed,priv-esc,supply-chain}
189+
Filter queries with specific tag
190+
--severity {info,low,medium,high,critical}, -s {info,low,medium,high,critical}
188191
Filter queries by severity level (default: info)
189192
--queries-path QUERIES_PATH, -dp QUERIES_PATH
190193
Queries folder (default: library)
194+
--format {raw,json}, -f {raw,json}
195+
Report format (default: raw)
191196
```
192197

193198
## Examples

‎library/query_body_context_injection.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
id: RQ-1
2+
3+
info:
4+
name: Body Context Injection
5+
severity: critical
6+
description: Body Injection is caused by using body variables in inline scripts
7+
full-description: |
8+
Issues, comments, discussions and PR bodies can contain any text and special characters.
9+
By using a body variable in an inline script, an attacker can inject arbitrary code
10+
into the build process.
11+
references:
12+
- https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
13+
- https://cycode.com/blog/github-actions-vulnerabilities/
14+
- https://github.com/CycodeLabs/raven/blob/main/docs/issue_injections/README.md
15+
tags:
16+
- injection
17+
- unauthenticated
18+
19+
query: |
20+
MATCH (w:Workflow)-[*]->(d:StepCodeDependency)
21+
WHERE (
22+
"issues" in w.trigger OR
23+
"issue_comment" in w.trigger OR
24+
"pull_request_target" in w.trigger
25+
) AND
26+
(
27+
d.param IN [
28+
"github.event.comment.body",
29+
"github.event.issue.body",
30+
"github.event.discussion.body",
31+
"github.event.pull_request.body"
32+
]
33+
)
34+
RETURN DISTINCT w.url AS url;

‎library/query_checkout_on_issue.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,10 @@
1-
id: checkout-on-issue
1+
id: RQ-2
22

33
info:
4-
name: Checkout on new Issue
4+
name: Checkout On New Issue
55
severity: critical
66
description: workflows triggered by issue events where a job involves checking out code from a repository ("actions/checkout") on issue event.
7+
full-description:
78
references:
89
- https://github.com/CycodeLabs/raven/tree/main/docs/issue_injections
910
- https://cycode.com/blog/github-actions-vulnerabilities/
@@ -32,4 +33,4 @@ query: |
3233
)
3334
)
3435
}
35-
RETURN DISTINCT w.path
36+
RETURN DISTINCT w.url AS url;

‎library/query_codesee_injection.yml‎

Lines changed: 14 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,37 +1,26 @@
1-
id: codesee-injection
1+
id: RQ-3
22

33
info:
44
name: CodeSee Injection
55
severity: info
6-
description: CodeSee NPM package before v0.376.0 allowed code injection vulnerability.
6+
description: CodeSee NPM package before v0.376.0 allowed code injection vulnerability.
7+
full-description:
78
references:
89
- https://github.com/CycodeLabs/raven/tree/main/docs/codesee_injections
9-
- https://cycode.com/blog/github-actions-vulnerabilities/
10+
- https://cycode.com/blog/cycode-secures-thousands-of-open-source-projects/
1011
tags:
1112
- unauthenticated
1213
- injection
1314
- fixed
1415

1516
query: |
16-
MATCH (w:Workflow)-[*]->(j:Job)
17-
WHERE
18-
(
19-
"issue_comment" in w.trigger OR
20-
"issues" in w.trigger
21-
) AND
22-
EXISTS {
23-
(j)-->(s:Step)-->(ca:CompositeAction)
24-
WHERE (
25-
ca.path = "actions/checkout" AND
26-
ANY(param IN s.with WHERE
27-
(
28-
param STARTS WITH "ref" and
29-
(
30-
param contains "head.sha" OR
31-
param contains "head.ref"
32-
)
33-
)
34-
)
35-
)
36-
}
37-
RETURN DISTINCT w.path
17+
MATCH (w:Workflow)
18+
WHERE
19+
w.permissions is null AND
20+
EXISTS {
21+
(w)-[*]->(ca:CompositeAction)
22+
WHERE (
23+
ca.path = "Codesee-io/codesee-map-action"
24+
)
25+
}
26+
RETURN DISTINCT w.url AS url;

‎library/query_email_context_injection.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
id: RQ-4
2+
3+
info:
4+
name: Email Context Injection
5+
severity: high
6+
description: Email Injection is caused by using email variables in inline scripts
7+
full-description: |
8+
GitHub allows creating accounts with email addresses that contain special characters,
9+
such as `+`, `@` and `"`. By using an email variable in an inline script, an attacker
10+
can inject arbitrary code into the build process.
11+
references:
12+
- https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
13+
tags:
14+
- injection
15+
- unauthenticated
16+
17+
query: |
18+
MATCH (w:Workflow)-[*]->(d:StepCodeDependency)
19+
WHERE (
20+
"issues" in w.trigger OR
21+
"issue_comment" in w.trigger OR
22+
"pull_request_target" in w.trigger
23+
) AND
24+
(
25+
d.param IN [
26+
"github.event.comment.author.email",
27+
"github.event.head_commit.committer.email"
28+
]
29+
)
30+
RETURN DISTINCT w.url AS url;

‎library/query_injectable_composite_action.yml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
id: RQ-13
2+
3+
info:
4+
name: Injectable Composite Action
5+
severity: high
6+
description: Composite Actions that use input parameters in inline scripts can be used to inject arbitrary code.
7+
full-description: |
8+
Composite Actions can get input parameters from the workflow file.
9+
If these input parameters are used in inline scripts, an attacker can
10+
inject arbitrary code into the build process.
11+
references:
12+
- https://docs.github.com/en/actions/creating-actions/creating-a-composite-action
13+
- https://cycode.com/blog/cycode-secures-thousands-of-open-source-projects/
14+
tags:
15+
- injection
16+
- unauthenticated
17+
18+
query: |
19+
MATCH (w:Workflow)-[*]->(s:Step)-->(ca:CompositeAction)-->(cas:CompositeActionStep)-->(d:StepCodeDependency)
20+
WHERE (
21+
(
22+
"issues" in w.trigger OR
23+
"issue_comment" in w.trigger OR
24+
"pull_request_target" in w.trigger
25+
) AND (
26+
ca.using = "composite" AND
27+
NOT cas.run is null AND
28+
d.param STARTS WITH "inputs."
29+
) AND (
30+
ANY(input IN s.with WHERE
31+
ANY (
32+
pattern IN [
33+
"github.event.issue.title",
34+
"github.event.issue.body",
35+
"github.event.pull_request.title",
36+
"github.event.pull_request.body",
37+
"github.event.comment.body",
38+
"github.event.review.body",
39+
"github.event.review_comment.body",
40+
"github.event.pages.*.page_name",
41+
"github.event.commits.*.message",
42+
"github.event.head_commit.message",
43+
"github.event.head_commit.author.email",
44+
"github.event.head_commit.author.name",
45+
"github.event.commits.*.author.email",
46+
"github.event.commits.*.author.name",
47+
"github.event.pull_request.head.ref",
48+
"github.event.pull_request.head.label",
49+
"github.event.pull_request.head.repo.default_branch",
50+
"github.head_ref"
51+
] WHERE input CONTAINS pattern
52+
)
53+
)
54+
)
55+
)
56+
RETURN DISTINCT s.url AS url;

‎library/query_issue_injection.yml‎

Lines changed: 0 additions & 24 deletions
This file was deleted.

‎library/query_label_context_injection.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
id: RQ-5
2+
3+
info:
4+
name: Label Context Injection
5+
severity: high
6+
description: Label Injection is caused by using label variables in inline scripts
7+
full-description: |
8+
Creating a new pull request could be submitted with a label that contains special characters.
9+
By using a label variable in an inline script, an attacker can inject arbitrary code into the build process.
10+
references:
11+
- https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
12+
tags:
13+
- injection
14+
15+
query: |
16+
MATCH (w:Workflow)-[*]->(d:StepCodeDependency)
17+
WHERE (
18+
"issues" in w.trigger OR
19+
"issue_comment" in w.trigger OR
20+
"pull_request_target" in w.trigger
21+
) AND
22+
(
23+
d.param IN [
24+
"github.event.pull_request.head.label"
25+
]
26+
)
27+
RETURN DISTINCT w.url AS url;

‎library/query_message_context_injection.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
id: RQ-6
2+
3+
info:
4+
name: Message Context Injection
5+
severity: high
6+
description: Commit Injection is caused by using commit message variables in inline scripts
7+
full-description: |
8+
Commit messages can contain any text and special characters.
9+
By using a commit message variable in an inline script, an attacker can inject arbitrary code
10+
into the build process.
11+
references:
12+
- https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
13+
tags:
14+
- injection
15+
- unauthenticated
16+
17+
query: |
18+
MATCH (w:Workflow)-[*]->(d:StepCodeDependency)
19+
WHERE (
20+
"issues" in w.trigger OR
21+
"issue_comment" in w.trigger OR
22+
"pull_request_target" in w.trigger
23+
) AND
24+
(
25+
d.param IN [
26+
"github.event.head_commit.message",
27+
"github.event.merge_group.head_commit.message"
28+
]
29+
)
30+
RETURN DISTINCT w.url AS url;

‎library/query_priv_esc_workflow_run.yml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
id: RQ-7
2+
3+
info:
4+
name: Privilege Escalation Workflow Run
5+
severity: critical
6+
description: Injection of malicious code that triggers a workflow run pipeline can lead to privilege escalation.
7+
full-description: |
8+
Pull request pipeline runs without access to secrets.
9+
However, if a workflow run is triggered by a pull request, the workflow run will have access to secrets.
10+
Meaning, if an attacker can inject malicious code into the PR workflow and pass the malicious code to the workflow run,
11+
the attacker can gain access to secrets even though the original workflow did not have access to secrets.
12+
references:
13+
- https://www.legitsecurity.com/blog/github-privilege-escalation-vulnerability
14+
tags:
15+
- unauthenticated
16+
- injection
17+
- priv-esc
18+
19+
query: |
20+
MATCH (w:Workflow)-[*]->(w2:Workflow)
21+
WHERE (
22+
(
23+
"pull_request" in w.trigger OR
24+
"pull_request_target" in w.trigger
25+
) AND
26+
(
27+
"workflow_run" in w2.trigger
28+
)
29+
) AND EXISTS {
30+
(w)-[*]->(d:StepCodeDependency)
31+
WHERE (
32+
d.param IN [
33+
"github.event.pull_request.title",
34+
"github.event.pull_request.body",
35+
"github.event.pull_request.head.ref",
36+
"github.event.pull_request.head.label",
37+
"github.event.pull_request.head.repo.default_branch"
38+
]
39+
)
40+
}
41+
RETURN DISTINCT w.url AS url;

0 commit comments

Comments
 (0)