4 ms·
Also this pattern makes path traversal vulnerabilities (a thing not uncommon in web frameworks) have the potential to allow for privilege escalation on Linux vi
by photon12 6y ago
Also this pattern makes path traversal vulnerabilities (a thing not uncommon in web frameworks) have the potential to allow for privilege escalation on Linux via the /proc/self/environ file.
I've been on a pentest where a recently disclosed path traversal bug in Rails was not patched in the environment I was testing and I thought I would get at least some credentials from at least one service, but every host used a dedicated API for secret retrieval and there was nothing sensitive exposed via any system.
Maybe your threat model doesn't care, just adding a data point.
- joshspankit 6y agoAny chance they documented that setup publicly? Would be interested to dive in to how all that works and gain any new insights
- photon12 6y agoIt's a large company that built their own bespoke internal credentials service running over a TCP port to the application with another proprietary protocol to push key material to hosts. Can't say much more due to NDAs. Edit: this service handles credentials and rotation for hundreds of thousands to millions of hosts.
- joshspankit 6y ago! Wild. I guess with custom protocols there’s not much that can be learned from that setup. Presumably wrap the request in security, handshake to verify authority, use the custom protocol to deliver the secret which is also wrapped in security. Too bad they keep it close to the vest, but I certainly don’t begrudge them for it.
- photon12 6y agoI mean the same company built a service with better architecture that they sell as part of their managed computing environment options. Some people complain about not wanting to use it due to "lock-in."