Ziad_Abdelgwad/ghaymah-CLI-v2_test
1
0
نسخ 0
الشفرة المشكلات طلبات السحب Actions Packages المشاريع الإصدارات الويكي النشاط

feat: add security audit automation scripts and detailed vulnerability documentation

تصفح المصدر
هذا الالتزام موجود في:
Ziad Mahmoud Ahmed Abdelgwad
2026-08-20 20:13:14 +03:00
الأصل a7a479141b
التزام e635566bc5
12 ملفات معدلة مع 1617 إضافات و363 حذوفات
تنزيل ملف التصحيح تنزيل ملف الاختلاف توسيع جميع الملفات طي جميع الملفات

508
README.md
عرض الملف

@@ -21,12 +21,12 @@
<br/>
```
```text
╔═══════════════════════════════════════════════════════════════════╗
║ ║
║ ██████╗ ██╗ ██╗ █████╗ ██╗ ██╗███╗ ███╗ █████╗ ██╗ ██╗ ║
║ ██╔════╝ ██║ ██║██╔══██╗╚██╗ ██╔╝████╗ ████║██╔══██╗██║ ██║ ║
║ ██║ ███╗███████║███████║ ╚████╔╝ ██╔████╔██║███████║███████║ ║
║ ██║ ███╗███████║███████║ ╚████╔╝ ██╔████╔██║███████║███████║ ║
║ ██║ ██║██╔══██║██╔══██║ ╚██╔╝ ██║╚██╔╝██║██╔══██║██╔══██║ ║
║ ╚██████╔╝██║ ██║██║ ██║ ██║ ██║ ╚═╝ ██║██║ ██║██║ ██║ ║
║ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚═╝ ╚═╝ ║
@@ -41,7 +41,7 @@
<a href="https://app.gitpasha.com/Ziad_Abdelgwad/ghaymah-CLI-v2_test"><img src="https://img.shields.io/badge/Repository-GitPasha-181717?style=flat-square&logo=git&logoColor=white" /></a>
<a href="#"><img src="https://img.shields.io/badge/Report_Date-August_2026-0D1117?style=flat-square&logo=calendar&logoColor=white" /></a>
<a href="#"><img src="https://img.shields.io/badge/Findings-4_Vulnerabilities-FF4444?style=flat-square&logo=bugcrowd&logoColor=white" /></a>
<a href="#"><img src="https://img.shields.io/badge/Findings-12_Vulnerabilities-FF4444?style=flat-square&logo=bugcrowd&logoColor=white" /></a>
<a href="#"><img src="https://img.shields.io/badge/Status-Report_Delivered-00C853?style=flat-square&logo=checkmarx&logoColor=white" /></a>
</div>
@@ -75,32 +75,84 @@
## 📋 Executive Summary
> **Scope:** Full-stack security assessment of the **Ghaymah CLI v2** command-line tool and its backing **web platform**, covering Docker container infrastructure, authentication mechanisms, session management, and CI/CD pipeline resilience.
> **Scope:** Full-stack security assessment of the **Ghaymah CLI v2** command-line tool and its backing **web platform**, covering Docker container infrastructure, authentication mechanisms, session management, and binary reverse engineering.
This audit identified **4 distinct vulnerability classes** across the CLI tool's deployment pipeline and the platform's authentication layer. Findings range from **Critical** credential exposure through Dockerfile/`.env` leakage to **High-severity** session management flaws and **Medium** denial-of-service vectors via configuration poisoning.
This repository contains the results of a comprehensive two-phase security audit. The audit utilized dynamic testing, binary reverse-engineering, network interception, and adversarial fuzzing.
The assessment leveraged real PoC applications deployed through the Ghaymah CLI to validate each finding under production-equivalent conditions on a Linux amd64 target.
- **Phase 1 (Platform & Infrastructure):** Focused on the deployment pipeline, static site hosting mechanisms, and the broader Ghaymah web platform authentication layer. It uncovered 4 severe logic and infrastructure flaws.
- **Phase 2 (Binary Reverse Engineering & Network):** Focused entirely on the compiled Go binary (`gy-linux-amd64`). Through decompilation, string extraction, and MITM proxying, we tested 62 distinct adversarial vectors. This phase yielded 8 critical findings ranging from credential proxy interception to insecure auto-updates.
| Metric | Value |
|:---|:---|
| **Total Findings** | `4` |
| **Critical** | `2` |
| **High** | `1` |
| **Medium / High** | `1` |
| **PoC Apps Created** | `8` |
| **Audit Duration** | `1 Day (Intensive)` |
| **Methodology** | `MITRE ATT&CK`, `OWASP Top 10` |
| **Total Findings** | `12` |
| **Critical** | `4` |
| **High** | `4` |
| **Medium** | `4` |
| **Adversarial Tests** | `62` |
| **Methodology** | `MITRE ATT&CK`, `OWASP Top 10`, `Reverse Engineering` |
---
<br/>
## ⚠️ Findings Dashboard
## 🔀 Attack Surface Architecture
```mermaid
flowchart LR
subgraph SCOPE ["Audit Scope"]
direction TB
CLI["Ghaymah CLI v2 (gy-linux-amd64)"]
WEB["Web Platform (Dashboard & API)"]
end
subgraph VECTORS ["Attack Vectors"]
direction TB
V1["T1552: Credential Leakage"]
V2["T1539: Session Bypass"]
V3["CWE-400: Config Poisoning"]
V4["OWASP A07: Auth Failure"]
V5["T1557: Proxy MITM"]
V6["T1027: Symlink Traversal"]
V7["T1195: Insecure Updates"]
end
subgraph IMPACT ["Impact"]
direction TB
I1["Secret Exposure"]
I2["Account Takeover"]
I3["Pipeline DoS"]
I4["RCE & Data Theft"]
end
CLI --> V1
CLI --> V3
CLI --> V5
CLI --> V6
CLI --> V7
WEB --> V2
WEB --> V4
V1 --> I1
V2 --> I2
V3 --> I3
V4 --> I2
V5 --> I1
V6 --> I4
V7 --> I4
style SCOPE fill:#0D1117,stroke:#4A90D9,stroke-width:2px,color:#FFFFFF
style VECTORS fill:#0D1117,stroke:#FF6600,stroke-width:2px,color:#FFFFFF
style IMPACT fill:#0D1117,stroke:#FF0000,stroke-width:2px,color:#FFFFFF
```
---
<br/>
## ⚠️ Detailed Findings Dashboard
<div align="center">
<!-- ─── Severity Legend ────────────────────────────────────────────────── -->
![Critical](https://img.shields.io/badge/●_CRITICAL-FF0000?style=flat-square&labelColor=FF0000)
![High](https://img.shields.io/badge/●_HIGH-FF6600?style=flat-square&labelColor=FF6600)
![Medium](https://img.shields.io/badge/●_MEDIUM-FFAA00?style=flat-square&labelColor=FFAA00)
@@ -109,44 +161,88 @@ The assessment leveraged real PoC applications deployed through the Ghaymah CLI
<br/>
### Phase 1: Platform & Infrastructure
<table>
<thead>
<tr>
<th width="40" align="center">#</th>
<th width="120" align="center">Severity</th>
<th width="160">MITRE ID</th>
<th>Finding Title</th>
<th width="110" align="center">Target</th>
<th width="120">MITRE/CWE</th>
<th>Finding Description</th>
</tr>
</thead>
<tbody>
<tr>
<td align="center"><b>1</b></td>
<td align="center"><img src="https://img.shields.io/badge/-CRITICAL-FF0000?style=flat-square" /></td>
<td><code>T1552</code></td>
<td><b>Dockerfile & <code>.env</code> Credential Leakage</b> — Sensitive environment variables and secrets are embedded in Dockerfiles and <code>.env</code> files, persisted in image layers and accessible post-deployment.</td>
<td align="center"><code>CLI</code></td>
<td><b>Dockerfile & <code>.env</code> Credential Leakage:</b> The auto-generated Dockerfile copies the entire directory root, exposing sensitive <code>.env</code> files and the <code>.git</code> folder directly to the public web via the deployed container.</td>
</tr>
<tr>
<td align="center"><b>2</b></td>
<td align="center"><img src="https://img.shields.io/badge/-CRITICAL-FF0000?style=flat-square" /></td>
<td><code>OWASP A07</code></td>
<td><b>Missing OTP & Unverified Password Change</b> — The web platform allows password changes without OTP/2FA verification, enabling account takeover via session hijacking or CSRF.</td>
<td align="center"><code>Web</code></td>
<td><b>Missing OTP & Unverified Password Change:</b> Password resets lack OTP validation, and users can change passwords inside the dashboard without providing their old password, allowing instant account takeover.</td>
</tr>
<tr>
<td align="center"><b>3</b></td>
<td align="center"><img src="https://img.shields.io/badge/-HIGH-FF6600?style=flat-square" /></td>
<td><code>T1539</code></td>
<td><b>Session Token Revocation Bypass</b> — After password change or logout, session tokens remain valid and can be reused to maintain unauthorized access.</td>
<td align="center"><code>Web</code></td>
<td><b>Session Token Revocation Bypass:</b> Logging out from the CLI merely deletes local config files; it does not revoke the token server-side, making it endlessly reusable if intercepted.</td>
</tr>
<tr>
<td align="center"><b>4</b></td>
<td align="center"><img src="https://img.shields.io/badge/-MEDIUM/HIGH-FFAA00?style=flat-square" /></td>
<td align="center"><img src="https://img.shields.io/badge/-MEDIUM-FFAA00?style=flat-square" /></td>
<td><code>CWE-400</code></td>
<td><b>Configuration Poisoning — DoS Pipeline Hang</b> — Injecting malformed environment variables causes the backend worker to crash, hanging the entire build/deploy pipeline indefinitely.</td>
<td align="center"><code>CLI</code></td>
<td><b>Configuration Poisoning — Pipeline DoS:</b> Setting environment variables via the CLI with malicious shell characters (e.g., <code>$(id)</code>) permanently hangs the backend CI/CD runner.</td>
</tr>
</tbody>
</table>
### Phase 2: Binary Reverse Engineering & Network (gy-linux-amd64)
<table>
<thead>
<tr>
<th width="120" align="center">Severity</th>
<th width="120">MITRE/CWE</th>
<th>Finding Description</th>
</tr>
</thead>
<tbody>
<tr>
<td align="center"><img src="https://img.shields.io/badge/-CRITICAL-FF0000?style=flat-square" /></td>
<td><code>T1557</code></td>
<td><b>HTTP/HTTPS Proxy Credential Interception:</b> The Go binary respects system-level <code>HTTP_PROXY</code> variables without TLS pinning. An attacker controlling the network proxy can intercept plaintext passwords during <code>gy login</code>.</td>
</tr>
<tr>
<td align="center"><img src="https://img.shields.io/badge/-CRITICAL-FF0000?style=flat-square" /></td>
<td><code>T1027</code></td>
<td><b>Symlink Following in Deploy Path:</b> The CLI's buildpack scanner reads through symlinks. Creating a symlink to <code>/etc/passwd</code> forces the CLI to parse and upload sensitive system files to the Ghaymah cloud.</td>
</tr>
<tr>
<td align="center"><img src="https://img.shields.io/badge/-HIGH-FF6600?style=flat-square" /></td>
<td><code>CWE-522</code></td>
<td><b>Plaintext Token Storage:</b> Auth tokens are saved in plaintext JSON inside <code>~/.config/ghaymah</code>. Although guarded by <code>0600</code> OS permissions, malware running as the user can easily extract them.</td>
</tr>
<tr>
<td align="center"><img src="https://img.shields.io/badge/-HIGH-FF6600?style=flat-square" /></td>
<td><code>CWE-532</code></td>
<td><b>Debug Mode Leaks User ID:</b> Appending <code>--debug</code> outputs verbose internal state, including the exact User UUID and all internal API endpoints, exposing excessive telemetry.</td>
</tr>
<tr>
<td align="center"><img src="https://img.shields.io/badge/-HIGH-FF6600?style=flat-square" /></td>
<td><code>T1195.002</code></td>
<td><b>Insecure Auto-Updates:</b> The binary downloads and executes <code>install.sh</code> over the network without verifying cryptographic signatures, exposing users to RCE via Man-in-the-Middle attacks.</td>
</tr>
<tr>
<td align="center"><img src="https://img.shields.io/badge/-MEDIUM-FFAA00?style=flat-square" /></td>
<td><code>CWE-20</code></td>
<td><b>No Client-Side Port Validation:</b> The CLI blindly accepts and transmits negative ports or numbers exceeding 65535, causing potential backend errors.</td>
</tr>
<tr>
<td align="center"><img src="https://img.shields.io/badge/-MEDIUM-FFAA00?style=flat-square" /></td>
<td><code>CWE-20</code></td>
<td><b>No Client-Side Name Sanitization:</b> The CLI accepts Cross-Site Scripting (XSS) payloads and directory traversal characters (e.g. <code>../../</code>) in project names.</td>
</tr>
<tr>
<td align="center"><img src="https://img.shields.io/badge/-MEDIUM-FFAA00?style=flat-square" /></td>
<td><code>CWE-526</code></td>
<td><b>GenAI API Key Exposure:</b> API keys for the AI integration are passed via standard environment variables and transmitted alongside local source code payloads.</td>
</tr>
</tbody>
</table>
@@ -155,284 +251,32 @@ The assessment leveraged real PoC applications deployed through the Ghaymah CLI
<br/>
## 🔬 Vulnerability Deep-Dive
<!-- ═══════════════════════════════════════════════════════════════════════ -->
<!-- FINDING 1 -->
<!-- ═══════════════════════════════════════════════════════════════════════ -->
<details>
<summary><b>🔴 FINDING 1 — T1552: Dockerfile & <code>.env</code> Credential Leakage</b></summary>
<br/>
### Overview
The Ghaymah CLI packages application source code—including `.env` files and Dockerfiles containing hardcoded secrets—directly into the container image. These artifacts persist across image layers and are trivially extractable by any entity with access to the image or registry.
### Impact
- **Credential Theft:** API keys, database passwords, and service tokens can be extracted from any pulled image.
- **Lateral Movement:** Leaked credentials may grant access to adjacent infrastructure components.
- **Supply Chain Risk:** Downstream consumers of the image inherit the exposed secrets.
### Evidence
| Artifact | Description |
|:---|:---|
| `Assets/Screenshots/env.png` | Screenshot showing `.env` file with credentials embedded in image |
| `Assets/Screenshots/docker.png` | Screenshot showing Dockerfile with exposed build arguments |
| `PoC_Apps/test-app/` | PoC application demonstrating the leakage |
### Remediation
```
1. Use Docker BuildKit secrets: --mount=type=secret,id=myenv
2. Add .env to .dockerignore in the CLI scaffolding
3. Inject secrets at runtime via orchestrator (K8s Secrets / Vault)
4. Implement image scanning in CI (Trivy, Grype)
```
</details>
<!-- ═══════════════════════════════════════════════════════════════════════ -->
<!-- FINDING 2 -->
<!-- ═══════════════════════════════════════════════════════════════════════ -->
<details>
<summary><b>🔴 FINDING 2 — OWASP A07: Missing OTP & Unverified Password Change</b></summary>
<br/>
### Overview
The Ghaymah web platform allows authenticated users to change their password without requiring the current password, an OTP challenge, or any secondary verification. This undermines the entire authentication chain.
### Impact
- **Account Takeover:** An attacker with a stolen session token can silently change the victim's password and lock them out.
- **Privilege Escalation:** Combined with Finding 3, a single leaked token grants permanent account control.
- **Compliance Violation:** Fails OWASP ASVS v4.0 §2.2 and NIST SP 800-63B requirements.
### Attack Flow
```
Attacker steals session token (XSS/Network sniff)
└──▶ Calls password change API (no OTP required)
└──▶ Sets new password
└──▶ Original user locked out permanently
```
### Remediation
```
1. Require current password + OTP for any credential change
2. Implement rate limiting on password change endpoints
3. Send email/SMS notification on password change events
4. Invalidate all existing sessions after password change
```
</details>
<!-- ═══════════════════════════════════════════════════════════════════════ -->
<!-- FINDING 3 -->
<!-- ═══════════════════════════════════════════════════════════════════════ -->
<details>
<summary><b>🟠 FINDING 3 — T1539: Session Token Revocation Bypass</b></summary>
<br/>
### Overview
Session tokens issued by the Ghaymah platform are not invalidated upon logout or password change. A captured token remains valid and usable indefinitely until its natural expiry.
### Impact
- **Persistent Unauthorized Access:** Attackers can maintain access even after the user changes their password or explicitly logs out.
- **Audit Trail Corruption:** Legitimate user and attacker actions become indistinguishable.
### Evidence
| Artifact | Description |
|:---|:---|
| `Assets/Screenshots/Screenshot_2026-08-19_163341.png` | Session validity after logout |
| `Assets/Screenshots/Screenshot_2026-08-19_163501.png` | Token reuse after password change |
### Remediation
```
1. Implement server-side session store (Redis) with explicit revocation
2. Rotate tokens on privilege-level changes (password change, role update)
3. Set short-lived access tokens (15 min) with refresh token rotation
4. Maintain a token deny-list for immediate revocation
```
</details>
<!-- ═══════════════════════════════════════════════════════════════════════ -->
<!-- FINDING 4 -->
<!-- ═══════════════════════════════════════════════════════════════════════ -->
<details>
<summary><b>🟡 FINDING 4 — CWE-400: Configuration Poisoning — DoS Pipeline Hang</b></summary>
<br/>
### Overview
The Ghaymah CLI's deployment pipeline does not validate environment variable values before passing them to the backend build worker. Injecting malformed or adversarial values (e.g., multi-line strings, shell metacharacters, excessively long values) causes the worker process to crash or enter an infinite loop, hanging the entire pipeline.
### Impact
- **Denial of Service:** The user's deployment pipeline becomes permanently stuck.
- **Resource Exhaustion:** Backend workers consume resources without releasing them.
- **No Recovery Path:** Users cannot cancel or restart the hung pipeline from the CLI.
### Architecture / Flow Graph
```mermaid
flowchart TB
subgraph CLIENT ["🖥️ Client Machine"]
A["fa:fa-terminal <b>gy deploy</b><br/>User runs CLI command"]
B["fa:fa-file-code <b>.env / .gy.json</b><br/>Config with malformed vars"]
end
subgraph GHAYMAH_API ["☁️ Ghaymah Backend"]
C["fa:fa-server <b>API Gateway</b><br/>Receives deploy request"]
D["fa:fa-cogs <b>Build Worker</b><br/>Parses env variables"]
E["fa:fa-docker <b>Docker Builder</b><br/>Builds container image"]
end
subgraph FAILURE ["💀 Failure State"]
F["fa:fa-bomb <b>Worker Crash</b><br/>Malformed input causes panic"]
G["fa:fa-hourglass-end <b>Pipeline Hang</b><br/>Indefinite wait state"]
H["fa:fa-ban <b>DoS Achieved</b><br/>No deploy / no cancel"]
end
A -->|"1. Reads config"| B
B -->|"2. Sends payload<br/>(unvalidated)"| C
C -->|"3. Dispatches job"| D
D -->|"4. ✅ Normal flow"| E
D -->|"4. ❌ Malformed input"| F
F -->|"5. No error propagation"| G
G -->|"6. User stuck"| H
style CLIENT fill:#1a1a2e,stroke:#00C853,stroke-width:2px,color:#FFFFFF
style GHAYMAH_API fill:#1a1a2e,stroke:#4A90D9,stroke-width:2px,color:#FFFFFF
style FAILURE fill:#1a1a2e,stroke:#FF4444,stroke-width:2px,color:#FFFFFF
style A fill:#0D1117,stroke:#00C853,color:#FFFFFF
style B fill:#0D1117,stroke:#FFAA00,color:#FFFFFF
style C fill:#0D1117,stroke:#4A90D9,color:#FFFFFF
style D fill:#0D1117,stroke:#4A90D9,color:#FFFFFF
style E fill:#0D1117,stroke:#00C853,color:#FFFFFF
style F fill:#0D1117,stroke:#FF4444,color:#FFFFFF
style G fill:#0D1117,stroke:#FF4444,color:#FFFFFF
style H fill:#0D1117,stroke:#FF0000,color:#FFFFFF
```
### Proof of Concept
The following PoC apps demonstrate this attack:
| PoC App | Purpose |
|:---|:---|
| `PoC_Apps/broken-docker-test/` | Intentionally broken Dockerfile to test error handling |
| `PoC_Apps/invalid-docker-test/` | Invalid Docker configuration causing pipeline hang |
| `PoC_Apps/test-app-3/` | Malformed env variable injection test |
| `PoC_Apps/test-app-5/` | Extended poisoning test with edge-case values |
### Evidence
| Artifact | Description |
|:---|:---|
| `Assets/Screenshots/logs.png` | Backend logs showing worker crash and hang state |
### Remediation
```
1. Validate all env variable keys/values against a strict schema
2. Implement build timeouts (max 10 min) with automatic cleanup
3. Add a "cancel deployment" feature to the CLI and API
4. Sanitize inputs: reject multi-line values, shell metacharacters, >4KB values
5. Return structured errors to the CLI on worker failure
```
</details>
---
<br/>
## 🔀 Attack Surface Architecture
> Complete Mermaid.js diagram mapping the audit scope, attack vectors, and affected components.
```mermaid
flowchart LR
subgraph SCOPE ["🎯 Audit Scope"]
direction TB
CLI["fa:fa-terminal <b>Ghaymah CLI v2</b><br/>gy-linux-amd64"]
WEB["fa:fa-globe <b>Web Platform</b><br/>Dashboard & API"]
end
subgraph VECTORS ["⚔️ Attack Vectors"]
direction TB
V1["T1552<br/>Credential Leakage"]
V2["T1539<br/>Session Bypass"]
V3["CWE-400<br/>Config Poisoning"]
V4["OWASP A07<br/>Auth Failure"]
end
subgraph IMPACT ["💥 Impact"]
direction TB
I1["🔑 Secret Exposure"]
I2["👤 Account Takeover"]
I3["⛔ Pipeline DoS"]
end
CLI --> V1
CLI --> V3
WEB --> V2
WEB --> V4
V1 --> I1
V2 --> I2
V3 --> I3
V4 --> I2
style SCOPE fill:#0D1117,stroke:#4A90D9,stroke-width:2px,color:#FFFFFF
style VECTORS fill:#0D1117,stroke:#FF6600,stroke-width:2px,color:#FFFFFF
style IMPACT fill:#0D1117,stroke:#FF0000,stroke-width:2px,color:#FFFFFF
style CLI fill:#1a1a2e,stroke:#00C853,color:#FFFFFF
style WEB fill:#1a1a2e,stroke:#4A90D9,color:#FFFFFF
style V1 fill:#1a1a2e,stroke:#FF0000,color:#FFFFFF
style V2 fill:#1a1a2e,stroke:#FF6600,color:#FFFFFF
style V3 fill:#1a1a2e,stroke:#FFAA00,color:#FFFFFF
style V4 fill:#1a1a2e,stroke:#FF0000,color:#FFFFFF
style I1 fill:#1a1a2e,stroke:#FF4444,color:#FFFFFF
style I2 fill:#1a1a2e,stroke:#FF4444,color:#FFFFFF
style I3 fill:#1a1a2e,stroke:#FF4444,color:#FFFFFF
```
---
<br/>
## 📁 Repository Structure
```
```text
ghaymah-v2-test/
│
├── 📂 Assets/
│ └── 📂 Screenshots/ # Visual evidence & proof captures
│ ├── docker.png # Dockerfile credential exposure
│ ├── env.png # .env file leakage in image layers
│ ├── logs.png # Backend worker crash logs
│ ├── Screenshot_*.png # Session management bypass evidence
│ ├── HTTP_Proxy_Credential_Interception_1.png
│ ├── HTTP_Proxy_Credential_Interception_2.png
│ └── ...
│
├── 📂 PoC_Apps/ # Proof-of-Concept applications
│ ├── 📂 test-app/ # Initial recon & .env leak PoC
│ ├── 📂 test-app-2/ # RCE boundary testing (auto_rce_test.sh)
│ ├── 📂 test-app-2/ # RCE boundary testing
│ ├── 📂 test-app-3/ # Malformed env variable injection
│ ├── 📂 test-app-5/ # Extended config poisoning tests
│ ├── 📂 test-app-clean/ # Baseline clean deployment
│ ├── 📂 test-app-final/ # Final validated Dockerfile
│ ├── 📂 broken-docker-test/ # Intentionally broken Docker config
│ └── 📂 invalid-docker-test/ # Invalid config → pipeline hang PoC
│ └── 📂 test-app-5/ # Extended config poisoning tests
│
├── 📂 Scripts/ # Scripts used for testing & fuzzing
│ └── adversarial_test.sh # Automated 62-test fuzzing script
│
├── 📂 Reports/
│ └── 📄 Ghaymah_CLI_v2_Audit_Report.pdf # Full audit report (PDF)
│ ├── 📄 Ghaymah_CLI_v2_Audit_Report.pdf # Phase 1: Full audit report
│ ├── 📄 Ghaymah_CLI_v2_Binary_Audit_Report.md # Phase 2: Binary Audit (Markdown)
│ └── 📄 vulnerability_verification_guide.md # Step-by-step reproduction guide
│
├── 📄 .gitignore # Ignores binary, .env, OS artifacts
├── 📄 organize.sh # Workspace organization script
└── 📄 README.md # ← You are here
```
@@ -440,77 +284,15 @@ ghaymah-v2-test/
<br/>
## 🧪 PoC Navigation Guide
## 📎 Full Reports
<details>
<summary><b>📂 How to reproduce the findings</b></summary>
<br/>
Each folder inside `PoC_Apps/` is a standalone application that was deployed through the Ghaymah CLI to validate a specific vulnerability. They are ordered chronologically by testing phase:
### Phase 1 — Reconnaissance & Credential Leakage
| Folder | Purpose | Related Finding |
|:---|:---|:---|
| `test-app/` | Initial deployment with `.env` file containing test credentials. Demonstrates that secrets persist in image layers. | Finding 1 (T1552) |
| `test-app-2/` | Includes `auto_rce_test.sh` — automated script probing for command injection boundaries in the build pipeline. | Exploratory |
### Phase 2 — Configuration Poisoning & DoS
| Folder | Purpose | Related Finding |
|:---|:---|:---|
| `test-app-3/` | Dockerfile with malformed `ENV` directives to test input validation on the backend worker. | Finding 4 (CWE-400) |
| `test-app-5/` | Extended poisoning tests: multi-line values, special characters, oversized payloads. | Finding 4 (CWE-400) |
| `broken-docker-test/` | Intentionally invalid Dockerfile to test error handling and pipeline recovery. | Finding 4 (CWE-400) |
| `invalid-docker-test/` | Invalid Docker configuration that triggers a permanent pipeline hang. | Finding 4 (CWE-400) |
### Phase 3 — Validation & Baseline
| Folder | Purpose | Related Finding |
|:---|:---|:---|
| `test-app-clean/` | Clean deployment with no malicious payloads — establishes a working baseline. | Baseline |
| `test-app-final/` | Final validated Dockerfile confirming the minimal reproducible deployment. | Baseline |
> **Note:** Findings 2 (OWASP A07) and 3 (T1539) target the **web platform** and were validated via browser-based testing and API calls, not via PoC apps.
</details>
---
<br/>
## 📊 Methodology
<details>
<summary><b>🔍 Testing Methodology & Frameworks</b></summary>
<br/>
| Framework | Application |
|:---|:---|
| **MITRE ATT&CK** | Technique mapping for CLI-side findings (T1552, T1539) |
| **OWASP Top 10 (2021)** | Web platform assessment (A07: Identification & Authentication Failures) |
| **OWASP ASVS v4.0** | Authentication & session management verification |
| **CWE/CVSS** | Vulnerability classification & severity scoring |
| **Manual Testing** | Custom PoC development, API fuzzing, Docker image inspection |
### Tools Used
- `gy-linux-amd64` — Ghaymah CLI v2 binary (target under test)
- `docker` — Container runtime for image inspection & layer analysis
- Browser DevTools — Session token inspection & API testing
- Custom shell scripts — Automated RCE boundary testing
</details>
---
<br/>
## 📎 Full Report
The comprehensive audit report with detailed technical analysis, risk ratings, and remediation roadmap is available as a PDF:
The comprehensive audit reports with detailed technical analysis, risk ratings, and remediation roadmaps are available in the `Reports/` directory:
<div align="center">
📄 **[`Reports/Ghaymah_CLI_v2_Audit_Report.pdf`](./Reports/Ghaymah_CLI_v2_Audit_Report.pdf)**
📄 **[Phase 1 Report (PDF)](./Reports/Ghaymah_CLI_v2_Audit_Report.pdf)** | 📄 **[Phase 2 Report (Markdown)](./Reports/Ghaymah_CLI_v2_Binary_Audit_Report.md)**
</div>