331 أسطر
15 KiB
Markdown
331 أسطر
15 KiB
Markdown
<!-- ═══════════════════════════════════════════════════════════════════════════
|
|
Ghaymah CLI v2 — Security & QA Audit Repository
|
|
Author: Ziad Mahmoud Ahmed Abdelgwad — Cybersecurity Specialist
|
|
═══════════════════════════════════════════════════════════════════════════ -->
|
|
|
|
<div align="center">
|
|
|
|
<!-- ─── Animated SVG Badges ──────────────────────────────────────────────── -->
|
|
|
|
[](.)
|
|
[](https://attack.mitre.org)
|
|
[](.)
|
|
[](.)
|
|
[](.)
|
|
|
|
<br/>
|
|
|
|
<!-- ─── Header Title Block ───────────────────────────────────────────────── -->
|
|
|
|
<img src="https://readme-typing-svg.demolab.com?font=JetBrains+Mono&weight=800&size=36&duration=3000&pause=1000&color=FF4444¢er=true&vCenter=true&multiline=true&repeat=true&width=900&height=100&lines=%F0%9F%9B%A1%EF%B8%8F+Ghaymah+CLI+v2+%E2%80%94+Security+Audit;Vulnerability+Research+%26+Penetration+Testing" alt="Typing SVG" />
|
|
|
|
<br/>
|
|
|
|
```text
|
|
╔═══════════════════════════════════════════════════════════════════╗
|
|
║ ║
|
|
║ ██████╗ ██╗ ██╗ █████╗ ██╗ ██╗███╗ ███╗ █████╗ ██╗ ██╗ ║
|
|
║ ██╔════╝ ██║ ██║██╔══██╗╚██╗ ██╔╝████╗ ████║██╔══██╗██║ ██║ ║
|
|
║ ██║ ███╗███████║███████║ ╚████╔╝ ██╔████╔██║███████║███████║ ║
|
|
║ ██║ ██║██╔══██║██╔══██║ ╚██╔╝ ██║╚██╔╝██║██╔══██║██╔══██║ ║
|
|
║ ╚██████╔╝██║ ██║██║ ██║ ██║ ██║ ╚═╝ ██║██║ ██║██║ ██║ ║
|
|
║ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚═╝ ╚═╝ ║
|
|
║ ║
|
|
║ S E C U R I T Y A U D I T R E P O R T ║
|
|
║ CLI v2 + Platform ║
|
|
║ ║
|
|
╚═══════════════════════════════════════════════════════════════════╝
|
|
```
|
|
|
|
<br/>
|
|
|
|
<a href="https://app.gitpasha.com/Ziad_Abdelgwad/ghaymah-CLI-v2_test"><img src="https://img.shields.io/badge/Repository-GitPasha-181717?style=flat-square&logo=git&logoColor=white" /></a>
|
|
<a href="#"><img src="https://img.shields.io/badge/Report_Date-August_2026-0D1117?style=flat-square&logo=calendar&logoColor=white" /></a>
|
|
<a href="#"><img src="https://img.shields.io/badge/Findings-12_Vulnerabilities-FF4444?style=flat-square&logo=bugcrowd&logoColor=white" /></a>
|
|
<a href="#"><img src="https://img.shields.io/badge/Status-Report_Delivered-00C853?style=flat-square&logo=checkmarx&logoColor=white" /></a>
|
|
|
|
</div>
|
|
|
|
---
|
|
|
|
<br/>
|
|
|
|
## 👤 Lead Auditor
|
|
|
|
<table>
|
|
<tr>
|
|
<td width="80" align="center">
|
|
<img src="https://img.shields.io/badge/🛡️-Lead_Auditor-FF4444?style=for-the-badge&labelColor=0D1117" />
|
|
</td>
|
|
<td>
|
|
|
|
**Ziad Mahmoud Ahmed Abdelgwad**
|
|
*Cybersecurity Specialist — Penetration Testing & Infrastructure Security*
|
|
|
|
<a href="https://github.com/ZiadMahmoud2003"><img src="https://img.shields.io/badge/GitHub-ZiadMahmoud2003-181717?style=flat-square&logo=github&logoColor=white" /></a>
|
|
<a href="https://app.gitpasha.com/Ziad_Abdelgwad"><img src="https://img.shields.io/badge/GitPasha-Ziad__Abdelgwad-181717?style=flat-square&logo=git&logoColor=white" /></a>
|
|
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
|
|
---
|
|
|
|
<br/>
|
|
|
|
## 📋 Executive Summary
|
|
|
|
> **Scope:** Full-stack security assessment of the **Ghaymah CLI v2** command-line tool and its backing **web platform**, covering Docker container infrastructure, authentication mechanisms, session management, and binary reverse engineering.
|
|
|
|
This repository contains the results of a comprehensive two-phase security audit. The audit utilized dynamic testing, binary reverse-engineering, network interception, and adversarial fuzzing.
|
|
|
|
- **Phase 1 (Platform & Infrastructure):** Focused on the deployment pipeline, static site hosting mechanisms, and the broader Ghaymah web platform authentication layer. It uncovered 4 severe logic and infrastructure flaws.
|
|
- **Phase 2 (Binary Reverse Engineering & Network):** Focused entirely on the compiled Go binary (`gy-linux-amd64`). Through decompilation, string extraction, and MITM proxying, we tested 62 distinct adversarial vectors. This phase yielded 8 critical findings ranging from credential proxy interception to insecure auto-updates.
|
|
|
|
| Metric | Value |
|
|
|:---|:---|
|
|
| **Total Findings** | `12` |
|
|
| **Critical** | `4` |
|
|
| **High** | `4` |
|
|
| **Medium** | `4` |
|
|
| **Adversarial Tests** | `62` |
|
|
| **Methodology** | `MITRE ATT&CK`, `OWASP Top 10`, `Reverse Engineering` |
|
|
|
|
---
|
|
|
|
<br/>
|
|
|
|
## 🔀 Attack Surface Architecture
|
|
|
|
```mermaid
|
|
flowchart LR
|
|
subgraph SCOPE ["Audit Scope"]
|
|
direction TB
|
|
CLI["Ghaymah CLI v2 (gy-linux-amd64)"]
|
|
WEB["Web Platform (Dashboard & API)"]
|
|
end
|
|
|
|
subgraph VECTORS ["Attack Vectors"]
|
|
direction TB
|
|
V1["T1552: Credential Leakage"]
|
|
V2["T1539: Session Bypass"]
|
|
V3["CWE-400: Config Poisoning"]
|
|
V4["OWASP A07: Auth Failure"]
|
|
V5["T1557: Proxy MITM"]
|
|
V6["T1027: Symlink Traversal"]
|
|
V7["T1195: Insecure Updates"]
|
|
end
|
|
|
|
subgraph IMPACT ["Impact"]
|
|
direction TB
|
|
I1["Secret Exposure"]
|
|
I2["Account Takeover"]
|
|
I3["Pipeline DoS"]
|
|
I4["RCE & Data Theft"]
|
|
end
|
|
|
|
CLI --> V1
|
|
CLI --> V3
|
|
CLI --> V5
|
|
CLI --> V6
|
|
CLI --> V7
|
|
WEB --> V2
|
|
WEB --> V4
|
|
|
|
V1 --> I1
|
|
V2 --> I2
|
|
V3 --> I3
|
|
V4 --> I2
|
|
V5 --> I1
|
|
V6 --> I4
|
|
V7 --> I4
|
|
|
|
style SCOPE fill:#0D1117,stroke:#4A90D9,stroke-width:2px,color:#FFFFFF
|
|
style VECTORS fill:#0D1117,stroke:#FF6600,stroke-width:2px,color:#FFFFFF
|
|
style IMPACT fill:#0D1117,stroke:#FF0000,stroke-width:2px,color:#FFFFFF
|
|
```
|
|
|
|
---
|
|
|
|
<br/>
|
|
|
|
## ⚠️ Detailed Findings Dashboard
|
|
|
|
<div align="center">
|
|
|
|
|
|
|
|
|
|
|
|
</div>
|
|
|
|
<br/>
|
|
|
|
### Phase 1: Platform & Infrastructure
|
|
<table>
|
|
<thead>
|
|
<tr>
|
|
<th width="120" align="center">Severity</th>
|
|
<th width="120">MITRE/CWE</th>
|
|
<th>Finding Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr>
|
|
<td align="center"><img src="https://img.shields.io/badge/-CRITICAL-FF0000?style=flat-square" /></td>
|
|
<td><code>T1552</code></td>
|
|
<td><b>Dockerfile & <code>.env</code> Credential Leakage:</b> The auto-generated Dockerfile copies the entire directory root, exposing sensitive <code>.env</code> files and the <code>.git</code> folder directly to the public web via the deployed container.</td>
|
|
</tr>
|
|
<tr>
|
|
<td align="center"><img src="https://img.shields.io/badge/-CRITICAL-FF0000?style=flat-square" /></td>
|
|
<td><code>OWASP A07</code></td>
|
|
<td><b>Missing OTP & Unverified Password Change:</b> Password resets lack OTP validation, and users can change passwords inside the dashboard without providing their old password, allowing instant account takeover.</td>
|
|
</tr>
|
|
<tr>
|
|
<td align="center"><img src="https://img.shields.io/badge/-HIGH-FF6600?style=flat-square" /></td>
|
|
<td><code>T1539</code></td>
|
|
<td><b>Session Token Revocation Bypass:</b> Logging out from the CLI merely deletes local config files; it does not revoke the token server-side, making it endlessly reusable if intercepted.</td>
|
|
</tr>
|
|
<tr>
|
|
<td align="center"><img src="https://img.shields.io/badge/-MEDIUM-FFAA00?style=flat-square" /></td>
|
|
<td><code>CWE-400</code></td>
|
|
<td><b>Configuration Poisoning — Pipeline DoS:</b> Setting environment variables via the CLI with malicious shell characters (e.g., <code>$(id)</code>) permanently hangs the backend CI/CD runner.</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
|
|
### Phase 2: Binary Reverse Engineering & Network (gy-linux-amd64)
|
|
<table>
|
|
<thead>
|
|
<tr>
|
|
<th width="120" align="center">Severity</th>
|
|
<th width="120">MITRE/CWE</th>
|
|
<th>Finding Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr>
|
|
<td align="center"><img src="https://img.shields.io/badge/-CRITICAL-FF0000?style=flat-square" /></td>
|
|
<td><code>T1557</code></td>
|
|
<td><b>HTTP/HTTPS Proxy Credential Interception:</b> The Go binary respects system-level <code>HTTP_PROXY</code> variables without TLS pinning. An attacker controlling the network proxy can intercept plaintext passwords during <code>gy login</code>.</td>
|
|
</tr>
|
|
<tr>
|
|
<td align="center"><img src="https://img.shields.io/badge/-CRITICAL-FF0000?style=flat-square" /></td>
|
|
<td><code>T1027</code></td>
|
|
<td><b>Symlink Following in Deploy Path:</b> The CLI's buildpack scanner reads through symlinks. Creating a symlink to <code>/etc/passwd</code> forces the CLI to parse and upload sensitive system files to the Ghaymah cloud.</td>
|
|
</tr>
|
|
<tr>
|
|
<td align="center"><img src="https://img.shields.io/badge/-HIGH-FF6600?style=flat-square" /></td>
|
|
<td><code>CWE-522</code></td>
|
|
<td><b>Plaintext Token Storage:</b> Auth tokens are saved in plaintext JSON inside <code>~/.config/ghaymah</code>. Although guarded by <code>0600</code> OS permissions, malware running as the user can easily extract them.</td>
|
|
</tr>
|
|
<tr>
|
|
<td align="center"><img src="https://img.shields.io/badge/-HIGH-FF6600?style=flat-square" /></td>
|
|
<td><code>CWE-532</code></td>
|
|
<td><b>Debug Mode Leaks User ID:</b> Appending <code>--debug</code> outputs verbose internal state, including the exact User UUID and all internal API endpoints, exposing excessive telemetry.</td>
|
|
</tr>
|
|
<tr>
|
|
<td align="center"><img src="https://img.shields.io/badge/-HIGH-FF6600?style=flat-square" /></td>
|
|
<td><code>T1195.002</code></td>
|
|
<td><b>Insecure Auto-Updates:</b> The binary downloads and executes <code>install.sh</code> over the network without verifying cryptographic signatures, exposing users to RCE via Man-in-the-Middle attacks.</td>
|
|
</tr>
|
|
<tr>
|
|
<td align="center"><img src="https://img.shields.io/badge/-MEDIUM-FFAA00?style=flat-square" /></td>
|
|
<td><code>CWE-20</code></td>
|
|
<td><b>No Client-Side Port Validation:</b> The CLI blindly accepts and transmits negative ports or numbers exceeding 65535, causing potential backend errors.</td>
|
|
</tr>
|
|
<tr>
|
|
<td align="center"><img src="https://img.shields.io/badge/-MEDIUM-FFAA00?style=flat-square" /></td>
|
|
<td><code>CWE-20</code></td>
|
|
<td><b>No Client-Side Name Sanitization:</b> The CLI accepts Cross-Site Scripting (XSS) payloads and directory traversal characters (e.g. <code>../../</code>) in project names.</td>
|
|
</tr>
|
|
<tr>
|
|
<td align="center"><img src="https://img.shields.io/badge/-MEDIUM-FFAA00?style=flat-square" /></td>
|
|
<td><code>CWE-526</code></td>
|
|
<td><b>GenAI API Key Exposure:</b> API keys for the AI integration are passed via standard environment variables and transmitted alongside local source code payloads.</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
|
|
---
|
|
|
|
<br/>
|
|
|
|
## 📁 Repository Structure
|
|
|
|
```text
|
|
ghaymah-v2-test/
|
|
│
|
|
├── 📂 Assets/
|
|
│ └── 📂 Screenshots/ # Visual evidence & proof captures
|
|
│ ├── HTTP_Proxy_Credential_Interception_1.png
|
|
│ ├── HTTP_Proxy_Credential_Interception_2.png
|
|
│ └── ...
|
|
│
|
|
├── 📂 PoC_Apps/ # Proof-of-Concept applications
|
|
│ ├── 📂 test-app/ # Initial recon & .env leak PoC
|
|
│ ├── 📂 test-app-2/ # RCE boundary testing
|
|
│ ├── 📂 test-app-3/ # Malformed env variable injection
|
|
│ └── 📂 test-app-5/ # Extended config poisoning tests
|
|
│
|
|
├── 📂 Scripts/ # Scripts used for testing & fuzzing
|
|
│ └── adversarial_test.sh # Automated 62-test fuzzing script
|
|
│
|
|
├── 📂 Reports/
|
|
│ ├── 📄 Ghaymah_CLI_v2_Audit_Report.pdf # Phase 1: Full audit report
|
|
│ ├── 📄 Ghaymah_CLI_v2_Binary_Audit_Report.md # Phase 2: Binary Audit (Markdown)
|
|
│ └── 📄 vulnerability_verification_guide.md # Step-by-step reproduction guide
|
|
│
|
|
├── 📄 .gitignore # Ignores binary, .env, OS artifacts
|
|
└── 📄 README.md # ← You are here
|
|
```
|
|
|
|
---
|
|
|
|
<br/>
|
|
|
|
## 📎 Full Reports
|
|
|
|
The comprehensive audit reports with detailed technical analysis, risk ratings, and remediation roadmaps are available in the `Reports/` directory:
|
|
|
|
<div align="center">
|
|
|
|
📄 **[Phase 1 Report (PDF)](./Reports/Ghaymah_CLI_v2_Audit_Report.pdf)** | 📄 **[Phase 2 Report (Markdown)](./Reports/Ghaymah_CLI_v2_Binary_Audit_Report.md)**
|
|
|
|
|
|
|
|
</div>
|
|
|
|
---
|
|
|
|
<br/>
|
|
|
|
## ⚖️ Disclaimer
|
|
|
|
> This security audit was conducted in a controlled testing environment with explicit authorization. All findings are reported responsibly to the platform maintainers. The PoC applications and scripts in this repository are provided for **educational and verification purposes only**. Unauthorized use of these techniques against systems you do not own or have permission to test is **illegal and unethical**.
|
|
|
|
---
|
|
|
|
<div align="center">
|
|
|
|
<br/>
|
|
|
|
<img src="https://img.shields.io/badge/Crafted_with-Precision_&_Purpose-0D1117?style=for-the-badge&logo=shield&logoColor=FF4444" />
|
|
|
|
<br/><br/>
|
|
|
|
**Ziad Mahmoud Ahmed Abdelgwad**
|
|
*Cybersecurity Specialist*
|
|
|
|
<br/>
|
|
|
|
<a href="https://github.com/ZiadMahmoud2003"><img src="https://img.shields.io/badge/GitHub-ZiadMahmoud2003-181717?style=for-the-badge&logo=github&logoColor=white" /></a>
|
|
|
|
<a href="https://app.gitpasha.com/Ziad_Abdelgwad"><img src="https://img.shields.io/badge/GitPasha-Ziad__Abdelgwad-181717?style=for-the-badge&logo=git&logoColor=white" /></a>
|
|
|
|
<br/><br/>
|
|
|
|
<sub>© 2026 — All rights reserved. Conducted under responsible disclosure principles.</sub>
|
|
|
|
</div>
|