Security Scanners Themselves Become a Supply Chain Attack Vector
Researchers have demonstrated how application security scanning tools, when integrated into development pipelines, can be exploited by attackers to gain a foothold and launch downstream attacks.
Specialized application security scanning tools are crucial for hardening code and bolstering software supply chain security. However, a new research finding reveals that these very tools can be turned into an attack vector, providing a gateway for adversaries to infiltrate deep into the supply chain.
This scenario, where security tools become compromised, was recently highlighted with broad supply chain attacks that poisoned versions of Trivy and KICS, impacting unsuspecting software engineering teams. These attacks, attributed to TeamPCP, aimed at widespread credential theft and fraud. Now, researchers from ZeroPath are set to demonstrate a different, less resource-intensive method for attackers to leverage security tools.
During an upcoming session at the Black Hat USA conference, ZeroPath's security team will detail how attackers can exploit security scanners without needing to compromise the vendor's entire development environment. The technique involves tricking the scanner into processing a specially crafted, malicious code repository. This approach exploits the way some scanners execute code and examine files, potentially allowing for the execution of malicious programs disguised as custom rules or configuration files.
ZeroPath's research initially stemmed from an alert about a suspicious, failed scan in their own environment. The investigation revealed an attacker systematically probing their hosted security product, examining how the scanning tools handled arbitrary files, dependency management, and secrets. This probe inspired ZeroPath to build a tool, dubbed Build Canaries, to test their own environment for similar vulnerabilities.
Build Canaries was then expanded to test the susceptibility of other security vendors. The tool analyzes vendor documentation and automatically generates tailored payloads to dynamically test scanning surfaces. ZeroPath's initial testing involved 20 unnamed security vendors, with significant findings in five, including the disclosure of sensitive secrets like cloud credentials, production database access, and personal access tokens.
"Most of the findings disclosed sensitive secrets like cloud credentials. One included the production database. Some included the Docker and GitHub personal access token for the actual developer that worked at the vendor," explained Raphael Karger, co-founder and CTO for ZeroPath. "These instances could have reached customers that thought they were secure."
The implications of these findings are significant, potentially affecting large enterprises, defense contractors, and government agencies. The ability to access production databases or view unpatched findings for customer organizations could lead to severe downstream consequences. Karger plans to release Build Canaries as an open-source tool at Black Hat, complete with 349 validated payloads for AppSec teams to test their own security scanning infrastructure.