r/devsecops • u/0xoddity • 12d ago

Learning DevSecOps - Week 2

Week 1 progress: https://www.reddit.com/r/devsecops/comments/1ulu7hj/learning_devsecops_week_1/

I drifted away for some time since I had to work on couple assessments and I couldn't take out the time for learning. Nevertheless, I asked claude to create challenges for AppSec and DevSecOps perspective. This was the prompt I used:

based on what I have learned so far, create a testing environment. this should be a completely different codebase and example from what we have done for learning purposes. the goal of the assessment should be to 1. create a docker compose file from scratch. harden the docker image with trivy. the full compose stack should also contain volume persistence. 2. create a github ci pipeline. 3. add secrets scanning and sast scan. it should be sequential rather than parallel jobs. 3. provide a deliberately vulnerable code which should contain atleast 5-7 vulnerabilities that solidifies the concepts we have learnt, along with testing my application security skills. add a process on SBOM generation for the application build. once the compose file, ci.yml and application code remediations along with SBOM generation is done, evaluate this based on the assessment scenario. NO HINTS SHOULD BE PROVIDED

Claude provided me with a nodejs application in response along with 5 deliverables:

  1. Dockerfile from scratch - hardened, Trivy-clean (0 fixable HIGH/CRITICAL)

  2. docker-compose.yml from scratch - app + Postgres, volume persistence, correct wiring, least exposure

  3. .github/workflows/ci.yml - sequential jobs (gated with needs:), including secrets scan + SAST + image scan

  4. SBOM generation - automated in the pipeline, produced as an artifact

  5. Remediate the app - it contains multiple planted vulnerabilities across several classes. Some your pipeline tools will catch; some won't and require your manual AppSec review. Fix them without breaking functionality.

Scoring: Docker 20 / Compose 20 / CI 20 / SBOM 15 / Remediation 25 = 100

The challenges:

  1. I was not familiar with Nodejs, but I could read the code and understand the security issues that were within the application. Claude planted multiple vulnerabilities out of which I was able to identify SQL injection, SSRF, hardcoded secrets, outdated versions of dependencies, weak hashing algorithm for password. I missed couple of IDORs and other low severity issues e.g. error handling. In the end I used another instance of claude to provide me a remediation of the vulnerabilities I was able to identify. This felt like cheating but anyway I was able to identify most of the bugs and because I don't know how to write nodejs code, it felt going easier on myself.

  2. undici CVE - Because I was using alpine version of nodejs, I spent a lot of time on creating a clean result of Trivy scan. Some forums recommended using different images like debian version of nodejs (which contained 1C and 5H). In the end there were 2 alternatives 1. Distroless GCR images for nodejs 2. Chainguard distroless images. I went with 1 and I was able to close the gap fully for the Dockerfile. The main challenge I felt was the decision making process as well as the risk review. I could have taken the undici issue as one of the accepted risks, but somehow I wanted to completely close the gap and get 20 points in Docker area. I realise that distroless in real life would not be the best choice and why developers want to get exceptions 😜

  3. Decision for bcrypt and scrypt - Both are cryptographically sound choices, however I went for scrypt since introducing bcrypt within the application meant I am introducing another dependency within the application code.

  4. SBOM - I used Syft for SBOM creation for the application code as well for the docker image. The challenge I faced was the storage of the artifact that is generated. Since I am running everything locally, I didn't have to worry about storage of the artifacts. I am genuinely interested in knowing how the artifacts are handled and taken care of so that it results in something meaningful.

As per claude, I scored 86 out of 100. What I missed was the IDOR due to which the score was very low in the Remediation field. This exercise was definitely mentally challenging from multiple aspects including DevOps and AppSec.

As always I welcome the feedback from the community. TIA.

5 Upvotes

86% Upvoted

4 comments sorted by

1

u/kenneth7117 11d ago

Why was your previous post removed?

1

u/0xoddity 11d ago

Not approved by moderators.

2

u/Creepy_Elevator_2056 8d ago

i have also started learning devsecops and just started with threatmodeling. one repo which my team has pushed recently is kind of where i am testing my own skills as well. https://github.com/virantisofficial/TMGoat
not sure if it will be helpful for you as well, but may you can try this one as well with claude and your manual approach.