GCP Terraform Misconfiguration: GKE Cluster HTTP Basic Authentication

Abstract

Terraform 組態在 GKE 叢集上啟用了 HTTP 基本驗證。

Explanation

Kubernetes API 伺服器是叢集的中央管理實體，接受 HTTP 基本驗證來驗證使用者。HTTP 基本驗證已棄用，且容易受到暴力破解攻擊，在錯誤設定的環境中，會將使用者憑證洩露給攻擊者。

範例 1：以下範例顯示一個 Terraform 組態，其透過將 master_auth 區塊中的 username 和 password 設定為非空值，來啟用 GKE 叢集上的 HTTP 基本驗證。


resource "google_container_cluster" "container_cluster_demo" {
...
  master_auth {
    username = "foo"
    password = "bar"
  }
...
}

References

[1] HashiCorp google_container_cluster

[2] Google Cloud Leave legacy client authentication methods disabled

[3] Standards Mapping - CIS Google Kubernetes Engine Benchmark Recommendation 5.8.1

[4] Standards Mapping - Common Weakness Enumeration CWE ID 287

[5] Standards Mapping - Common Weakness Enumeration Top 25 2020 [14] CWE ID 287

[6] Standards Mapping - Common Weakness Enumeration Top 25 2021 [14] CWE ID 287

[7] Standards Mapping - Common Weakness Enumeration Top 25 2022 [14] CWE ID 287

[8] Standards Mapping - Common Weakness Enumeration Top 25 2024 [14] CWE ID 287

[9] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001958

[10] Standards Mapping - FIPS200 IA

[11] Standards Mapping - General Data Protection Regulation (GDPR) Access Violation

[12] Standards Mapping - NIST Special Publication 800-53 Revision 4 IA-3 Device Identification and Authentication (P1), IA-5 Authenticator Management (P1)

[13] Standards Mapping - NIST Special Publication 800-53 Revision 5 IA-3 Device Identification and Authentication, IA-5 Authenticator Management

[14] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[15] Standards Mapping - OWASP Application Security Verification Standard 4.0 1.2.3 Authentication Architectural Requirements (L2 L3), 2.2.5 General Authenticator Requirements (L3), 2.6.3 Look-up Secret Verifier Requirements (L2 L3), 6.2.1 Algorithms (L1 L2 L3), 8.3.1 Sensitive Private Data (L1 L2 L3), 8.1.6 General Data Protection (L3), 9.1.1 Communications Security Requirements (L1 L2 L3), 9.2.2 Server Communications Security Requirements (L2 L3), 14.4.5 HTTP Security Headers Requirements (L1 L2 L3)

[16] Standards Mapping - OWASP Top 10 2017 A2 Broken Authentication

[17] Standards Mapping - OWASP Top 10 2021 A07 Identification and Authentication Failures

[18] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.10

[19] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[20] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.2.4

[21] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 5.4 - Authentication and Access Control

[22] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 5.4 - Authentication and Access Control

[23] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 5.4 - Authentication and Access Control, Control Objective C.2.3 - Web Software Access Controls

[24] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-001650 CAT II

[25] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-001650 CAT II

[26] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-001650 CAT II

[27] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-001650 CAT II

[28] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-001650 CAT II

[29] Standards Mapping - Security Technical Implementation Guide Version 6.2 APSC-DV-001650 CAT II

desc.structural.hcl.gcp_terraform_misconfiguration_gke_cluster_http_basic_authentication