ovotech/gitoops

all paths lead to clouds

GitOops!

😱

all paths lead to clouds

GitOops is a tool to help attackers and defenders identify lateral movement and privilege escalation paths in GitHub organizations by abusing CI/CD pipelines and GitHub access controls.

It works by mapping relationships between a GitHub organization and its CI/CD jobs and environment variables. It'll use any Bolt-compatible graph database as backend, so you can query your attack paths with openCypher:

MATCH p=(:User{login:"alice"})-[*..5]->(v:EnvironmentVariable)
WHERE v.name =~ ".*SECRET.*"
RETURN p

GitOops takes inspiration from tools like Bloodhound and Cartography.

Check out the docs, some more example queries and our BSides London talk.

gitoops's Issues

Potential leak of Neo4j sessions and drivers

Neo4j Go driver maintainer here 👋
While I was experimenting with the upgrade to v5 alpha1, I noticed a couple of issues with the way the driver is currently used:

• the session created with database.GetDB is never closed
• the driver is never closed and cannot be, since it's not referenced anywhere when the above function exits

support team membership to teams

Teams can be members of other teams. We don't currently support that.

CircleCI integration doesn't work

I tried to use the manual for the circleCI integration, but I got an error:
I fetched the ring_session_cookie from request to graphql_unstable, but still received that my organization doesn't exist.
I ran the following command:
export ORG=my_org; export SESSION=my_session; export RCOOKIE={extracted data from my authenticated session}
./gitoops circleci -debug -organization $ORG -neo4j-password test -neo4j-uri="neo4j://localhost:7687/" -cookie $RCOOKIE -session $SESSION
WARN[0000] 1 errors on organization: Either the org 'github/my_org' does not exist, or you do not have permission to view it
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x12745ff]

goroutine 1 [running]:
github.com/ovotech/gitoops/pkg/circleci.(*OrganizationIngestor).GetOrganizationId(...)
(...)/gitoops/pkg/circleci/organization.go:40
github.com/ovotech/gitoops/pkg/circleci.(*CircleCI).Sync(0xc000028840)
(...)/gitoops/pkg/circleci/circleci.go:55 +0x17f
main.cmdCircleCI(0x12c03e0?)
(...)/gitoops/cmd/cmd_circleci.go:27 +0x119
main.main()
(...)/gitoops/cmd/main.go:65 +0x2f2

add support for Enterprises / multiple Organizations

it would be great to support ingesting a GitHub Enterprise or multiple organzations.

my immediate concern is around rate limits.

smart rate limit handling

can we handle rate limits smartly? some ideas:

• throttle requests to avoid hitting rate limits
• terminate with a "resume code" if we hit rate limits. code allows resuming the ingestion from where it left off.

this would open the door to #44

ingest branch protection rules for environments

we currently only record whether there are any branch protection rules for a given github environment.

we don't record what the branch protection rules are (for environments that is. we actually do ingest the branch protection rule for the default branch already)

support Jenkins

would be great to add support for Jenkins.

nb: it's probably best to not try to merge concepts between different CI/CD systems when considering schema. keeping things separate should keep things simple.

fix pagination for GitHub rest client

The original GitHub REST client pagination was implemented for the repo webhooks API, which returns a list as root element.

The other APIs tend to return an object like this:

{
  "total_count": 1,
  "secrets": [
    {
      "name": "TEST",
      "created_at": "2021-09-13T13:26:11Z",
      "updated_at": "2021-09-13T13:26:11Z"
    }
  ]
}

We need to modify the REST client to support both.

For now, all other REST ingestors (org secrets, repo secrets, environments, environment secrets) only have the first page returned.