It has been reported that IBM has patched a critical vulnerability in Apache OpenWhisk, the open source serverless platform that IBM uses to run its cloud functions. This vulnerability allowed an attacker to replace a company’s serverless code with their own malicious code instead.
Tim Mackey, Senior Technical Evangelist at BlackDuckbySynopsys:
“OpenWhisk is an Apache Software Foundation project which provides a framework for users to create “serverless” functions known as “Actions”. Commercially, Apache OpenWhisk is available as IBM Cloud Functions which is part of the IBM Cloud. The vulnerabilities CVE-2018-11756 and CVE-2018-11757 disclose a situation where the function hosted within a an OpenWhisk runtime container could be reinitialized with malicious code.
Developers using OpenWhisk can create functional building blocks for their application using a variety of languages. The code representing the function is uploaded to OpenWhisk when the function, known as an “Action”, is created. When a consumer of the Action makes the request, OpenWhisk routes the request to a container image running within a Docker engine. Since the goal of any serverless platform is speed of execution, any time spent creating a Docker image for the Action or starting the Actions’ container should be optimised. Many optimisation strategies exist, but the most common are to reuse an existing container or to pre-cache an idle container. During container startup, the Action’s code is loaded into the container image for execution. The disclosed vulnerabilities describe a situation where the Action’s code can be replaced at runtime by exploiting the nature of the action itself, vulnerabilities within the Action and the potential of OpenWhisk to update Actions from within an Action. If an Action is replaced with comparable functionality, the new Action would have access to all data passed to the Action without a consumer being aware of the modifications.
These vulnerabilities demonstrate how trust of infrastructure impacts the overall security of the applications being delivered. Whether the application is traditional, containerised or serverless, the security of the entire delivery stack must be continually monitored. As applications are decomposed into functions deployed in serverless models, the potential attack surface for these application increases and each function should be considered as a distinct deliverable subject to a full security review.”
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.