AppSec Europe 2017

Configuration management tools such as Puppet or Chef have become increasingly popular as many organizations shifted towards a Software Defined Infrastructure (SDI).. These tools allow system administrators to express the infrastructure in source code once and deploy them multiple times. While configuration management tools offer many advantages in terms of single point of maintenance, (security) testing and the ability to perform security audits, they are also an attractive target for attackers as they can be used to gain control of the full software stack. 

In this talk, we present the lessons learned of security reviews on real-world SDI deployments. First, we give an overview of a typical SDI deployment. Second, we explain the attack surface and threats of the SDI deployment. Third, we present how we identified vulnerabilities in this SDI deployment using source code analysis techniques. We conclude with an explanation on how to remediate these vulnerabilities.