TMA-GITLAB-1.4.4

Ensure only secured webhooks are used

높음레벨 1자동gitlab

설명

Use only secured webhooks in the source code management platform. A webhook is an event listener, attached to critical and sensitive parts of the software delivery process. It is triggered by a list of events (such as a new code being committed), and when triggered, the webhook sends out a notification with some payload to specific internet endpoints. Since the payload of the webhook contains sensitive organization data, it's important all webhooks are directed to an endpoint (URL) protected by SSL verification (HTTPS). This helps ensure that the data sent is delivered to securely without any man-in-the-middle, who could easily access and even alter the payload of the request.

점검 방법

감사 방식: 셸 명령

shell

command -v glab >/dev/null 2>&1 || exit 1
glab auth status >/dev/null 2>&1 || exit 1
proj=$(glab repo view -F json 2>/dev/null) || exit 1
printf "%s" "$proj" | grep -q '"id":' && echo compliant || echo non-compliant

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Perform the following to secure all webhooks. For each project and for each group: - Navigate to the project or group - Select Settings > Webhooks on the side menu. - Find any webhooks that start with 'http' and not 'https', or which have 'SSL Verification: disabled'. - Click Edit. - Change the payload URL to begin with 'https' - Select the 'Enable SSL verification' checkbox - Click Update webhook. As an Administrator: - Navigate to the Admin Area - Select System Hooks on the side menu. - Find any webhooks that start with 'http' and not 'https', or which have 'SSL Verification: disabled'. - Click Edit. - Change the payload URL to begin with 'https' - Select the 'Enable SSL verification' checkbox - Click Update webhook.

속성

운영 체제: 모두
태그: devsecopsgitlab
참고 자료: CIS GitLab Benchmark v1.0.1 - 1.4.4 Ensure only secured webhooks are used

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target gitlab