TMA-GITHUB-1.4.4

Ensure only secured webhooks are used

VisokaNivo 1Automatskagithub

Opis

Use only secured webhooks in the source code management platform. A webhook is an event listener, attached to critical and sensitive parts of the software delivery process. It is triggered by a list of events (such as a new code being committed), and when triggered, the webhook sends ... Every organization and repository webhook must use an https:// URL with SSL verification enabled (insecure_ssl 0). Uses the GitHub REST/GraphQL API through gh api (read-only). The repository comes from GH_REPO or the current git checkout (gh's {owner}/{repo} resolution, GH_HOST for GitHub Enterprise Server); the organization comes from GH_ORG (default: the repository owner). Fails when gh is missing or unauthenticated (gh auth login or GH_TOKEN); organization settings and branch protection need an owner/admin token.

Kako se proverava

Metod provere: Komanda ljuske

shell

command -v gh >/dev/null 2>&1 || exit 1
gh auth status >/dev/null 2>&1 || exit 1
info=$(gh api 'repos/{owner}/{repo}' --jq '.full_name + " " + .default_branch' 2>/dev/null) || exit 1
R=${info% *}; B=${info#* }
[ -n "$R" ] && [ -n "$B" ] || exit 1
O=${GH_ORG:-${R%%/*}}
oh=$(gh api --paginate "orgs/$O/hooks?per_page=100" --jq '.[] | select(((.config.url // "") | startswith("https://") | not) or ((.config.insecure_ssl // "0") | tostring) != "0") | (.config.url // "?")' 2>/dev/null) || exit 1
rh=$(gh api --paginate "repos/$R/hooks?per_page=100" --jq '.[] | select(((.config.url // "") | startswith("https://") | not) or ((.config.insecure_ssl // "0") | tostring) != "0") | (.config.url // "?")' 2>/dev/null) || exit 1
b=$(printf '%s\n%s\n' "$oh" "$rh" | grep . || true)
[ -z "$b" ] && echo compliant || printf 'insecure webhook: %s\n' $b

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Edit each listed webhook (Settings > Webhooks) to use an https:// payload URL with SSL verification enabled, and set a webhook secret.

Svojstva

Operativni sistemi: Bilo koji
Oznake: githubsource-code
Referenca: CIS GitHub Benchmark v1.2.0 - 1.4.4 Ensure only secured webhooks are used

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target github