Scholarlink

This study examines metadata-assisted detection of supply chain attacks in Infrastructure as Code (IaC), focusing on metadata’s role in identifying security smells. Metadata, including dependency relationships and author records, provides insights into IaC scripts but remains underutilized by detection tools. The evaluation of static IaC smell detection tools highlights their limitations in incorporating metadata analysis. To address this, a methodology integrating metadata and dependency analysis was developed to identify security smells in dependency chains. An analysis of 482 Ansible Galaxy repositories identified vulnerabilities in 45 dependency chains, including reliance on deprecated dependencies (CWE-477), hard-coded credentials (CWE-798), and improper file permissions (CWE-280). Additionally, three repositories contained security vulnerabilities associated with output (CVE-2024-8775) and logging (CVE-2017-7550). The findings highlight the necessity of integrating metadata analysis with static code analysis for detecting security smells. This approach enhances IaC security and mitigates risks related to supply chain attacks.

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Metadata Assisted Supply-Chain Attack Detection for Ansible

  • 会议论文

  • 发表日期：

    2025年

查看全文
  • Pandu Ranga Reddy Konala,
  • Vimal Kumar,
  • David Bainbridge,
  • Junaid Haseeb

摘要

This study examines metadata-assisted detection of supply chain attacks in Infrastructure as Code (IaC), focusing on metadata’s role in identifying security smells. Metadata, including dependency relationships and author records, provides insights into IaC scripts but remains underutilized by detection tools. The evaluation of static IaC smell detection tools highlights their limitations in incorporating metadata analysis. To address this, a methodology integrating metadata and dependency analysis was developed to identify security smells in dependency chains. An analysis of 482 Ansible Galaxy repositories identified vulnerabilities in 45 dependency chains, including reliance on deprecated dependencies (CWE-477), hard-coded credentials (CWE-798), and improper file permissions (CWE-280). Additionally, three repositories contained security vulnerabilities associated with output (CVE-2024-8775) and logging (CVE-2017-7550). The findings highlight the necessity of integrating metadata analysis with static code analysis for detecting security smells. This approach enhances IaC security and mitigates risks related to supply chain attacks.