Unauth Pact Broker Unauthenticated Access Scanner

Pact Broker is a widely used repository for managing consumer-driven contracts and verification results. It is used primarily by development teams to store, share, and coordinate the contracts between services. By hosting contracts, it allows for effective collaboration across different teams, ensuring proper testing of service integrations. Organizations use Pact Broker to ensure that all services work harmoniously together, reducing the risk of breaking changes in production environments. The software is utilized by companies adopting microservices to facilitate service communication via contracts. Pact Broker supports continuous delivery by ensuring seamless integration and deployment processes.

Unauthenticated Access in Pact Broker refers to the vulnerability where unauthorized users can access restricted areas. This usually results from misconfigurations that do not enforce proper authentication controls. Exploiting this vulnerability may allow attackers to view or modify consumer-driven contracts and verification results. Such exposure compromises data integrity, potentially leading to incorrect service integrations and service disruptions. This vulnerability is critical for organizations relying on secure service communications. Proper security measures should be in place to prevent unauthorized data access.

The vulnerability arises when authentication checks are missing or improperly configured in the Pact Broker. Unauthorized users can gain access to endpoints such as '/pacts' or '/ui/relationships' without needing valid credentials. Indicators of this vulnerability include being able to view titles like "Pacts" or "Pact Broker" within the HTML body of responses. Additionally, API responses should contain pivotal elements such as "_links" and specific actions like "pb:pacticipants". Successful detection involves checking for HTTP status code 200 without credential requirements. Monitoring responses for these clues helps in identifying unauthorized access points within the Pact Broker.

Exploiting this vulnerability can lead to significant security and operational impacts. Unauthorized users can tamper with existing contracts, leading to potential service integration failures. Incorrect contract data might be published, causing services to behave unpredictably or fail altogether. Malicious actors could use this access to execute unauthorized webhooks or manipulate pacticipant data. The unauthorized exposure also allows for inventorying service relationships, which can be leveraged for further attacks. Preventing such exploitations is crucial for maintaining data confidence and service reliability.

REFERENCES

• https://docs.pact.io/pact_broker
• https://github.com/pact-foundation/pact_broker