Microsoft’s PowerShell Gallery is facing criticism from researchers at Aqua Nautilus who claim that the online repository presents a software supply chain risk due to its weak protections against malicious packages. The researchers recently conducted tests on the repository’s policies regarding package names and owners, and discovered that threat actors could easily exploit them to deceive users and make it difficult to identify the true owner of a package.
According to Yakir Kadkoda, the lead security researcher at Aqua, organizations that use PowerShell modules from the gallery should exercise caution. He recommends using signed PowerShell modules, trusted private repositories, and being careful when downloading new modules/scripts from registries. In addition, Kadkoda advises similar platforms to the PowerShell Gallery to enhance their security measures, such as implementing a mechanism to prevent developers from uploading modules with names similar to existing ones.
Aqua informed Microsoft about the issues, and while the tech giant claimed to have addressed two separate issues, Kadkoda states that these problems still persist as of August 16. Microsoft has not yet responded to a request for comment from Dark Reading.
The PowerShell Gallery is a widely used repository for finding, publishing, and sharing PowerShell code modules and desired state configuration (DSC) resources. While many packages on the registry come from trusted entities like Microsoft, AWS, and VMware, there are also numerous packages from community members. So far this year, the repository has seen over 1.6 billion package downloads.
One major issue discovered by Aqua is the lack of protection against typosquatting. This technique involves threat actors using phonetically similar names to popular and legitimate packages on public software repositories, tricking users into downloading malicious packages. Aqua found that PowerShell Gallery’s policies did little to prevent such deception. For example, while most Azure packages on the repository followed a specific naming pattern, some popular packages like “Aztable” deviated from the pattern and did not have a dot in the name.
Another concern raised by Aqua is the ease with which a threat actor can make a malicious package appear legitimate by falsifying details like the author’s information. “An attacker can freely choose any name when creating a user in the PowerShell Gallery,” Aqua explained in a blog post. This creates a challenge in determining the true author of a PowerShell module on the gallery. Users who find these packages can be easily deceived into believing that the author is a legitimate entity like Microsoft.
Additionally, Aqua found that PowerShell Gallery’s API provided a way for threat actors to find unlisted modules on the registry, potentially exposing sensitive data associated with those modules. Unlisted modules should be private and not easily discoverable by attackers. Aqua’s researchers were able to not only locate such modules but also found one that contained sensitive secrets belonging to a large technology company.
While there is currently no evidence to suggest that threat actors have exploited these weaknesses to introduce malicious packages into PowerShell Gallery, the risk is real. Microsoft claims to scan PowerShell modules/scripts uploaded to the gallery, which is a good security measure. However, it remains an ongoing challenge for Microsoft to stay ahead of attackers.