T08 · Insecure Dependencies
Warning
- Location
- fastlane.md:7
- Finding
- Unpinned Fastlane installation creates a mutable CI supply-chain dependency<![CDATA[ ## Vulnerability Details **File Location**: `fastlane.md:7-12` and `fastlane.md:220-225` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash # macOS (Homebrew) brew install fastlane # Ruby (any platform) gem install fastlane ``` The GitLab CI example repeats the unpinned installation: ```yaml script: - echo "$KEYSTORE_BASE64" | base64 -d > keystore.jks - echo "$PLAY_SERVICE_ACCOUNT" | base64 -d > service-account.json - gem install fastlane - fastlane internal ``` ### Technical Analysis The documented installation commands resolve and install the latest available Fastlane package at execution time. No reviewed version, lockfile, or integrity constraint is specified. Consequently, the code executed by the deployment workflow can change without any corresponding modification to this project. The GitLab example is particularly sensitive because it installs Fastlane immediately after decoding the Android signing keystore and Google Play service-account credentials. Installation hooks or subsequently executed compromised package code could run inside a CI job containing these assets. This is a supply-chain weakness rather than evidence that the current Fastlane package is malicious. Exploitation depends on compromise of an upstream package, package repository, dependency, or package-resolution path. ### Attack Path 1. An attacker compromises a Fastlane release, one of its transitive dependencies, or the package-resolution infrastructure. 2. The CI job executes `gem install fastlane` without a version constraint or lockfile. 3. The runner downloads and installs the attacker-controlled package version. 4. The job executes `fastlane internal`, loading the compromised package in the deployment environment. 5. Malicious package code reads the decoded keystore, service-account file, environment variables, or other CI credentials. 6. The attacker exfiltrates those crede ...[truncated 669 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Manage Fastlane through a reviewed `Gemfile` and committed `Gemfile.lock`. 2. Execute Fastlane with `bundle exec fastlane` so CI uses the locked dependency graph. 3. Pin Ruby, Fastlane, and relevant transitive dependencies to reviewed versions. 4. Use automated dependency updates that require review and CI validation before merging. 5. Prefer immutable CI images identified by digest rather than mutable image tags. 6. Enable dependency provenance, signature, checksum, and repository verification where supported. 7. Separate dependency installation from credential-bearing deployment stages. Build a verified image before injecting production secrets. 8. Grant the Google Play service account only the minimum permissions required for the intended release track. ]]>