运行CASA APK扫描时遭遇NoCredentialsError问题求助

编辑说明 #

问题已解决，相关修复细节可查看对应issue。

原始问题 #

在运行APK扫描时遇到如下错误：

─────────────────────────────────── Running ────────────────────────────────────

[INFO] Official Documentation: https://docs.fluidattacks.com/tech/scanner/standalone/
[INFO] Namespace: myapp
[ERROR] Computing commit hash: /working-dir 
[INFO] info HEAD is now at: 0000000000000000000000000000000000000000
[INFO] Startup work dir is: /working-dir
[INFO] Moving work dir to: /working-dir
[INFO] Running SAST analysis on specified paths
[WARNING] Function: __main__.cli_scan_wrapped, type in : Unable to locate credentials
Traceback (most recent call last):
  File "/nix/store/g8l3msrrig0gapjzpbajd7n6d58knd98-skims/utils/function.py", line 180, in wrapper
    return function(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/nix/store/g8l3msrrig0gapjzpbajd7n6d58knd98-skims/cli/__init__.py", line 259, in cli_scan_wrapped
    success: tuple[bool, int] = run(core.scan.main())
                                ^^^^^^^^^^^^^^^^^^^^^
  File "/nix/store/55r9nsl17a2addsdh67cns3c75y5n8i4-skims-runtime/lib/python3.11/site-packages/aioextensions/__init__.py", line 292, in run
    return asyncio.run(coroutine, debug=debug)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/nix/store/hx2c957wpwa6i3fz0wiwhg72sfgq62k1-python3-3.11.2/lib/python3.11/asyncio/runners.py", line 190, in run
    return runner.run(main)
           ^^^^^^^^^^^^^^^^
  File "/nix/store/hx2c957wpwa6i3fz0wiwhg72sfgq62k1-python3-3.11.2/lib/python3.11/asyncio/runners.py", line 118, in run
    return self._loop.run_until_complete(task)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/nix/store/hx2c957wpwa6i3fz0wiwhg72sfgq62k1-python3-3.11.2/lib/python3.11/asyncio/base_events.py", line 653, in run_until_complete
    return future.result()
           ^^^^^^^^^^^^^^^
  File "/nix/store/g8l3msrrig0gapjzpbajd7n6d58knd98-skims/core/scan.py", line 413, in main
    stores = await execute_skims()
             ^^^^^^^^^^^^^^^^^^^^^
  File "/nix/store/g8l3msrrig0gapjzpbajd7n6d58knd98-skims/utils/telemetry.py", line 38, in async_wrapper
    result = await _func(*args, **kwargs)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/nix/store/g8l3msrrig0gapjzpbajd7n6d58knd98-skims/core/scan.py", line 176, in execute_skims
    send_metrics_to_cloudwatch(calculate_methods_averages())
  File "/nix/store/g8l3msrrig0gapjzpbajd7n6d58knd98-skims/utils/logs.py", line 145, in send_metrics_to_cloudwatch
    cloudwatch_client.put_metric_data(
  File "/nix/store/55r9nsl17a2addsdh67cns3c75y5n8i4-skims-runtime/lib/python3.11/site-packages/botocore/client.py", line 535, in _api_call
    return self._make_api_call(operation_name, kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/nix/store/55r9nsl17a2addsdh67cns3c75y5n8i4-skims-runtime/lib/python3.11/site-packages/botocore/client.py", line 963, in _make_api_call
    http, parsed_response = self._make_request(
                            ^^^^^^^^^^^^^^^^^^^
  File "/nix/store/55r9nsl17a2addsdh67cns3c75y5n8i4-skims-runtime/lib/python3.11/site-packages/botocore/client.py", line 986, in _make_request
    return self._endpoint.make_request(operation_model, request_dict)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/nix/store/55r9nsl17a2addsdh67cns3c75y5n8i4-skims-runtime/lib/python3.11/site-packages/botocore/endpoint.py", line 119, in make_request
    return self._send_request(request_dict, operation_model)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/nix/store/55r9nsl17a2addsdh67cns3c75y5n8i4-skims-runtime/lib/python3.11/site-packages/botocore/endpoint.py", line 198, in _send_request
    request = self.create_request(request_dict, operation_model)
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/nix/store/55r9nsl17a2addsdh67cns3c75y5n8i4-skims-runtime/lib/python3.11/site-packages/botocore/endpoint.py", line 134, in create_request
    self._event_emitter.emit(
  File "/nix/store/55r9nsl17a2addsdh67cns3c75y5n8i4-skims-runtime/lib/python3.11/site-packages/botocore/hooks.py", line 412, in emit
    return self._emitter.emit(aliased_event_name, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/nix/store/55r9nsl17a2addsdh67cns3c75y5n8i4-skims-runtime/lib/python3.11/site-packages/botocore/hooks.py", line 256, in emit
    return self._emit(event_name, kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/nix/store/55r9nsl17a2addsdh67cns3c75y5n8i4-skims-runtime/lib/python3.11/site-packages/botocore/hooks.py", line 239, in _emit
    response = handler(**kwargs)
               ^^^^^^^^^^^^^^^^^
  File "/nix/store/55r9nsl17a2addsdh67cns3c75y5n8i4-skims-runtime/lib/python3.11/site-packages/botocore/signers.py", line 105, in handler
    return self.sign(operation_name, request)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/nix/store/55r9nsl17a2addsdh67cns3c75y5n8i4-skims-runtime/lib/python3.11/site-packages/botocore/signers.py", line 189, in sign
    auth.add_auth(request)
  File "/nix/store/55r9nsl17a2addsdh67cns3c75y5n8i4-skims-runtime/lib/python3.11/site-packages/botocore/auth.py", line 418, in add_auth
    raise NoCredentialsError()
botocore.exceptions.NoCredentialsError: Unable to locate credentials

[INFO] Summary: An error occurred while analyzing your targets.

────────────────────────── 😵 Failed with exit code 1 ──────────────────────────

执行命令 #

sudo docker run -v /home/kali/casa/mobile/application/:/working-dir ghcr.io/fluidattacks/makes/amd64 m gitlab:fluidattacks/universe@trunk /skims scan ./config.yaml

目录结构 #

casa
└── mobile
    ├── application
    │   ├── config.yaml
    │   ├── test.apk
    │   └── whatsapp.apk
    └── Dockerfile

配置文件内容 #

namespace: myapp
output:
  file_path: ./Fluid-Attacks-Results.csv
  format: CSV
working_dir: /home/kali/casa/mobile/application/
language: EN
apk:
  include:
    - test.apk
debug: true

疑问 #

这个credentials错误是什么？官方文档并未要求提供凭证，尝试过修改配置文件，也搜索过添加凭证的方法，但根据官方文档，静态扫描不需要凭证。

问题解答 #

这个凭证错误并非静态扫描本身需要凭证，而是扫描工具内部默认尝试向AWS CloudWatch发送遥测指标导致的，属于工具的一个bug。

解决方法：

• 升级到最新版本的fluidattacks/makes镜像，该问题已在后续更新中修复。
• 或者在运行命令时添加环境变量禁用遥测功能，修改后的命令如下：

  sudo docker run -e SKIMS_TELEMETRY=false -v /home/kali/casa/mobile/application/:/working-dir ghcr.io/fluidattacks/makes/amd64 m gitlab:fluidattacks/universe@trunk /skims scan ./config.yaml
  

内容的提问来源于stack exchange，提问作者Harsh Parekh