Gitlab CI/CD中Burp Dastardly权限报错及构建失败的解决方案咨询

问题背景 #

在Gitlab CI/CD中部署PortSwigger的Burp Dastardly工具时遇到两个核心问题：

• 浏览器沙箱无法启动，提示当前以root用户运行
• 扫描到高风险漏洞后直接终止构建

Gitlab CI配置 #

Burp_DAST:
  stage: dast
  image: docker:stable
  script:
    - |
      docker run --user $(id -u):$(id -g) --rm -v $(pwd):/dastardly -e \
      DASTARDLY_TARGET_URL=$TARGET_URL -e \
      DASTARDLY_OUTPUT_FILE=/dastardly/$CI_PROJECT_NAME-dastardly-report.xml \
      public.ecr.aws/portswigger/dastardly:latest
  artifacts:
    paths:
      - "$CI_PROJECT_NAME-dastardly-report.xml"
    when: always

报错信息 #

2022-11-01 12:03:09 INFO  dastardly.EventLogPrinter - Nov 01 2022 11:52:22 INFORMATION Audit started.
2022-11-01 12:03:09 INFO  dastardly.EventLogPrinter - Nov 01 2022 11:52:23 ERROR Could not start Burp's browser sandbox because you are running as root. Either switch to running as an unprivileged user or allow running without sandbox.
2022-11-01 12:03:09 ERROR dastardly.ScanFinishedHandler - Failing build as scanner identified issue(s) with severity higher than "INFO":
2022-11-01 12:03:09 ERROR dastardly.ScanFinishedHandler - Path: / Issue Type: Cross-origin resource sharing: arbitrary origin trusted Severity: HIGH
2022-11-01 12:03:09 ERROR dastardly.ScanFinishedHandler - Path: /robots.txt Issue Type: Cross-origin resource sharing: arbitrary origin trusted Severity: HIGH
2022-11-01 12:03:10 INFO  bsee.BurpProcess.scan.scan-1 - Deleting temporary files - please wait ... done.

本地使用非root sudoer用户运行以下命令可正常工作：

sudo docker run --user $(id -u):$(id -g) --rm -v $(pwd):/dastardly -e DASTARDLY_TARGET_URL=$TAGET_URL -e DASTARDLY_OUTPUT_FILE=/dastardly/dastardly-report.xml public.ecr.aws/portswigger/dastardly:latest

但Gitlab中docker:dind默认以root运行，docker:dind-rootless表现不佳，需针对性解决。

解决方案 #

1. 禁用浏览器沙箱 #

在容器运行命令中添加DASTARDLY_NO_SANDBOX=true环境变量，绕开root用户无法启动沙箱的限制：

-e DASTARDLY_NO_SANDBOX=true \

2. 调整构建失败的严重级别阈值 #

默认情况下，Burp Dastardly会在扫描到高于INFO级别的漏洞时终止构建。可通过DASTARDLY_FAIL_ON_SEVERITY环境变量指定允许的最高严重级别：

• 仅在发现CRITICAL级漏洞时终止构建：

  -e DASTARDLY_FAIL_ON_SEVERITY=CRITICAL \
  

• 完全禁止因漏洞导致构建失败：

  -e DASTARDLY_FAIL_ON_SEVERITY=NONE \
  

修改后的完整Gitlab CI配置 #

Burp_DAST:
  stage: dast
  image: docker:stable
  script:
    - |
      docker run --user $(id -u):$(id -g) --rm -v $(pwd):/dastardly -e \
      DASTARDLY_TARGET_URL=$TARGET_URL -e \
      DASTARDLY_OUTPUT_FILE=/dastardly/$CI_PROJECT_NAME-dastardly-report.xml -e \
      DASTARDLY_NO_SANDBOX=true -e \
      DASTARDLY_FAIL_ON_SEVERITY=CRITICAL \
      public.ecr.aws/portswigger/dastardly:latest
  artifacts:
    paths:
      - "$CI_PROJECT_NAME-dastardly-report.xml"
    when: always

说明 #

• 禁用沙箱在CI环境中是安全的，CI容器本身已具备隔离性
• 调整失败阈值可根据项目需求灵活设置，既保留漏洞检测能力，又不会因非致命漏洞中断CI流程

内容的提问来源于stack exchange，提问作者Iman