{{categoryFriendlyName}}/

Penetration testing of Fleet (April 2022)

Guillaume Ross

Share

On this page

Docs

REST API

Guides

Get a demo

Suggest an edit

Try it out

See what Fleet can do

Start now

Penetration testing of Fleet (April 2022)

Guillaume Ross

Penetration testing of Fleet (April 2022)

Penetration testing of Fleet

We have recently had Lares perform penetration testing on our internal instance of Fleet. Lares performed the last test on 4.12. This test unveiled some authorization issues identified in this advisory and resolved in 4.13.

As promised when we published the Orbit audit and said we’d post other audit and pentest reports, we are now publishing the full report. We resolved the most critical issues in 4.13, and we continue to track and prioritize the others.

Small redacted sections are present in the PDF as we are hiding some internal email addresses to save ourselves from receiving more spam.

You can find the full report here: 2022-04-29-fleet-penetration-test.pdf.

You can see all publicly available security audits and penetration testing reports in the Fleet documentation, including what we intend to do about the remaining issues.