Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

[blog] Secure against SeleniumGreed #1830

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
AutomatedTester merged 2 commits into trunk from SeleniumGreed-blog
Jul 31, 2024
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
View file Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
---
title: "Protecting unsecured Selenium Grids against SeleniumGreed"
linkTitle: "Protecting unsecured Selenium Grids"
date: 2024年07月31日
tags: ["selenium"]
categories: ["general"]
author: David Burns [@automatedtester](https://www.linkedin.com/in/theautomatedtester/)
description: >
With an ongoing attack, called SeleniumGreed, on Selenium Grids, we recommend you keep your grid secure.
---

Over the last week there have been stories going around about crypto miners abusing unsecured Selenium Grids by
injecting code in the session create to download and start up crypto miners. This came out thanks to the work from
Wiz about an attack they have called [SeleniumGreed](https://www.wiz.io/blog/seleniumgreed-cryptomining-exploit-attack-flow-remediation-steps).
This issue can be abused on most versions of Selenium but there appears to be a lot of effort going into abusing
Selenium Grid 3.14. Please upgrade as some of the security items have been added since then.

Selenium Grid by default doesn't have any authentication as the assumption has always been that we want you to put
this behind a secure network to prevent people from abusing your resources. There are ways that you can secure the grid,
and we have documentation available on how to do this in our [help section](https://www.selenium.dev/documentation/grid/configuration/help/#security). You can see more details if you run

```
java -jar selenium-server-<version>.jar info security
```

Another way to combat this is to use a cloud provider to run your Selenium Grid. We have numerous vendors that sponsor us
so have a look at our [sponsors](https://www.selenium.dev/sponsors/) page. If you need help, after reading the [help section](https://www.selenium.dev/documentation/grid/configuration/help/#security)
please come into our [chat rooms](https://www.selenium.dev/support/#ChatRoom) and we will try guide you through making your
grid more secure.

AltStyle によって変換されたページ (->オリジナル) /