Detection for 3 new CVES (#173)

* changed version hunting to be on a a new version disclosure vulnerability

* fixed version publish

* added logging and fixed typo

* changed whole way of comparing versions in cve hunter

* changed K8sVersionDisclosure vulnerability to one core vulnerability, that takes an endpoint. changed all usage

* added tests

* merged kubectl cve hunting with apiserver hunting. and simplified the code of apiserver cve hunting

* fixed tests to new names

* changed name of module to cves.py

* drastically improved the cve vulnerble detection utility function. now works with all types of versioning methods

* added packaging in requirementes.txt

* added another test, and improved logic on cve comparison for more complicated versions

* changed CveHunter to subscribe_once, to prevent duplicates duplicates

* fixed tests for new improvements

* removed unnecessary ternary on doc

* removed unnecessary join split

* improved compare function, made it util

* improved cve checking to use mapping

* added detection for CVE-2019-9512 and  CVE-2019-9514

* added detection for CVE-2019-11247 and added minor comments

src/modules/hunting/cves.py

@@ -10,8 +10,7 @@ from ..discovery.kubectl import KubectlClientEvent
 
 from packaging import version
 
-""" CVE Vulnerabilities """
-
+""" Cluster CVES """
 class ServerApiVersionEndPointAccessPE(Vulnerability, Event):
     """Node is vulnerable to critical CVE-2018-1002105"""
     def __init__(self, evidence):
@@ -24,6 +23,27 @@ class ServerApiVersionEndPointAccessDos(Vulnerability, Event):
         Vulnerability.__init__(self, KubernetesCluster, name="Denial of Service to Kubernetes API Server", category=DenialOfService)
         self.evidence = evidence
 
+class PingFloodHttp2Implementation(Vulnerability, Event):
+    """Node not patched for CVE-2019-9512. an attacker could cause a Denial of Service by sending specially crafted HTTP requests."""
+    def __init__(self, evidence):
+        Vulnerability.__init__(self, KubernetesCluster, name="Possible Ping Flood Attack", category=DenialOfService)
+        self.evidence = evidence
+
+class ResetFloodHttp2Implementation(Vulnerability, Event):
+    """Node not patched for CVE-2019-9514. an attacker could cause a Denial of Service by sending specially crafted HTTP requests."""
+    def __init__(self, evidence):
+        Vulnerability.__init__(self, KubernetesCluster, name="Possible Reset Flood Attack", category=DenialOfService)
+        self.evidence = evidence
+
+class ServerApiClusterScopedResourcesAccess(Vulnerability, Event):
+    """Api Server not patched for CVE-2019-11247. API server allows access to custom resources via wrong scope"""
+    def __init__(self, evidence):
+        Vulnerability.__init__(self, KubernetesCluster, name="Arbitrary Access To Cluster Scoped Resources", category=PrivilegeEscalation)
+        self.evidence = evidence
+
+
+""" Kubectl CVES """
+
 class IncompleteFixToKubectlCpVulnerability(Vulnerability, Event):
     """The kubectl client is vulnerable to CVE-2019-11246, an attacker could potentially execute arbitrary code on the client's machine"""
     def __init__(self, binary_version):
@@ -120,7 +140,10 @@ class K8sClusterCveHunter(Hunter):
         logging.debug('Api Cve Hunter determining vulnerable version: {}'.format(self.event.version))
         cve_mapping = {
             ServerApiVersionEndPointAccessPE: ["1.10.11", "1.11.5", "1.12.3"],
-            ServerApiVersionEndPointAccessDos: ["1.11.8", "1.12.6", "1.13.4"], 
+            ServerApiVersionEndPointAccessDos: ["1.11.8", "1.12.6", "1.13.4"],
+            ResetFloodHttp2Implementation: ["1.13.10", "1.14.6", "1.15.3"],
+            PingFloodHttp2Implementation: ["1.13.10", "1.14.6", "1.15.3"],
+            ServerApiClusterScopedResourcesAccess: ["1.13.9", "1.14.5", "1.15.2"]
         }        
         for vulnerability, fix_versions in cve_mapping.items():
             if CveUtils.is_vulnerable(fix_versions, self.event.version):