From 0315af75cf752d01f5cf73991690eb80e3504431 Mon Sep 17 00:00:00 2001 From: danielsagi Date: Tue, 27 Aug 2019 22:03:29 +0300 Subject: [PATCH] Detection for 3 new CVES (#173) * changed version hunting to be on a a new version disclosure vulnerability * fixed version publish * added logging and fixed typo * changed whole way of comparing versions in cve hunter * changed K8sVersionDisclosure vulnerability to one core vulnerability, that takes an endpoint. changed all usage * added tests * merged kubectl cve hunting with apiserver hunting. and simplified the code of apiserver cve hunting * fixed tests to new names * changed name of module to cves.py * drastically improved the cve vulnerble detection utility function. now works with all types of versioning methods * added packaging in requirementes.txt * added another test, and improved logic on cve comparison for more complicated versions * changed CveHunter to subscribe_once, to prevent duplicates duplicates * fixed tests for new improvements * removed unnecessary ternary on doc * removed unnecessary join split * improved compare function, made it util * improved cve checking to use mapping * added detection for CVE-2019-9512 and CVE-2019-9514 * added detection for CVE-2019-11247 and added minor comments --- src/modules/hunting/cves.py | 29 ++++++++++++++++++++++++++--- 1 file changed, 26 insertions(+), 3 deletions(-) diff --git a/src/modules/hunting/cves.py b/src/modules/hunting/cves.py index a090d5b..582d598 100644 --- a/src/modules/hunting/cves.py +++ b/src/modules/hunting/cves.py @@ -10,8 +10,7 @@ from ..discovery.kubectl import KubectlClientEvent from packaging import version -""" CVE Vulnerabilities """ - +""" Cluster CVES """ class ServerApiVersionEndPointAccessPE(Vulnerability, Event): """Node is vulnerable to critical CVE-2018-1002105""" def __init__(self, evidence): @@ -24,6 +23,27 @@ class ServerApiVersionEndPointAccessDos(Vulnerability, Event): Vulnerability.__init__(self, KubernetesCluster, name="Denial of Service to Kubernetes API Server", category=DenialOfService) self.evidence = evidence +class PingFloodHttp2Implementation(Vulnerability, Event): + """Node not patched for CVE-2019-9512. an attacker could cause a Denial of Service by sending specially crafted HTTP requests.""" + def __init__(self, evidence): + Vulnerability.__init__(self, KubernetesCluster, name="Possible Ping Flood Attack", category=DenialOfService) + self.evidence = evidence + +class ResetFloodHttp2Implementation(Vulnerability, Event): + """Node not patched for CVE-2019-9514. an attacker could cause a Denial of Service by sending specially crafted HTTP requests.""" + def __init__(self, evidence): + Vulnerability.__init__(self, KubernetesCluster, name="Possible Reset Flood Attack", category=DenialOfService) + self.evidence = evidence + +class ServerApiClusterScopedResourcesAccess(Vulnerability, Event): + """Api Server not patched for CVE-2019-11247. API server allows access to custom resources via wrong scope""" + def __init__(self, evidence): + Vulnerability.__init__(self, KubernetesCluster, name="Arbitrary Access To Cluster Scoped Resources", category=PrivilegeEscalation) + self.evidence = evidence + + +""" Kubectl CVES """ + class IncompleteFixToKubectlCpVulnerability(Vulnerability, Event): """The kubectl client is vulnerable to CVE-2019-11246, an attacker could potentially execute arbitrary code on the client's machine""" def __init__(self, binary_version): @@ -120,7 +140,10 @@ class K8sClusterCveHunter(Hunter): logging.debug('Api Cve Hunter determining vulnerable version: {}'.format(self.event.version)) cve_mapping = { ServerApiVersionEndPointAccessPE: ["1.10.11", "1.11.5", "1.12.3"], - ServerApiVersionEndPointAccessDos: ["1.11.8", "1.12.6", "1.13.4"], + ServerApiVersionEndPointAccessDos: ["1.11.8", "1.12.6", "1.13.4"], + ResetFloodHttp2Implementation: ["1.13.10", "1.14.6", "1.15.3"], + PingFloodHttp2Implementation: ["1.13.10", "1.14.6", "1.15.3"], + ServerApiClusterScopedResourcesAccess: ["1.13.9", "1.14.5", "1.15.2"] } for vulnerability, fix_versions in cve_mapping.items(): if CveUtils.is_vulnerable(fix_versions, self.event.version):