Skip to content

Commit 33aff52

Browse files
manuel-sommermanuel-sommer
authored
💄 Restructure Kubehunter json files to make it readable (#13061)
1 parent 9f05153 commit 33aff52

File tree

4 files changed

+232
-4
lines changed

4 files changed

+232
-4
lines changed

‎unittests/scans/kubehunter/dupe.json‎

Lines changed: 50 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,50 @@
1-
{"nodes": [{"type": "Node/Master", "location": "10.1.1.1"}, {"type": "Node/Master", "location": "10.2.2.0"}], "services": [{"service": "Kubelet API (readonly)", "location": "10.0.1.1:10255"}, {"service": "Kubelet API", "location": "10.0.1.1:10250"}, {"service": "API Server", "location": "10.0.0.1:443"}], "vulnerabilities": [{"location": "10.0.1.1:10255", "vid": "KHV044", "category": "Privilege Escalation // Privileged container", "severity": "high", "vulnerability": "Privileged Container", "description": "A Privileged container exist on a node\n could expose the node/cluster to unwanted root operations", "evidence": "pod: kube-proxy, container: kube-proxy, count: 1", "avd_reference": "https://avd.aquasec.com/kube-hunter/khv044/", "hunter": "Kubelet Readonly Ports Hunter"},{"location": "10.0.1.1:10255", "vid": "KHV044", "category": "Privilege Escalation // Privileged container", "severity": "high", "vulnerability": "Privileged Container", "description": "A Privileged container exist on a node\n could expose the node/cluster to unwanted root operations", "evidence": "pod: kube-proxy, container: kube-proxy, count: 1", "avd_reference": "https://avd.aquasec.com/kube-hunter/khv044/", "hunter": "Kubelet Readonly Ports Hunter"}]}
1+
{
2+
"nodes": [
3+
{
4+
"type": "Node/Master",
5+
"location": "10.1.1.1"
6+
},
7+
{
8+
"type": "Node/Master",
9+
"location": "10.2.2.0"
10+
}
11+
],
12+
"services": [
13+
{
14+
"service": "Kubelet API (readonly)",
15+
"location": "10.0.1.1:10255"
16+
},
17+
{
18+
"service": "Kubelet API",
19+
"location": "10.0.1.1:10250"
20+
},
21+
{
22+
"service": "API Server",
23+
"location": "10.0.0.1:443"
24+
}
25+
],
26+
"vulnerabilities": [
27+
{
28+
"location": "10.0.1.1:10255",
29+
"vid": "KHV044",
30+
"category": "Privilege Escalation // Privileged container",
31+
"severity": "high",
32+
"vulnerability": "Privileged Container",
33+
"description": "A Privileged container exist on a node\n could expose the node/cluster to unwanted root operations",
34+
"evidence": "pod: kube-proxy, container: kube-proxy, count: 1",
35+
"avd_reference": "https://avd.aquasec.com/kube-hunter/khv044/",
36+
"hunter": "Kubelet Readonly Ports Hunter"
37+
},
38+
{
39+
"location": "10.0.1.1:10255",
40+
"vid": "KHV044",
41+
"category": "Privilege Escalation // Privileged container",
42+
"severity": "high",
43+
"vulnerability": "Privileged Container",
44+
"description": "A Privileged container exist on a node\n could expose the node/cluster to unwanted root operations",
45+
"evidence": "pod: kube-proxy, container: kube-proxy, count: 1",
46+
"avd_reference": "https://avd.aquasec.com/kube-hunter/khv044/",
47+
"hunter": "Kubelet Readonly Ports Hunter"
48+
}
49+
]
50+
}

‎unittests/scans/kubehunter/kubehunter_many_vul.json‎

Lines changed: 116 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,116 @@
1-
{"nodes": [{"type": "Node/Master", "location": "10.1.1.1"}, {"type": "Node/Master", "location": "10.2.2.0"}], "services": [{"service": "Kubelet API (readonly)", "location": "10.0.1.1:10255"}, {"service": "Kubelet API", "location": "10.0.1.1:10250"}, {"service": "API Server", "location": "10.0.0.1:443"}], "vulnerabilities": [{"location": "Local to Pod (kube-hunter-5pmjs)", "vid": "KHV050", "category": "Credential Access // Access container service account", "severity": "low", "vulnerability": "Read access to pod's service account token", "description": "Accessing the pod service account token gives an attacker the option to use the server API", "evidence": "TOKEN", "avd_reference": "https://avd.aquasec.com/kube-hunter/khv050/", "hunter": "Access Secrets"}, {"location": "Local to Pod (kube-hunter-5pmjs)", "vid": "None", "category": "Lateral Movement // ARP poisoning and IP spoofing", "severity": "medium", "vulnerability": "CAP_NET_RAW Enabled", "description": "CAP_NET_RAW is enabled by default for pods.\n If an attacker manages to compromise a pod,\n they could potentially take advantage of this capability to perform network\n attacks on other pods running on the same node", "evidence": "", "avd_reference": "https://avd.aquasec.com/kube-hunter/none/", "hunter": "Pod Capabilities Hunter"}, {"location": "Local to Pod (kube-hunter-5pmjs)", "vid": "None", "category": "Credential Access // Access container service account", "severity": "low", "vulnerability": "Access to pod's secrets", "description": "Accessing the pod's secrets within a compromised pod might disclose valuable data to a potential attacker", "evidence": "['/var/run/secrets/kubernetes.io/serviceaccount/namespace', '/var/run/secrets/kubernetes.io/serviceaccount/ca.crt']", "avd_reference": "https://avd.aquasec.com/kube-hunter/none/", "hunter": "Access Secrets"}, {"location": "10.0.1.1:10255", "vid": "KHV044", "category": "Privilege Escalation // Privileged container", "severity": "high", "vulnerability": "Privileged Container", "description": "A Privileged container exist on a node\n could expose the node/cluster to unwanted root operations", "evidence": "pod: kube-proxy, container: kube-proxy, count: 1", "avd_reference": "https://avd.aquasec.com/kube-hunter/khv044/", "hunter": "Kubelet Readonly Ports Hunter"}, {"location": "10.0.1.1:10255", "vid": "KHV043", "category": "Initial Access // General Sensitive Information", "severity": "low", "vulnerability": "Cluster Health Disclosure", "description": "By accessing the open /healthz handler,\n an attacker could get the cluster health state without authenticating", "evidence": "status: ok", "avd_reference": "https://avd.aquasec.com/kube-hunter/khv043/", "hunter": "Kubelet Readonly Ports Hunter"}, {"location": "10.0.1.1:10255", "vid": "KHV052", "category": "Discovery // Access Kubelet API", "severity": "medium", "vulnerability": "Exposed Pods", "description": "An attacker could view sensitive information about pods that are\n bound to a Node using the /pods endpoint", "evidence": "count: 7", "avd_reference": "https://avd.aquasec.com/kube-hunter/khv052/", "hunter": "Kubelet Readonly Ports Hunter"}, {"location": "10.0.0.1:443", "vid": "KHV002", "category": "Initial Access // Exposed sensitive interfaces", "severity": "high", "vulnerability": "K8s Version Disclosure", "description": "The kubernetes version could be obtained from the /version endpoint", "evidence": "v1", "avd_reference": "https://avd.aquasec.com/kube-hunter/khv002/", "hunter": "Api Version Hunter"}, {"location": "10.16.0.1:443", "vid": "KHV005", "category": "Discovery // Access the K8S API Server", "severity": "medium", "vulnerability": "Access to API using service account token", "description": "The API Server port is accessible.\n Depending on your RBAC settings this could expose access to or control of your cluster.", "evidence": "b'{\"kind\":\"APIVersions\",\"versions\":[\"v1\"],\"serverAddressByClientCIDRs\":[{\"clientCIDR\":\"0.0.0.0/0\",\"serverAddress\":\"10.1.1.1:443\"}]}\\n'", "avd_reference": "https://avd.aquasec.com/kube-hunter/khv005/", "hunter": "API Server Hunter"}]}
1+
{
2+
"nodes": [
3+
{
4+
"type": "Node/Master",
5+
"location": "10.1.1.1"
6+
},
7+
{
8+
"type": "Node/Master",
9+
"location": "10.2.2.0"
10+
}
11+
],
12+
"services": [
13+
{
14+
"service": "Kubelet API (readonly)",
15+
"location": "10.0.1.1:10255"
16+
},
17+
{
18+
"service": "Kubelet API",
19+
"location": "10.0.1.1:10250"
20+
},
21+
{
22+
"service": "API Server",
23+
"location": "10.0.0.1:443"
24+
}
25+
],
26+
"vulnerabilities": [
27+
{
28+
"location": "Local to Pod (kube-hunter-5pmjs)",
29+
"vid": "KHV050",
30+
"category": "Credential Access // Access container service account",
31+
"severity": "low",
32+
"vulnerability": "Read access to pod's service account token",
33+
"description": "Accessing the pod service account token gives an attacker the option to use the server API",
34+
"evidence": "TOKEN",
35+
"avd_reference": "https://avd.aquasec.com/kube-hunter/khv050/",
36+
"hunter": "Access Secrets"
37+
},
38+
{
39+
"location": "Local to Pod (kube-hunter-5pmjs)",
40+
"vid": "None",
41+
"category": "Lateral Movement // ARP poisoning and IP spoofing",
42+
"severity": "medium",
43+
"vulnerability": "CAP_NET_RAW Enabled",
44+
"description": "CAP_NET_RAW is enabled by default for pods.\n If an attacker manages to compromise a pod,\n they could potentially take advantage of this capability to perform network\n attacks on other pods running on the same node",
45+
"evidence": "",
46+
"avd_reference": "https://avd.aquasec.com/kube-hunter/none/",
47+
"hunter": "Pod Capabilities Hunter"
48+
},
49+
{
50+
"location": "Local to Pod (kube-hunter-5pmjs)",
51+
"vid": "None",
52+
"category": "Credential Access // Access container service account",
53+
"severity": "low",
54+
"vulnerability": "Access to pod's secrets",
55+
"description": "Accessing the pod's secrets within a compromised pod might disclose valuable data to a potential attacker",
56+
"evidence": "['/var/run/secrets/kubernetes.io/serviceaccount/namespace', '/var/run/secrets/kubernetes.io/serviceaccount/ca.crt']",
57+
"avd_reference": "https://avd.aquasec.com/kube-hunter/none/",
58+
"hunter": "Access Secrets"
59+
},
60+
{
61+
"location": "10.0.1.1:10255",
62+
"vid": "KHV044",
63+
"category": "Privilege Escalation // Privileged container",
64+
"severity": "high",
65+
"vulnerability": "Privileged Container",
66+
"description": "A Privileged container exist on a node\n could expose the node/cluster to unwanted root operations",
67+
"evidence": "pod: kube-proxy, container: kube-proxy, count: 1",
68+
"avd_reference": "https://avd.aquasec.com/kube-hunter/khv044/",
69+
"hunter": "Kubelet Readonly Ports Hunter"
70+
},
71+
{
72+
"location": "10.0.1.1:10255",
73+
"vid": "KHV043",
74+
"category": "Initial Access // General Sensitive Information",
75+
"severity": "low",
76+
"vulnerability": "Cluster Health Disclosure",
77+
"description": "By accessing the open /healthz handler,\n an attacker could get the cluster health state without authenticating",
78+
"evidence": "status: ok",
79+
"avd_reference": "https://avd.aquasec.com/kube-hunter/khv043/",
80+
"hunter": "Kubelet Readonly Ports Hunter"
81+
},
82+
{
83+
"location": "10.0.1.1:10255",
84+
"vid": "KHV052",
85+
"category": "Discovery // Access Kubelet API",
86+
"severity": "medium",
87+
"vulnerability": "Exposed Pods",
88+
"description": "An attacker could view sensitive information about pods that are\n bound to a Node using the /pods endpoint",
89+
"evidence": "count: 7",
90+
"avd_reference": "https://avd.aquasec.com/kube-hunter/khv052/",
91+
"hunter": "Kubelet Readonly Ports Hunter"
92+
},
93+
{
94+
"location": "10.0.0.1:443",
95+
"vid": "KHV002",
96+
"category": "Initial Access // Exposed sensitive interfaces",
97+
"severity": "high",
98+
"vulnerability": "K8s Version Disclosure",
99+
"description": "The kubernetes version could be obtained from the /version endpoint",
100+
"evidence": "v1",
101+
"avd_reference": "https://avd.aquasec.com/kube-hunter/khv002/",
102+
"hunter": "Api Version Hunter"
103+
},
104+
{
105+
"location": "10.16.0.1:443",
106+
"vid": "KHV005",
107+
"category": "Discovery // Access the K8S API Server",
108+
"severity": "medium",
109+
"vulnerability": "Access to API using service account token",
110+
"description": "The API Server port is accessible.\n Depending on your RBAC settings this could expose access to or control of your cluster.",
111+
"evidence": "b'{\"kind\":\"APIVersions\",\"versions\":[\"v1\"],\"serverAddressByClientCIDRs\":[{\"clientCIDR\":\"0.0.0.0/0\",\"serverAddress\":\"10.1.1.1:443\"}]}\\n'",
112+
"avd_reference": "https://avd.aquasec.com/kube-hunter/khv005/",
113+
"hunter": "API Server Hunter"
114+
}
115+
]
116+
}

‎unittests/scans/kubehunter/kubehunter_one_vul.json‎

Lines changed: 39 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,39 @@
1-
{"nodes": [{"type": "Node/Master", "location": "10.1.1.1"}, {"type": "Node/Master", "location": "10.2.2.0"}], "services": [{"service": "Kubelet API (readonly)", "location": "10.0.1.1:10255"}, {"service": "Kubelet API", "location": "10.0.1.1:10250"}, {"service": "API Server", "location": "10.0.0.1:443"}], "vulnerabilities": [{"location": "10.0.1.1:10255", "vid": "KHV044", "category": "Privilege Escalation // Privileged container", "severity": "high", "vulnerability": "Privileged Container", "description": "A Privileged container exist on a node\n could expose the node/cluster to unwanted root operations", "evidence": "pod: kube-proxy, container: kube-proxy, count: 1", "avd_reference": "https://avd.aquasec.com/kube-hunter/khv044/", "hunter": "Kubelet Readonly Ports Hunter"}]}
1+
{
2+
"nodes": [
3+
{
4+
"type": "Node/Master",
5+
"location": "10.1.1.1"
6+
},
7+
{
8+
"type": "Node/Master",
9+
"location": "10.2.2.0"
10+
}
11+
],
12+
"services": [
13+
{
14+
"service": "Kubelet API (readonly)",
15+
"location": "10.0.1.1:10255"
16+
},
17+
{
18+
"service": "Kubelet API",
19+
"location": "10.0.1.1:10250"
20+
},
21+
{
22+
"service": "API Server",
23+
"location": "10.0.0.1:443"
24+
}
25+
],
26+
"vulnerabilities": [
27+
{
28+
"location": "10.0.1.1:10255",
29+
"vid": "KHV044",
30+
"category": "Privilege Escalation // Privileged container",
31+
"severity": "high",
32+
"vulnerability": "Privileged Container",
33+
"description": "A Privileged container exist on a node\n could expose the node/cluster to unwanted root operations",
34+
"evidence": "pod: kube-proxy, container: kube-proxy, count: 1",
35+
"avd_reference": "https://avd.aquasec.com/kube-hunter/khv044/",
36+
"hunter": "Kubelet Readonly Ports Hunter"
37+
}
38+
]
39+
}

‎unittests/scans/kubehunter/kubehunter_zero_vul.json‎

Lines changed: 27 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,27 @@
1-
{"nodes": [{"type": "Node/Master", "location": "10.1.1.1"}, {"type": "Node/Master", "location": "10.2.2.0"}], "services": [{"service": "Kubelet API (readonly)", "location": "10.0.1.1:10255"}, {"service": "Kubelet API", "location": "10.0.1.1:10250"}, {"service": "API Server", "location": "10.0.0.1:443"}], "vulnerabilities": []}
1+
{
2+
"nodes": [
3+
{
4+
"type": "Node/Master",
5+
"location": "10.1.1.1"
6+
},
7+
{
8+
"type": "Node/Master",
9+
"location": "10.2.2.0"
10+
}
11+
],
12+
"services": [
13+
{
14+
"service": "Kubelet API (readonly)",
15+
"location": "10.0.1.1:10255"
16+
},
17+
{
18+
"service": "Kubelet API",
19+
"location": "10.0.1.1:10250"
20+
},
21+
{
22+
"service": "API Server",
23+
"location": "10.0.0.1:443"
24+
}
25+
],
26+
"vulnerabilities": []
27+
}

0 commit comments

Comments
 (0)