Files
nuclei-templates/cloud/kubernetes/deployments/k8s-host-ports-check.yaml
2024-06-18 16:04:45 +04:00

50 lines
1.9 KiB
YAML

id: k8s-host-ports-check
info:
name: Host ports should not be used
author: princechaddha
severity: medium
description: Checks Kubernetes Deployments to ensure they are not configured to use host ports, which can expose the host to potential security risks.
impact: |
Using host ports can compromise the isolation between the host and the containers, increasing the risk of unauthorized access to host resources. This can lead to security breaches.
remediation: |
Avoid using host ports in Kubernetes Deployments. Use services or other networking mechanisms to expose container applications.
reference:
- https://kubernetes.io/docs/concepts/services-networking/service/
tags: cloud,devops,kubernetes,devsecops,deployments,k8s,k8s-cluster-security
flow: |
code(1);
for (let deployment of template.items) {
set("deployment", deployment)
javascript(1);
}
self-contained: true
code:
- engine:
- sh
- bash
source: kubectl get deployments --all-namespaces --output=json
extractors:
- type: json
name: items
internal: true
json:
- '.items[] | {name: .metadata.name, namespace: .metadata.namespace, containers: .spec.template.spec.containers}'
javascript:
- code: |
let deploymentData = JSON.parse(template.deployment);
deploymentData.containers.forEach(container => {
if (container.ports && container.ports.some(port => port.hostPort)) {
let result = (`Deployment '${deploymentData.name}' in namespace '${deploymentData.namespace}' uses host ports.`);
Export(result);
}
});
extractors:
- type: dsl
dsl:
- response
# digest: 4b0a00483046022100f3a3753e5b3711de8e19eb7d96fe6cb9bbb71ea0d38975957c40c504f3469967022100c210bc6cb2adbcf0da1de9cd21c812ec890563c3cd8bb2edc76196cd311aecbd:366f2a24c8eb519f6968bd8801c08ebe