mirror of
https://github.com/projectdiscovery/nuclei-templates.git
synced 2026-01-31 07:43:27 +08:00
50 lines
1.9 KiB
YAML
50 lines
1.9 KiB
YAML
id: k8s-host-ports-check
|
|
|
|
info:
|
|
name: Host ports should not be used
|
|
author: princechaddha
|
|
severity: medium
|
|
description: Checks Kubernetes Deployments to ensure they are not configured to use host ports, which can expose the host to potential security risks.
|
|
impact: |
|
|
Using host ports can compromise the isolation between the host and the containers, increasing the risk of unauthorized access to host resources. This can lead to security breaches.
|
|
remediation: |
|
|
Avoid using host ports in Kubernetes Deployments. Use services or other networking mechanisms to expose container applications.
|
|
reference:
|
|
- https://kubernetes.io/docs/concepts/services-networking/service/
|
|
tags: cloud,devops,kubernetes,devsecops,deployments,k8s,k8s-cluster-security
|
|
|
|
flow: |
|
|
code(1);
|
|
for (let deployment of template.items) {
|
|
set("deployment", deployment)
|
|
javascript(1);
|
|
}
|
|
|
|
self-contained: true
|
|
code:
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: kubectl get deployments --all-namespaces --output=json
|
|
extractors:
|
|
- type: json
|
|
name: items
|
|
internal: true
|
|
json:
|
|
- '.items[] | {name: .metadata.name, namespace: .metadata.namespace, containers: .spec.template.spec.containers}'
|
|
|
|
javascript:
|
|
- code: |
|
|
let deploymentData = JSON.parse(template.deployment);
|
|
deploymentData.containers.forEach(container => {
|
|
if (container.ports && container.ports.some(port => port.hostPort)) {
|
|
let result = (`Deployment '${deploymentData.name}' in namespace '${deploymentData.namespace}' uses host ports.`);
|
|
Export(result);
|
|
}
|
|
});
|
|
|
|
extractors:
|
|
- type: dsl
|
|
dsl:
|
|
- response
|
|
# digest: 4b0a00483046022100f3a3753e5b3711de8e19eb7d96fe6cb9bbb71ea0d38975957c40c504f3469967022100c210bc6cb2adbcf0da1de9cd21c812ec890563c3cd8bb2edc76196cd311aecbd:366f2a24c8eb519f6968bd8801c08ebe |