Repository navigation
Don't confirm Kubernetes or Consul exposure from generic JSON - #36
Draft
cursor[bot] wants to merge 1 commit into
Draft
cursor[bot] wants to merge 1 commit into
cursor[bot] wants to merge 1 commit into
Conversation
check_kubernetes_noauth treated any HTTP 200 whose body contained a "versions" key as anonymous kube-apiserver access (CRITICAL). check_consul_noauth treated any JSON object on /v1/catalog/services as an open Consul API (HIGH). Fusion pins both as un-droppable. Require kube-apiserver identity (kind=APIVersions or serverAddressByClientCIDRs plus a versions list) and Consul catalog shape (tag lists plus X-Consul-Index or the default consul service). Co-authored-by: dmitryflynn <dmitryflynn@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bug and impact
check_kubernetes_noauthtreated any HTTP 200 whose JSON body contained a"versions"key as confirmed CRITICAL anonymous kube-apiserver access.check_consul_noauthtreated any JSON object onGET /v1/catalog/servicesas confirmed HIGH unauthenticated Consul.Fusion maps every
service_probe_resultfinding tosource=probe+ high reliability, and the gate pins those as un-droppable. A false CRITICAL/HIGH therefore lands in the report, HackerOne export, and executive summary.Sibling checks already require distinctive identity (
ApiVersionfor Docker,cluster_name/elasticsearchfor ES,node/peerURLsfor etcd). These two did not.Trigger:
--probe/--full(or any GUI scan) against a host with 6443 or 8500 open:GET /apiwith{"versions":["v1"]}(versioned REST, API gateway, mock)GET /v1/catalog/serviceswith{}or{"status":"ok"}Root cause
Kubernetes confirmation was
"versions" in bodyafter a loose pre-check. Consul confirmation wasbody.strip().startswith("{")plusjson.loads— no catalog shape, noX-Consul-Index.Fix
kind == "APIVersions"orserverAddressByClientCIDRs, and aversionslist.map[string][]stringcatalog values plusX-Consul-Indexor the defaultconsulservice.Validation
python3 -m pytest test_probers.py test_hardening.py test_fusion_engine_bridge.py test_service_enum.py -q— 105 passed.New cases: generic
{"versions":["v1"]}/{"status":"ok"}rejected; real kube-apiserverAPIVersionsstill CRITICAL; real Consul catalog still HIGH; 401 still means auth enforced.