Defender For Cloud – Security alerts – a reference guide (Containers)

scp in OpenSSH through 8.6p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. <P>
Affected Versions:<BR>
8.6p1 and prior versions of OpenSSH <P>

QID Detection Logic:<BR>
The QID checks for the vulnerable versions of OpenSSH and checks the presence of scp command by executing ‘which scp'<P>
Note : Affected version checked till 8.6p1 as per PoC.

scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. <P>
Affected Versions:<BR>
8.3p1 and prior versions of OpenSSH <P>

QID Detection Logic:<BR>
The QID checks for the vulnerable versions of OpenSSH and checks the presence of scp command by executing ‘which scp'<P>
Note : Affected version checked till 8.3p1 as per PoC.

scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. <P>
Affected Versions:<BR>
8.3p1 and prior versions of OpenSSH <P>

QID Detection Logic:<BR>
The QID checks for the vulnerable versions of OpenSSH and checks the presence of scp command by executing ‘which scp'<P>
Note : Affected version checked till 8.6p1 as per PoC.

Affected versions:<BR>
Alpine Linux 3.12 <BR>

Affected versions:<BR>
Alpine Linux 3.8 <BR><P>

QID Detection Logic (authenticated):
The QID checks for Alpine Linux version using &quot;cat /etc/alpine-release&quot; command.

Affected versions:<BR>
Alpine Linux 3.6 <BR><P>

QID Detection Logic (authenticated):
The QID checks for Alpine Linux version using &quot;cat /etc/alpine-release&quot; command..

Affected OS:<BR>
Debian 9<BR>
Debian 10<P>

<P>Affected Versions:<BR>
All Linux docker images who has NULL password

<P>QID Detection Logic:<BR>
This QID checks if the /etc/shadow file of alpine linux docker images have NULL password or not.<P>

<BR><B>Note</B>: on 5/21/2019, we extend this QID to detect this vulnerability on ALL Linux docker images.

Note: For unix target, this QID will only work if Go path is properly set in environment variable.<P>

Note: For unix target , this QID will only work if Go path is properly set in environment variable.<P>

Affected version:<BR>
Kubernetes versions 1.0 to 1.20 are affected.<P>

QID Detection Logic:(Authenticated)<BR>
It uses &quot;kubectl version&quot; command to check for vulnerable versions of Kubernetes and also checks if &quot;kube-apiserver&quot; is running or not.<P>

QID Detection Logic:(Unauthenticated)<BR>
The detection uses the response from requests HTTP GET /openapi/v2 and HTTP GET /version to check for the version of Kubernetes.<P>

No mitigations are provided for LoadBalancer IPs since we do not recommend granting users patch service/status permission. If LoadBalancer IP restrictions are required, the approach for the external IP mitigations can be copied.

CVE-2021-31525: A vulnerability was found in net/http of the Go standard library when parsing very large HTTP header values, causing a crash and subsequent denial of service. This vulnerability affects both clients and servers written in Go, however servers are only vulnerable if the default 1 MB value for MaxHeaderBytes is increased.<P>

Affected Version:<BR>
Go version before 1.15.12<BR>
Go version 1.16.x before 1.16.4<P>

QID Detection Logic(authenticated):<BR>This QID checks for vulnerable version of Go installed on the target.<P>

Note: For unix target, this QID will only work if Go path is properly set in environment variable.<P>

Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR.<P>

Affected versions: <BR>
Golang versions prior to 1.17<P>

QID Detection Logic:<BR>
This QID detects vulnerable versions of Golang with ‘go version’ command.<P>

Affected versions: <BR>
Prior to 1.16.6 <BR>
Prior to 1.15.14 <BR>

QID Detection Logic:<BR>
This QID detects vulnerable versions of Go lang.<P>

<P>Affected versions:<BR>
Log4j versions  2.x prior to and including  2.14.1 (exclude 2.12.x)<BR>
Log4j versions 2.12.x prior to 2.12.2<BR>

<P>QID Detection: (Authenticated) – Linux<BR>
Detection logic is checking for vulnerable jar version and also checks for JNDI Class is present or not.<BR>

This detection logic is updated to find log4j installs using the locate command and ls proc command. These updates are in VULNSIGS-2.5.352-4 <BR>

QID Detection: (Authenticated) – Windows<BR>
On Windows system, the QID identifies vulnerable instance of log4j via WMI to check log4j included in the running processes via command-line.
<BR>
<P>
Note:QID 376157 also leverages the OS package manager to identify vulnerable Log4j packages.This method checks only version information and does not check for workaround.<P>

Note: Please provide Oracle auth records for scanning Oracle Database instances.<BR>

<P>Affected versions:<BR>
Log4j versions  2.x prior to and including  2.14.1<BR>

<P>QID Detection: (Authenticated)<BR>
This detection is based on querying the OS package managers on the target. If the target has a log4j package with a version less than 2.15.0, the target is flagged as vulnerable.

This detection logic is updated to find log4j installs using the locate command and ls proc command. These updates are in VULNSIGS-2.5.352-4 <BR>
On Windows system, the QID identifies vulnerable instance of log4j via WMI to check log4j included in the running processes via command-line.
<BR>
<P>
Note:QID 376157 leverages the OS package manager to identify vulnerable Log4j packages. If the target does not have the vulnerable log4j package installed via the package manager, this QID might not get detected. This would typically happen when an application bundles the Log4j library in a jar etc. <BR>

CVE-2021-45046: A zero-day exploit affecting the popular Apache Log4j utility to Denial of Service attack.<P>

<P>Affected versions:<BR>
Log4j versions from 2.x prior to and including  2.12.2<BR>
Log4j versions 2.13.0 prior to and including 2.15.0<P>

<P>QID Detection: (Authenticated)<BR>
This detection is based on querying the OS package managers on the target. If the target has a log4j package with a affected version, the target is flagged as vulnerable.
This detection logic is updated to find log4j installs using the locate command and ls proc command.<BR>
On Windows system, the QID identifies vulnerable instance of log4j via WMI to check log4j included in the running processes via command-line.
<BR>
<P>
<B>Note:</B>QID leverages the OS package manager to identify vulnerable Log4j packages. If the target does not have the vulnerable log4j package installed via the package manager, this QID might not get detected. This would typically happen when an application bundles the Log4j library in a jar etc. <BR>

CVE-2021-45046: A zero-day exploit affecting the popular Apache Log4j utility to Remote Code Execution and Denial of Service attack.<P>

<P>Affected versions:<BR>
Log4j versions from 2.x prior to 2.12.2<BR>
Log4j versions 2.13.0 prior to and including 2.15.0<P>

<P>QID Detection: (Authenticated) – Linux<BR>
This detection is based on querying the OS package managers on the target. If the target has a log4j package with an affected version, the target is flagged as vulnerable.
This detection logic is updated to find log4j installs using the locate command and ls proc command.<BR>

QID Detection: (Authenticated) – Windows<BR>
On Windows system, the QID identifies vulnerable instance of log4j via WMI to check log4j included in the running processes via command-line.
<BR>
<P>
<B>Note:</B>QID leverages the OS package manager to identify vulnerable Log4j packages. If the target does not have the vulnerable log4j package installed via the package manager, this QID might not get detected. This would typically happen when an application bundles the Log4j library in a jar etc. <BR>
This detection checks only version information and does not check for workaround.<BR>

<P>Affected versions:<BR>
Log4j versions  all versions from 2.0-beta9 to 2.16.0, excluding 2.12.3, 2.3.1<BR>

<P>QID Detection: (Authenticated)<BR>
This detection is based on querying the OS package managers on the target. If the target has a log4j package with a version less than or equals to 2.16.0, the target is flagged as vulnerable.

This detection logic also tries to find log4j installs using the locate command and ls proc command. These updates are in VULNSIGS-2_5_357<BR>

QID Detection: (Authenticated) – Windows <BR>
On Windows system, the QID identifies vulnerable instance of log4j via WMI to check log4j included in the running processes via command-line.
<BR>
<P>

CVE-2021-44832: Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration.<P>

<P>Affected versions:<BR>

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4)<P>

<P>QID Detection: (Authenticated) – Linux<BR>
This detection is based on querying the OS package managers on the target. If the target has a log4j package with a affected version, the target is flagged as vulnerable.
This detection logic is updated to find log4j installs using the locate command and ls proc command.<P>
QID Detection: (Authenticated) – Windows<BR>
On Windows system, the QID identifies vulnerable instance of log4j via WMI to check log4j included in the running processes via command-line.
<P>

Integer overflow that can lead to heap overflow in Redis-CLI, Redis-sentinel on some platforms and DoS vulnerability<P>

Affected Versions:<BR>
Redis  Server versions prior to 6.2.6, 6.0.16, 5.0.14<P>

QID Detection Logic (Authenticated): Linux<BR>
This QID executes the commands &quot;redis-server –version&quot;, &quot;redis-cli –version&quot; and &quot;redis-sentinel –version&quot; to identify versions of Redis Server, Redis cli and Redis Sentinel, respectively, to detect Redis Server versions prior to 6.2.6, 6.0.16 and 5.0.14.<BR>

Triggering this vulnerability requires use of the Spring MVC and Spring WebFlux applications running on JDK9 and above.<P>

Vulnerable Versions:<BR>
Spring framework versions 5.3.0 to 5.3.17, 5.2.0 to 5.2.19, and older are vulnerable.<BR>

QID Detection: (Authenticated) – Linux<BR>
Detection logic checks if system has java 9 or later versions and executes locate -b -e -r ‘^spring\-webmvc.*\.jar$’ -r ‘^spring\-webflux.*\.jar$’ command, ls -l /proc/*/fd | grep -Eo ‘\S+\/spring\S+jar’ | uniq 2&gt; /dev/null and checks if any or both of the spring-webmvc-*.jar or spring-webflux*.jar files are present on the system. <BR>
<P>
QID Detection: (Authenticated) – Windows<BR>
On Windows systems, the QID identifies vulnerable instances of Spring via WMI and checks whether &quot;spring-webmvc&quot;, &quot;spring-webflux&quot; and &quot;spring-boot&quot; are included in the running processes via command-line with JDK9 or higher<BR>
<P>
QID Detection: (Authenticated) – MacOS<BR>
Detection logic checks if system runs java 9 or later versions and executes locate command to check the presence of &quot;spring-webmvc&quot;, and &quot;spring-webflux&quot; jar files on a system.<P>
QID Detection: (Qualys CS Image Scanning)<BR>
Container Sensor image scanning uses the &quot;find&quot; command to check for &quot;spring-webmvc&quot; and &quot;spring-webflux&quot; jars from .war/.jar files along with JDK9 or higher.<P>

QID Detection: (Qualys CS Image Scanning)<BR>
Container Sensor image scanning uses find command to check for spring-webmvc and spring-webflux  jars from .war/.jar files along with JDK9 or higher.<P>

Triggering this vulnerability requires use of the Spring MVC and Spring WebFlux applications running on JDK9 and above.<P>

Vulnerable Versions:<BR>
Spring framework versions 5.3.0 to 5.3.17, 5.2.0 to 5.2.19, and older are vulnerable.<BR>

QID Detection: (Authenticated) – Linux<BR>
Detection logic checks if system has java 9 or later versions and executes locate -b -e -r ‘^spring\-webmvc.*\.jar$’ -r ‘^spring\-webflux.*\.jar$’ command, ls -l /proc/*/fd | grep -Eo ‘\S+\/spring\S+jar’ | uniq 2&gt; /dev/null and checks if any or both of the spring-webmvc-*.jar or spring-webflux*.jar  present on the system. <BR>
<P>
QID Detection: (Authenticated) – Windows<BR>
On Windows system, the QID identifies vulnerable instance of Spring via WMI to check spring-webmvc, spring-webflux and spring-boot are included in the running processes via command-line. with JDK9 or higher<BR>
<P>
QID Detection: (Authenticated) – MacOS<BR>
Detection logic checks if system has java 9 or later versions and executes locate command to check the presence of spring-webmvc, and spring-webflux jar files on a system.<P>
QID Detection: (Qualys CS Image Scanning)<BR>
Container Sensor image scanning uses find command to check for spring-webmvc and spring-webflux  jars from .war/.jar files along with JDK9 or higher.<P>

Affected version:<BR>
kube-apiserver v1.20.0 – v1.20.5<BR>
kube-apiserver v1.19.0 – v1.19.9<BR>
kube-apiserver including and prior to v1.18.17<BR>

QID Detection Logic:(Authenticated)<BR>
The QID uses ‘kubectl version’ command to check for vulnerable versions of Kubernetes <P>

Affected version:<BR>
kubernetes v1.19.0 – v1.19.2<BR>
kubernetes v1.18.0 – v1.18.9<BR>
kubernetes v1.17.0 – v1.17.12<BR>

QID Detection Logic:(Authenticated)<BR>
The QID uses ‘kubectl version’ command to check for vulnerable versions of Kubernetes <P>

Affected version:<BR>
kubernetes v1.19.0 – v1.19.5<BR>
kubernetes v1.18.0 – v1.18.13<BR>
kubernetes v1.17.0 – v1.17.15<BR>

QID Detection Logic:(Authenticated)<BR>
The QID uses ‘kubectl version’ command to check for vulnerable versions of Kubernetes <P>

Affected version:<BR>
kubernetes v1.19.0 – v1.19.2<BR>
kubernetes v1.18.0 – v1.18.9<BR>
kubernetes v1.17.0 – v1.17.12<BR>

QID Detection Logic:(Authenticated)<BR>
The QID uses ‘kubectl version’ command to check for vulnerable versions of Kubernetes <P>

Affected version:<BR>
kubelet v1.18.0-1.18.5<BR>
kubelet v1.17.0-1.17.8<BR>
kubelet prior to  v1.16.13<BR>

QID Detection Logic:(Authenticated)<BR>
The QID uses ‘kubectl version’ command to check for vulnerable versions of Kubernetes <P>

Affected version:<BR>
kube-apiserver v1.18.0-1.18.5<BR>
kube-apiserver v1.17.0-1.17.8<BR>
kube-apiserver v1.16.0-1.16.12<BR>
all kube-apiserver versions prior to v1.16.0<BR>

QID Detection Logic:(Authenticated)<BR>
The QID uses ‘kubectl version’ command to check for vulnerable versions of Kubernetes <P>

Affected Versions:<BR>
Git 2.30.x prior to 2.30.7 <BR>
Git 2.31.x prior to 2.31.6 <BR>
Git 2.32.x prior to 2.32.5 <BR>
Git 2.33.x prior to 2.33.6 <BR>
Git 2.34.x prior to 2.34.6 <BR>
Git 2.35.x prior to 2.35.6 <BR>
Git 2.36.x prior to 2.36.4 <BR>
Git 2.37.x prior to 2.37.5 <BR>
Git 2.38.x prior to 2.38.3 <BR>
Git 2.39.x prior to 2.39.1 <P>

QID Detection Logic (authenticated):<BR>
Windows: This QID checks for vulnerable version of git-cmd.exe. <BR>
Linux/MacOS: This QID checks for vulnerable version via git –version.