Skip to content

Commit e917ddf

Browse files
DVKunionDVKunion
authored
feat(veinmind-minio): CVE-2023-28432 (#213)
* feat(veinmind-minio): CVE-2023-28432 * feat(veinmind-minio): add doc pic
1 parent 9f3024e commit e917ddf

File tree

15 files changed

+2210
-1
lines changed

15 files changed

+2210
-1
lines changed

‎.github/workflows/veinmind-build.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ jobs:
1919
veinmind-vuln,
2020
veinmind-weakpass,
2121
veinmind-webshell,
22+
veinmind-minio,
2223
]
2324
path: [ ./plugins/go/ ]
2425
include:

‎.github/workflows/veinmind-package.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,10 @@ jobs:
8484
with:
8585
name: veinmind-basic-amd64
8686
path: ./
87+
- uses: actions/download-artifact@v3
88+
with:
89+
name: veinmind-minio-amd64
90+
path: ./
8791
- uses: actions/download-artifact@v3
8892
with:
8993
name: veinmind-runner-amd64
@@ -99,11 +103,12 @@ jobs:
99103
mv veinmind-iac_${{env.CI_GOOS}}_${{env.CI_GOARCH}} veinmind-iac
100104
mv veinmind-basic_${{env.CI_GOOS}}_${{env.CI_GOARCH}} veinmind-basic
101105
mv veinmind-escalate_${{env.CI_GOOS}}_${{env.CI_GOARCH}} veinmind-escalate
106+
mv veinmind-minio_${{env.CI_GOOS}}_${{env.CI_GOARCH}} veinmind-minio
102107
mv ./plugins/python/veinmind-history ./veinmind-history
103108
mv ./plugins/python/veinmind-backdoor ./veinmind-backdoor
104109
rm -rf ./veinmind-runner && mv veinmind-runner_${{env.CI_GOOS}}_${{env.CI_GOARCH}} veinmind-runner
105110
chmod +x veinmind-runner veinmind-malicious veinmind-vuln veinmind-webshell veinmind-unsafe-mount veinmind-log4j2 veinmind-weakpass veinmind-iac veinmind-sensitive veinmind-basic veinmind-escalate
106-
tar cvzf veinmind-runner.tar.gz veinmind-runner veinmind-malicious veinmind-vuln veinmind-webshell \
111+
tar cvzf veinmind-runner.tar.gz veinmind-runner veinmind-malicious veinmind-vuln veinmind-webshell veinmind-minio \
107112
veinmind-unsafe-mount veinmind-log4j2 veinmind-weakpass veinmind-iac veinmind-sensitive veinmind-basic veinmind-escalate \
108113
./veinmind-history \
109114
./veinmind-backdoor \

‎.github/workflows/veinmind-push.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,7 @@ jobs:
6060
veinmind-vuln,
6161
veinmind-weakpass,
6262
veinmind-webshell,
63+
veinmind-minio,
6364
]
6465
path: [ ./plugins/go/ ]
6566
name: ${{ matrix.plugin }}

‎docs/veinmind-minio/minio_scan_1.png‎

62.2 KB
Loading

‎docs/veinmind-minio/minio_scan_2.png‎

62.9 KB
Loading

‎docs/veinmind-minio/minio_scan_3.png‎

48 KB
Loading

‎plugins/go/veinmind-minio/Dockerfile‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
FROM veinmind/go1.18:1.5.3-stretch as builder
2+
WORKDIR /build
3+
COPY .. .
4+
RUN make build
5+
6+
FROM alpine:3.9 as compresser
7+
WORKDIR /build
8+
COPY --from=builder /build/veinmind-minio .
9+
RUN sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories && apk add upx && upx -9 veinmind-minio
10+
11+
FROM veinmind/base:1.5.3-slim as release
12+
WORKDIR /tool
13+
COPY --from=compresser /build/veinmind-minio .
14+
RUN echo "#!/bin/bash\n\n./veinmind-minio \$*" > /tool/entrypoint.sh && chmod +x /tool/entrypoint.sh && chmod +x /tool/veinmind-minio
15+
ENTRYPOINT ["/tool/entrypoint.sh"]

‎plugins/go/veinmind-minio/Makefile‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
.DEFAULT_GOAL := help
2+
3+
# plugin params
4+
SHELL = /bin/bash
5+
APP = veinmind-minio
6+
CMD = cmd/cli.go
7+
ARG = ""
8+
9+
# build params
10+
IMAGE_TAG = latest
11+
CI_GOOS = linux
12+
CI_GOARCH=$(shell uname -m)
13+
14+
##@ Init
15+
.PHONY: deps
16+
deps: ## Install Dependencies.
17+
go env -w GOPROXY=https://goproxy.cn,direct && go mod tidy
18+
19+
##@ Build
20+
.PHONY: build
21+
build: deps ## Build Apps.
22+
go build -ldflags '-s -w' -v -trimpath -a -o ${APP} ${CMD}
23+
24+
.PHONY: build.platform
25+
build.platform: deps ## Build Apps With Platform.
26+
export CGO_ENABLED=1 GOOS="${CI_GOOS}" GOARCH="${CI_GOARCH}"; \
27+
go build -ldflags '-s -w' -v -trimpath -a -o ${APP}_${CI_GOOS}_${CI_GOARCH} ${CMD}
28+
29+
.PHONY: build.docker
30+
build.docker: ## Build Apps Docker Images.
31+
docker build -t ${APP}:${IMAGE_TAG} .
32+
33+
##@ Run
34+
.PHONY: run
35+
run: deps ## Run Apps. e.g. : `make run ARG="scan iac xxxx"` .
36+
go run ${CMD} ${ARG}
37+
38+
.PHONY: run.docker
39+
run.docker: ## Run With Parallel Container Mode. e.g. : `make run.docker ARG="scan iac xxxx"` .
40+
docker run --rm -it --mount 'type=bind,source=/,target=/host,readonly,bind-propagation=rslave' -v `pwd`:/tool/data registry.veinmind.tech/veinmind/${APP} ${ARG}
41+
42+
.PHONY: help
43+
help:
44+
@awk 'BEGIN {FS = ":.*##"; printf "Usage: make \033[36m<target>\033[0m\n"} /^[a-zA-Z_-\\.]+:.*?##/ { printf " \033[36m%-10s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)

‎plugins/go/veinmind-minio/README.md‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
# veinmind-minio
2+
3+
<p align="center">
4+
veinmind-minio 主要用于扫描 CVE-2023-28432 漏洞专项检查。
5+
</p>
6+
7+
## 功能特性
8+
9+
- 快速扫描容器/镜像中的minio CVE-2023-28432风险
10+
- 支持`JSON`/`CLI`/`HTML`等多种报告格式输出
11+
12+
## 兼容性
13+
14+
- linux/amd64
15+
- linux/386
16+
- linux/arm64
17+
- linux/arm
18+
19+
## 使用方式
20+
21+
### 基于可执行文件
22+
23+
请先安装`libveinmind`，安装方法可以参考[官方文档](https://github.com/chaitin/libveinmind)
24+
#### Makefile 一键命令
25+
26+
```
27+
make run ARG="scan xxx"
28+
```
29+
#### 自行编译可执行文件进行扫描
30+
31+
编译可执行文件
32+
```
33+
make build
34+
```
35+
运行可执行文件进行扫描
36+
```
37+
chmod +x veinmind-minio && ./veinmind-minio scan xxx
38+
```
39+
### 基于平行容器模式
40+
确保机器上安装了`docker`以及`docker-compose`
41+
#### Makefile 一键命令
42+
```
43+
make run.docker ARG="scan xxxx"
44+
```
45+
#### 自行构建镜像进行扫描
46+
构建`veinmind-minio`镜像
47+
```
48+
make build.docker
49+
```
50+
运行容器进行扫描
51+
```
52+
docker run --rm -it --mount 'type=bind,source=/,target=/host,readonly,bind-propagation=rslave' veinmind-minio scan xxx
53+
```
54+
55+
## 使用参数
56+
57+
1.指定镜像名称或镜像ID并扫描 (需要本地存在对应的镜像)
58+
59+
```
60+
./veinmind-minio scan image [imageID/imageName]
61+
```
62+
![](../../../docs/veinmind-minio/minio_scan_1.png)
63+
2.扫描所有本地镜像
64+
65+
```
66+
./veinmind-minio scan image
67+
```
68+
69+
3.指定容器名称或容器ID并扫描
70+
71+
```
72+
./veinmind-minio scan container [containerID/containerName]
73+
```
74+
![](../../../docs/veinmind-minio/minio_scan_2.png)
75+
4.扫描所有本地容器
76+
77+
```
78+
./veinmind-minio scan container
79+
```
80+
81+
5.指定输出格式
82+
支持的输出格式：
83+
- html
84+
- json
85+
- cli（默认）
86+
```
87+
./veinmind-minio scan container [containerID/containerName] -f html
88+
```
89+
生成的result.html效果如图：
90+
91+
![](../../../docs/veinmind-minio/minio_scan_3.png)
92+

‎plugins/go/veinmind-minio/cmd/cli.go‎

Lines changed: 159 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,159 @@
1+
package main
2+
3+
import (
4+
"os"
5+
"time"
6+
7+
api "github.com/chaitin/libveinmind/go"
8+
"github.com/chaitin/libveinmind/go/cmd"
9+
"github.com/chaitin/libveinmind/go/plugin"
10+
"github.com/chaitin/veinmind-common-go/service/report"
11+
"github.com/chaitin/veinmind-common-go/service/report/event"
12+
"github.com/chaitin/veinmind-tools/plugins/go/veinmind-minio/pkg/scanner"
13+
)
14+
15+
var reportService = &report.Service{}
16+
var rootCmd = &cmd.Command{}
17+
18+
var scanCmd = &cmd.Command{
19+
Use: "scan",
20+
}
21+
22+
var scanImageCmd = &cmd.Command{
23+
Use: "image",
24+
Short: "scan image command",
25+
}
26+
27+
var scanContainerCmd = &cmd.Command{
28+
Use: "container",
29+
Short: "scan container command",
30+
}
31+
32+
var ReferencesURLList = []string{
33+
"https://mp.weixin.qq.com/s/JgskenAZ6Cpecoe2k2AEjQ",
34+
"https://github.com/minio/minio/releases/tag/RELEASE.2023-03-20T20-16-18Z",
35+
"https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q",
36+
}
37+
38+
// scanImage is func that used to do some action with Images
39+
// you can write your plugin scan code here
40+
func scanImage(c *cmd.Command, image api.Image) error {
41+
// do something here
42+
res, err := scanner.ScanImage(image)
43+
if err != nil {
44+
return err
45+
}
46+
47+
if res.Version != "" {
48+
// if you want display at runner report, you should send your result to report event
49+
reportEvent := &event.Event{
50+
BasicInfo: &event.BasicInfo{
51+
ID: image.ID(),
52+
Object: event.NewObject(image),
53+
Time: time.Now(),
54+
Level: event.Critical,
55+
DetectType: event.Image,
56+
EventType: event.Risk,
57+
AlertType: event.Vulnerability,
58+
},
59+
DetailInfo: &event.DetailInfo{
60+
AlertDetail: &event.VulnDetail{
61+
ID: "CVE-2023-28432",
62+
Published: time.Date(2023, 03, 23, 0, 0, 0, 0, time.Local),
63+
Summary: "Information Disclosure in Cluster Deployment",
64+
Details: "In a cluster deployment, MinIO returns all environment variables, including MINIO_SECRET_KEY and MINIO_ROOT_PASSWORD, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade ASAP.",
65+
References: initReferences(),
66+
Source: event.Source{
67+
Type: "go-binary",
68+
FilePath: res.File,
69+
Packages: event.AssetPackageDetail{
70+
Name: res.File,
71+
Version: res.Version,
72+
},
73+
},
74+
},
75+
},
76+
}
77+
err := reportService.Client.Report(reportEvent)
78+
if err != nil {
79+
return err
80+
}
81+
}
82+
83+
return nil
84+
}
85+
86+
// scanContainer is func that used to do some action with container
87+
// you can write your plugin scan code here
88+
func scanContainer(c *cmd.Command, container api.Container) error {
89+
// do something here
90+
res, err := scanner.ScanContainer(container)
91+
if err != nil {
92+
return err
93+
}
94+
95+
if res.Version != "" {
96+
reportEvent := &event.Event{
97+
BasicInfo: &event.BasicInfo{
98+
ID: container.ID(), // container id info
99+
Object: event.NewObject(container),
100+
Time: time.Now(), // report time, usually use time.Now
101+
Level: event.Critical, // report event level
102+
DetectType: event.Container, // report scan object type
103+
EventType: event.Risk,
104+
AlertType: event.Vulnerability,
105+
},
106+
DetailInfo: &event.DetailInfo{
107+
AlertDetail: &event.VulnDetail{
108+
ID: "CVE-2023-28432",
109+
Published: time.Date(2023, 03, 23, 0, 0, 0, 0, time.Local),
110+
Summary: "Information Disclosure in Cluster Deployment",
111+
Details: "In a cluster deployment, MinIO returns all environment variables, including MINIO_SECRET_KEY and MINIO_ROOT_PASSWORD, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade ASAP.",
112+
References: initReferences(),
113+
Source: event.Source{
114+
Type: "go-binary",
115+
FilePath: res.File,
116+
Packages: event.AssetPackageDetail{
117+
Name: res.File,
118+
Version: res.Version,
119+
},
120+
},
121+
},
122+
},
123+
}
124+
err := reportService.Client.Report(reportEvent)
125+
if err != nil {
126+
return err
127+
}
128+
}
129+
130+
return nil
131+
}
132+
133+
func initReferences() (res []event.References) {
134+
for _, value := range ReferencesURLList {
135+
tmpRef := event.References{
136+
Type: "URL",
137+
URL: value,
138+
}
139+
res = append(res, tmpRef)
140+
}
141+
return res
142+
}
143+
144+
func init() {
145+
rootCmd.AddCommand(scanCmd)
146+
scanCmd.AddCommand(report.MapReportCmd(cmd.MapImageCommand(scanImageCmd, scanImage), reportService))
147+
scanCmd.AddCommand(report.MapReportCmd(cmd.MapContainerCommand(scanContainerCmd, scanContainer), reportService))
148+
rootCmd.AddCommand(cmd.NewInfoCommand(plugin.Manifest{
149+
Name: "veinmind-minio",
150+
Author: "veinmind-team",
151+
Description: "veinmind-minio scan CVE-2023-28432 risk in images/containers",
152+
}))
153+
}
154+
155+
func main() {
156+
if err := rootCmd.Execute(); err != nil {
157+
os.Exit(1)
158+
}
159+
}

0 commit comments

Comments
 (0)