Encryption for Unattached Disks - Disabled

ID: unattached-disk-encryption-disabled

Severity: high

Author: DhiyaneshDK

Tags: cloud,devops,aliyun,alibaba,alibaba-cloud-config,ecs

Description

Unencrypted unattached disks in Alibaba Cloud pose a risk of data exposure if accessed by unauthorized users. Enabling encryption ensures the security of sensitive data at rest.

YAML Source

id: unattached-disk-encryption-disabled

info:
  name: Encryption for Unattached Disks - Disabled
  author: DhiyaneshDK
  severity: high
  description: |
    Unencrypted unattached disks in Alibaba Cloud pose a risk of data exposure if accessed by unauthorized users. Enabling encryption ensures the security of sensitive data at rest.
  reference:
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-ECS/encrypt-unattached-disks.html
    - https://www.alibabacloud.com/help/en/ecs/user-guide/encrypt-a-data-disk
  metadata:
    max-request: 1
    verified: true
  tags: cloud,devops,aliyun,alibaba,alibaba-cloud-config,ecs

variables:
  region: "cn-hangzhou"

self-contained: true

code:
  - engine:
      - sh
      - bash
    source: |
      aliyun ecs DescribeDisks --Status Available --region $region

    matchers:
      - type: word
        words:
          - '"Encrypted": false'

    extractors:
      - type: dsl
        dsl:
          - '" Encryption for Unattached Disks is Disabled "'
# digest: 4a0a00473045022100e3f1eb9d2f25397e2c3f9b1fc03ff807b1f188d0168bd3bb3f37314a23a68d6f02200a78f4cbcbf9c402d5e827134acfe497858577368c7c4ee8792fd1cd97198c32:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "cloud/alibaba/ecs/unattached-disk-encryption-disabled.yaml"

View on Github