Artifact Registry Vulnerability Scanning Not Enabled

ID: gcloud-vuln-scan-missing

Severity: high

Author: princechaddha

Tags: cloud,devops,gcp,gcloud,artifact-registry,container-scanning,gcp-cloud-config

Description

Ensure that vulnerability scanning for Google Cloud Artifact Registry repositories is enabled in order to find security weaknesses in your container images before deploying them and help prevent security breaches.

YAML Source

id: gcloud-vuln-scan-missing

info:
  name: Artifact Registry Vulnerability Scanning Not Enabled
  author: princechaddha
  severity: high
  description: |
    Ensure that vulnerability scanning for Google Cloud Artifact Registry repositories is enabled in order to find security weaknesses in your container images before deploying them and help prevent security breaches.
  impact: |
    Disabling vulnerability scanning on Artifact Registry repositories can expose your deployment to undiscovered security vulnerabilities, increasing the risk of security breaches.
  remediation: |
    Enable the Container Scanning API for each Artifact Registry by visiting the API & services page in the Google Cloud Console and enabling `containerscanning.googleapis.com`.
  reference:
    - https://cloud.google.com/artifact-registry/docs/vulnerability-scanning
  tags: cloud,devops,gcp,gcloud,artifact-registry,container-scanning,gcp-cloud-config

flow: |
  code(1)
  for(let projectId of iterate(template.projectIds)){
    set("projectId", projectId)
    code(2)
  }

self-contained: true

code:
  - engine:
      - sh
      - bash
    source: |
      gcloud projects list --format="json(projectId)"
    extractors:
      - type: json
        name: projectIds
        internal: true
        json:
          - '.[].projectId'

  - engine:
      - sh
      - bash
    source: |
      gcloud services list --enabled --project $projectId --format="json(config.name)"

    matchers:
      - type: word
        words:
          - 'containerscanning.googleapis.com'
        negative: true

      - type: word
        words:
          - '"config":'

    extractors:
      - type: dsl
        dsl:
          - '"Vulnerability Scanning not enabled for Artifact Registry in Project: " + projectId'
# digest: 4a0a004730450221009fddff36e3531876ec8020199fd3d82830417f005b705281b2382f4415a1a2750220507b9a58b4acc754e098c9bfad7d61ec238a0e4d4069632fb08eea3891c320ab:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "cloud/gcp/artifactregistry/gcloud-vuln-scan-missing.yaml"

View on Github