Image Tag should be fixed - not latest or blank

ID: k8s-image-tag-not-fixed

Severity: low

Author: princechaddha

Tags: cloud,devops,kubernetes,k8s,devsecops,deployments,k8s-cluster-security

Description

Checks if Kubernetes Deployment container images are using tags other than ‘latest’ or blank, which can lead to unstable and unpredictable deployments.

YAML Source

id: k8s-image-tag-not-fixed

info:
  name: Image Tag should be fixed - not latest or blank
  author: princechaddha
  severity: low
  description: Checks if Kubernetes Deployment container images are using tags other than 'latest' or blank, which can lead to unstable and unpredictable deployments.
  impact: |
    Using 'latest' or blank image tags can result in deploying non-reproducible container images, potentially leading to unexpected application behavior and difficulties in troubleshooting.
  remediation: |
    Use specific image tags for all containers in Kubernetes Deployments to ensure reproducibility and stability of application deployments.
  reference:
    - https://kubernetes.io/docs/concepts/containers/images/
  tags: cloud,devops,kubernetes,k8s,devsecops,deployments,k8s-cluster-security

flow: |
  code(1);
  for (let deployment of template.items) {
    set("deployment",deployment)
    javascript(1);
  }

self-contained: true

code:
  - engine:
      - sh
      - bash
    source: kubectl get deployments --all-namespaces --output=json
    extractors:
      - type: json
        name: items
        internal: true
        json:
          - '.items[]'

javascript:
  - code: |
        deployment = JSON.parse(template.deployment);
        deployment.spec.template.spec.containers.forEach(container => {
          const tag = container.image.split(':').pop();
          if (tag === 'latest' || tag === '') {
            let result = (`Deployment '${deployment.metadata.name}' in namespace '${deployment.metadata.namespace}' uses 'latest' or blank image tag for container '${container.name}'.`);
            Export(result);
          }
        });

    extractors:
      - type: dsl
        dsl:
          - response
# digest: 490a0046304402205af00e8e402d32be2050dc9ea97a0fb6afc837008ecce4dbbab92fcab55ddab502206908326f89dd365d270fe3e5e41783ec68a6b1018c8eff18a2092b1ca020db72:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "cloud/kubernetes/deployments/k8s-image-tag-not-fixed.yaml"

View on Github