Containers Endpoint Exposed.bcheck

metadata:
    language: v2-beta
    name: "Containers Endpoint Exposed"
    description: "Containers endpoints that have been exposed"
    author: "Kaustubh"

run for each:
    potential_path =
        "/Dockerrun.aws.json",
        "/v1.24/containers/json",
        "/v1.24/images/json",
        "/v1.24/version",
        "/Dockerfile",
        "/docker-compose.yml",
        "/api/v1/nodes",
        "/pods",
        "/metrics",
        "/api/v1/namespaces/kube-system/services/kubernetes-dashboard:/proxy/",
        "/ecs-agent/v1/metadata",
        "/ecs-agent/v1/tasks",
        "/computeMetadata/v1/",
        "/computeMetadata/v1/instance",
        "/computeMetadata/v1/project",
        "/metadata/instance",
        "/etc/hosts",
        "/etc/resolv.conf",
        "/etc/environment",
        "/var/log/",
        "/proc/self/cgroup",
        "/sys/fs/cgroup",
        "/etc/passwd",
        "/etc/shadow",
        "/root/.ssh/",
        "/var/lib/docker/",
        "/run/secrets/"

given host then
    send request called check:
        method: "GET"
        path: {potential_path}

    if {check.response.status_code} is "200" then
        # Compare against a random garbage path to rule out soft-404 pages that return
        # 200 for every URL (would otherwise produce a false positive for every path).
        send request called garbage:
            method: "GET"
            path: `/{random_str(16)}`

        if {garbage} differs from {check} then
            report issue and continue:
                severity: high
                confidence: firm
                detail: `Container or infrastructure endpoint exposed at {potential_path}. Verify the response content manually.`
                remediation: "Restrict access to container management endpoints. These paths should never be reachable from the internet."
        end if
    end if