5fc601b564
Extend owned-fleet control with scheduled tasks, audit log, file browser, HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge options, KEV exposure in full sys check with Telegram alerts, and UI/tests.
67 lines
3.7 KiB
Go
67 lines
3.7 KiB
Go
package client
|
|
|
|
// KEVEntry describes a CISA-known-exploited style vulnerability for read-only exposure checks.
|
|
// Heuristics indicate likely exposure on the host — not a penetration test.
|
|
type KEVEntry struct {
|
|
ID string
|
|
Name string
|
|
Product string
|
|
Severity string // critical, high, medium
|
|
CISAKEV bool
|
|
Description string
|
|
}
|
|
|
|
// KEVCatalog is aligned with CISA AA22-117A / AA22-279A top exploited CVE families.
|
|
var KEVCatalog = []KEVEntry{
|
|
{ID: "CVE-2021-44228", Name: "Log4Shell", Product: "Apache Log4j", Severity: "critical", CISAKEV: true,
|
|
Description: "JNDI RCE in Log4j 2.x before 2.17.0"},
|
|
{ID: "CVE-2021-26855", Name: "ProxyLogon", Product: "Microsoft Exchange", Severity: "critical", CISAKEV: true,
|
|
Description: "Exchange Server pre-auth SSRF chain (Mar 2021)"},
|
|
{ID: "CVE-2020-1472", Name: "Zerologon", Product: "Microsoft Netlogon", Severity: "critical", CISAKEV: true,
|
|
Description: "Domain controller Netlogon privilege escalation"},
|
|
{ID: "CVE-2019-19781", Name: "Citrix ADC", Product: "Citrix ADC/Gateway", Severity: "critical", CISAKEV: true,
|
|
Description: "Path traversal on Citrix Application Delivery Controller"},
|
|
{ID: "CVE-2019-11510", Name: "Pulse Secure", Product: "Ivanti Pulse Connect Secure", Severity: "critical", CISAKEV: true,
|
|
Description: "Arbitrary file read on Pulse VPN appliances"},
|
|
{ID: "CVE-2020-5902", Name: "F5 BIG-IP", Product: "F5 BIG-IP", Severity: "critical", CISAKEV: true,
|
|
Description: "Remote code execution in TMUI (CVE-2020-5902)"},
|
|
{ID: "CVE-2022-1388", Name: "F5 iControl", Product: "F5 BIG-IP", Severity: "critical", CISAKEV: true,
|
|
Description: "iControl REST auth bypass (May 2022)"},
|
|
{ID: "CVE-2021-26084", Name: "Confluence OGNL", Product: "Atlassian Confluence", Severity: "critical", CISAKEV: true,
|
|
Description: "Confluence Server/Data Center RCE"},
|
|
{ID: "CVE-2022-26134", Name: "Confluence RCE", Product: "Atlassian Confluence", Severity: "critical", CISAKEV: true,
|
|
Description: "Confluence unauthenticated RCE (2022)"},
|
|
{ID: "CVE-2021-40539", Name: "ManageEngine", Product: "Zoho ManageEngine ADSelfService Plus", Severity: "critical", CISAKEV: true,
|
|
Description: "Unauthenticated RCE in ADSelfService Plus"},
|
|
{ID: "CVE-2018-13379", Name: "FortiOS path traversal", Product: "Fortinet FortiGate/FortiOS", Severity: "critical", CISAKEV: true,
|
|
Description: "SSL-VPN path traversal (FortiOS)"},
|
|
{ID: "CVE-2021-34527", Name: "PrintNightmare", Product: "Windows Print Spooler", Severity: "high", CISAKEV: true,
|
|
Description: "Spooler remote code execution (Jul 2021)"},
|
|
{ID: "CVE-2020-0688", Name: "Exchange RCE", Product: "Microsoft Exchange", Severity: "high", CISAKEV: true,
|
|
Description: "Exchange control panel deserialization RCE"},
|
|
{ID: "CVE-2021-21972", Name: "vCenter RCE", Product: "VMware vCenter", Severity: "critical", CISAKEV: true,
|
|
Description: "vSphere Client RCE in vCenter Server"},
|
|
}
|
|
|
|
// KEVFinding is one catalog entry with a probe result for this host.
|
|
type KEVFinding struct {
|
|
CVE string `json:"cve"`
|
|
Name string `json:"name"`
|
|
Product string `json:"product"`
|
|
Severity string `json:"severity"`
|
|
CISAKEV bool `json:"cisa_kev"`
|
|
Status string `json:"status"` // exposed, likely, clear, n/a
|
|
Detail string `json:"detail,omitempty"`
|
|
}
|
|
|
|
// KEVScanReport aggregates exposure heuristics for the dashboard.
|
|
type KEVScanReport struct {
|
|
ScannedAt string `json:"scanned_at"`
|
|
ExposedCount int `json:"exposed_count"`
|
|
LikelyCount int `json:"likely_count"`
|
|
CriticalCount int `json:"critical_count"`
|
|
RiskScore int `json:"risk_score"` // 0-100 higher = worse
|
|
Findings []KEVFinding `json:"findings"`
|
|
Summary string `json:"summary,omitempty"`
|
|
}
|