계: Environment

이 섹션에는 소스 코드 외부에 있지만 제작 중인 제품의 보안에는 여전히 중요한 내용이 모두 포함되어 있습니다. 이 섹션에서 다루는 문제들은 소스 코드와 직접적으로 관련이 없기 때문에 나머지 섹션과 분리했습니다.

633 개 항목 찾음

취약점

AWS Ansible Misconfiguration: Privileged Batch Container

YAML

Abstract

구성이 승격된 권한으로 작업을 실행하도록 컨테이너를 설정합니다.

Explanation

컨테이너는 기본적으로 대부분의 시스템 및 네트워크 관리 작업을 실행할 수 없습니다. 그런데 권한 있는 모드에서는 이러한 제한이 적용되지 않습니다. 그러므로 악의적인 작업의 공격 표면이 대폭 확장됩니다.

References

[1] Standards Mapping - Common Weakness Enumeration CWE ID 250

[2] Standards Mapping - Common Weakness Enumeration Top 25 2019 [3] CWE ID 020

[3] Standards Mapping - Common Weakness Enumeration Top 25 2020 [3] CWE ID 020

[4] Standards Mapping - Common Weakness Enumeration Top 25 2021 [4] CWE ID 020

[5] Standards Mapping - Common Weakness Enumeration Top 25 2022 [4] CWE ID 020

[6] Standards Mapping - Common Weakness Enumeration Top 25 2024 [15] CWE ID 269

[7] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000213, CCI-001084

[8] Standards Mapping - FIPS200 CM

[9] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data

[10] Standards Mapping - NIST Special Publication 800-53 Revision 4 AC-3 Access Enforcement (P1), AC-6 Least Privilege (P1), SC-3 Security Function Isolation (P1)

[11] Standards Mapping - NIST Special Publication 800-53 Revision 5 AC-3 Access Enforcement, AC-6 Least Privilege, SC-3 Security Function Isolation

[12] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[13] Standards Mapping - OWASP Application Security Verification Standard 4.0 5.1.3 Input Validation Requirements (L1 L2 L3), 5.1.4 Input Validation Requirements (L1 L2 L3)

[14] Standards Mapping - OWASP Mobile 2014 M1 Weak Server Side Controls

[15] Standards Mapping - OWASP Top 10 2004 A10 Insecure Configuration Management

[16] Standards Mapping - OWASP Top 10 2010 A6 Security Misconfiguration

[17] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration

[18] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration

[19] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[20] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.10

[21] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.6

[22] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.6

[23] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.6

[24] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.6

[25] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[26] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.2.4

[27] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection

[28] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection

[29] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection

[30] Standards Mapping - SANS Top 25 2009 Insecure Interaction - CWE ID 020

[31] Standards Mapping - SANS Top 25 2011 Porous Defenses - CWE ID 250

[32] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3500 CAT II

[33] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3500 CAT II

[34] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3500 CAT II

[35] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3500 CAT II

[36] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3500 CAT II

[37] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3500 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3500 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-000460 CAT I, APSC-DV-002360 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-000460 CAT I, APSC-DV-002360 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-000460 CAT I, APSC-DV-002360 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-000460 CAT I, APSC-DV-002360 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-000460 CAT I, APSC-DV-002360 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-000460 CAT I, APSC-DV-002360 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-000460 CAT I, APSC-DV-002360 CAT II

[46] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-000460 CAT I, APSC-DV-002360 CAT II

[47] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-000460 CAT I, APSC-DV-002360 CAT II

[48] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-000460 CAT I, APSC-DV-002360 CAT II

[49] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-000460 CAT I, APSC-DV-002360 CAT II

[50] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-000460 CAT I, APSC-DV-002360 CAT II

[51] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-000460 CAT I, APSC-DV-002360 CAT II

[52] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-000460 CAT I, APSC-DV-002360 CAT II

[53] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-000460 CAT I, APSC-DV-002360 CAT II

[54] Standards Mapping - Web Application Security Consortium Version 2.00 Application Misconfiguration (WASC-15)

desc.structural.iac.misconfiguration_privileged_container.base

AWS Ansible Misconfiguration: RDS Auto-Upgrade Disabled

YAML

Abstract

구성이 자동 소프트웨어 업그레이드를 끕니다.

Explanation

알려진 소프트웨어 취약성을 해결하는 패치를 적시에 적용하는 자동 소프트웨어 업그레이드가 비활성화되어 있습니다.

References

[1] Standards Mapping - CIS Amazon Web Services Foundations Benchmark Recommendation 2.3.2

[2] Standards Mapping - FIPS200 CM

[3] Standards Mapping - General Data Protection Regulation (GDPR) Insufficient Data Protection

[4] Standards Mapping - NIST Special Publication 800-53 Revision 4 SI-2 Flaw Remediation (P1)

[5] Standards Mapping - NIST Special Publication 800-53 Revision 5 SI-2 Flaw Remediation

[6] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[7] Standards Mapping - OWASP Top 10 2017 A9 Using Components with Known Vulnerabilities

[8] Standards Mapping - OWASP Top 10 2021 A06 Vulnerable and Outdated Components

[9] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.2

[10] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.3.3

[11] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.3.3

[12] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 10.2 - Threat and Vulnerability Management

[13] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 10.2 - Threat and Vulnerability Management

[14] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 10.2 - Threat and Vulnerability Management, Control Objective C.1.6 - Web Software Components & Services

desc.structural.iac.misconfiguration_auto_upgrade_disabled.base

AWS Ansible Misconfiguration: RDS Missing Customer-Managed Encryption Key

YAML

Abstract

구성이 미사용 데이터용 고객 관리형 암호화 키를 지정하지 않습니다.

Explanation

미사용 데이터에는 고객 관리형 키가 사용되지 않습니다.

기본적으로 AWS는 암호화가 활성화된 경우 AWS 관리형 키를 사용하여 미사용 데이터를 암호화합니다. 고객 관리형 키를 사용하는 조직은 선택한 암호화 키를 사용하여 데이터를 암호화할 수 있습니다. 따라서 암호화 프로세스를 더욱 효율적으로 제어하고 로깅할 수 있습니다.

이러한 이유로 인해 고객 관리형 키는 다음을 비롯한 여러 요구 사항을 충족하는 솔루션에 포함되는 경우가 많습니다.
- 민감한 데이터 액세스 관련 감사 로그
- 데이터 보존
- 키 교체, 비활성화 또는 삭제

aws/service-name 형식의 키는 AWS 관리형 키용으로 예약되어 있습니다.

References

[1] Amazon Web Services, Inc. or its affiliates AWS Key Management Service Developer Guide

[2] Standards Mapping - Common Weakness Enumeration CWE ID 311

[3] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001350, CCI-002475

[4] Standards Mapping - FIPS200 MP

[5] Standards Mapping - General Data Protection Regulation (GDPR) Insufficient Data Protection

[6] Standards Mapping - NIST Special Publication 800-53 Revision 4 AU-9 Protection of Audit Information (P1), SC-28 Protection of Information at Rest (P1)

[7] Standards Mapping - NIST Special Publication 800-53 Revision 5 AU-9 Protection of Audit Information, SC-28 Protection of Information at Rest

[8] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[9] Standards Mapping - OWASP Application Security Verification Standard 4.0 2.6.3 Look-up Secret Verifier Requirements (L2 L3), 6.2.1 Algorithms (L1 L2 L3), 8.1.6 General Data Protection (L3)

[10] Standards Mapping - OWASP Top 10 2017 A3 Sensitive Data Exposure

[11] Standards Mapping - OWASP Top 10 2021 A02 Cryptographic Failures

[12] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.3

[13] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4, Requirement 3.5.1

[14] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 3.3.2, Requirement 3.3.3, Requirement 3.5.1, Requirement 6.2.4

[15] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 7.1 - Use of Cryptography

[16] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 7.1 - Use of Cryptography

[17] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 7.2 - Use of Cryptography

[18] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-001350 CAT II, APSC-DV-002340 CAT II

[19] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-001350 CAT II, APSC-DV-002340 CAT II

[20] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-001350 CAT II, APSC-DV-002340 CAT II

[21] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-001350 CAT II, APSC-DV-002340 CAT II

[22] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-001350 CAT II, APSC-DV-002340 CAT II

desc.structural.iac.aws.misconfiguration_missing_customer_managed_encryption_key.base

AWS Ansible Misconfiguration: Reduced CloudFront Availability

YAML

Abstract

구성이 서비스 가용성을 낮춥니다.

Explanation

클라우드 서비스는 원활한 서비스 확장을 지원하고 컨텐츠를 더욱 빠르게 제공하는 동시에 대규모 공격의 영향을 완화하기 위해 일반적으로 캐싱, 복제, 로드 밸런싱 등의 기술을 사용합니다. 가용성 기능을 비활성화하거나 잘못 구성하면 서비스 성능이 저하됩니다. 그런데 트래픽 급증, 하드웨어 오류 등의 심각한 상황이 발생할 때까지는 가용성 저하의 즉각적인 영향이 나타나지 않는 경우도 많습니다.

References

[1] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001094

[2] Standards Mapping - NIST Special Publication 800-53 Revision 4 SC-5 Denial of Service Protection (P1)

[3] Standards Mapping - NIST Special Publication 800-53 Revision 5 SC-5 Denial of Service Protection

[4] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[5] Standards Mapping - OWASP Top 10 2004 A9 Application Denial of Service

[6] Standards Mapping - OWASP Top 10 2010 A6 Security Misconfiguration

[7] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration

[8] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration

[9] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[10] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.6

[11] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[12] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.2.4

[13] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection

[14] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection

[15] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection, Control Objective C.3.3 - Web Software Attack Mitigation

[16] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002400 CAT II

[17] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002400 CAT II

[18] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002400 CAT II

[19] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002400 CAT II

[20] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002400 CAT II

[21] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002400 CAT II

[22] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-002400 CAT II

desc.structural.iac.misconfiguration_reduced_availability.base

AWS Ansible Misconfiguration: Reduced EC2 Availability

YAML