huawei-cloud-ecs-vulnerability-auditor

Audit Huawei Cloud ECS instances for security vulnerabilities across host OS packages, running services, application dependencies (Java, Python, Node.js, PHP, Go), and container environments (Docker, containerd, Podman). Collects asset inventories remotely via Cloud Operations Center (COC), matches components against Known Exploited Vulnerabilities (KEVs) via the public db.gcve.eu API, and outputs an actionable remediation report. 触发词: ECS漏洞扫描, ECS漏洞发现, 主机漏洞扫描, 容器漏洞发现, ECS资产收集, KEV漏洞检测, ecs vulnerability audit, ecs vuln scan, gcve vulnerability auditor

Overview

Audit Huawei Cloud ECS instances across host operating systems, active network services, application language runtimes, and container workloads for known and actively exploited vulnerabilities:

1. IAM Authorization — Verify or initialize the ServiceAgencyForCOC cross-service agency trusting op_svc_coc.
2. Asset Collection via COC — Remotely execute a safe, read-only Python-based inventory collector on the target ECS instance using Huawei Cloud Cloud Operations Center (COC).
3. Multi-Tier Asset Extraction — Robustly collect host OS packages (dpkg/rpm), listening ports and process binaries (ss/netstat), application libraries (Java .jar manifests, pip, npm, composer), and container workloads (docker, podman).
4. Result Retrieval from COC Logs — Fetch execution output via COC GetScriptJobBatch and extract the structured inventory between demarcated boundary markers (===ECS_ASSET_INVENTORY_START=== / ===END===).
5. Vulnerability & KEV Matching — Cross-reference identified assets against https://db.gcve.eu/api/ (/vulnerability/?product={product} for product CVEs, /kev for confirmed in-the-wild exploitation, and /epss for exploit prediction scoring).
6. Automatic Version Range Matching & CVSS Fallback — Automatically evaluate whether the installed version falls within the CVE's affected version range (e.g. 8.3.* to <8.3.36), extract CVSS scores with graceful fallback policies, and extract official vulnerability disclosure dates.
7. Remediation Report Generation — Output prioritized remediation guidance (P0 KEV criticals, package upgrade commands, container base image updates, network security group rules).
8. Security Cleanup — Automatically remove temporary COC scripts and remote scan artifacts.

Tool chain: Huawei Cloud KooCLI (hcloud) + Python 3 + https://db.gcve.eu/api/.

Prerequisites

• KooCLI (hcloud) authenticated with AK/SK — see CLI Installation Guide
• IAM permissions to operate COC and ECS — see IAM Policies
• Target ECS instance ID or Elastic IP (ACTIVE state)
• Network access to https://db.gcve.eu/api from the auditing environment — see GCVE API Reference

Workflow

1. IAM Authorization & Target Resolution

One-time per-account setup. Authorize COC to operate on ECS instances:

1. Get domain ID — Call KeystoneListAuthDomains and extract the domain id.
2. Create agency — Call CreateAgency with name ServiceAgencyForCOC and trust domain op_svc_coc.
   • HTTP 200 — New agency created. Record agency.id. Proceed to step 3.
   • HTTP 409 — Agency already exists. Skip the entire agency creation and role binding (steps 3–4) and proceed to Step 5 (Target Resolution).
3. Find role IDs — Call KeystoneListPermissions for each of the 4 roles: IAM ReadOnlyAccess, RMS ReadOnlyAccess, DCS UserAccess, COCServiceAgencyPolicy. If any role is not found, stop — the account may lack access.
4. Bind roles — Call AssociateAgencyWithAllProjectsPermission for each of the 4 role IDs.
   • HTTP 200 — Bound successfully.
   • HTTP 409 — Already bound, skip and continue.
5. Resolve ECS Instance — If only an Elastic IP was provided, query NovaListServersDetails to obtain the instance UUID and region. Ensure the instance is in ACTIVE state.

2. Deploy & Execute Remote Asset Collector via COC

1. Create Collector Script: Register scripts/collect_assets.sh as a temporary COC shell script via COC CreateScript.
2. Execute on Target ECS: Dispatch the script to the target instance using COC ExecuteScript.
3. Poll Status: Poll COC GetScriptJobInfo until status reaches SUCCESS.
4. Retrieve Inventory Output: Call COC GetScriptJobBatch to obtain the batch instance execution details:

   bash

   hcloud COC GetScriptJobBatch --cli-region=<region> --execute_uuid="<execute_uuid>" --batch_index=1 --limit=10
   

   The collector script emits the inventory surrounded by markers:

   text

   ===ECS_ASSET_INVENTORY_START===
   { ... json inventory ... }
   ===ECS_ASSET_INVENTORY_END===
   

   The intelligence engine scripts/query_gcve.py can directly ingest this batch JSON response, raw log text, or extracted JSON file.

3. Vulnerability & KEV Intelligence Matching

Run the intelligence engine scripts/query_gcve.py against the collected inventory:

1. Product Selection & Exhaustive Audit:
   • Use --product <name> (or -p <name>) to audit a specific product (e.g. --product nginx or --product php).
   • If --product is omitted, query_gcve.py automatically audits ALL discovered network services, application libraries, container workloads, and core system packages.
2. Product Vulnerability Query: Query https://db.gcve.eu/api/vulnerability/?product={product}&per_page=20&date_sort=published&sort_order=desc.
3. Automatic Version Matching: Checks installed version against the CVE affected ranges (lessThan, lessThanOrEqual, version prefixes).
4. KEV & EPSS Querying: Query /api/kev?vuln_id={cve} for active in-the-wild exploitation evidence and /api/epss/{cve} for exploit probability.
5. CVSS Extraction & Fallback: Extracts CVSS base score and severity from CNA or ADP metrics. If missing, applies an intelligent fallback estimation based on KEV exploitation and EPSS score.

4. Prioritized Remediation Reporting

Render findings ranked by threat severity:

• P0 (Critical): Actively exploited vulnerabilities present in KEV on externally exposed services.
• P1 (High): High CVSS / high EPSS vulnerabilities on internal or auxiliary services.
• P2 / P3 (Medium / Low): Hardening advisories, unmanaged library updates, and base image refreshes.
• Disclosure Timestamps: Each vulnerability lists its published date (date_published) and update date.

5. Security & Resource Cleanup

Delete temporary COC scripts and remote temporary files:

1. Delete COC script via COC DeleteScript.
2. Remove temporary files from /tmp/ecs_assets_inventory.json on the target host.

Core Commands

Placeholder values:

Placeholder	Linux / macOS	Windows (PowerShell)
<hcloud>	hcloud	hcloud
<temp_dir>	/tmp	$env:TEMP
<region>	cn-north-4	cn-north-4

[!NOTE] Command syntax conforms to the latest KooCLI standard without legacy /v2.1 or /v3 URL suffixes. Use hcloud <service> <operation> --help to confirm parameters on your local version.

bash

# 1. Check/setup COC IAM authorization (one-time per account)
<hcloud> IAM KeystoneListAuthDomains
<hcloud> IAM CreateAgency \
  --agency.domain_id="<domain_id>" \
  --agency.name="ServiceAgencyForCOC" \
  --agency.trust_domain_name="op_svc_coc" \
  --agency.description="Agency for COC remote script execution and asset auditing" \
  --agency.duration="FOREVER"
<hcloud> IAM KeystoneListPermissions --display_name="<role_name>"
<hcloud> IAM AssociateAgencyWithAllProjectsPermission \
  --agency_id="<agency_id>" --domain_id="<domain_id>" --role_id="<role_id>"

# 2. Resolve ECS instance details by IP
<hcloud> ECS NovaListServersDetails --ip="<ecs_ip>"

# 3. Check existing COC scripts
<hcloud> COC ListScripts --cli-region=<region> --name_like="ecs_asset_collector" --limit=10

# 4. Create COC script via JSON input (ensure UTF-8 without BOM on Windows)
cat > <temp_dir>/coc_collector_create.json << 'EOF'
{
  "body": {
    "name": "ecs_asset_collector",
    "type": "SHELL",
    "description": "Read-only asset collector for ECS vulnerability auditing",
    "content": "#!/usr/bin/env bash\n...",
    "properties": {
      "risk_level": "LOW",
      "version": "1.0.0"
    }
  }
}
EOF
<hcloud> COC CreateScript --cli-region=<region> --cli-jsonInput=<temp_dir>/coc_collector_create.json

# 5. Execute script on target instance
cat > <temp_dir>/coc_collector_execute.json << 'EOF'
{
  "path": {"script_uuid": "<script_uuid>"},
  "body": {
    "execute_batches": [{
      "batch_index": 1,
      "rotation_strategy": "CONTINUE",
      "target_instances": [{
        "region_id": "<region>",
        "resource_id": "<instance_id>"
      }]
    }],
    "execute_param": {
      "execute_user": "root",
      "timeout": 180,
      "success_rate": 100
    }
  }
}
EOF
<hcloud> COC ExecuteScript --cli-region=<region> --cli-jsonInput=<temp_dir>/coc_collector_execute.json

# 6. Poll job status
<hcloud> COC GetScriptJobInfo --cli-region=<region> --execute_uuid="<execute_uuid>"

# 7. Retrieve execution log output
<hcloud> COC GetScriptJobBatch --cli-region=<region> --execute_uuid="<execute_uuid>" --batch_index=1 --limit=10 > <temp_dir>/coc_batch_output.json

# 8. Run GCVE Intelligence Audit & Generate Report (audits all components by default)
python scripts/query_gcve.py --inventory=<temp_dir>/coc_batch_output.json --output-format=markdown

# Optional: Audit a specific product only
python scripts/query_gcve.py --inventory=<temp_dir>/coc_batch_output.json --product=nginx

# 9. Cleanup COC script
<hcloud> COC DeleteScript --cli-region=<region> --script_uuid="<script_uuid>"

Parameters

Parameter	Required	Default	Description
ecs_instance_id	Conditional	None	ECS Instance UUID; required if ecs_ip is not provided
ecs_ip	Conditional	None	ECS Elastic IP; required if ecs_instance_id is not provided
region	No	cn-north-4	Huawei Cloud region where ECS and COC reside
product	No	None	Specific product to audit (e.g. php, nginx). If omitted, all discovered assets are audited
output_format	No	markdown	Report format: markdown or json
cleanup	No	true	Automatically clean up COC scripts and remote files

Output Format

The skill provides structured progress updates across each audit phase:

Phase	Output Content
Target & IAM	Target ECS ID, IP address, OS flavor, and COC agency status
Asset Collection	Count of discovered OS packages, listening services, Java/Python/Node dependencies, and containers
Result Retrieval	Confirmation of log retrieval from GetScriptJobBatch with marker extraction
KEV Matching	Identified Known Exploited Vulnerabilities (KEVs), EPSS scores, CVSS severity, publication dates, and version matches
Remediation Report	Full Markdown report with executive summary, CVE breakdown, and specific remediation commands
Cleanup	Deletion confirmation for COC script and temporary files