From 51bcf17be8f5490968d10db9a1e29c63743e7c8d Mon Sep 17 00:00:00 2001 From: kazet Date: Thu, 11 Jul 2024 12:21:45 +0200 Subject: [PATCH] Better open database port messages (#1143) --- artemis/config.py | 2 +- .../template_nuclei_exposed_panel.jinja2 | 15 ++++++++++ .../en_US/LC_MESSAGES/messages.po | 15 ++++++++-- .../pl_PL/LC_MESSAGES/messages.po | 22 ++++++++++++-- .../template_open_port_database.jinja2 | 11 ++++--- .../en_US/LC_MESSAGES/messages.po | 14 +++++---- .../pl_PL/LC_MESSAGES/messages.po | 29 ++++++++++++------- 7 files changed, 82 insertions(+), 26 deletions(-) diff --git a/artemis/config.py b/artemis/config.py index 670a904f3..baafdcdaf 100644 --- a/artemis/config.py +++ b/artemis/config.py @@ -78,7 +78,7 @@ class Reporting: MIN_DAYS_BETWEEN_REMINDERS__SEVERITY_LOW: Annotated[ int, "If a low-severity report has already been seen earlier - how much time needs to pass for a second report to be generated.", - ] = get_config("MIN_DAYS_BETWEEN_REMINDERS__SEVERITY_LOW", default=8 * 30, cast=int) + ] = get_config("MIN_DAYS_BETWEEN_REMINDERS__SEVERITY_LOW", default=18 * 30, cast=int) MIN_DAYS_BETWEEN_REMINDERS__SEVERITY_MEDIUM: Annotated[ int, diff --git a/artemis/reporting/modules/nuclei/template_nuclei_exposed_panel.jinja2 b/artemis/reporting/modules/nuclei/template_nuclei_exposed_panel.jinja2 index b02dbf1e8..8fa8deaf6 100644 --- a/artemis/reporting/modules/nuclei/template_nuclei_exposed_panel.jinja2 +++ b/artemis/reporting/modules/nuclei/template_nuclei_exposed_panel.jinja2 @@ -1,4 +1,6 @@ {% if "nuclei_exposed_panel" in data.contains_type %} + {% set contains_db_admin = namespace(data=0) %} +
  • {% trans %}The following addresses contain login panels, analytics services, management panels etc.:{% endtrans %}

    {% trans trimmed %} - Databases shouldn't be publicly available - an attack is possible when the password - leaks (e.g. because of an exposed configuration file such as a backup of /wp-config.php). - The recommended configuration is to make the database - available to the application locally or using an internal network. + We do not recommend database ports to be publicly available - although they require correct username + and password to login, an attack is possible when the password leaks or is too simple. + A password leak may be caused e.g. by an accidentally exposed configuration file such as a backup of + /wp-config.php or by a local file inclusion vulnerability. Such mistakes are frequent, and lack of publicly exposed + database ports makes it significantly harder to perform an attack. + + The recommended configuration is to make the database available to the application locally or using an internal network. {% endtrans %}

    • diff --git a/artemis/reporting/modules/port_scanner/translations/en_US/LC_MESSAGES/messages.po b/artemis/reporting/modules/port_scanner/translations/en_US/LC_MESSAGES/messages.po index c2441733d..e964b014c 100644 --- a/artemis/reporting/modules/port_scanner/translations/en_US/LC_MESSAGES/messages.po +++ b/artemis/reporting/modules/port_scanner/translations/en_US/LC_MESSAGES/messages.po @@ -9,11 +9,15 @@ msgstr "" #: artemis/reporting/modules/port_scanner/template_open_port_database.jinja2:14 msgid "" -"Databases shouldn't be publicly available - an attack is possible when " -"the password leaks (e.g. because of an exposed configuration file such as" -" a backup of /wp-config.php). The recommended configuration is " -"to make the database available to the application locally or using an " -"internal network." +"We do not recommend database ports to be publicly available - although " +"they require correct username and password to login, an attack is " +"possible when the password leaks or is too simple. A password leak may be" +" caused e.g. by an accidentally exposed configuration file such as a " +"backup of /wp-config.php or by a local file inclusion " +"vulnerability. Such mistakes are frequent, and lack of publicly exposed " +"database ports makes it significantly harder to perform an attack. The " +"recommended configuration is to make the database available to the " +"application locally or using an internal network." msgstr "" #: artemis/reporting/modules/port_scanner/template_open_port_remote_desktop.jinja2:2 diff --git a/artemis/reporting/modules/port_scanner/translations/pl_PL/LC_MESSAGES/messages.po b/artemis/reporting/modules/port_scanner/translations/pl_PL/LC_MESSAGES/messages.po index c3eb45fcc..43edef840 100644 --- a/artemis/reporting/modules/port_scanner/translations/pl_PL/LC_MESSAGES/messages.po +++ b/artemis/reporting/modules/port_scanner/translations/pl_PL/LC_MESSAGES/messages.po @@ -9,17 +9,26 @@ msgstr "domena: " #: artemis/reporting/modules/port_scanner/template_open_port_database.jinja2:14 msgid "" -"Databases shouldn't be publicly available - an attack is possible when " -"the password leaks (e.g. because of an exposed configuration file such as" -" a backup of /wp-config.php). The recommended configuration is " -"to make the database available to the application locally or using an " -"internal network." +"We do not recommend database ports to be publicly available - although " +"they require correct username and password to login, an attack is " +"possible when the password leaks or is too simple. A password leak may be" +" caused e.g. by an accidentally exposed configuration file such as a " +"backup of /wp-config.php or by a local file inclusion " +"vulnerability. Such mistakes are frequent, and lack of publicly exposed " +"database ports makes it significantly harder to perform an attack. The " +"recommended configuration is to make the database available to the " +"application locally or using an internal network." msgstr "" -"Bazy danych nie powinny być publicznie dostępne - atak jest możliwy np. " -"gdy hasło wycieknie (np. gdy kopia zapasowa pliku konfiguracyjnego " -"takiego jak /wp.config.php zostanie przypadkowo upubliczniona). " -"Zalecamy, aby baza danych była dostępna tylko lokalnie lub w sieci " -"wewnętrznej." +"Nie rekomendujemy, aby porty baz danych były publicznie dostępne - " +"logowanie wymaga podania nazwy użytkownika i hasła, lecz atak jest " +"możliwy gdy hasło wycieknie, lub jest zbyt małej złożoności. Do wycieku " +"hasła może dojść np. gdy kopia zapasowa pliku konfiguracyjnego takiego " +"jak /wp.config.php zostanie przypadkowo upubliczniona, lub gdy " +"zostanie wykorzystana podatność w aplikacji pozwalająca na odczyt plików." +" Z doświadczeń CERT Polska w obsłudze incydentów wynika, że takie błędy " +"są częste, a brak publicznie dostępnego panelu zarządzania bazą danych " +"znacząco utrudnia atakującym dalsze prowadzenie ataku. Zalecamy, aby baza" +" danych była dostępna tylko lokalnie lub w sieci wewnętrznej." #: artemis/reporting/modules/port_scanner/template_open_port_remote_desktop.jinja2:2 msgid "The following servers have remote desktop ports open:"