Detection system and method for registration vulnerabilities of mirror image warehouse Harbor

Abstract

The invention provides a system and method for detecting registration vulnerabilities of a mirror image warehouse Harbor, and the method comprises the steps: inputting a target IP address list to a scanning module, and detecting the network accessibility of each IP address in the target IP address list; if the network reachable IP address exists, detecting all ports of the IP address, and recording an open port number; service classification is carried out by identifying services running under open ports; if the service is classified as a Web service of a mirror image warehouse Harbor, judging whether an apiusers path under the service can be accessed or not; if the access is successful, a registration module is used to initiate a post request to the apiusers path and register an administrator account; the method comprises the following steps: under the condition that a post request is realized and a mirror image warehouse Harbor server successfully creates a new administrator account, pulling a mirror image file of a mirror image warehouse through an analysis module, and analyzing and detecting the mirror image file; and combining the detected vulnerabilities through a detection report module to generate a detection report of the registration vulnerabilities of the mirror image warehouse Harbor.

Description

Technical Field

[0001] The present invention relates to the technical field of vulnerability detection, and in particular to a detection system, method, electronic device and storage medium for detecting a registration vulnerability of an image repository Harbor. Background Art

[0002] Harbor is an enterprise-level registry server for storing and distributing Docker images. When Harbor is enabled, if relevant permission control is not done well, illegal users can access apiuser and add key parameters in the request to exploit this vulnerability to create an administrator account, thereby taking over the Harbor image repository and obtaining monitoring information in the application system.

[0003] Vulnerability detection does not have the ability to automatically register possible administrator vulnerabilities in the image warehouse Harbor, making it difficult to deeply explore the vulnerabilities in the images managed in the image warehouse Harbor. Usually, it is necessary to manually enter the Harbor web management page, complete the administrator manual registration, and then parse the image.

[0004] To solve the above problems, a detection system, method, electronic device and storage medium for Harbor registration vulnerability of image repository are proposed herein. Summary of the invention

[0005] The embodiments of the present disclosure aim to solve at least one of the technical problems existing in the prior art, and provide a system, method, electronic device and storage medium for detecting a registration vulnerability of an image repository Harbor.

[0006] In a first aspect of the present disclosure, a system for detecting a vulnerability in a Harbor registration of an image repository is provided, comprising:

[0007] A scanning module is used to receive a target IP address list, detect the network reachability of each IP address in the target IP address list, record the open port number, identify the service running under the open port, and classify the service;

[0008] The registration module is used to initiate a post request to the api users path under the Web service of the image repository Harbor and register an administrator account;

[0009] A parsing module, used to pull the image file of the image warehouse and parse and detect the image file if the administrator account is successfully registered in the registration module;

[0010] The detection report module is used to merge the detected vulnerabilities to generate a detection report of the image repository Harbor registration vulnerabilities.

[0011] A second aspect of the present disclosure provides a method for detecting a vulnerability in a Harbor registration of an image repository, including:

[0012] Inputting a target IP address list into the scanning module, and detecting the network reachability of each IP address in the target IP address list;

[0013] If there is an IP address that is reachable on the network, detect all ports of the IP address and record the open port numbers;

[0014] Classify services by identifying services running under open ports;

[0015] If the service is classified as a Web service of the image repository Harbor, determine whether the apiusers path under the service can be accessed;

[0016] If the access is successful, use the registration module to initiate a post request to the api users path and register an administrator account;

[0017] When the post request has been implemented and the image warehouse Harbor server has successfully created a new administrator account, the image file of the image warehouse is pulled through the parsing module and the image file is parsed and tested;

[0018] The detection report module combines the detected vulnerabilities into a detection report for the Harbor registration vulnerabilities in the image repository.

[0019] In combination with the second aspect, the detecting the network reachability of each IP address in the IP address list includes sending an ICMP request packet to each IP address through Ping scanning, and determining the network reachability of the IP address according to the response information.

[0020] In combination with the second aspect, if there is a network-reachable IP address, detecting all ports of the IP address includes scanning all ports of the target IP address through TCP SYN scanning and / or TCP Connect scanning, and recording them in order from 1 to 65535.

[0021] In combination with the second aspect, the service classification by identifying the services running under the open port includes sending a preset data packet to the open port, analyzing the response information by calling the Nmap database, and identifying the type of the running service.

[0022] In combination with the second aspect, if the access is successful, using the registration module to initiate a post request to the api users path and register an administrator account includes running a Python script, loading the mitmproxy library, sending an HTTP request package to access the api users path, and initiating a POST request to the path to complete the form registration information and grant administrator permissions.

[0023] In conjunction with the second aspect, the pulling of the image file from the image repository by the parsing module and parsing and detecting the image file includes:

[0024] Pull the image file of the image warehouse to the local computer through the parsing module, and use the shell script to execute the docker run instruction in the local computer to start the interactive container for parsing;

[0025] Execute a vuln-scan command in the interactive container to detect vulnerabilities in the image file.

[0026] In combination with the second aspect, the detection report module combines the detected vulnerabilities to generate a detection report of the image repository Harbor registration vulnerability, including checking the vulnerability detection results through the vuln-monitor instruction and combining the vulnerability detection results through the type instruction to generate a detection report of the image repository Harbor registration vulnerability.

[0027] According to a third aspect of the present disclosure, an electronic device is provided, including:

[0028] one or more processors;

[0029] A storage unit is used to store one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors can implement any of the above-mentioned methods for detecting vulnerabilities in the image repository Harbor registration.

[0030] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, any of the above-mentioned methods for detecting a vulnerability in the registration of an image repository Harbor can be implemented.

[0031] The present invention provides a detection system, method, electronic device and storage medium for the registration vulnerability of the image warehouse Harbor. Through the collaborative work of the scanning module, the registration module, the parsing module and the detection report module, the automatic detection of the registration vulnerability in the Harbor system is realized. Specifically, the system can automatically receive the target IP address list, detect network accessibility, scan open ports, identify service types, and initiate a registration request through a specific path to generate an administrator account, further parse the image files in the image warehouse, detect the vulnerabilities therein, and finally generate a detailed vulnerability detection report. The system effectively improves the efficiency of detecting Harbor registration vulnerabilities, reduces the complexity of manual operations, and provides a complete vulnerability report to help users discover and repair security risks in a timely manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 It is a structural diagram of a detection system for image repository Harbor registration vulnerabilities according to an embodiment of the present disclosure;

[0033] Figure 2 A flowchart of a method for detecting a vulnerability in the registration of an image repository Harbor according to an embodiment of the present disclosure;

[0034] Figure 3 It is a schematic diagram of the structure of an electronic device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0035] Here, exemplary embodiments are described in detail, and examples thereof are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the embodiments of the present disclosure.

[0036] The terms used in the disclosed embodiments are only for the purpose of describing specific embodiments and are not intended to limit the disclosed embodiments. The singular forms of "a", "said" and "the" used in the disclosed embodiments and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0037] It should be understood that although the terms first, second, third, etc. may be used to describe various information in the disclosed embodiments, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the disclosed embodiments, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0038] like Figure 1 FIG. 1 is a schematic diagram of a system for detecting a vulnerability in the registration of an image repository Harbor according to an embodiment of the present disclosure. The system includes:

[0039] The scanning module 110 is used to receive a target IP address list, detect the network reachability of each IP address in the target IP address list, record the open port number, identify the service running under the open port, and classify the service;

[0040] The registration module 120 is used to initiate a post request to the api users path under the Web service of the image repository Harbor and register an administrator account;

[0041] The parsing module 130 is used to pull the image file of the image repository and parse and detect the image file if the administrator account is successfully registered by the registration module;

[0042] The detection report module 140 is used to merge the detected vulnerabilities to generate a detection report of the image repository Harbor registration vulnerabilities.

[0043] Specifically, the scanning module 110 is responsible for receiving a target IP address list and detecting the network reachability of each IP address in the list one by one. The network reachability is usually determined by sending an ICMP Ping request or other protocol packets to determine whether the target server is accessible.

[0044] Once an IP address is confirmed to be reachable, the scanning module will further scan all ports of the IP address and record the open port numbers. This process can be completed through TCP SYN scanning or TCP Connect scanning, and will detect port numbers from 1 to 65535 one by one.

[0045] After confirming the open port, the scanning module will identify the service running on the port and classify the service. This identification process can be determined by sending specific packets to the port and analyzing the response, such as calling the Nmap database to identify the service type.

[0046] The registration module 120 initiates a POST request to the ** / api / users** path for the Web service of the identified image repository Harbor, in an attempt to register a user account with administrator privileges.

[0047] Among them, a form containing registration information such as username, password, and email address is submitted to the / api / users path, and the administrator permission variable has_admin_role in the form is set to true to generate an account with administrator permissions.

[0048] Once the registration is successful, the system will be able to use the newly registered administrator account to access Harbor's private and public image repositories, laying the foundation for subsequent image file downloads and vulnerability detection.

[0049] After the registration module successfully creates an administrator account, the parsing module 130 starts downloading and parsing the image files stored in the Harbor image repository. The module will pull all accessible image files and perform in-depth parsing and vulnerability detection on these image files.

[0050] The parsing process starts an interactive container and executes the vuln-scan command to scan the image file. The vulnerability detection tool identifies possible security vulnerabilities in the image file, such as insecure configurations, outdated software components, and unpatched known vulnerabilities.

[0051] The result of the parsing module is a detailed vulnerability list containing potential risks found in each image file.

[0052] The detection report module 140 is responsible for integrating the detection results of the analysis module, summarizing and classifying all vulnerability information, and generating a complete image repository Harbor registration vulnerability detection report.

[0053] The report not only lists the detected vulnerabilities, but also provides repair suggestions to help system administrators or security teams quickly patch the vulnerabilities and enhance the overall security of the system.

[0054] The reports output by this module can be generated in formats such as PDF or HTML for easy sharing and archiving.

[0055] Beneficial effects: Through modular design, the detection system can realize fully automatic detection of Harbor registration vulnerabilities, avoiding the tedious process of manually registering administrator accounts and manually analyzing image files, greatly improving detection efficiency. The targeted vulnerability detection system can not only detect Harbor registration vulnerabilities, but also further analyze specific image files in the image repository and deeply explore potential security vulnerabilities in these files. This full-process vulnerability detection strategy can provide users with a more comprehensive security assessment. At the same time, the system can be deployed in various environments and is suitable for networks and cloud platforms of various sizes. At the same time, the registration module and the parsing module can also be expanded according to different needs, such as supporting other types of image repositories or vulnerability detection tools.

[0056] like Figure 2 FIG. 1 is a flow chart of a method for detecting a vulnerability in the registration of an image repository Harbor according to an embodiment of the present disclosure. The method includes:

[0057] S201: Input a target IP address list to a scanning module, and detect the network reachability of each IP address in the target IP address list;

[0058] S202: If there is an IP address that is reachable on the network, detect all ports of the IP address and record the open port numbers;

[0059] S203: Classifying services by identifying services running under open ports;

[0060] S204: If the service is classified as a Web service of the image repository Harbor, determine whether the apiusers path under the service can be accessed;

[0061] S205: If the access is successful, use the registration module to initiate a post request to the apiusers path and register an administrator account;

[0062] S206: When the post request has been implemented and the image repository Harbor server has successfully created a new administrator account, the image file of the image repository is pulled by the parsing module and the image file is parsed and detected;

[0063] S207: The detected vulnerabilities are merged through the detection report module to generate a detection report of the image repository Harbor registration vulnerability.

[0064] Specifically, S201 inputs a target IP address list into a scanning module, and detects the network reachability of each IP address in the IP address list.

[0065] The user or system administrator provides a list of multiple target IP addresses to the scanning module. These IP addresses may correspond to servers running Harbor services. The system determines which targets can be further scanned by detecting the network reachability of these IP addresses.

[0066] Network reachability detection can be achieved through ICMP Ping requests, or by using methods such as TCP SYN scanning. If the target IP address can respond to the probe request in the network, it means that the address is reachable under the current network conditions, which means that further port scanning can be performed.

[0067] In actual applications, since some network or firewall configurations may block ICMP Ping requests, the network detection method can be adjusted as needed, such as using the TCP or UDP protocol detection method to ensure that it adapts to various network environments.

[0068] S202: If there is an IP address that is reachable on the network, detect all ports of the IP address and record the open port numbers.

[0069] After confirming that the IP address is reachable, the system performs a full port scan on each IP address and records all open ports. This step is intended to determine which services are running on the target server.

[0070] Full port scanning is a key step in vulnerability detection. By scanning all ports from 1 to 65535, you can identify the services running on the target server. This process is usually completed using TCP SYN scanning or TCP Connect scanning technology.

[0071] Full port scanning can be processed in parallel to improve the efficiency of large-scale detection. At the same time, the system can also be configured to scan specific port ranges (such as the common 80, 443, 8080, etc.) to improve targeting and efficiency.

[0072] S203: Classify the services by identifying the services running under the open ports.

[0073] The system categorizes services by analyzing the types of services running on open ports. Common services include HTTP, HTTPS, SSH, etc. Here we pay special attention to Harbor's Web service.

[0074] Service identification is usually achieved by sending specific data packets to a port and analyzing the response information. Tools such as Nmap are commonly used service identification tools. By querying its database, the service type on the port can be accurately identified.

[0075] Service classification helps the system focus on specific services, such as Harbor's Web service, to avoid unnecessary scanning steps and improve the efficiency of vulnerability detection. In addition, other services (such as SSH, FTP, etc.) can also be used as potential attack vectors, and the system can expand these detection functions in the future.

[0076] S204: If the service is classified as a Web service of the image repository Harbor, determine whether the / api / users path under the service can be accessed.

[0077] When the system confirms that an open port is running the Harbor Web service, the system will try to access the service's ** / api / users** path. This path is the Harbor user management interface, and if it is not protected, it may be used to create a new administrator account.

[0078] The path is usually accessed by sending an HTTP request and judging whether the path is accessible based on the returned HTTP status code. Status code 200 indicates successful access, while other status codes (such as 403, 401, etc.) may indicate that permissions are limited or the path is protected.

[0079] This step determines whether further attempts to exploit the vulnerability can be made. If the ** / api / users** path of Harbor is not protected (such as authentication or authorization mechanisms), an attacker can exploit this vulnerability to register an administrator account and gain full control over the entire image repository.

[0080] S205: If the access is successful, use the registration module to initiate a POST request to the / api / users path and register an administrator account.

[0081] If the ** / api / users** path can be successfully accessed, the registration module will send a POST request to try to register a user account with administrator privileges.

[0082] The registration request contains information such as username, password, email, etc. At the same time, the has_admin_role variable in the form is assigned to true, which means that the newly registered user will have administrator privileges. Once the server returns a status code 401, it indicates that the request has been successful and a new administrator account has been created.

[0083] This operation exploits a permission vulnerability in the Harbor Web service. Once the registration is successful, the attacker will have full control over the image repository, including access to all stored image files. The system can also further check whether there are other management interfaces or opportunities for privilege escalation.

[0084] S206: When the POST request has been implemented and the image repository Harbor server has successfully created a new administrator account, the image file of the image repository is pulled by the parsing module and the image file is parsed and detected.

[0085] Once the registration is successful, the system pulls the image files in the image repository through the parsing module and performs in-depth analysis and vulnerability detection on these files.

[0086] The parsing module uses administrator privileges to download all image files from private and public image repositories and scan these images for vulnerabilities in the local environment. By starting an interactive container and running tools such as vuln-scan, known vulnerabilities and potential security risks in the image can be identified.

[0087] Vulnerabilities in image files may include insecure dependencies, misconfigurations, or unpatched applications. The parsing module's detection capabilities are not limited to known vulnerabilities, but can also use machine learning models for in-depth analysis to uncover hidden security risks.

[0088] S207: The detected vulnerabilities are merged through the detection report module to generate a detection report of the image repository Harbor registration vulnerability.

[0089] The system summarizes all detection results through the detection report module and generates a detection report on Harbor registration vulnerabilities.

[0090] The detection report includes the vulnerability information found, the risk level of the vulnerability, the scope of vulnerability impact, repair suggestions, etc. The report format can be PDF, HTML, etc., which is convenient for security teams and system administrators to analyze and process.

[0091] In addition to reporting the vulnerability itself, the report module can also provide repair suggestions, such as how to strengthen Harbor's permission management, how to limit access to the ** / api / users** path, how to update insecure images in the image repository, etc. This report can help enterprises fix vulnerabilities in a timely manner and enhance system security.

[0092] Beneficial effects: The entire process of this method realizes the complete chain from network detection, port scanning, service classification, vulnerability exploitation to image file vulnerability detection through automated tools. Through automated POST requests, the system can efficiently detect Harbor's administrator registration vulnerabilities and further deeply mine the vulnerabilities in the image files through administrator permissions. This fully automated detection solution greatly improves efficiency and reduces the risk of manual operation. At the same time, it can provide detailed detection reports and provide powerful security protection measures for system administrators.

[0093] Furthermore, detecting the network reachability of each IP address in the IP address list includes sending an ICMP request packet to each IP address through Ping scanning, and determining the network reachability of the IP address according to the response information.

[0094] The system uses Ping scanning to test whether each target IP address can respond using ICMP request packets (Internet Control Message Protocol). This process is used to determine whether the target IP is reachable on the network.

[0095] ICMP Ping scan is one of the commonly used methods in network detection. It can quickly determine whether an IP address is online. Ping scan sends a request packet (ICMP Echo Request) and waits for a response packet (ICMP Echo Reply). If the target host is online and not blocked by a firewall, it will usually reply with a response packet.

[0096] In some highly secure network environments, ICMP request packets may be blocked by firewalls or other security mechanisms. Therefore, this process may require alternatives, such as TCP SYN scanning or UDP scanning, to ensure effective detection in various network environments.

[0097] If there is an IP address that is reachable on the network, detecting all ports of the IP address includes scanning all ports of the target IP address through TCP SYN scanning and / or TCP Connect scanning, and recording them in the order of 1 to 65535.

[0098] If the target IP address is reachable, the system will perform a full port scan on the IP address to check whether all ports on the IP are open. Common scanning techniques include TCP SYN scanning and TCP Connect scanning.

[0099] TCP SYN scanning is the most common port scanning method. It checks the port status by sending TCP SYN packets (synchronization request packets). If the target port responds to the SYN-ACK packet, it means that the port is open. TCP Connect scanning determines whether the port is open by trying to establish a complete TCP connection.

[0100] Full port scanning is a core step in network security, because some services may run on non-standard ports (for example, not using common ports 80, 443, etc.), full port scanning ensures that all potential vulnerability points can be detected. For large-scale scanning, the system can parallelize the processing to improve efficiency.

[0101] The service classification by identifying the services running under the open port includes sending a preset data packet to the open port, analyzing the response information by calling the Nmap database, and identifying the type of the running service.

[0102] The system sends specific preset data packets to the open port and calls the Nmap database to analyze the type of service running on the port.

[0103] Nmap is a widely used network detection and security auditing tool. It has powerful service identification capabilities and can determine the specific service running on the port (for example, HTTP, FTP, SSH, etc.) by analyzing the response packets of the port.

[0104] In addition to calling the Nmap database, the system can also integrate other service identification libraries or technologies, such as Masscan and other tools, to further improve the accuracy and efficiency of service identification. Correctly identifying the service type helps narrow the scope of vulnerability detection and perform relevant security scans for specific services.

[0105] If the access is successful, the registration module is used to initiate a post request to the apiusers path and register an administrator account, including running a Python script, loading the mitmproxy library, sending an HTTP request package to access the api users path, and initiating a POST request to the path to complete the form registration information and grant administrator permissions.

[0106] Mitmproxy library: mitmproxy is a proxy tool commonly used to intercept and modify HTTP / HTTPS requests. Here, the mitmproxy library is used to initiate an HTTP POST request to automatically submit a form to create a user account with administrator privileges.

[0107] HTTP request package: Generate and send HTTP POST request through mitmproxy, the goal is to access the ** / api / users path. The POST request contains form fields such as username, password, email, etc. The key parameter has_admin_role** is assigned a true value to create an account with administrator privileges.

[0108] Python script: used to automate the vulnerability detection process. After confirming that the Harbor service is accessible through the scanning module, the Python script begins to initiate requests through the mitmproxy library.

[0109] POST request: Send a POST request to the ** / api / users path of Harbor through mitmproxy. The form data contained in it sets the username, password, and email address, and explicitly sets the **has_admin_role** field to true to try to register an administrator account.

[0110] Mitmproxy can intercept HTTP traffic and allow users to modify the content of HTTP requests. Here, mitmproxy is used to construct and send a customized POST request to exploit the Harbor registration vulnerability.

[0111] By integrating Python with mitmproxy, users can simulate the process of manually submitting registration forms and send requests in batches to automatically complete the testing of registration vulnerabilities.

[0112] Pulling the image file from the image repository by the parsing module and parsing and detecting the image file includes:

[0113] Pull the image file of the image warehouse to the local computer through the parsing module, and use the shell script to execute the docker run instruction in the local computer to start the interactive container for parsing;

[0114] Execute a vuln-scan command in the interactive container to detect vulnerabilities in the image file.

[0115] The parsing module first downloads the specified image file from the image repository Harbor to the local computer to ensure that the image file can be parsed and detected offline.

[0116] Use the shell script to run the docker run command to start a Docker interactive container on the local computer. The Docker container is used as an isolated operating environment to run specialized vulnerability detection tools.

[0117] In the interactive container, execute the vuln-scan command to scan and detect vulnerabilities in the image file. vuln-scan is a command or tool used to scan for known vulnerabilities. It can check whether there are potential security vulnerabilities in the image file.

[0118] Docker provides an isolated container environment in which you can install and run various tools or commands, such as vuln-scan. Through Docker containers, users can ensure that the vulnerability scanning process is isolated from the host system to avoid affecting the host system. In addition, the tools running in the container can ensure compatibility with the scan target image.

[0119] Interactive containers allow users to perform manual or automatic operations inside the container. By starting an interactive container with the docker run-it command, users can execute a series of commands (such as vuln-scan) inside the container to detect image files.

[0120] vuln-scan is a vulnerability scanning tool or command that analyzes components, dependent libraries, and configuration files in image files to find known vulnerabilities that may exist. Vulnerabilities may involve outdated software versions, configuration errors, or potential attack points. This command can help users identify security issues in images and provide corresponding repair suggestions.

[0121] The method of merging the detected vulnerabilities to generate a detection report of the image repository Harbor registration vulnerabilities by using the detection report module includes checking the vulnerability detection results through the vuln-monitor instruction and merging the vulnerability detection results through the type instruction to generate a detection report of the image repository Harbor registration vulnerabilities.

[0122] The test report includes the following key parts:

[0123] Vulnerability Description: Lists the basic information and technical details of the vulnerability.

[0124] Risk assessment: Vulnerabilities are classified into risk levels (such as high, medium, and low risk) based on their severity.

[0125] Repair suggestions: Provide specific repairs or mitigation measures for each vulnerability, including updating software versions, modifying configurations, etc.

[0126] Affected Components: Describes the specific services or components affected by the vulnerability, such as a specific image file or service endpoint.

[0127] The vuln-monitor command can not only monitor vulnerability scan results, but also issue real-time alarms based on user needs. For example, when a high-risk vulnerability is detected, the system can notify the relevant person in charge via email or message to ensure timely action.

[0128] The merging function of the type instruction can be extended to integrate multiple different types of reports (such as vulnerability reports, compliance reports, security policy check reports, etc.) to generate a comprehensive security assessment file and provide a broader view of the system status.

[0129] Beneficial effects: Through these instructions, the detection report module can automatically generate detection reports, reducing the need for manual participation. This process can be further integrated into the enterprise's continuous integration (CI) / continuous deployment (CD) pipeline to automatically detect and generate vulnerability reports, so that the security of the image file can be confirmed before each deployment.

[0130] For easy sharing and viewing, the generated inspection reports can be exported to multiple formats, such as PDF, HTML, JSON, etc. These formats can adapt to different needs, such as for document archiving, API integration or display on the user interface.

[0131] The embodiments of the present disclosure provide a detection system, method, electronic device and storage medium for the registration vulnerability of the image repository Harbor, which realizes the automatic detection of registration vulnerabilities in the Harbor system through the collaborative work of the scanning module, the registration module, the parsing module and the detection report module. Specifically, the system can automatically receive a list of target IP addresses, detect network accessibility, scan open ports, identify service types, and initiate a registration request through a specific path to generate an administrator account, further parse the image files in the image repository, detect vulnerabilities therein, and finally generate a detailed vulnerability detection report. The system effectively improves the efficiency of detecting Harbor registration vulnerabilities, reduces the complexity of manual operations, and provides a complete vulnerability report to help users discover and repair security risks in a timely manner.

[0132] The electronic device 300 may be a desktop computer, a notebook, a PDA, a cloud server, or other electronic device. The electronic device 300 may include, but is not limited to, a processor 301 and a memory 302. Those skilled in the art will appreciate that Figure 3 It is only an example of the electronic device 300 and does not constitute a limitation of the electronic device 300. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the electronic device may also include input and output devices, network access devices, buses, etc.

[0133] The processor 301 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.

[0134] The memory 302 may be an internal storage unit of the electronic device 300, for example, a hard disk or memory of the electronic device 300. The memory 302 may also be an external storage device of the electronic device 300, for example, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the electronic device 300. Further, the memory 302 may also include both an internal storage unit of the electronic device 300 and an external storage device. The memory 302 is used to store the computer program 303 and other programs and data required by the electronic device. The memory 302 may also be used to temporarily store data that has been output or is to be output.

[0135] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present disclosure. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0136] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0137] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this disclosure.

[0138] In the embodiments provided in the present disclosure, it should be understood that the disclosed devices / electronic devices and methods can be implemented in other ways. For example, the device / electronic device embodiments described above are merely schematic. For example, the division of modules or units is only a logical function division. There may be other division methods in actual implementation. Multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection of devices or units, which may be electrical, mechanical or other forms.

[0139] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0140] In addition, each functional unit in each embodiment of the present disclosure may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0141] If the integrated module / unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present disclosure implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. The computer program may include computer program code, and the computer program code may be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, the computer-readable medium does not include electric carrier signals and telecommunication signals.

[0142] The above embodiments are only used to illustrate the technical solutions of the present disclosure, rather than to limit them. Although the present disclosure has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present disclosure, and should all be included in the protection scope of the present disclosure.

Claims

1. A detection system for image repository Harbor registration vulnerabilities, characterized in that: include: A scanning module is used to receive a target IP address list, detect the network reachability of each IP address in the target IP address list, record the open port number, identify the service running under the open port, and classify the service; The registration module is used to initiate a post request to the apiusers path under the Web service of the image repository Harbor and register an administrator account; A parsing module, used to pull the image file of the image warehouse and parse and detect the image file if the administrator account is successfully registered in the registration module; The detection report module is used to merge the detected vulnerabilities to generate a detection report of the image repository Harbor registration vulnerabilities.

2. A method for detecting a vulnerability in the image repository Harbor registration, characterized in that: include: Inputting a target IP address list into the scanning module, and detecting the network reachability of each IP address in the target IP address list; If there is an IP address that is reachable on the network, detect all ports of the IP address and record the open port numbers; Classify services by identifying services running under open ports; If the service is classified as a Web service of the image repository Harbor, determine whether the apiusers path under the service can be accessed; If the access is successful, use the registration module to initiate a post request to the apiusers path and register an administrator account; When the post request has been implemented and the image warehouse Harbor server has successfully created a new administrator account, the image file of the image warehouse is pulled through the parsing module and the image file is parsed and tested; The detection report module combines the detected vulnerabilities into a detection report for the Harbor registration vulnerabilities in the image repository.

3. The method according to claim 2, characterized in that The detecting the network reachability of each IP address in the IP address list includes sending an ICMP request packet to each IP address through Ping scanning, and judging the network reachability of the IP address according to the response information.

4. The method according to claim 2, characterized in that: If there is an IP address that is reachable on the network, detecting all ports of the IP address includes scanning all ports of the target IP address through TCP SYN scanning and / or TCP Connect scanning, and recording them in the order of 1 to 65535.

5. The method according to claim 2, characterized in that: The service classification by identifying the services running under the open port includes sending a preset data packet to the open port, analyzing the response information by calling the Nmap database, and identifying the type of the running service.

6. The method according to claim 2, characterized in that If the access is successful, the registration module is used to initiate a post request to the apiusers path and register an administrator account, including running a Python script, loading the mitmproxy library, sending an HTTP request packet to access the api users path, and initiating a POST request to the path to complete the form registration information and grant administrator permissions.

7. The method according to claim 2, characterized in that: Pulling the image file from the image repository by the parsing module and parsing and detecting the image file includes: Pull the image file of the image warehouse to the local computer through the parsing module, and use the shell script to execute the docker run instruction in the local computer to start the interactive container for parsing; Execute a vuln-scan command in the interactive container to detect vulnerabilities in the image file.

8. The method according to claim 7, characterized in that The method of merging the detected vulnerabilities through the detection report module to generate a detection report of the image warehouse Harbor registration vulnerability includes checking the vulnerability detection results through the vuln-mon i tor instruction and merging the vulnerability detection results through the type instruction to generate a detection report of the image warehouse Harbor registration vulnerability.

9. An electronic device, characterized in that: include: one or more processors; A storage unit, used to store one or more programs, which, when executed by the one or more processors, enable the one or more processors to implement the detection method for the image repository Harbor registration vulnerability according to any one of claims 2 to 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it can implement the detection method for the image repository Harbor registration vulnerability according to any one of claims 2 to 8.

Images