Detection system and method for harbor image registry registration vulnerabilities

Abstract

The present application provides a detection system and method for Harbor image registry registration vulnerabilities. The method comprises: inputting a target IP address list to a scanning module, and detecting network reachability of each IP address in the target IP address list; if there is a network-reachable IP address, detecting all ports of the IP address, and recording the number of an open port; by identifying a service running under the open port, classifying the service; if the service is classified as a Web service of a Harbor image registry, determining whether an api users path under the service can be accessed; if the access succeeds, using a registration module to initiate a post request for the api users path and register an administrator account; when the post request has been implemented and a new administrator account has been successfully created by a Harbor image registry server, a parsing module pulling an image file of the image registry and parsing and detecting the image file; and a detection report module integrating detected vulnerabilities to generate a detection report of Harbor image registry registration vulnerabilities.

Description

System and method for detecting vulnerabilities registered by Harbor mirror repository

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to the Chinese patent application No. 202411327322.7, filed on September 23, 2024, and entitled "System and method for detecting vulnerabilities registered by Harbor mirror repository", the entire content of which is incorporated herein by reference. TECHNICAL FIELD

[0003] The present application relates to the technical field of vulnerability detection, and in particular to a system and method for detecting vulnerabilities registered by Harbor mirror repository, an electronic device and a storage medium. BACKGROUND

[0004] Harbor is an enterprise-level Registry server for storing and distributing Docker images. In the case of Harbor enabled, if the relevant permission control is not done well, an illegal user can create an administrator account by accessing the api user and adding a key parameter in the request, thereby taking over the Harbor mirror repository to obtain the monitoring information in the application system.

[0005] The vulnerability detection does not have the function of automatically registering the possible administrator vulnerabilities of the Harbor mirror repository, and it is difficult to deeply mine the vulnerabilities existing in the images managed in the Harbor mirror repository. Usually, manual entry into the web management page of Harbor is required to complete the manual registration of the administrator, and then the images are parsed.

[0006] To solve the above problems, a system and method for detecting vulnerabilities registered by Harbor mirror repository, an electronic device and a storage medium are proposed.

[0007] SUMMARY

[0008] Embodiments of the present application aim to at least solve one of the technical problems existing in the prior art, and provide a system and method for detecting vulnerabilities registered by Harbor mirror repository, an electronic device and a storage medium.

[0009] In a first aspect, a system for detecting vulnerabilities registered by Harbor mirror repository is provided, comprising:

[0010] A scanning module is configured to receive a target IP address list, detect the network reachability of each IP address in the target IP address list, record the open port number, identify the services running under the open port, and classify the services.

[0011] The registration module is configured to initiate a post request to an api users path under a web service of the image warehouse Harbor, and register an administrator account.

[0012] The analysis module is configured to, if the registration of the administrator account by the registration module is successful, pull an image file of the image warehouse and analyze and detect the image file.

[0013] The detection report module is configured to combine and generate a detection report of the registered vulnerability of the image warehouse Harbor.

[0014] In a second aspect, the application provides a detection method for a registered vulnerability of an image warehouse Harbor, comprising:

[0015] Inputting a target IP address list to the scanning module to detect network reachability of each IP address in the target IP address list;

[0016] If there is a network-reachable IP address, detecting all ports of the IP address and recording open port numbers;

[0017] Classifying services by identifying services running under the open ports;

[0018] If the services are classified as web services of the image warehouse Harbor, determining whether the api users path under the services can be accessed;

[0019] If the access is successful, initiating a post request to the api users path by the registration module and registering an administrator account;

[0020] If the post request is implemented and the image warehouse Harbor server successfully creates a new administrator account, pulling an image file of the image warehouse by the analysis module and analyzing and detecting the image file;

[0021] Combining and generating a detection report of the registered vulnerability of the image warehouse Harbor by the detection report module.

[0022] In combination with the second aspect, the detection of the network reachability of each IP address in the IP address list comprises sending an ICMP request packet to each IP address by Ping scanning, and determining the network reachability of the IP address according to response information.

[0023] In combination with the second aspect, if there is a network-reachable IP address, detecting all ports of the IP address comprises scanning all ports of the target IP address by TCP SYN scanning and / or TCP Connect scanning, and recording the ports in the order of 1 to 65535.

[0024] With reference to the second aspect, the service categorization by identifying the services running under the open port comprises sending a preset data packet to the open port, analyzing the response information by calling the Nmap database to identify the type of service running.

[0025] With reference to the second aspect, the post request to the api users path and registration of the administrator account using the registration module if the access is successful comprises loading the mitmproxy library by running a Python script, sending an HTTP request packet to access the api users path, and initiating a POST request to the path to complete the form registration information and give the administrator authority.

[0026] With reference to the second aspect, the pulling of the image file of the image repository by the analysis module and the analysis and detection of the image file comprise:

[0027] The image file of the image repository is pulled to the local computer by the analysis module, and a shell script is used to execute a docker run instruction to start an interactive container for analysis in the local computer;

[0028] A vuln-scan command is executed in the interactive container to detect vulnerabilities in the image file.

[0029] With reference to the second aspect, the generation of a detection report of registered vulnerabilities of the image repository Harbor by the detection report module by merging the detected vulnerabilities comprises viewing the vulnerability detection results by a vuln-monitor instruction and merging the vulnerability detection results by a tpye instruction to generate the detection report of registered vulnerabilities of the image repository Harbor.

[0030] The third aspect of the present application provides an electronic device, comprising:

[0031] one or more processors;

[0032] a storage unit for storing one or more programs, which, when executed by the one or more processors, can cause the one or more processors to implement any one of the above methods for detecting registered vulnerabilities of the image repository Harbor.

[0033] The fourth aspect of the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement any one of the above methods for detecting registered vulnerabilities of the image repository Harbor.

[0034] The application provides a detection system, method, electronic device and storage medium for Harbor registration vulnerability of image warehouse. Through the cooperative work of the scanning module, the registration module, the analysis module and the detection report module, the automatic detection of the registration vulnerability in the Harbor system is realized. Specifically, the system can automatically receive a target IP address list, detect network reachability, scan open ports, identify service types, and generate an administrator account by initiating a registration request through a specific path, further analyze the image files in the image warehouse, detect the vulnerabilities therein, and finally generate a detailed vulnerability detection report. The system effectively improves the efficiency of detecting Harbor registration vulnerabilities, reduces the complexity of manual operations, and provides a complete vulnerability report to help users discover and repair security risks in a timely manner. BRIEF DESCRIPTION OF DRAWINGS

[0035] FIG. 1 is a structural schematic diagram of a detection system for Harbor registration vulnerability of image warehouse according to an embodiment of the application;

[0036] FIG. 2 is a flowchart of a detection method for Harbor registration vulnerability of image warehouse according to an embodiment of the application;

[0037] FIG. 3 is a structural schematic diagram of an electronic device according to an embodiment of the application. DETAILED DESCRIPTION

[0038] The exemplary embodiments will be described in detail herein below with reference to the drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the embodiments of the application.

[0039] The terms used in the embodiments of the present application are merely for the purpose of describing particular embodiments and are not intended to limit the embodiments of the present application. The singular forms "a," "an," and "the" used in the embodiments of the present application and the appended claims are intended to include plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the term "and / or" used herein includes any or all possible combinations of one or more associated listed items.

[0040] It should be understood that although the terms first, second, third, etc. can be used in this application to describe various information, these information should not be limited to these terms. These terms are only used to distinguish information of the same type from each other. For example, without departing from the scope of the embodiments of the present application, the first information can also be referred to as the second information, and similarly, the second information can also be referred to as the first information. Depending on the context, the word "if" as used herein can be interpreted as "when" or "upon" or "in response to determining".

[0041] As shown in Figure 1, it is a structural schematic diagram of the detection system for Harbor mirror image warehouse registration vulnerability of the embodiment of the application. It comprises:

[0042] The scanning module 110 is configured to receive a target IP address list, detect the network reachability of each IP address in the target IP address list, record the open port number, identify the service running under the open port, and perform service classification.

[0043] The registration module 120 is configured to initiate a post request to the api users path under the Web service of the mirror image warehouse Harbor, and register an administrator account.

[0044] The parsing module 130 is configured to pull the image file of the mirror image warehouse and analyze and detect the image file in the case that the registration of the administrator account by the registration module is successful.

[0045] The detection report module 140 is configured to combine the detected vulnerabilities to generate a detection report of the Harbor mirror image warehouse registration vulnerability.

[0046] Specifically, the scanning module 110 is responsible for receiving a target IP address list, and detecting the network reachability of each IP address in the list one by one. Network reachability is usually determined by sending an ICMP Ping request or other protocol packet to determine whether the target server can be accessed.

[0047] Once it is confirmed that a certain IP address is reachable, the scanning module will further scan all ports of the IP address and record the open port number. This process can be completed by TCP SYN scanning or TCP Connect scanning, and each port number from 1 to 65535 will be detected one by one.

[0048] After confirming the open port, the scanning module will identify the service running on the port and perform service classification. This identification process can be determined by sending specific data packets to the port and analyzing the response, such as calling the Nmap database to identify the service type.

[0049] The registration module 120 is directed to the identified Web service of the mirror image warehouse Harbor, and initiates a POST request to the ** / api / users** path to attempt to register a user account with administrator privileges.

[0050] Among them, the form containing the registration information such as username, password, and email is submitted to the / api / users path, and the administrator privilege variable has_admin_role in the form is set to true, so as to generate an account with administrator privileges.

[0051] Once the registration is successful, the system can access the private and public image repositories of Harbor using the newly registered administrator account, laying the foundation for subsequent image file downloads and vulnerability detection.

[0052] The parsing module 130 initiates the download and parsing of image files stored in the Harbor image repository after the registration module successfully creates the administrator account. This module pulls all accessible image files and performs in-depth parsing and vulnerability detection on these image files.

[0053] The parsing process scans the image files by starting an interactive container and executing the vuln-scan command. The vulnerability detection tool identifies potential security vulnerabilities in the image files, such as insecure configurations, outdated software components, and unpatched known vulnerabilities.

[0054] The result of the parsing module is a detailed list of vulnerabilities, including potential risks found in each image file.

[0055] The detection report module 140 is responsible for integrating the detection results of the parsing module, summarizing and classifying all vulnerability information, and generating a complete image repository Harbor registration vulnerability detection report.

[0056] The report not only lists the detected vulnerabilities, but also provides repair suggestions to help system administrators or security teams quickly patch vulnerabilities and enhance the overall security of the system.

[0057] The report output by this module can be generated in PDF or HTML format for easy sharing and archiving.

[0058] Beneficial effects: This detection system, through modular design, can realize automatic detection of Harbor registration vulnerabilities, avoiding the tedious process of manually registering administrator accounts and manually analyzing image files, greatly improving detection efficiency. The targeted vulnerability detection system not only detects Harbor registration vulnerabilities, but also further analyzes specific image files in the image repository to deeply excavate potential security vulnerabilities in these files. This full-process vulnerability detection strategy can provide users with more comprehensive security assessment. At the same time, this system can be deployed in various environments and is suitable for various sizes of networks and cloud platforms. At the same time, the registration module and the parsing module can also be extended according to different needs, such as supporting other types of image repositories or vulnerability detection tools.

[0059] As shown in Figure 2, the flowchart of the image repository Harbor registration vulnerability detection method of the embodiment of the present application is shown. It includes:

[0060] S201: input a target IP address list to the scanning module, and detect the network reachability of each IP address in the target IP address list;

[0061] S202: if there is a network-reachable IP address, detect all ports of the IP address, and record the open port number.

[0062] S203: classify services by identifying services running under open ports.

[0063] S204: if the service is classified as the Web service of the image repository Harbor, determine whether the api users path under the service can be accessed.

[0064] S205: if the access is successful, use the registration module to initiate a post request to the api users path and register an administrator account.

[0065] S206: in the case that the post request has been implemented and the image repository Harbor server has successfully created a new administrator account, pull the image file of the image repository through the parsing module and analyze and detect the image file.

[0066] S207: combine the detected vulnerabilities through the detection report module to generate a detection report of the image repository Harbor registration vulnerability.

[0067] Specifically, S201 inputs a target IP address list to the scanning module, and detects the network reachability of each IP address in the target IP address list.

[0068] The user or system administrator provides a list containing multiple target IP addresses to the scanning module, which may correspond to servers running the Harbor service. The system detects the network reachability of these IP addresses to determine which targets can be further scanned.

[0069] Network reachability detection can be achieved through ICMP Ping requests, or methods such as TCP SYN scanning. If the target IP address can respond to the detection request in the network, it means that the address is reachable under the current network conditions, which means that further port scanning can be performed.

[0070] In practical applications, due to the fact that some network or firewall configurations may block ICMP Ping requests, the network detection method can be adjusted as needed, such as using TCP or UDP protocol detection methods, to ensure adaptation to various network environments.

[0071] S202: if there is a network-reachable IP address, detect all ports of the IP address, and record the open port number.

[0072] After confirming the IP address is reachable, the system performs a full port scan on each IP address, recording all open ports. This step aims to determine which services are running on the target server.

[0073] Full port scanning is a critical step in vulnerability detection, identifying services running on the target server by scanning all ports from 1 to 65535. This process is usually done using TCP SYN scanning or TCP Connect scanning techniques.

[0074] Full port scanning can be parallelized to improve efficiency for large-scale detection. At the same time, the system can be configured to scan specific port ranges (such as 80, 443, 8080, etc.) to improve relevance and efficiency.

[0075] S203: Service classification by identifying services running under open ports.

[0076] The system classifies services by analyzing the types of services running on open ports. Common services include HTTP, HTTPS, SSH, etc. This article focuses on Harbor's web service.

[0077] Service identification is usually achieved by sending specific packets to the port and analyzing the response information. Tools such as Nmap are commonly used for service identification, and by querying their databases, the system can accurately identify the type of service on the port.

[0078] Service classification helps the system focus on specific services, such as Harbor's web service, avoiding unnecessary scanning steps and improving vulnerability detection efficiency. In addition, other services (such as SSH, FTP, etc.) can also be potential attack vectors, and the system can extend these detection functions in the future.

[0079] S204: If the service is classified as the web service of the image repository Harbor, determine whether the / api / users path under the service can be accessed.

[0080] When the system confirms that a certain open port is running Harbor's web service, the system will attempt to access the ** / api / users** path of the service. This path is the interface for Harbor user management, and if not protected, it can be exploited to create a new administrator account.

[0081] The way to access this path is usually by sending an HTTP request and judging whether the path is accessible according to the returned HTTP status code. Status code 200 indicates successful access, and other status codes (such as 403, 401, etc.) may indicate restricted permissions or protected paths.

[0082] This step determines whether further exploitation attempts can be made. If the ** / api / users** path of Harbor is not protected (such as authentication or authorization mechanisms), an attacker can exploit this vulnerability to register an administrator account, thereby gaining full control over the entire image repository.

[0083] S205: If the access is successful, use the registration module to initiate a POST request to the ** / api / users** path and register an administrator account.

[0084] If the ** / api / users** path can be successfully accessed, the registration module will send a POST request to try to register a user account with administrator privileges.

[0085] The registration request contains information such as username, password, email, etc., and the has_admin_role variable in the form is assigned as true, which means the newly registered user will have administrator privileges. Once the server returns a status code of 401, indicating that the request has been successful, a new administrator account has been created.

[0086] This operation exploits the permission vulnerability of Harbor Web services. Once the registration is successful, the attacker will have full control over the image repository, including access to all stored image files. The system can further check for other management interfaces or opportunities for privilege escalation.

[0087] S206: In the case of a successful POST request and the image repository Harbor server successfully creating a new administrator account, use the parsing module to pull the image files from the image repository and parse and detect the image files.

[0088] Once the registration is successful, the system uses the parsing module to pull the image files from the image repository and perform in-depth parsing and vulnerability detection on these files.

[0089] The parsing module uses administrator privileges to download all image files from private and public image repositories and perform vulnerability scanning on these images in a local environment. By interacting with the container and running tools such as vuln-scan, it can identify known vulnerabilities and potential security risks in the images.

[0090] The vulnerabilities in the image files may include insecure dependencies, configuration errors, or unpatched applications. The detection capabilities of the parsing module are not limited to known vulnerabilities, but also use machine learning models for in-depth analysis to uncover hidden security risks.

[0091] S207: Use the detection report module to merge the detected vulnerabilities and generate a detection report for the image repository Harbor registration vulnerability.

[0092] The system aggregates all detection results through the detection report module and generates a detection report on the Harbor registration vulnerability.

[0093] The detection report includes information about the discovered vulnerabilities, the risk level of the vulnerabilities, the scope of the vulnerability impact, and repair suggestions. The report format can be PDF, HTML, etc., making it convenient for security teams and system administrators to analyze and handle.

[0094] In addition to reporting the vulnerability itself, the report module can also provide repair suggestions, such as how to strengthen Harbor's permission management, how to limit access to the ** / api / users** path, and how to update insecure images in the image repository. This report can help enterprises promptly repair vulnerabilities and enhance system security.

[0095] Beneficial effects: The entire process of this method realizes a complete chain from network detection, port scanning, service classification, vulnerability exploitation to image file vulnerability detection through automated tools. Through automated POST requests, the system can efficiently detect Harbor administrator registration vulnerabilities and further exploit vulnerabilities in image files through administrator permissions. This fully automated detection scheme greatly improves efficiency, reduces the risk of manual operation, and provides detailed detection reports to provide powerful security protection means for system managers.

[0096] Optionally, the network reachability of each IP address in the IP address list is detected by sending an ICMP request packet to each IP address through Ping scanning and determining the network reachability of the IP address according to the response information.

[0097] The system uses ICMP request packets (Internet Control Message Protocol) to test whether each target IP address can respond through Ping scanning. This process is used to determine whether the target IP is reachable in the network.

[0098] ICMP Ping scanning is one of the commonly used methods in network detection, which can quickly determine whether an IP address is online. Ping scanning sends a request packet (ICMP Echo Request) and waits for a response packet (ICMP Echo Reply). If the target host is online and not blocked by a firewall, it will usually return a response packet.

[0099] In some high-security network environments, ICMP request packets may be blocked by firewalls or other security mechanisms, so alternative solutions such as TCP SYN scanning or UDP scanning may be required to ensure effective detection in various network environments.

[0100] If the IP address is found to be reachable, the system will perform a full port scan on that IP address to check if all ports on that IP are open. Common scanning techniques include TCP SYN scan and TCP Connect scan.

[0101] If the target IP address is found to be reachable, the system will perform a full port scan on that IP address to check if all ports on that IP are open. Common scanning techniques include TCP SYN scan and TCP Connect scan.

[0102] TCP SYN scan is the most common port scanning method, which checks the port status by sending a TCP SYN packet (synchronization request packet). If the target port responds with a SYN-ACK packet, it indicates that the port is open. TCP Connect scan is to determine whether the port is open by attempting to establish a complete TCP connection.

[0103] Full port scanning is a core step in network security, as some services may run on non-standard ports (such as not using common ports 80, 443, etc.), full port scanning ensures that all potential vulnerabilities can be detected. For large-scale scanning, the system can be parallelized to improve efficiency.

[0104] The service classification by identifying the services running on the open ports includes sending a preset data packet to the open port, analyzing the response information by calling the Nmap database, and identifying the type of service running.

[0105] The system sends a specific preset data packet to the open port and calls the Nmap database to analyze the type of service running on the port.

[0106] Nmap is a widely used network detection and security audit tool, which has strong service identification ability, and can determine the specific service (such as HTTP, FTP, SSH, etc.) running on the port by analyzing the response packet of the port.

[0107] In addition to calling the Nmap database, the system can also integrate other service identification libraries or technologies, such as Masscan and other tools, to further improve the accuracy and efficiency of service identification. Correctly identifying the type of service helps to narrow the scope of vulnerability detection and perform relevant security scans on specific services.

[0108] If the access is successful, the post request is initiated to the api users path using the registration module, which includes running a Python script, loading the mitmproxy library, sending an HTTP request package to access the api users path, and initiating a POST request to the path to complete the form registration information and assign administrator permissions.

[0109] Mitmproxy library: mitmproxy is a proxy tool commonly used for intercepting and modifying HTTP / HTTPS requests. Here, the mitmproxy library is used to initiate an HTTP POST request and automate form submission to create a user account with administrator privileges.

[0110] HTTP request package: An HTTP POST request is generated and sent through mitmproxy, targeting the ** / api / users path. The POST request contains form fields such as username, password, email, etc., with the key parameter has_admin_role** set to true to create an account with administrator privileges.

[0111] Python script: used to automate the vulnerability detection process. After confirming that the Harbor service is accessible through the scanning module, the Python script initiates requests through the mitmproxy library.

[0112] POST request: A POST request is sent to the Harbor ** / api / users path through mitmproxy, containing form data such as username, password, and email, and explicitly setting the has_admin_role** field to true to attempt to register an administrator account.

[0113] Mitmproxy can intercept HTTP traffic and allow users to modify the contents of HTTP requests. Here, mitmproxy is used to construct and send custom POST requests to exploit the Harbor registration vulnerability.

[0114] By integrating Python with mitmproxy, users can simulate the process of manually submitting a registration form and send requests in bulk, automating the testing of the registration vulnerability.

[0115] The image file of the image repository is pulled and analyzed by the parsing module, including:

[0116] The parsing module pulls the image file of the image repository to the local computer, and uses a shell script to execute the docker run instruction to start an interactive container for parsing;

[0117] In the interactive container, the vuln-scan command is executed to detect vulnerabilities in the image file.

[0118] The parsing module first downloads the specified image file from the image repository Harbor to the local computer, ensuring that the image file can be parsed and detected offline.

[0119] The shell script is used to run the docker run command to start a Docker interactive container on the local computer. The Docker container serves as an isolated running environment for running specialized vulnerability detection tools.

[0120] In the interactive container, the vuln-scan command is executed to scan and detect vulnerabilities in the image file. Vuln-scan is a command or tool for scanning known vulnerabilities, which can check the image file for potential security vulnerabilities.

[0121] Docker provides an isolated container environment where various tools or commands such as vuln-scan can be installed and run. Through the Docker container, users can ensure that the vulnerability scanning process is isolated from the host system, avoiding affecting the host system. In addition, the tools running in the container can ensure compatibility with the scanned target image.

[0122] The interactive container allows users to perform manual or automatic operations inside the container. By starting an interactive container with the docker run-it command, users can execute a series of commands (such as vuln-scan) inside the container to detect the image file.

[0123] Vuln-scan is a vulnerability scanning tool or command that analyzes components, dependent libraries and configuration files in the image file to find known vulnerabilities. Vulnerabilities may involve outdated software versions, configuration errors or potential attack entry points. This command can help users identify security issues in the image and provide corresponding repair suggestions.

[0124] The detection report module combines the detected vulnerabilities to generate a detection report of the image repository Harbor registered vulnerabilities, including using the vuln-monitor instruction to view the vulnerability detection results and using the tpye instruction to combine the vulnerability detection results to generate a detection report of the image repository Harbor registered vulnerabilities.

[0125] The detection report includes the following key sections:

[0126] Vulnerability Description: Lists the basic information and technical details of the vulnerability.

[0127] Risk Assessment: Classifies the risk level of the vulnerability based on its severity (e.g., high, medium, low risk).

[0128] Remediation Suggestions: Provides specific remediation or mitigation measures for each vulnerability, including updating software versions, modifying configurations, etc.

[0129] Affected Components: Specifies the particular service or component affected by the vulnerability, such as a specific image file or service endpoint.

[0130] The vuln-monitor directive not only monitors the vulnerability scan results but also provides real-time alerts based on user requirements. For example, when a high-risk vulnerability is detected, the system can notify the responsible person via email or message, ensuring timely action.

[0131] The merge functionality of the tpye directive can be extended to integrate multiple different types of reports (such as vulnerability reports, compliance reports, security policy check reports, etc.) to generate a comprehensive security assessment file, providing a more extensive view of the system's status.

[0132] Benefits: Through these directives, the detection report module can automatically generate detection reports, reducing the need for manual involvement. This process can be further integrated into the enterprise's continuous integration (CI) / continuous deployment (CD) pipeline, automatically detecting and generating vulnerability reports, ensuring the security of image files before each deployment.

[0133] For ease of sharing and viewing, the generated detection reports can be exported in various formats, such as PDF, HTML, JSON, etc. These formats can adapt to different needs, such as document archiving, API integration, or displaying on user interfaces.

[0134] Embodiments of the present application provide a detection system, method, electronic device and storage medium for Harbor registry vulnerability. Through the cooperative work of the scanning module, the registration module, the analysis module and the detection report module, the automatic detection of the registration vulnerability in the Harbor system is realized. Specifically, the system can automatically receive the target IP address list, detect the network reachability, scan the open port, identify the service type, and generate the administrator account through the specific path to initiate the registration request, further analyze the image file in the image warehouse, detect the vulnerability therein, and finally generate a detailed vulnerability detection report. The system effectively improves the efficiency of detecting Harbor registration vulnerability, reduces the complexity of manual operation, and provides a complete vulnerability report to help users discover and repair security risks in time.

[0135] The electronic device 300 can be a desktop computer, a notebook computer, a palm computer, a cloud server and the like. The electronic device 300 can include but is not limited to a processor 301 and a memory 302. Those skilled in the art can understand that FIG. 3 is only an example of the electronic device 300, and does not constitute a limitation on the electronic device 300, and can include more or fewer components than the diagram, or combine certain components, or different components, for example, the electronic device can also include an input / output device, a network access device, a bus and the like.

[0136] The processor 301 can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor.

[0137] The memory 302 can be an internal storage unit of the electronic device 300, for example, a hard disk or a memory of the electronic device 300. The memory 302 can also be an external storage device of the electronic device 300, for example, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the electronic device 300. Alternatively, the memory 302 can include both an internal storage unit and an external storage device of the electronic device 300. The memory 302 is used to store the computer program 303 and other programs and data required by the electronic device. The memory 302 can also be used to temporarily store data that has been output or will be output.

[0138] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the above-mentioned division of each functional unit and module is exemplified, and in actual application, the above-mentioned functions can be completed by different functional units and modules according to needs, that is, the internal structure of the device is divided into different functional units or modules to complete all or part of the functions described above. Each functional unit and module in the embodiment can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of software functional unit. In addition, the specific name of each functional unit and module is only for easy distinction, and does not limit the protection scope of the present application. The specific working process of the unit and module in the above system can refer to the corresponding process in the foregoing method embodiments, which will not be described here.

[0139] In the above embodiments, the description of each embodiment has its own emphasis, and the parts not described or recorded in detail in a certain embodiment can be referred to the relevant description of other embodiments.

[0140] Those of ordinary skill in the art can realize that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be realized in electronic hardware or a combination of computer software and electronic hardware. Whether the functions are executed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0141] In the embodiments of the present application, it should be understood that the disclosed apparatus / equipment and method can be implemented in other manners. For example, the embodiments of the apparatus / equipment described above are merely schematic, and the division of the modules or units can be changed or integrated, or some features can be ignored or not executed. In addition, the display or discussion about the coupling or direct coupling or communication connection between the modules can be achieved through some interfaces, and can be indirect coupling or communication connection between the modules, and can be electrical, mechanical or other forms.

[0142] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e. may be located in one place or distributed on multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the embodiments.

[0143] In addition, the functional units in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0144] If the integrated module / unit is realized in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on this understanding, all or part of the processes in the above-mentioned embodiment methods can also be completed by computer programs instructing related hardware, and the computer programs can be stored in a computer readable storage medium. The computer program can be executed by a processor to implement the steps of each method embodiment. The computer program can include computer program code, which can be in the form of source code, object code, executable file or some intermediate form. The computer readable medium can include any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signal, telecommunication signal and software distribution medium, etc. Optionally, the readable storage medium is a non-transitory readable storage medium. It should be noted that the content contained in the computer readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction, for example, in some jurisdictions, according to legislation and patent practice, the computer readable medium does not include electrical carrier signals and telecommunication signals.

[0145] The above examples are only used to illustrate the technical solutions of the present application, but not to limit the present application; although the present application has been described in detail with reference to the foregoing examples, those ordinarily skilled in the art should understand: the technical solutions recorded in the foregoing examples can still be modified, or some technical features can be replaced equivalently; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application.

Claims

1. A detection system for Harbor registry vulnerability mirroring warehouse, characterized in that, The application comprises: a scanning module for receiving a target IP address list, detecting the network accessibility of each IP address in the target IP address list, recording open port numbers, identifying services running under the open ports, and classifying services; a registration module for initiating a post request to the api users path under the web service of the image warehouse Harbor and registering an administrator account; a parsing module for pulling image files of the image warehouse and parsing and detecting the image files in the case that the registration of the administrator account by the registration module is successful; a detection report module for merging the detected vulnerabilities to generate a detection report of the vulnerabilities registered by the image warehouse Harbor.

2. A detection method for Harbor registry vulnerability mirroring warehouse, characterized in that, The application comprises: inputting a target IP address list to the scanning module and detecting the network accessibility of each IP address in the target IP address list; if there is a network accessible IP address, detecting all ports of the IP address and recording open port numbers; classifying services by identifying services running under the open ports; if the services are classified as the web service of the image warehouse Harbor, judging whether the api users path under the service can be accessed; if the access is successful, initiating a post request to the api users path by the registration module and registering an administrator account; in the case that the post request has been implemented and the image warehouse Harbor server has successfully created a new administrator account, pulling image files of the image warehouse by the parsing module and parsing and detecting the image files; merging the detected vulnerabilities by the detection report module to generate a detection report of the vulnerabilities registered by the image warehouse Harbor.

3. The method of claim 2, wherein, The detection of the network accessibility of each IP address in the IP address list comprises sending an ICMP request packet to each IP address by Ping scanning and judging the network accessibility of the IP address according to the response information.

4. The method of claim 2, wherein, The detection of all ports of the IP address in the case that there is a network accessible IP address comprises scanning all ports of the target IP address by TCP SYN scanning and / or TCP Connect scanning and recording the ports in the order of 1 to 65535.

5. The method of claim 2, wherein, The classification of services by identifying services running under the open ports comprises sending a preset data packet to the open ports, analyzing the response information by calling the Nmap database, and identifying the type of the running services.

6. The method of claim 2, wherein, The initiation of a post request to the api users path by the registration module in the case that the access is successful comprises running a Python script, loading the mitmproxy library, sending an HTTP request packet to access the api users path, initiating a POST request to the path to complete the form registration information, and giving the administrator authority.

7. The method of claim 2, wherein, The pulling of image files of the image warehouse by the parsing module and the parsing and detecting of the image files comprise: The image file of the image warehouse is pulled to a local computer by the analysis module, and a shell script is used to execute a docker run instruction to start an interactive container for analysis in the local computer; A vuln-scan command is executed in the interactive container to detect vulnerabilities in the image file.

8. The method of claim 7, wherein, The detection report module combines the detected vulnerabilities to generate a detection report of the image warehouse Harbor registered vulnerabilities, including viewing the vulnerability detection results by a vuln-monitor instruction, combining the vulnerability detection results by a tpye instruction, and generating a detection report of the image warehouse Harbor registered vulnerabilities.

9. An electronic device, comprising: Comprise: One or more processors; A storage unit for storing one or more programs, which, when executed by the one or more processors, can cause the one or more processors to implement the method for detecting vulnerabilities of the image warehouse Harbor according to any one of claims 2 to 8.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program can implement the method for detecting vulnerabilities of the image warehouse Harbor according to any one of claims 2 to 8 when executed by the processor.

Images