Back to Checks
alibabacloud

Scheduled vulnerability scan is enabled on all servers

securitycenter_vulnerability_scan_enabled
Service: securitycenterSeverity: high
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:ALIYUN::SAS::Instance

Alibaba Cloud Security Center should have scheduled vulnerability scanning enabled on all servers to periodically discover system vulnerabilities. The scan should cover all vulnerability types including yum, cve, sys, cms, and emg to ensure comprehensive detection of known security weaknesses across the infrastructure.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

Without scheduled vulnerability scans enabled, system vulnerabilities may remain undetected for extended periods. This leaves servers exposed to known security exploits, privilege escalation attacks, and malware infections that target unpatched software, increasing the overall attack surface and risk of compromise.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks securitycenter_vulnerability_scan_enabled

Recommendation

Enable scheduled vulnerability scanning on all servers in Security Center, covering all vulnerability types to ensure timely discovery and remediation of known security weaknesses.

Remediation

CLI

aliyun sas ModifyVulConfig --Type <vul_type> --Config on

Other

1Log on to the **Security Center Console**
2Select **Vulnerabilities**
3Click **Settings**
4Apply all types of vulnerabilities (`yum`, `cve`, `sys`, `cms`, `emg`)
5Enable **High** (asap) and **Medium** (later) vulnerability scan levels

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.securitycenter.securitycenter_client import (
    securitycenter_client,
)


class securitycenter_vulnerability_scan_enabled(Check):
    """Check if scheduled vulnerability scan is enabled on all servers."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []

        # Required vulnerability types that must be enabled
        required_vul_types = ["yum", "cve", "sys", "cms", "emg"]

        # Required scan levels: "asap" (high) and "later" (medium)
        required_scan_levels = ["asap", "later"]

        vul_configs = securitycenter_client.vul_configs
        concern_necessity = securitycenter_client.concern_necessity

        # Check vulnerability types
        disabled_types = []
        for vul_type in required_vul_types:
            config = vul_configs.get(vul_type)
            if not config or not config.enabled:
                disabled_types.append(vul_type)

        # Check scan levels
        missing_levels = []
        for level in required_scan_levels:
            if level not in concern_necessity:
                missing_levels.append(level)

        # Create report
        report = CheckReportAlibabaCloud(metadata=self.metadata(), resource={})
        report.region = securitycenter_client.region
        report.resource_id = securitycenter_client.audited_account
        report.resource_arn = f"acs:sas::{securitycenter_client.audited_account}:vulnerability-scan-config"

        if not disabled_types and not missing_levels:
            report.status = "PASS"
            report.status_extended = (
                "Scheduled vulnerability scan is enabled for all vulnerability types "
                "(yum, cve, sys, cms, emg) and all required scan levels (high/asap, medium/later) are enabled."
            )
        else:
            report.status = "FAIL"
            issues = []
            if disabled_types:
                issues.append(
                    f"Vulnerability types disabled: {', '.join(disabled_types)}"
                )
            if missing_levels:
                level_names = {"asap": "high", "later": "medium"}
                missing_names = [
                    level_names.get(level, level) for level in missing_levels
                ]
                issues.append(
                    f"Scan levels not enabled: {', '.join(missing_names)} ({', '.join(missing_levels)})"
                )
            report.status_extended = (
                "Scheduled vulnerability scan is not properly configured. "
                + "; ".join(issues)
            )

        findings.append(report)
        return findings

References