Back to Checks
aws

Inspector2 has no active findings for CISA Known Exploited Vulnerabilities past their remediation due date

inspector2_active_findings_kev_within_due_date
Service: inspector2Severity: critical
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:Other

Amazon Inspector active findings for CISA Known Exploited Vulnerabilities are compared with the remediation due date (dateDue) that CISA assigns to each entry of the KEV catalog. Findings that are still active after that date are reported.

The result is reported per Region where Inspector is enabled.

Prowler logoProwlerprowler-provider-aws

Risk

CISA due dates reflect active exploitation. Missing them keeps exploited vulnerabilities open beyond the window CISA sets for federal agencies and shows that vulnerability response is not keeping pace with real threats.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks inspector2_active_findings_kev_within_due_date

Recommendation

Track every KEV finding against its CISA due date and remediate before it passes. When no fix exists yet, apply the vendor or CISA mitigations and document the residual risk.

Remediation

Other

1In the AWS Console, open Amazon Inspector > Findings
2Filter by Vulnerability ID for each overdue CVE reported by this check
3Patch or upgrade the affected packages, rebuild container images or update Lambda runtimes
4If a fix is not available, apply the mitigations listed in the CISA catalog entry
5Confirm the findings move to Closed

Check Code

from datetime import datetime, timezone

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.inspector2.inspector2_client import (
    inspector2_client,
)
from prowler.providers.aws.services.inspector2.lib.vulnerabilities import (
    summarize_vulnerabilities,
)


class inspector2_active_findings_kev_within_due_date(Check):
    """Ensure active Inspector2 findings for CISA KEVs are not past their CISA due date."""

    def execute(self) -> list[Check_Report_AWS]:
        """Report, per Region, whether any CISA KEV finding is past its remediation due date."""
        findings = []
        now = datetime.now(timezone.utc)
        known_exploited = inspector2_client.known_exploited_vulnerabilities
        lookup_failed = inspector2_client.vulnerability_lookup_failed
        for inspector in inspector2_client.inspectors:
            if inspector.status != "ENABLED":
                continue
            report = Check_Report_AWS(metadata=self.metadata(), resource=inspector)
            if inspector.findings is None:
                report.status = "MANUAL"
                report.status_extended = (
                    f"Inspector2 findings could not be retrieved in region {inspector.region}; "
                    "verify the inspector2:ListFindings permission."
                )
                findings.append(report)
                continue
            vulnerability_ids = {
                finding.vulnerability_id
                for finding in inspector.findings
                if finding.vulnerability_id
            }
            overdue = sorted(
                f"{vulnerability_id} (due {known_exploited[vulnerability_id].date_due.date().isoformat()})"
                for vulnerability_id in known_exploited.keys() & vulnerability_ids
                if known_exploited[vulnerability_id].date_due
                and known_exploited[vulnerability_id].date_due < now
            )
            unverified_ids = sorted(vulnerability_ids & lookup_failed)
            if overdue:
                report.status = "FAIL"
                report.status_extended = (
                    f"Inspector2 has active findings in region {inspector.region} for CISA "
                    "Known Exploited Vulnerabilities past their remediation due date: "
                    f"{summarize_vulnerabilities(overdue)}."
                )
            elif unverified_ids:
                report.status = "MANUAL"
                report.status_extended = (
                    "Inspector2 could not verify the CISA Known Exploited Vulnerabilities status of "
                    f"{summarize_vulnerabilities(unverified_ids)} in region {inspector.region}; "
                    "verify the inspector2:BatchGetFindingDetails permission."
                )
            else:
                report.status = "PASS"
                report.status_extended = (
                    f"Inspector2 has no active findings in region {inspector.region} for CISA "
                    "Known Exploited Vulnerabilities past their remediation due date."
                )
            findings.append(report)
        return findings

References