Back to Checks
aws

Inspector2 has no active findings for CISA Known Exploited Vulnerabilities

inspector2_active_findings_no_known_exploited_vulnerabilities
Service: inspector2Severity: high
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:Other

Amazon Inspector active findings are cross-referenced with the CISA Known Exploited Vulnerabilities (KEV) catalog, using the CISA data that Inspector returns in the finding details (BatchGetFindingDetails) of each CVE.

The result is reported per Region where Inspector is enabled.

Prowler logoProwlerprowler-provider-aws

Risk

KEV entries are vulnerabilities confirmed as exploited in the wild. Workloads carrying them are prime targets for initial access and ransomware, enabling remote code execution, data exfiltration and lateral movement.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks inspector2_active_findings_no_known_exploited_vulnerabilities

Recommendation

Remediate KEV findings before any other vulnerability: patch or upgrade the affected packages, rebuild and redeploy container images, and stop deploying new resources that carry known exploited vulnerabilities.

Remediation

Other

1In the AWS Console, open Amazon Inspector > Findings
2Filter by Vulnerability ID for each CVE reported by this check
3Patch or upgrade the affected packages, rebuild container images or update Lambda runtimes
4Confirm the findings move to Closed

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.inspector2.inspector2_client import (
    inspector2_client,
)
from prowler.providers.aws.services.inspector2.lib.vulnerabilities import (
    summarize_vulnerabilities,
)


class inspector2_active_findings_no_known_exploited_vulnerabilities(Check):
    """Ensure no active Inspector2 finding is a CISA Known Exploited Vulnerability."""

    def execute(self) -> list[Check_Report_AWS]:
        """Report, per Region, whether any active finding is a CISA Known Exploited Vulnerability."""
        findings = []
        known_exploited = inspector2_client.known_exploited_vulnerabilities
        lookup_failed = inspector2_client.vulnerability_lookup_failed
        for inspector in inspector2_client.inspectors:
            if inspector.status != "ENABLED":
                continue
            report = Check_Report_AWS(metadata=self.metadata(), resource=inspector)
            if inspector.findings is None:
                report.status = "MANUAL"
                report.status_extended = (
                    f"Inspector2 findings could not be retrieved in region {inspector.region}; "
                    "verify the inspector2:ListFindings permission."
                )
                findings.append(report)
                continue
            vulnerability_ids = {
                finding.vulnerability_id
                for finding in inspector.findings
                if finding.vulnerability_id
            }
            kev_ids = sorted(known_exploited.keys() & vulnerability_ids)
            unverified_ids = sorted(vulnerability_ids & lookup_failed)
            if kev_ids:
                report.status = "FAIL"
                report.status_extended = (
                    f"Inspector2 has active findings in region {inspector.region} for CISA "
                    f"Known Exploited Vulnerabilities: {summarize_vulnerabilities(kev_ids)}."
                )
            elif unverified_ids:
                report.status = "MANUAL"
                report.status_extended = (
                    "Inspector2 could not verify the CISA Known Exploited Vulnerabilities status of "
                    f"{summarize_vulnerabilities(unverified_ids)} in region {inspector.region}; "
                    "verify the inspector2:BatchGetFindingDetails permission."
                )
            else:
                report.status = "PASS"
                report.status_extended = (
                    f"Inspector2 has no active findings in region {inspector.region} for CISA "
                    "Known Exploited Vulnerabilities."
                )
            findings.append(report)
        return findings

References