Huawei Cloud ECS Vulnerability Auditor

Overview

Audit Huawei Cloud ECS instances across host operating systems, active network services, application language runtimes, and container workloads for known and actively exploited vulnerabilities:

1. IAM Authorization — Verify or initialize the ServiceAgencyForCOC cross-service agency trusting op_svc_coc.
2. Asset Collection via COC — Remotely execute a safe, read-only Python-based inventory collector on the target ECS instance using Huawei Cloud Cloud Operations Center (COC).
3. Multi-Tier Asset Extraction — Symmetrically collect host and container assets focusing on running processes and $PATH directory drill-down:
   • Host Level: Host OS packages (dpkg/rpm), listening network services (ss/netstat), active running processes (/proc enumeration), full $PATH directory drill-down ($PATH executable enumeration, coreutils filtering, and universal version probing), and application libraries (Java .jar manifests, pip, npm, php).
   • Container Level: For running containers (docker, podman), enters container namespaces via exec and /proc/<pid>/root to inspect the internal OS distribution (/etc/os-release), package manager inventories (apk, dpkg, rpm), active running processes (top), container $PATH directory drill-down, and embedded Java libraries.
4. Result Retrieval from COC Logs — Fetch execution output via COC GetScriptJobBatch and extract the structured inventory between demarcated boundary markers (===ECS_ASSET_INVENTORY_START=== / ===END===).
5. Vulnerability & KEV Matching — Cross-reference identified assets against https://db.gcve.eu/api/ (/vulnerability/?product={product} for product CVEs, /kev for confirmed in-the-wild exploitation, and /epss for exploit prediction scoring).
6. Automatic Version Range Matching & CVSS Fallback — Automatically evaluate whether the installed version falls within the CVE's affected version range (e.g. 8.3.* to <8.3.36), extract CVSS scores with graceful fallback policies, and extract official vulnerability disclosure dates.
7. Remediation Report Generation — Output prioritized remediation guidance (P0 KEV criticals, package upgrade commands, container base image updates, network security group rules).
8. Security Cleanup — Automatically remove temporary COC scripts and remote scan artifacts.

Tool chain: Huawei Cloud KooCLI (hcloud) + Python 3 + https://db.gcve.eu/api/.