Detect Text4Shell in Kubernetes cluster using Trivy - CVE-2022-42889

kubernetes-text4shell-CVE-2022-42889-detect.sh

#!/usr/bin/env bash
# Detect Text4Shell in Kubernetes cluster using Trivy.
# This script retrieve all running images from a Kubernetes cluster
# and run a Trivy scan against them in order to quickly detect the
# Text4Shell vulnerability (CVE-2022-42889)
# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42889
# You will need Kubectl and the Trivy CLI installed on your machine
# before running this script.

VULNERABILITY_ID="CVE-2022-42889"

for image in $(kubectl get pods -A -o jsonpath='{range .items[*].spec.containers[*]}{.image}{"\n"}{end}' | sort | uniq)
do
  echo "Scanning $image..."
  trivy image --security-checks vuln --format json -s CRITICAL $image --output /tmp/report.json
  found_vulnerabilities=$(jq -r '[.Results[].Vulnerabilities[]? | select(.VulnerabilityID == "'"$VULNERABILITY_ID"'")]? | length' /tmp/report.json 2> /dev/null)
  if [[ "$found_vulnerabilities" -gt 0 ]]
  then
    echo "Found $VULNERABILITY_ID in $image:"
    jq -r '.Results[].Vulnerabilities[]? | select(.VulnerabilityID == "'"$VULNERABILITY_ID"'") | { Image: "'"$image"'", PkgPath: .PkgPath, PkgName: .PkgName, InstalledVersion: .InstalledVersion}' /tmp/report.json
  fi
  echo ""
done