huawei-cloud-ecs-vulnerability-auditor git:20261023.9d46426A

Immutable. This exact content never changes and is served at /api/v1/blob/9f4284ef55923d31.

---
name: huawei-cloud-ecs-vulnerability-auditor
description: |
  Audit Huawei Cloud ECS instances for security vulnerabilities across host OS packages, running services, application dependencies (Java, Python, Node.js, PHP, Go), and container environments (Docker, containerd, Podman). Collects asset inventories remotely via Cloud Operations Center (COC), matches components against Known Exploited Vulnerabilities (KEVs) via the public db.gcve.eu API, and outputs an actionable remediation report.
  触发词: ECS漏洞扫描, ECS漏洞发现, 主机漏洞扫描, 容器漏洞发现, ECS资产收集, KEV漏洞检测, ecs vulnerability audit, ecs vuln scan, gcve vulnerability auditor
---

# Huawei Cloud ECS Vulnerability Auditor

## Overview

Audit Huawei Cloud ECS instances across **host operating systems**, **active network services**, **application language runtimes**, and **container workloads** for known and actively exploited vulnerabilities:

1. **IAM Authorization** — Verify or initialize the `ServiceAgencyForCOC` cross-service agency trusting `op_svc_coc`.
2. **Asset Collection via COC** — Remotely execute a safe, read-only Python-based inventory collector on the target ECS instance using Huawei Cloud Cloud Operations Center (COC).
3. **Multi-Tier Asset Extraction** — Robustly collect host OS packages (`dpkg`/`rpm`), listening ports and process binaries (`ss`/`netstat`), application libraries (Java `.jar` manifests, `pip`, `npm`, `composer`), and container workloads (`docker`, `podman`).
4. **Result Retrieval from COC Logs** — Fetch execution output via `COC GetScriptJobBatch` and extract the structured inventory between demarcated boundary markers (`===ECS_ASSET_INVENTORY_START===` / `===END===`).
5. **Vulnerability & KEV Matching** — Cross-reference identified assets against `https://db.gcve.eu/api/` (`/vulnerability/?product={product}` for product CVEs, `/kev` for confirmed in-the-wild exploitation, and `/epss` for exploit prediction scoring).
6. **Automatic Version Range Matching & CVSS Fallback** — Automatically evaluate whether the installed version falls within the CVE's affected version range (e.g. `8.3.* to <8.3.36`), extract CVSS scores with graceful fallback policies, and extract official vulnerability disclosure dates.
7. **Remediation Report Generation** — Output prioritized remediation guidance (P0 KEV criticals, package upgrade commands, container base image updates, network security group rules).
8. **Security Cleanup** — Automatically remove temporary COC scripts and remote scan artifacts.

**Tool chain:** Huawei Cloud KooCLI (`hcloud`) + Python 3 + `https://db.gcve.eu/api/`.

## Prerequisites

- KooCLI (`hcloud`) authenticated with AK/SK — see [CLI Installation Guide](references/cli-installation-guide.md)
- IAM permissions to operate COC and ECS — see [IAM Policies](references/iam-policies.md)
- Target ECS instance ID or Elastic IP (`ACTIVE` state)
- Network access to `https://db.gcve.eu/api` from the auditing environment — see [GCVE API Reference](references/gcve-api-guide.md)

## Workflow

### 1. IAM Authorization & Target Resolution

**One-time per-account setup.** Authorize COC to operate on ECS instances:

1. **Get domain ID** — Call `KeystoneListAuthDomains` and extract the domain `id`.
2. **Create agency** — Call `CreateAgency` with name `ServiceAgencyForCOC` and trust domain `op_svc_coc`.
   - **HTTP 200** — New agency created. Record `agency.id`. Proceed to step 3.
   - **HTTP 409** — Agency already exists. **Skip the entire agency creation and role binding (steps 3–4) and proceed to Step 5 (Target Resolution).**
3. **Find role IDs** — Call `KeystoneListPermissions` for each of the 4 roles: `IAM ReadOnlyAccess`, `RMS ReadOnlyAccess`, `DCS UserAccess`, `COCServiceAgencyPolicy`. If any role is not found, stop — the account may lack access.
4. **Bind roles** — Call `AssociateAgencyWithAllProjectsPermission` for each of the 4 role IDs.
   - **HTTP 200** — Bound successfully.
   - **HTTP 409** — Already bound, skip and continue.
5. **Resolve ECS Instance** — If only an Elastic IP was provided, query `NovaListServersDetails` to obtain the instance UUID and region. Ensure the instance is in `ACTIVE` state.

### 2. Deploy & Execute Remote Asset Collector via COC

1. **Create Collector Script**: Register `scripts/collect_assets.sh` as a temporary COC shell script via `COC CreateScript`.
2. **Execute on Target ECS**: Dispatch the script to the target instance using `COC ExecuteScript`.
3. **Poll Status**: Poll `COC GetScriptJobInfo` until status reaches `SUCCESS`.
4. **Retrieve Inventory Output**:
   Call `COC GetScriptJobBatch` to obtain the batch instance execution details:
   ```bash
   hcloud COC GetScriptJobBatch --cli-region=<region> --execute_uuid="<execute_uuid>" --batch_index=1 --limit=10
   ```
   The collector script emits the inventory surrounded by markers:
   ```
   ===ECS_ASSET_INVENTORY_START===
   { ... json inventory ... }
   ===ECS_ASSET_INVENTORY_END===
   ```
   The intelligence engine `scripts/query_gcve.py` can directly ingest this batch JSON response, raw log text, or extracted JSON file.

### 3. Vulnerability & KEV Intelligence Matching

Run the intelligence engine `scripts/query_gcve.py` against the collected inventory:

1. **Product Selection & Exhaustive Audit**:
   - Use `--product <name>` (or `-p <name>`) to audit a specific product (e.g. `--product nginx` or `--product php`).
   - If `--product` is omitted, `query_gcve.py` automatically audits **ALL** discovered network services, application libraries, container workloads, and core system packages.
2. **Product Vulnerability Query**: Query `https://db.gcve.eu/api/vulnerability/?product={product}&per_page=20&date_sort=published&sort_order=desc`.
3. **Automatic Version Matching**: Checks installed version against the CVE `affected` ranges (`lessThan`, `lessThanOrEqual`, `version` prefixes).
4. **KEV & EPSS Querying**: Query `/api/kev?vuln_id={cve}` for active in-the-wild exploitation evidence and `/api/epss/{cve}` for exploit probability.
5. **CVSS Extraction & Fallback**: Extracts CVSS base score and severity from CNA or ADP metrics. If missing, applies an intelligent fallback estimation based on KEV exploitation and EPSS score.

### 4. Prioritized Remediation Reporting

Render findings ranked by threat severity:
- **P0 (Critical)**: Actively exploited vulnerabilities present in KEV on externally exposed services.
- **P1 (High)**: High CVSS / high EPSS vulnerabilities on internal or auxiliary services.
- **P2 / P3 (Medium / Low)**: Hardening advisories, unmanaged library updates, and base image refreshes.
- **Disclosure Timestamps**: Each vulnerability lists its published date (`date_published`) and update date.

### 5. Security & Resource Cleanup

Delete temporary COC scripts and remote temporary files:
1. Delete COC script via `COC DeleteScript`.
2. Remove temporary files from `/tmp/ecs_assets_inventory.json` on the target host.

## Core Commands

Placeholder values:

| Placeholder | Linux / macOS | Windows (PowerShell) |
|---|---|---|
| `<hcloud>` | `hcloud` | `hcloud` |
| `<temp_dir>` | `/tmp` | `$env:TEMP` |
| `<region>` | `cn-north-4` | `cn-north-4` |

> [!NOTE]
> Command syntax conforms to the latest KooCLI standard without legacy `/v2.1` or `/v3` URL suffixes. Use `hcloud <service> <operation> --help` to confirm parameters on your local version.

```bash
# 1. Check/setup COC IAM authorization (one-time per account)
<hcloud> IAM KeystoneListAuthDomains
<hcloud> IAM CreateAgency \
  --agency.domain_id="<domain_id>" \
  --agency.name="ServiceAgencyForCOC" \
  --agency.trust_domain_name="op_svc_coc" \
  --agency.description="Agency for COC remote script execution and asset auditing" \
  --agency.duration="FOREVER"
<hcloud> IAM KeystoneListPermissions --display_name="<role_name>"
<hcloud> IAM AssociateAgencyWithAllProjectsPermission \
  --agency_id="<agency_id>" --domain_id="<domain_id>" --role_id="<role_id>"

# 2. Resolve ECS instance details by IP
<hcloud> ECS NovaListServersDetails --ip="<ecs_ip>"

# 3. Check existing COC scripts
<hcloud> COC ListScripts --cli-region=<region> --name_like="ecs_asset_collector" --limit=10

# 4. Create COC script via JSON input (ensure UTF-8 without BOM on Windows)
cat > <temp_dir>/coc_collector_create.json << 'EOF'
{
  "body": {
    "name": "ecs_asset_collector",
    "type": "SHELL",
    "description": "Read-only asset collector for ECS vulnerability auditing",
    "content": "#!/usr/bin/env bash\n...",
    "properties": {
      "risk_level": "LOW",
      "version": "1.0.0"
    }
  }
}
EOF
<hcloud> COC CreateScript --cli-region=<region> --cli-jsonInput=<temp_dir>/coc_collector_create.json

# 5. Execute script on target instance
cat > <temp_dir>/coc_collector_execute.json << 'EOF'
{
  "path": {"script_uuid": "<script_uuid>"},
  "body": {
    "execute_batches": [{
      "batch_index": 1,
      "rotation_strategy": "CONTINUE",
      "target_instances": [{
        "region_id": "<region>",
        "resource_id": "<instance_id>"
      }]
    }],
    "execute_param": {
      "execute_user": "root",
      "timeout": 180,
      "success_rate": 100
    }
  }
}
EOF
<hcloud> COC ExecuteScript --cli-region=<region> --cli-jsonInput=<temp_dir>/coc_collector_execute.json

# 6. Poll job status
<hcloud> COC GetScriptJobInfo --cli-region=<region> --execute_uuid="<execute_uuid>"

# 7. Retrieve execution log output
<hcloud> COC GetScriptJobBatch --cli-region=<region> --execute_uuid="<execute_uuid>" --batch_index=1 --limit=10 > <temp_dir>/coc_batch_output.json

# 8. Run GCVE Intelligence Audit & Generate Report (audits all components by default)
python scripts/query_gcve.py --inventory=<temp_dir>/coc_batch_output.json --output-format=markdown

# Optional: Audit a specific product only
python scripts/query_gcve.py --inventory=<temp_dir>/coc_batch_output.json --product=nginx

# 9. Cleanup COC script
<hcloud> COC DeleteScript --cli-region=<region> --script_uuid="<script_uuid>"
```

## Parameters

| Parameter | Required | Default | Description |
|---|---|---|---|
| `ecs_instance_id` | Conditional | None | ECS Instance UUID; required if `ecs_ip` is not provided |
| `ecs_ip` | Conditional | None | ECS Elastic IP; required if `ecs_instance_id` is not provided |
| `region` | No | `cn-north-4` | Huawei Cloud region where ECS and COC reside |
| `product` | No | None | Specific product to audit (e.g. `php`, `nginx`). If omitted, all discovered assets are audited |
| `output_format` | No | `markdown` | Report format: `markdown` or `json` |
| `cleanup` | No | `true` | Automatically clean up COC scripts and remote files |

## Output Format

The skill provides structured progress updates across each audit phase:

| Phase | Output Content |
|---|---|
| **Target & IAM** | Target ECS ID, IP address, OS flavor, and COC agency status |
| **Asset Collection** | Count of discovered OS packages, listening services, Java/Python/Node dependencies, and containers |
| **Result Retrieval** | Confirmation of log retrieval from `GetScriptJobBatch` with marker extraction |
| **KEV Matching** | Identified Known Exploited Vulnerabilities (KEVs), EPSS scores, CVSS severity, publication dates, and version matches |
| **Remediation Report** | Full Markdown report with executive summary, CVE breakdown, and specific remediation commands |
| **Cleanup** | Deletion confirmation for COC script and temporary files |