This project contains cloud middleware (i.e. agents installed by cloud security providers) used across the major cloud service providers (Azure, AWS and GCP).
The cloud middleware dataset lists all agents installed by the major cloud service providers (Azure, AWS, and GCP). The purpose of this project is to provide cloud customers fully visibility into the middleware that is installed in their environments, which could potentially increase the attack surface.
The cloud middleware problem
Cloud service providers install proprietary software on customers virtual machines usually without the customer’s awareness or explicit consent. This propriety software, that bridges between customers’ virtual machines and the cloud providers managed services, was often found to introduce new potential attack surface unknown to the cloud customers. Due to the implicit installation method of cloud middleware software, cloud customers are unaware of the existence of cloud middleware or of the new security risks it presents. As a result, when a new vulnerability is detected in a cloud middleware software, customers are left unknowingly exposed. Moreover, being the CSP’s proprietary software running on the customer environment, it is not always clear whose responsibility it is to update the middleware in the first place.
Field explanations
Cloud provider: The name of the Cloud provider (AWS, GCP, or Azure)
Cloud services: A comma-seperated list of the names of the cloud services that install the cloud agent on the cloud users' virtual machines, or the name of the images where the agent is pre-installed.
Past vulnerabilities: A comma-separated list of past vulnerabilities found in the cloud agent.
Attack surface: A free text explanation of the potential attack surface of the cloud agent, such as....
Open source: Indicates whether the cloud agent source is publicly accessible or not.
Operating system: The operating system supported by the specific cloud agent.
Past vulnerabilities: CVE-2021-38645 – Local privilege escalation to root, CVE-2021-38647 – Unauthenticated Remote Code Execution as root, CVE-2021-38648– Local privilege escalation to root, CVE-2021-38649 – Local privilege escalation to root
Cloud services: Pre-built in Amazon Windows virtual machine images
Past vulnerabilities: No public vulnerabilities
Attack surface:
Exposes a kernel attack surface
Open source: No
Operating system: Windows
AWS ECS container agent
Cloud provider: AWS
Cloud services: Amazon ECS-optimized AMI, Amazon ECS-optimized Windows Server AMI, Amazon ECS-optimized Windows Server 2022 Full AMI, Amazon ECS-optimized Windows Server 2022 Core AMI, Amazon ECS-optimized Windows Server 2019 Full AMI, Amazon ECS-optimized Windows Server 2019 Core AMI, Amazon ECS-optimized Windows Server 2004 Core AMI