Project: KICS (Provisioning / Security & Compliance)
File: bc2908f3-f73c-40a9-8793-c1b7d5544f79.md

title: Privileged Ports Mapped In Container hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: bc2908f3-f73c-40a9-8793-c1b7d5544f79 Query name: Privileged Ports Mapped In Container Platform: DockerCompose Severity: <span style="color:#ff7213">Medium</span> Category: Networking and Firewall URL: Privileged ports (1 to 1023) should not be mapped. Also you should drop netbindservice linux capability from the container unless you absolutely need to use priviledged ports.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="12 5" services: dhcpd: image: networkboot/dhcpd:latest container_name: dhcpd ports: 67:67/udp networks: privnet dhcp_client: build: dhcp_client containername: dhcpclient ports: 68:68/udp networks: privnet: ipam: config: subnet: 192.168.0.0/24 ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="11" version: '2.1' services: webapp: container_name: webapp build: ./webapp environment: ASPNETCORE_ENVIRONMENT=Development ASPNETCORE_URLS=http://0.0.0.0:80 TradeUrl=http://trading.api ports: "127.0.0.1::50" network_mode: "LDC" ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="11" version: '2.1' services: webapp: container_name: webapp build: ./webapp environment: ASPNETCORE_ENVIRONMENT=Development ASPNETCORE_URLS=http://0.0.0.0:80 TradeUrl=http://trading.api ports: "12400-12500:124" network_mode: "LDC" ``` <details><summary>Positive test num. 4 - yaml file</summary> ```yaml hl_lines="11" version: '2.1' services: webapp: container_name: webapp build: ./webapp environment: ASPNETCORE_ENVIRONMENT=Development ASPNETCORE_URLS=http://0.0.0.0:80 TradeUrl=http://trading.api ports: target: 80 published: 8080 protocol: tcp mode: host network_mode: "LDC" ``` </details> <details><summary>Positive test num. 5 - yaml file</summary> ```yaml hl_lines="11" version: '2.1' services: webapp: container_name: webapp build: ./webapp environment: ASPNETCORE_ENVIRONMENT=Development ASPNETCORE_URLS=http://0.0.0.0:80 TradeUrl=http://trading.api ports: "7000:80" network_mode: "LDC" ``` </details> <details><summary>Positive test num. 6 - yaml file</summary> ```yaml hl_lines="11" version: '2.1' services: webapp: container_name: webapp build: ./webapp environment: ASPNETCORE_ENVIRONMENT=Development ASPNETCORE_URLS=http://0.0.0.0:80 TradeUrl=http://trading.api ports: "70:8000" network_mode: "LDC" ``` </details> <details><summary>Positive test num. 7 - yaml file</summary> ```yaml hl_lines="11" version: '2.1' services: webapp: container_name: webapp build: ./webapp environment: ASPNETCORE_ENVIRONMENT=Development ASPNETCORE_URLS=http://0.0.0.0:80 TradeUrl=http://trading.api ports: "70-8000" network_mode: "LDC" ``` </details> <details><summary>Positive test num. 8 - yaml file</summary> ```yaml hl_lines="11" version: '2.1' services: webapp: container_name: webapp build: ./webapp environment: ASPNETCORE_ENVIRONMENT=Development ASPNETCORE_URLS=http://0.0.0.0:80 TradeUrl=http://trading.api ports: "80" network_mode: "LDC" ``` </details> <details><summary>Positive test num. 9 - yaml file</summary> ```yaml hl_lines="11" version: '2.1' services: webapp: container_name: webapp build: ./webapp environment: ASPNETCORE_ENVIRONMENT=Development ASPNETCORE_URLS=http://0.0.0.0:80 TradeUrl=http://trading.api ports: "90-9091:8080-8081" network_mode: "LDC" ``` </details> <details><summary>Positive test num. 10 - yaml file</summary> ```yaml hl_lines="11" version: '2.1' services: webapp: container_name: webapp build: ./webapp environment: ASPNETCORE_ENVIRONMENT=Development ASPNETCORE_URLS=http://0.0.0.0:80

ports: "9090-9091:80-8081" network_mode: "LDC" ``` </details> <details><summary>Positive test num. 11 - yaml file</summary> ```yaml hl_lines="11" version: '2.1' services: webapp: container_name: webapp build: ./webapp environment: ASPNETCORE_ENVIRONMENT=Development ASPNETCORE_URLS=http://0.0.0.0:80 TradeUrl=http://trading.api ports: "49100:22" network_mode: "LDC" ``` </details> <details><summary>Positive test num. 12 - yaml file</summary> ```yaml hl_lines="11" version: '2.1' services: webapp: container_name: webapp build: ./webapp environment: ASPNETCORE_ENVIRONMENT=Development ASPNETCORE_URLS=http://0.0.0.0:80 TradeUrl=http://trading.api ports: "127.0.0.1:80:8001" network_mode: "LDC" ``` </details> ```yaml title="Negative test num. 1 - yaml file" services: dhcpd: image: networkboot/dhcpd:latest container_name: dhcpd ports: 6700:6700/udp cap_drop: NETBINDSERVICE networks: privnet dhcp_client: build: dhcp_client containername: dhcpclient ports: 6800:6800/udp networks: privnet: ipam: config: subnet: 192.168.0.0/24 ``` ```yaml title="Negative test num. 2 - yaml file" version: '2.1' services: webapp: container_name: webapp build: ./webapp environment: ASPNETCORE_ENVIRONMENT=Development ASPNETCORE_URLS=http://0.0.0.0:80 TradeUrl=http://trading.api ports: target: 8000 published: 8080 protocol: tcp mode: host cap_drop: CHOWN network_mode: "LDC" ``` ```yaml title="Negative test num. 3 - yaml file" version: '2.1' services: webapp: container_name: webapp build: ./webapp environment: ASPNETCORE_ENVIRONMENT=Development ASPNETCORE_URLS=http://0.0.0.0:80 TradeUrl=http://trading.api ports: "7000:8000" cap_drop: NETBINDSERVICE network_mode: "LDC" ``` <details><summary>Negative test num. 4 - yaml file</summary> ```yaml version: '2.1' services: webapp: container_name: webapp build: ./webapp environment: ASPNETCORE_ENVIRONMENT=Development ASPNETCORE_URLS=http://0.0.0.0:80 TradeUrl=http://trading.api ports: "7000-8000" cap_drop: NETBINDSERVICE network_mode: "LDC" ``` </details> <details><summary>Negative test num. 5 - yaml file</summary> ```yaml version: '2.1' services: webapp: container_name: webapp build: ./webapp environment: ASPNETCORE_ENVIRONMENT=Development ASPNETCORE_URLS=http://0.0.0.0:80 TradeUrl=http://trading.api ports: "8000" cap_drop: NETBINDSERVICE network_mode: "LDC" ``` </details> <details><summary>Negative test num. 6 - yaml file</summary> ```yaml version: '2.1' services: webapp: container_name: webapp build: ./webapp environment: ASPNETCORE_ENVIRONMENT=Development ASPNETCORE_URLS=http://0.0.0.0:80 TradeUrl=http://trading.api ports: "9000-9091:8080-8081" cap_drop: NETBINDSERVICE network_mode: "LDC" ``` </details> <details><summary>Negative test num. 7 - yaml file</summary> ```yaml version: '2.1' services: webapp: container_name: webapp build: ./webapp environment: ASPNETCORE_ENVIRONMENT=Development ASPNETCORE_URLS=http://0.0.0.0:80 TradeUrl=http://trading.api ports: "127.0.0.1:8000:8001" cap_drop: NETBINDSERVICE network_mode: "LDC" ``` </details> <details><summary>Negative test num. 8 - yaml file</summary> ```yaml version: '2.1' services: webapp: container_name: webapp build: ./webapp environment: ASPNETCORE_ENVIRONMENT=Development ASPNETCORE_URLS=http://0.0.0.0:80 TradeUrl=http://trading.api ports: "127.0.0.1::5000" cap_drop: NETBINDSERVICE network_mode: "LDC" ``` </details> <details><summary>Negative test num. 9 - yaml file</summary> ```yaml version: '2.1' services: webapp: container_name: webapp build: ./webapp environment: ASPNETCORE_ENVIRONMENT=Development ASPNETCORE_URLS=http://0.0.0.0:80 TradeUrl=http://trading.api ports: "12400-12500:1240" cap_drop: NETBINDSERVICE network_mode: "LDC" ``` </details> <details><summary>Negative test num. 10 - yaml file</summary> ```yaml version: '2.1' services: webapp: container_name: webapp build: ./webapp environment: ASPNETCORE_ENVIRONMENT=Development ASPNETCORE_URLS=http://0.0.0.0:80 TradeUrl=http://trading.api ports: target: 8000 published: 8080 protocol: tcp mode: host cap_drop: NETBINDSERVICE network_mode: "LDC" ``` </details>