gcloud-dns-dangling-records: Dangling DNS Records Check

id: gcloud-dns-dangling-records

info:
  name: Dangling DNS Records Check
  author: princechaddha
  severity: high
  description: |
    Ensure that dangling DNS records are removed from your public Cloud DNS zones in order to maintain the integrity and authenticity of your domains/subdomains and to protect against domain hijacking.
  impact: |
    Dangling DNS records can lead to domain hijacking and misrouting of traffic, compromising the security and reliability of your domain infrastructure.
  remediation: |
    Regularly audit your DNS records and associated IP addresses. Remove any DNS records that point to IP addresses no longer reserved under your Google Cloud account.
  reference:
    - https://cloud.google.com/dns/docs
  tags: cloud,devops,gcp,gcloud,dns,gcp-cloud-config,discovery

flow: |
  code(1)
  for(let projectId of iterate(template.projectIds)){
    set("projectId", projectId)
    code(2)
    for(let managedZone of iterate(template.managedZones)){
      set("managedZone", managedZone)
      code(3)
      for(let recordSet of iterate(template.recordSets)){
        recordSet = JSON.parse(recordSet)
        set("recordType", recordSet.type)
        set("recordData", recordSet.rrdatas)
        code(4)
      }
    }
  }

self-contained: true

code:
  - engine:
      - sh
      - bash
    source: |
      gcloud projects list --format="json(projectId)"

    extractors:
      - type: json
        name: projectIds
        internal: true
        json:
          - '.[].projectId'

  - engine:
      - sh
      - bash
    source: |
      gcloud dns managed-zones list --project $projectId --format="json(name,visibility)"

    extractors:
      - type: json
        name: managedZones
        internal: true
        json:
          - '.[].name'

  - engine:
      - sh
      - bash
    source: |
      gcloud dns record-sets list --zone=$managedZone --format="json(type,rrdatas)"

    extractors:
      - type: json
        name: recordSets
        internal: true
        json:
          - '{type: .type, rrdatas: .rrdatas[]}'

  - engine:
      - sh
      - bash
    source: |
      gcloud compute addresses list --filter "addressType~EXTERNAL" --format="json(name,status,address)"

    matchers:
      - type: word
        words:
          - 'RESERVED'

    extractors:
      - type: dsl
        dsl:
          - '"Dangling DNS Record: Type: " + recordType + " Data: " + recordData + " in Zone: " + managedZone + " of Project: " + projectId'
# digest: 4a0a0047304502204272ac41efa35729e016879c17d50d03f4b6ac55bfb4f8f44988453124e52510022100fa6369224c1eeb6551e2601a926be5495112c2ec965403dd2f0303907a37bfcd:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.