About Vulnerability Management (VM)

Vulnerability Management is a tool for centralized management of container image and endpoint vulnerability scanning and for viewing scan results within your workspace.

It detects vulnerabilities in container images stored in Container Registry and Cloud Registry, in images run in Managed Service for Kubernetes clusters, and in endpoints of your applications and services.

Image scanningImage scanning

Vulnerability Management supports scanning container images from the following sources:

• Yandex Container Registry, the Docker image storage and distribution service.
• Yandex Cloud Registry, the artifact storage and distribution service for artifacts of different types, including container images.
• Kubernetes clusters monitored by Kubernetes® Security Posture Management (KSPM).

Scan triggersScan triggers

Image scanning can start automatically on one of the following triggers:

• Image push: Scanning starts automatically when you push a new image to Container Registry or Cloud Registry.

• Scheduled run: Scanning starts from time to time according to a schedule. Depending on your settings, the following is scanned:

  • All images in the registries, including those added since the previous scan.

  • Only images with the latest tag or those added since the previous scan.

    For more on image tags, see Docker image version control.

• Image use: Scanning starts automatically when you create a new Managed Service for Kubernetes cluster or container with an image in an existing cluster.

You can combine the triggers for maximum scan coverage.

Scanning images in Kubernetes clustersScanning images in Kubernetes clusters

When integrated with KSPM, Vulnerability Management automatically detects images running in Managed Service for Kubernetes clusters assigned to the workspace.

With the scheduled scan trigger on, the scanning of Kubernetes cluster images works like a filter: each run generates a list of images which are then scanned.

Scanning application and service endpointsScanning application and service endpoints

Vulnerabilities in endpoints pose a serious threat to data security and to the stable operation of applications and services. The Vulnerability Management module enables you to discover external endpoints of applications and services and check them for vulnerabilities by sending test requests and analyzing the responses.

Security Deck implements endpoint vulnerability scanning and analysis utilizing SolidPoint DAST tools.

To work with endpoint scanning, you need the following roles:

• vulnerability-manager.editor or higher to create, update, and delete scan schedules, as well as to run scan jobs.
• vulnerability-manager.viewer or higher to view scan results.

Scan targetsScan targets

A scan target is a service or application within the scope of Vulnerability Management that has a known IP or URL address along with defined properties such as its hosting resource, technology, etc.

Currently, Vulnerability Management can discover scan targets deployed within the selected scope across these resources:

• Yandex Compute Cloud VM instances.
• L7 load balancers from Yandex Application Load Balancer.
• Network load balancers from Yandex Network Load Balancer.

Scan schedulesScan schedules

Scans in basic attack surface analysis mode run automatically and discover all targets within your selected Vulnerability Management scope.

Scans in advanced attack surface analysis and deep vulnerability scanning modes run according to a scan schedule. A scan schedule is a Vulnerability Management resource that specifies the target groups, scanning mode, modules to apply, and scanning frequency.

Scan target groupsScan target groups

When configuring a scan schedule, you can restrict the scan scope by creating a target group with the following settings:

• Resources to scan. In the schedule settings, you can select to discover and analyze targets within the entire Vulnerability Management scope defined in the workspace, or narrow it down to specific clouds and/or folders.
• Addresses to scan. In the schedule settings, you can exclude specific URLs from the scan by specifying them as a list of strings with path segments and/or regular expressions.

Endpoint scanning modesEndpoint scanning modes

Currently, Vulnerability Management provides three endpoint scanning modes: basic attack surface analysis, advanced attack surface analysis, and deep vulnerability scanning.

Basic attack surface analysis runs automatically at the interval defined in the Vulnerability Management workspace settings.

To perform an advanced attack surface analysis or deep vulnerability scanning, you need to create and configure a scan schedule first. The scan schedule will run regular scan jobs as often as specified in its settings. Additionally, a user can manually trigger a scan job within a schedule.

Basic attack surface analysisBasic attack surface analysis

Basic attack surface analysis starts automatically after you enable regular vulnerability scanning in the workspace's vulnerability management settings. This mode runs regular scan jobs within the selected scope, which include the following operations:

• Resource type detection.
• IP addresses inventory.
• Inventory of open ports.
• Identification of applications and services.
• For web applications, discovery of endpoints and application fingerprinting.

Basic attack surface analysis relies on the following modules (analysis methods):

Module name	Analysis method	Description
static-crawler	Static web crawling and dirbusting	The crawler explores web resources to analyze HTML markups without page rendering, with optional dirbusting.
dynamic-crawler	Dynamic web crawling	The crawler identifies endpoints through dynamic interaction with web app interfaces using a managed browser.
powby2	Signature-based resource analysis and technology detection	Based on the static-crawler results, analyzes resources, maps them against signatures, and identifies the technologies used. It also uses signatures to detect CopilotKit and Inkeep endpoints, as well as client-side code from AI libraries: Vercel AI SDK, CopilotKit, assistant-ui, Inkeep, Intercom Fin, AG-UI, LangChain, LangGraph UI.
graphql-inspector	GraphQL endpoint detection	Sends GraphQL-specific HTTP requests to identify GraphQL endpoints.

Basic analysis does not detect vulnerabilities. However, the targets it discovers can be used for deep scanning.

Advanced attack surface analysisAdvanced attack surface analysis

Advanced attack surface analysis identifies additional targets that may have been missed during the basic analysis. While it also does not detect vulnerabilities, its results can be used for deep scanning.

You can trigger advanced attack surface analysis manually or run it on a schedule, the analysis includes the following operations:

• All basic analysis operations.
• Configuration analysis for TLS, CORS, and SSH.
• Detection of known vulnerabilities.

Advanced attack surface analysis scans a target group using all basic analysis modules, plus the following additional modules (analysis methods):

Module name	Analysis method	Description
js-analyzer	Client-side JavaScript code analysis	Identifies server endpoints by analyzing client-side JavaScript code.
zvlom-serialize	Controlled serialized data	Searches for serialized objects in server responses and supports PHP, Python, Ruby, Java, .NET, and other stacks. It can identify serialized objects that may be encoded either once or as a chain of multiple encodings or compression algorithms.
nuclei-runner-deps	Flaws in advanced Nuclei signatures	Performs active endpoint scanning using advanced Nuclei templates.
nuclei-runner	Flaws in Nuclei signatures	Performs active scanning of various protocols using Nuclei YAML signatures.
cors-franziscanner	Incorrect CORS configuration	Identifies CORS configuration flaws that allow unauthorized web pages to access application resources. Flaws are identified by sending requests with various Origin header values and analyzing CORS headers in HTTP responses.

Deep vulnerability scanningDeep vulnerability scanning

Beyond advanced attack surface analysis, deep vulnerability scanning combines signature scanning and attack simulation to detect various threats: from insecure data serialization to SQL and NoSQL injections, XSS attacks, Path Traversal, and more.

Deep vulnerability scanning can be either run manually or on a schedule, and includes the following operations:

• All advanced analysis operations.
• Fuzzing.
• Cross-referencing with the CVE database.
• Detailed object analysis.

Deep vulnerability scanning examines a target group using all basic and advanced analysis modules, plus the following additional modules (analysis methods):

Module name	Analysis method	Description
cspp-scanner	Client-Side Prototype Pollution	Performs dynamic checking of JavaScript code execution on the application page in a web browser.
dynamic-page-analyzer-cspp	Client-Side Prototype Pollution	Performs dynamic analysis of data flows that may lead to CSPP.
dynamic-page-analyzer-domxss	DOM XSS	Performs dynamic analysis of data flows that may lead to DOM XSS.
stored-xss	Stored XSS	Performs a two-step crawl of the application with dynamic checking of JavaScript code execution.
bruteforce	Accounts with weak credentials	Performs dictionary-based brute-forcing to expose accounts with weak login credentials.
file-upload-scanner	File upload vulnerabilities	Identifies flaws related to PHP code execution, ImageMagick, and Reflected XSS during uploads.
idor-franziscanner	IDOR	This experimental module isolates potentially unsafe parameters and sends requests with substituted values.
java-deserialize	Insecure deserialization in Java	Identifies flaws in Java web applications using objects found by zvlom-serialize.
nosql	NoSQL injections	Identifies flaws when user data leak into the context of NoSQL database commands.
path-traversal-scanner	Path Traversal	Exposes access to files and directories by searching for standard system files.
reflected-xss-cspp	Reflected XSS	Identifies Reflected XSS based on the cspp-scanner results.
reflected-xss	Reflected XSS	Performs dynamic checking of JavaScript code execution on the application page in a web browser.
shell-injection-scanner	Shell injections	Performs shell command injections, validating results in HTTP responses and via blind time-based checks.
sql-injection-scanner	SQL injections	Detects SQL injections through out-of-band, delay-based, and busy wait checks.
ssti-franziscanner	SSTI	Detects server-side template injections through out-of-band interaction and time-based checks.
xxe-franziscanner	XXE	Detects XML External Entity through out-of-band interaction and the local DTDs technique.
php-unserialize-fuzzer	Insecure deserialization in PHP	Exposes flaws in PHP applications using objects discovered by zvlom-serialize.

When configuring a scan, you can disable checks for specific modules.

Scan resultsScan results

Information about discovered targets is displayed on the Endpoints tab of the Vulnerability Management module and includes:

• Endpoint address of the target and the ports it uses.
• Name and type of the resource housing the target.
• Service or protocol handling requests to the target.
• Technologies used to process requests to the target.
• Number of paths discovered at the target.
• Number and severity of discovered vulnerabilities.

For general information about the number and severity of discovered vulnerabilities, see the Vulnerability Management dashboard and global workspace dashboard. Additionally, when a vulnerability is detected, Vulnerability Management generates an alert.

For detailed information on scan results and discovered vulnerabilities, see the Scans tab of the Vulnerability Management module. For more information, see Viewing endpoint scan results in Vulnerability Management (VM).

Useful linksUseful links

• Activating the module Vulnerability Management (VM)
• Creating an endpoint scan schedule in the Vulnerability Management module (VM)
• Running an endpoint scan in Vulnerability Management (VM)
• Viewing endpoint scan results in Vulnerability Management (VM)
• Working with the Vulnerability Management (VM) dashboard
• Security Deck workspaces
• Kubernetes® Security Posture Management (KSPM)
• About Alerts

An endpoint is an application component's URL address open to HTTP requests and returning a response. Endpoints are all points of interaction with an application: from public pages to internal API methods.

A fingerprint is an identifiable set of technical characteristics of a web service (HTTP headers, response patterns, URL structure, error-triggered behavior, and so on) that allows you to determine the service type, version, and configuration.

Web crawling is the sequential traversal of web pages to analyze their content and collect data for further processing.

Dirbusting refers to dictionary-based brute-forcing of endpoints.