Compare commits

...
Author SHA1 Message Date
Joseph Barcia d161a10191 Update GitHub Actions to Node 24 compatible versions
- actions/checkout v4 -> v6
- actions/setup-go v4 -> v5
- go-version ^1.20 -> ^1.25
- Replace abandoned marvinpinto/action-automatic-releases with
  softprops/action-gh-release v2

Node.js 20 actions are deprecated and will be forced to Node 24
starting June 2, 2026, and removed September 16, 2026.
2026-04-21 16:44:08 +00:00
jbarciabf 1b0925877d Merge pull request #127 from BishopFox/fix/pmapper-basepath-all-checks
Fix pmapper-data-basepath ignored in all-checks and instances race condition
2026-04-21 09:06:40 -04:00
Joseph Barcia 7727d1d08c Fix pmapper-data-basepath ignored in all-checks and race condition in instances module
The pmapperCommand in runAllChecksCommand was missing the
PmapperDataBasePath parameter, causing --pmapper-data-basepath to be
ignored for the pmapper module when running all-checks. (Fixes #105)

The instances module had a race condition where role analysis ran before
the receiver goroutine finished collecting all MappedInstances. This
caused IsAdminRole and CanPrivEscToAdmin columns to appear empty in
all-checks despite pmapper data being available. Fixed by signaling
the receiver to stop and waiting for it to drain before running role
analysis.

Version bumped to 2.0.4.
2026-04-21 13:06:11 +00:00
jbarciabf c7f81dc5cc Merge pull request #126 from mitre88/main
Fix --pmapper-data-basepath ignored in all-checks for EC2 user data module
2026-04-21 09:02:34 -04:00
Open Source Contributor 008fb84d23 Fix --pmapper-data-basepath ignored in all-checks for EC2 user data module
The EC2 user data InstancesModule in runAllChecksCommand was not receiving
the PmapperDataBasePath parameter, causing the --pmapper-data-basepath flag
to be ignored when running all-checks.

Fix: Add PmapperDataBasePath: PmapperDataBasePath to the ec2UserData struct
initialization in runAllChecksCommand.
2026-04-20 20:38:56 -06:00
jbarciabf 142757b5c2 Merge pull request #125 from BishopFox/fix/go-stdlib-vulnerabilities
Upgrade Go to 1.25.9, fix 24 stdlib vulnerabilities
2026-04-13 09:06:34 -04:00
5 changed files with 22 additions and 21 deletions

No files matched your search

+6 -9
View File
@@ -15,10 +15,10 @@ jobs:
steps:
- name: Go 1.21
uses: actions/setup-go@v4
- name: Go 1.25
uses: actions/setup-go@v5
with:
go-version: ^1.20
go-version: ^1.25
id: go
- id: install-secret-key
@@ -28,7 +28,7 @@ jobs:
gpg --list-secret-keys --keyid-format LONG
- name: Check Out Code
uses: actions/checkout@v4
uses: actions/checkout@v6
- name: Git Fetch Tags
run: git fetch --prune --unshallow --tags -f
@@ -39,9 +39,6 @@ jobs:
- name: Release binaries
uses: "marvinpinto/action-automatic-releases@latest"
uses: softprops/action-gh-release@v2
with:
repo_token: "${{ secrets.GITHUB_TOKEN }}"
prerelease: false
files: |
./cloudfox/*
files: ./cloudfox/*
+1 -1
View File
@@ -11,6 +11,6 @@ jobs:
codespell:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v6
- run: pip install --user codespell
- run: codespell --ignore-words-list="aks,referers,invokable" --skip="*.sum"
+6 -4
View File
@@ -128,9 +128,13 @@ func (m *InstancesModule) Instances(filter string, outputDirectory string, verbo
}
wg.Wait()
//time.Sleep(time.Second * 2)
// Perform role analysis
// Signal the receiver to stop and wait for it to finish draining the channel.
// This must happen BEFORE role analysis to ensure all MappedInstances are collected.
receiverDone <- true
<-receiverDone
// Perform role analysis (all instances are now in m.MappedInstances)
if m.pmapperError == nil {
for i := range m.MappedInstances {
m.MappedInstances[i].Admin, m.MappedInstances[i].CanPrivEsc = GetPmapperResults(m.SkipAdminCheck, m.pmapperMod, &m.MappedInstances[i].Role)
@@ -144,8 +148,6 @@ func (m *InstancesModule) Instances(filter string, outputDirectory string, verbo
// Send a message to the spinner goroutine to close the channel and stop
spinnerDone <- true
<-spinnerDone
receiverDone <- true
<-receiverDone
// This conditional block will either dump the userData attribute content or the general instances data, depending on what you select via command line.
//fmt.Printf("\n[*] Preparing output...\n\n")
+8 -6
View File
@@ -2252,6 +2252,7 @@ func runAllChecksCommand(cmd *cobra.Command, args []string) {
WrapTable: AWSWrapTable,
AWSOutputType: AWSOutputType,
AWSTableCols: AWSTableCols,
PmapperDataBasePath: PmapperDataBasePath,
}
ec2UserData.Instances(InstancesFilter, AWSOutputDirectory, Verbosity)
envsMod := aws.EnvsModule{
@@ -2434,12 +2435,13 @@ func runAllChecksCommand(cmd *cobra.Command, args []string) {
roleTrusts.PrintRoleTrusts(AWSOutputDirectory, Verbosity)
pmapperCommand := aws.PmapperModule{
Caller: *caller,
AWSProfile: profile,
Goroutines: Goroutines,
WrapTable: AWSWrapTable,
AWSOutputType: AWSOutputType,
AWSTableCols: AWSTableCols,
Caller: *caller,
AWSProfile: profile,
Goroutines: Goroutines,
WrapTable: AWSWrapTable,
AWSOutputType: AWSOutputType,
AWSTableCols: AWSTableCols,
PmapperDataBasePath: PmapperDataBasePath,
}
pmapperCommand.PrintPmapperData(AWSOutputDirectory, Verbosity)
+1 -1
View File
@@ -4,4 +4,4 @@ const CLOUDFOX_USER_AGENT = "cloudfox"
const CLOUDFOX_LOG_FILE_DIR_NAME = ".cloudfox"
const CLOUDFOX_BASE_DIRECTORY = "cloudfox-output"
const LOOT_DIRECTORY_NAME = "loot"
const CLOUDFOX_VERSION = "2.0.3"
const CLOUDFOX_VERSION = "2.0.4"