Skip to content
This repository was archived by the owner on Oct 14, 2020. It is now read-only.

Commit bcfe5b3

Browse files
committed
Add WIP trivy integration
1 parent a73892e commit bcfe5b3

File tree

13 files changed

+4021
-0
lines changed

13 files changed

+4021
-0
lines changed

integrations/trivy/.helmignore

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
.DS_Store
2+
3+
parser/
4+
scanner/

integrations/trivy/Chart.yaml

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
apiVersion: v2
2+
name: trivy
3+
description: A Helm chart for the trivy security Scanner that integrates with the secureCodeBox.
4+
5+
type: application
6+
version: 0.1.0
7+
appVersion: latest
8+
9+
keywords:
10+
- security
11+
- trivy
12+
- image-scanning
13+
- scanner
14+
- secureCodeBox
15+
home: https://www.securecodebox.io/scanner/trivy
16+
icon: https://github.com/aquasecurity/trivy/blob/master/imgs/logo.png
17+
sources:
18+
- https://github.com/secureCodeBox/secureCodeBox
19+
maintainers:
20+
- name: iteratec GmbH
21+
email: security@iteratec.com
Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
FROM scbexperimental/parser-sdk-nodejs:latest
2+
WORKDIR /home/app/parser-wrapper/parser/
3+
COPY --chown=app:app ./parser.js ./parser.js

integrations/trivy/parser/__snapshots__/parser.test.js.snap

Lines changed: 2101 additions & 0 deletions
Large diffs are not rendered by default.
Lines changed: 204 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,204 @@
1+
[
2+
{
3+
"Target": "bkimminich/juice-shop:v10.2.0 (alpine 3.11.5)",
4+
"Vulnerabilities": [
5+
{
6+
"VulnerabilityID": "CVE-2020-1967",
7+
"PkgName": "openssl",
8+
"InstalledVersion": "1.1.1d-r3",
9+
"FixedVersion": "1.1.1g-r0",
10+
"Layer": {
11+
"DiffID": "sha256:beee9f30bc1f711043e78d4a2be0668955d4b761d587d6f60c2c8dc081efb203"
12+
},
13+
"Title": "openssl: Segmentation fault in SSL_check_chain causes denial of service",
14+
"Description": "Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the \"signature_algorithms_cert\" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).",
15+
"Severity": "HIGH",
16+
"References": [
17+
"http://www.openwall.com/lists/oss-security/2020/04/22/2",
18+
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1967",
19+
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=eb563247aef3e83dda7679c43f9649270462e5b1",
20+
"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44440",
21+
"https://lists.apache.org/thread.html/r66ea9c436da150683432db5fbc8beb8ae01886c6459ac30c2cea7345@%3Cdev.tomcat.apache.org%3E",
22+
"https://lists.apache.org/thread.html/r94d6ac3f010a38fccf4f432b12180a13fa1cf303559bd805648c9064@%3Cdev.tomcat.apache.org%3E",
23+
"https://lists.apache.org/thread.html/r9a41e304992ce6aec6585a87842b4f2e692604f5c892c37e3b0587ee@%3Cdev.tomcat.apache.org%3E",
24+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XVEP3LAK4JSPRXFO4QF4GG2IVXADV3SO/",
25+
"https://security.FreeBSD.org/advisories/FreeBSD-SA-20:11.openssl.asc",
26+
"https://security.gentoo.org/glsa/202004-10",
27+
"https://security.netapp.com/advisory/ntap-20200424-0003/",
28+
"https://www.debian.org/security/2020/dsa-4661",
29+
"https://www.openssl.org/news/secadv/20200421.txt",
30+
"https://www.synology.com/security/advisory/Synology_SA_20_05_OpenSSL"
31+
]
32+
}
33+
]
34+
},
35+
{
36+
"Target": "juice-shop/frontend/package-lock.json",
37+
"Vulnerabilities": null
38+
},
39+
{
40+
"Target": "juice-shop/package-lock.json",
41+
"Vulnerabilities": [
42+
{
43+
"VulnerabilityID": "NSWG-ECO-428",
44+
"PkgName": "base64url",
45+
"InstalledVersion": "0.0.6",
46+
"FixedVersion": "\u003e=3.0.0",
47+
"Layer": {
48+
"DiffID": "sha256:6de27bb627f066285f0628172e686caf3e388a3bf266606c88d619d87d14aae3"
49+
},
50+
"Title": "Out-of-bounds Read",
51+
"Description": "`base64url` allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below",
52+
"Severity": "HIGH",
53+
"References": [
54+
"https://github.com/brianloveswords/base64url/pull/25",
55+
"https://hackerone.com/reports/321687"
56+
]
57+
},
58+
{
59+
"VulnerabilityID": "NSWG-ECO-17",
60+
"PkgName": "jsonwebtoken",
61+
"InstalledVersion": "0.1.0",
62+
"FixedVersion": "\u003e=4.2.2",
63+
"Layer": {
64+
"DiffID": "sha256:6de27bb627f066285f0628172e686caf3e388a3bf266606c88d619d87d14aae3"
65+
},
66+
"Title": "Verification Bypass",
67+
"Description": "It is possible for an attacker to bypass verification when \"a token digitally signed with an asymetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family)\" [1]",
68+
"Severity": "HIGH",
69+
"References": [
70+
"https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/",
71+
"https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687",
72+
"https://www.timmclean.net/2015/02/25/jwt-alg-none.html"
73+
]
74+
},
75+
{
76+
"VulnerabilityID": "NSWG-ECO-17",
77+
"PkgName": "jsonwebtoken",
78+
"InstalledVersion": "0.4.0",
79+
"FixedVersion": "\u003e=4.2.2",
80+
"Layer": {
81+
"DiffID": "sha256:6de27bb627f066285f0628172e686caf3e388a3bf266606c88d619d87d14aae3"
82+
},
83+
"Title": "Verification Bypass",
84+
"Description": "It is possible for an attacker to bypass verification when \"a token digitally signed with an asymetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family)\" [1]",
85+
"Severity": "HIGH",
86+
"References": [
87+
"https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/",
88+
"https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687",
89+
"https://www.timmclean.net/2015/02/25/jwt-alg-none.html"
90+
]
91+
},
92+
{
93+
"VulnerabilityID": "CVE-2016-1000223",
94+
"PkgName": "jws",
95+
"InstalledVersion": "0.2.6",
96+
"FixedVersion": "\u003e=3.0.0",
97+
"Layer": {
98+
"DiffID": "sha256:6de27bb627f066285f0628172e686caf3e388a3bf266606c88d619d87d14aae3"
99+
},
100+
"Title": "Forgeable Public/Private Tokens",
101+
"Description": "Since \"algorithm\" isn't enforced in `jws.verify()`, a malicious user could choose what algorithm is sent to the server. If the server is expecting RSA but is sent HMAC-SHA with RSA's public key, the server will think the public key is actually an HMAC private key. This could be used to forge any data an attacker wants.\n\nIn addition, there is the `none` algorithm to be concerned about. In versions prior to 3.0.0, verification of the token could be bypassed when the `alg` field is set to `none`.\n\n*Edit ( 7/29/16 ): A previous version of this advisory incorrectly stated that the vulnerability was patched in version 2.0.0 instead of 3.0.0. The advisory has been updated to reflect this new information. Thanks to Fabien Catteau for reporting the error.*",
102+
"Severity": "HIGH",
103+
"References": [
104+
"https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/",
105+
"https://github.com/brianloveswords/node-jws/commit/585d0e1e97b6747c10cf5b7689ccc5618a89b299#diff-4ac32a78649ca5bdd8e0ba38b7006a1e"
106+
]
107+
},
108+
{
109+
"VulnerabilityID": "CVE-2018-16487",
110+
"PkgName": "lodash",
111+
"InstalledVersion": "2.4.2",
112+
"FixedVersion": "\u003e=4.17.11",
113+
"Layer": {
114+
"DiffID": "sha256:6de27bb627f066285f0628172e686caf3e388a3bf266606c88d619d87d14aae3"
115+
},
116+
"Title": "lodash: Prototype pollution in utilities function",
117+
"Description": "A prototype pollution vulnerability was found in lodash \u003c4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.",
118+
"Severity": "HIGH",
119+
"References": [
120+
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16487",
121+
"https://hackerone.com/reports/380873",
122+
"https://security.netapp.com/advisory/ntap-20190919-0004/",
123+
"https://www.npmjs.com/advisories/782"
124+
]
125+
},
126+
{
127+
"VulnerabilityID": "CVE-2018-3721",
128+
"PkgName": "lodash",
129+
"InstalledVersion": "2.4.2",
130+
"FixedVersion": "\u003e=4.17.5",
131+
"Layer": {
132+
"DiffID": "sha256:6de27bb627f066285f0628172e686caf3e388a3bf266606c88d619d87d14aae3"
133+
},
134+
"Title": "lodash: Prototype pollution in utilities function",
135+
"Description": "lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of \"Object\" via __proto__, causing the addition or modification of an existing property that will exist on all objects.",
136+
"Severity": "MEDIUM",
137+
"References": [
138+
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3721",
139+
"https://github.com/lodash/lodash/commit/d8e069cc3410082e44eb18fcf8e7f3d08ebe1d4a",
140+
"https://hackerone.com/reports/310443",
141+
"https://security.netapp.com/advisory/ntap-20190919-0004/"
142+
]
143+
},
144+
{
145+
"VulnerabilityID": "CVE-2016-4055",
146+
"PkgName": "moment",
147+
"InstalledVersion": "2.0.0",
148+
"FixedVersion": "\u003e=2.11.2",
149+
"Layer": {
150+
"DiffID": "sha256:6de27bb627f066285f0628172e686caf3e388a3bf266606c88d619d87d14aae3"
151+
},
152+
"Title": "moment.js: regular expression denial of service",
153+
"Description": "The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a \"regular expression Denial of Service (ReDoS).\"",
154+
"Severity": "HIGH",
155+
"References": [
156+
"http://www.openwall.com/lists/oss-security/2016/04/20/11",
157+
"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
158+
"http://www.securityfocus.com/bid/95849",
159+
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4055",
160+
"https://lists.apache.org/thread.html/10f0f3aefd51444d1198c65f44ffdf2d78ca3359423dbc1c168c9731@%3Cdev.flink.apache.org%3E",
161+
"https://lists.apache.org/thread.html/17ff53f7999e74fbe3cc0ceb4e1c3b00b180b7c5afec8e978837bc49@%3Cuser.flink.apache.org%3E",
162+
"https://lists.apache.org/thread.html/52bafac05ad174000ea465fe275fd3cc7bd5c25535a7631c0bc9bfb2@%3Cuser.flink.apache.org%3E",
163+
"https://lists.apache.org/thread.html/54df3aeb4239b64b50b356f0ca6f986e3c4ca5b84c515dce077c7854@%3Cuser.flink.apache.org%3E",
164+
"https://nodesecurity.io/advisories/55",
165+
"https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS",
166+
"https://www.tenable.com/security/tns-2019-02"
167+
]
168+
},
169+
{
170+
"VulnerabilityID": "CVE-2016-1000237",
171+
"PkgName": "sanitize-html",
172+
"InstalledVersion": "1.4.2",
173+
"FixedVersion": "\u003e=1.4.3",
174+
"Layer": {
175+
"DiffID": "sha256:6de27bb627f066285f0628172e686caf3e388a3bf266606c88d619d87d14aae3"
176+
},
177+
"Title": "XSS - Sanitization not applied recursively",
178+
"Description": "sanitize-html before 1.4.3 has XSS.",
179+
"Severity": "MEDIUM",
180+
"References": [
181+
"https://github.com/punkave/sanitize-html/issues/29",
182+
"https://nodesecurity.io/advisories/135",
183+
"https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000237.json"
184+
]
185+
},
186+
{
187+
"VulnerabilityID": "NSWG-ECO-154",
188+
"PkgName": "sanitize-html",
189+
"InstalledVersion": "1.4.2",
190+
"FixedVersion": "\u003e=1.11.4",
191+
"Layer": {
192+
"DiffID": "sha256:6de27bb627f066285f0628172e686caf3e388a3bf266606c88d619d87d14aae3"
193+
},
194+
"Title": "Cross Site Scripting",
195+
"Description": "Sanitize-html is a library for scrubbing html input of malicious values.\n\nVersions 1.11.1 and below are vulnerable to cross site scripting (XSS) in certain scenarios:\n\nIf allowed at least one nonTextTags, the result is a potential XSS vulnerability.\nPoC:\n\n```\nvar sanitizeHtml = require('sanitize-html');\n\nvar dirty = '!\u003ctextarea\u003e\u0026lt;/textarea\u0026gt;\u003csvg/onload=prompt`xs`\u0026gt;\u003c/textarea\u003e!';\nvar clean = sanitizeHtml(dirty, {\n allowedTags: [ 'textarea' ]\n});\n\nconsole.log(clean);\n\n// !\u003ctextarea\u003e\u003c/textarea\u003e\u003csvg/onload=prompt`xs`\u003e\u003c/textarea\u003e!\n```",
196+
"Severity": "MEDIUM",
197+
"References": [
198+
"https://github.com/punkave/sanitize-html/commit/5d205a1005ba0df80e21d8c64a15bb3accdb2403",
199+
"https://github.com/punkave/sanitize-html/issues/100"
200+
]
201+
}
202+
]
203+
}
204+
]
Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
[
2+
{
3+
"Target": "securecodebox/amass:unstable@sha256:05954f82eaa7bbe81dfc81907113c1e8d9b2409f3d38be3f0e12bccb322bea2c (debian 9.11)",
4+
"Vulnerabilities": null
5+
}
6+
]

0 commit comments

Comments
 (0)