← 输入框|github.com|刷新
Skip to content

Authenticated advanced ZAP scan fails in the Juice Shop demo #615

New issue
New issue
Closed
Closed
Authenticated advanced ZAP scan fails in the Juice Shop demo#615
#603 (+2)
Assignees
rfelber
Labels
bugBugs
Milestone
v3.1.0

Description

@ammerzon
ammerzon
opened on Aug 30, 2021

🐞 Bug report

Describe the bug

Steps To Reproduce

  1. Create a separate namespace: kubectl create namespace juiceshop
  2. Install OWASP juice-shop: helm upgrade --install juice-shop secureCodeBox/juice-shop -n juiceshop
  3. Install zap-advanced: helm upgrade --install zap-advanced secureCodeBox/zap-advanced -n juiceshop
  4. Apply the demo-juiceshop-scan-authenticated scan and update the service name and namespace beforehand
apiVersion: v1
kind: ConfigMap
metadata:
  name: zap-advanced-scan-config
  namespace: juiceshop
data:
  2-zap-advanced-scan.yaml: |-

    contexts:
      - name: scb-juiceshop-context
        url: http://juice-shop.juiceshop.svc:3000/
        ...
  1. Inspect the logs of the scanner container

Expected behavior

The scanner should not fail and generate the findings.

System

  • secureCodeBox: 3.0.1
  • OS: macOS
  • Kubernetes Version: v1.22.0 (client), v1.21.2 (server)
  • Docker Version: 20.10.8

Screenshots / Logs

ZAP logs 
2021-08-27 09:37 zapclient    INFO    : :: Configuring ZAP Instance with {'http': 'http://localhost:8080', 'https': 'http://localhost:8080'}
2021-08-27 09:37 zapclient    INFO    : :: Starting SCB ZAP Automation Framework with config /home/securecodebox/configs/
2021-08-27 09:37 ZapClient    INFO    : Importing YAML files for ZAP configuration at dir: '['/home/securecodebox/configs/1-zap-advanced-scantype.yaml', '/home/securecodebox/configs/2-zap-advanced-scan.yaml']'
2021-08-27 09:37 zapclient    INFO    : :: Starting SCB ZAP Scan with target http://juice-shop.juiceshop.svc:3000/
2021-08-27 09:37 ZapClient    INFO    : Configuring ZAP Global
2021-08-27 09:37 ZapConfigureSettings INFO    : Creating a new ZAP session with the name: secureCodeBox
2021-08-27 09:37 ZapClient    INFO    : Configuring ZAP Context
2021-08-27 09:37 ZapConfigureContext INFO    : Existing Contexts will be removed: ['Default Context']
2021-08-27 09:37 ZapConfigureContext INFO    : Configuring a new ZAP Context with name: scb-juiceshop-context
2021-08-27 09:37 ZapConfigureContextAuthentication INFO    : HTTP ZAP HTTP JSON Params: 'loginUrl=http://juice-shop.juiceshop.svc:3000/rest/user/login&loginRequestData={"email":"admin@juice-sh.op","password":"admin123"}'
2021-08-27 09:37 ZapConfigureContext INFO    : Existing Users will be removed before adding new ones.
2021-08-27 09:37 ZapConfigureContext INFO    : Configuring the ZAP session management (type=scriptBasedSessionManagement)
2021-08-27 09:37 ZapClient    INFO    : Loading new Script 'juiceshop-session-management.js' at '/home/zap/.ZAP_D/scripts/scripts/session/juiceshop-session-management.js' with type: 'session' and engine 'Oracle Nashorn'
2021-08-27 09:37 ZapClient    ERROR   : The script couldn't be loaded due to errors!
2021-08-27 09:37 zapclient    ERROR   : Unexpected error: The script couldn't be loaded due to errors!
Traceback (most recent call last):
  File "/zap-client/zapclient/__main__.py", line 64, in process
    zap_automation.scan_target(target=args.target)
  File "/zap-client/zapclient/zap_automation.py", line 84, in scan_target
    zap_context.configure_contexts()
  File "/zap-client/zapclient/context/zap_context.py", line 64, in configure_contexts
    self._configure_context(context)
  File "/zap-client/zapclient/context/zap_context.py", line 97, in _configure_context
    self._configure_context_session_management(sessions_config=context["session"], context_id=context_id)
  File "/zap-client/zapclient/context/zap_context.py", line 229, in _configure_context_session_management
    self._configure_context_session_management_scriptbased(script_config=script_config, context_id=context_id)
  File "/zap-client/zapclient/context/zap_context.py", line 245, in _configure_context_session_management_scriptbased
    self._configure_load_script(script_config=script_config, script_type="session")
  File "/zap-client/zapclient/zap_abstract_client.py", line 115, in _configure_load_script
    self.check_zap_result(
  File "/zap-client/zapclient/zap_abstract_client.py", line 71, in check_zap_result
    raise Exception(exception_message)
Exception: The script couldn't be loaded due to errors!
2021-08-27 09:37 ZapClient    INFO    : :: Show all Statistics
2021-08-27 09:37 ZapClient    INFO    : []
2021-08-27 09:37 ZapClient    INFO    : :: Shutting down the running ZAP Instance.

Activity

  1. ammerzon
    added
    bugBugs
    on Aug 30, 2021

  2. rfelber commented on Aug 30, 2021

    @rfelber
    rfelber
    on Aug 30, 2021
    Member

    Hi @ammerzon,

    thx for reporting this issue with all the needed informations 🙏 That helps alot 👍🏻

    I tried to fix that issue in the following PR: #609

    Maybe you can verify that it's fixed if you change your helm chart to use temporary the main image tag within the zap-advanced scanner.

    scanner:
  image:
    repository: docker.io/securecodebox/scanner-zap-advanced
    tag: main
  3. rfelber
    self-assigned this
    on Aug 30, 2021
  4. rfelber
    added this to the v3.1.0 milestone on Aug 30, 2021
  5. rfelber
    linked a pull request that will close this issueBugfixed zap-advanced scanner script configuration #609on Aug 30, 2021

  6. ammerzon commented on Aug 30, 2021

    @ammerzon
    ammerzon
    on Aug 30, 2021
    Author

    Thank you for your quick reply. I updated the values.yaml and now the scan finishes successfully.

    parser:
  image:
    repository: docker.io/securecodebox/parser-zap
    tag: main
    ....

scanner:
  image:
    repository: docker.io/securecodebox/scanner-zap-advanced
    tag: main
    ...

    The findings are saved to MinIO but the parser failed with error that findings-schema.json cannot be found. Is this error related to the PR?

    Parser logs 
    Starting Parser
Fetching result file
Fetched result file
Transformed raw result file into 14 findings
Adding UUIDs and Dates to the findings
Validating Findings
Findings Validation failed with error:
[Error: ENOENT: no such file or directory, open '/home/app/parser-wrapper/findings-schema.json'] {
  errno: -2,
  code: 'ENOENT',
  syscall: 'open',
  path: '/home/app/parser-wrapper/findings-schema.json'
}
Updated status successfully
Uploading results to the file storage service
Completed parser
  7. rfelber
    linked a pull request that will close this issueBugfixed zap-advanced HelmChart to Include the Authentication Scripts Again #597on Aug 31, 2021

  8. ammerzon commented on Aug 31, 2021

    @ammerzon
    ammerzon
    on Aug 31, 2021
    Author

    Will these changes only be included in 3.1.0 or are there any plans for an earlier release?

  9. rfelber
    linked a pull request that will close this issueEnsure Findings are validated in Integration Tests (closes #546) #603on Aug 31, 2021

  10. rfelber commented on Aug 31, 2021

    @rfelber
    rfelber
    on Aug 31, 2021
    Member

    Hi @ammerzon,

    yes they will 👍🏻 and we will release this version as soon as all related PRs are finished 🤞

  11. Weltraumschaf
    closed this as completedin #603on Aug 31, 2021

  12. JohannesZahn commented on Aug 31, 2021

    @JohannesZahn
    JohannesZahn
    on Aug 31, 2021
    Contributor

    @ammerzon can you confirm that everything runs without errors now (still using the main tag)

  13. ammerzon commented on Sep 8, 2021

    @ammerzon
    ammerzon
    on Sep 8, 2021
    Author

    @JohannesZahn I am sorry for the late answer. I tested it again and yes now everything is working as expected.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

bugBugs

Type

No type

Projects

No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions