From fdecd9de642c22a362b1769762e0ef51923f0ca2 Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Thu, 19 Aug 2021 12:57:10 +0200 Subject: [PATCH 01/42] Created Dockerfile of the Typo3Scanner --- scanners/typo3scan/.helmignore | 23 +++++++ scanners/typo3scan/Chart.yaml | 44 +++++++++++++ scanners/typo3scan/parser/Dockerfile | 11 ++++ scanners/typo3scan/scanner/Dockerfile | 31 ++++++++++ scanners/typo3scan/scanner/wrapper.sh | 11 ++++ scanners/typo3scan/templates/NOTES.txt | 22 +++++++ scanners/typo3scan/templates/_helpers.tpl | 62 +++++++++++++++++++ scanners/typo3scan/templates/deployment.yaml | 61 ++++++++++++++++++ scanners/typo3scan/templates/hpa.yaml | 28 +++++++++ scanners/typo3scan/templates/ingress.yaml | 61 ++++++++++++++++++ scanners/typo3scan/templates/service.yaml | 15 +++++ .../typo3scan/templates/serviceaccount.yaml | 12 ++++ .../templates/tests/test-connection.yaml | 15 +++++ scanners/typo3scan/values.yaml | 60 ++++++++++++++++++ 14 files changed, 456 insertions(+) create mode 100644 scanners/typo3scan/.helmignore create mode 100644 scanners/typo3scan/Chart.yaml create mode 100644 scanners/typo3scan/parser/Dockerfile create mode 100644 scanners/typo3scan/scanner/Dockerfile create mode 100644 scanners/typo3scan/scanner/wrapper.sh create mode 100644 scanners/typo3scan/templates/NOTES.txt create mode 100644 scanners/typo3scan/templates/_helpers.tpl create mode 100644 scanners/typo3scan/templates/deployment.yaml create mode 100644 scanners/typo3scan/templates/hpa.yaml create mode 100644 scanners/typo3scan/templates/ingress.yaml create mode 100644 scanners/typo3scan/templates/service.yaml create mode 100644 scanners/typo3scan/templates/serviceaccount.yaml create mode 100644 scanners/typo3scan/templates/tests/test-connection.yaml create mode 100644 scanners/typo3scan/values.yaml diff --git a/scanners/typo3scan/.helmignore b/scanners/typo3scan/.helmignore new file mode 100644 index 0000000000..0e8a0eb36f --- /dev/null +++ b/scanners/typo3scan/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/scanners/typo3scan/Chart.yaml b/scanners/typo3scan/Chart.yaml new file mode 100644 index 0000000000..7639f8111e --- /dev/null +++ b/scanners/typo3scan/Chart.yaml @@ -0,0 +1,44 @@ +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 +apiVersion: v2 +name: typo3scan +description: A Helm chart for the Typo3 security scanner that integrates with the secureCodeBox + +# A chart can be either an 'application' or a 'library' chart. +# +# Application charts are a collection of templates that can be packaged into versioned archives +# to be deployed. +# +# Library charts provide useful utilities or functions for the chart developer. They're included as +# a dependency of application charts to inject those utilities and functions into the rendering +# pipeline. Library charts do not define any templates and therefore cannot be deployed. +type: application + +# This is the chart version. This version number should be incremented each time you make changes +# to the chart and its templates, including the app version. +# Versions are expected to follow Semantic Versioning (https://semver.org/) +version: 0.1.0 + +# This is the version number of the application being deployed. This version number should be +# incremented each time you make changes to the application. Versions are not expected to +# follow Semantic Versioning. They should reflect the version the application is using. +# It is recommended to use it with quotes. +appVersion: "1.16.0" +kubeVersion: ">=v1.11.0-0" +keywords: + - security + - typo3scan + - typo3 + - scanner + - secureCodeBox + +home: https://docs.securecodebox.io/docs/scanners/typo3scan +#TODO Scanner doesn't have an icon + +sources: + - https://github.com/secureCodeBox/secureCodeBox + +maintainers: + - name: iteratec GmbH + - email: secureCodeBox@iteratec.com diff --git a/scanners/typo3scan/parser/Dockerfile b/scanners/typo3scan/parser/Dockerfile new file mode 100644 index 0000000000..4dd33baf1d --- /dev/null +++ b/scanners/typo3scan/parser/Dockerfile @@ -0,0 +1,11 @@ +ARG baseImageTag +FROM node:12-alpine as build +RUN mkdir -p /home/app +WORKDIR /home/app +COPY package.json package-lock.json ./ +RUN npm ci --production + +FROM securecodebox/parser-sdk-nodejs:${baseImageTag:-latest} +WORKDIR /home/app/parser-wrapper/parser/ +COPY --from=build --chown=app:app /home/app/node_modules/ ./node_modules/ +COPY --chown=app:app ./parser.js ./parser.js \ No newline at end of file diff --git a/scanners/typo3scan/scanner/Dockerfile b/scanners/typo3scan/scanner/Dockerfile new file mode 100644 index 0000000000..b40bdd0e54 --- /dev/null +++ b/scanners/typo3scan/scanner/Dockerfile @@ -0,0 +1,31 @@ +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 + +FROM alpine:3.12 + +#Install Python3 +ENV PYTHONUNBUFFERED=1 +RUN apk add --update --no-cache python3 && ln -sf python3 /usr/bin/python +RUN python3 -m ensurepip +RUN pip3 install --no-cache --upgrade pip setuptools + +#Install git +RUN apk add git + +#Create typo3scan user/group and give access +RUN addgroup --system --gid 1001 typo3scan && adduser typo3scan --system --uid 1001 --ingroup typo3scan +RUN mkdir /home/securecodebox/ +RUN chown -R typo3scan:typo3scan /home/securecodebox/ +USER 1001 + +#clone Repo +WORKDIR /home/securecodebox/ +RUN git clone https://github.com/whoot/Typo3Scan.git +WORKDIR /home/securecodebox/Typo3Scan + +#Install Typo3Scan python requirements +RUN python3 -m pip install -r requirements.txt +COPY wrapper.sh ./wrapper.sh + +ENTRYPOINT [ "sh", "./wrapper.sh" ] \ No newline at end of file diff --git a/scanners/typo3scan/scanner/wrapper.sh b/scanners/typo3scan/scanner/wrapper.sh new file mode 100644 index 0000000000..a45c6d6676 --- /dev/null +++ b/scanners/typo3scan/scanner/wrapper.sh @@ -0,0 +1,11 @@ +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 + +python3 typo3scan.py --no-interaction --json $@ + +if [ -f ./typo3scan.json ]; then + mv ./typo3scan.json /home/securecodebox/typo3scan-results.json +fi + +exit 0 diff --git a/scanners/typo3scan/templates/NOTES.txt b/scanners/typo3scan/templates/NOTES.txt new file mode 100644 index 0000000000..6973440292 --- /dev/null +++ b/scanners/typo3scan/templates/NOTES.txt @@ -0,0 +1,22 @@ +1. Get the application URL by running these commands: +{{- if .Values.ingress.enabled }} +{{- range $host := .Values.ingress.hosts }} + {{- range .paths }} + http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }} + {{- end }} +{{- end }} +{{- else if contains "NodePort" .Values.service.type }} + export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "typo3scan.fullname" . }}) + export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") + echo http://$NODE_IP:$NODE_PORT +{{- else if contains "LoadBalancer" .Values.service.type }} + NOTE: It may take a few minutes for the LoadBalancer IP to be available. + You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "typo3scan.fullname" . }}' + export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "typo3scan.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}") + echo http://$SERVICE_IP:{{ .Values.service.port }} +{{- else if contains "ClusterIP" .Values.service.type }} + export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "typo3scan.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") + export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}") + echo "Visit http://127.0.0.1:8080 to use your application" + kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT +{{- end }} diff --git a/scanners/typo3scan/templates/_helpers.tpl b/scanners/typo3scan/templates/_helpers.tpl new file mode 100644 index 0000000000..81cabd0fd6 --- /dev/null +++ b/scanners/typo3scan/templates/_helpers.tpl @@ -0,0 +1,62 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "typo3scan.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "typo3scan.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "typo3scan.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "typo3scan.labels" -}} +helm.sh/chart: {{ include "typo3scan.chart" . }} +{{ include "typo3scan.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "typo3scan.selectorLabels" -}} +app.kubernetes.io/name: {{ include "typo3scan.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "typo3scan.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "typo3scan.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} diff --git a/scanners/typo3scan/templates/deployment.yaml b/scanners/typo3scan/templates/deployment.yaml new file mode 100644 index 0000000000..fe31fa948d --- /dev/null +++ b/scanners/typo3scan/templates/deployment.yaml @@ -0,0 +1,61 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "typo3scan.fullname" . }} + labels: + {{- include "typo3scan.labels" . | nindent 4 }} +spec: + {{- if not .Values.autoscaling.enabled }} + replicas: {{ .Values.replicaCount }} + {{- end }} + selector: + matchLabels: + {{- include "typo3scan.selectorLabels" . | nindent 6 }} + template: + metadata: + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "typo3scan.selectorLabels" . | nindent 8 }} + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "typo3scan.serviceAccountName" . }} + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} + containers: + - name: {{ .Chart.Name }} + securityContext: + {{- toYaml .Values.securityContext | nindent 12 }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + ports: + - name: http + containerPort: 80 + protocol: TCP + livenessProbe: + httpGet: + path: / + port: http + readinessProbe: + httpGet: + path: / + port: http + resources: + {{- toYaml .Values.resources | nindent 12 }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} diff --git a/scanners/typo3scan/templates/hpa.yaml b/scanners/typo3scan/templates/hpa.yaml new file mode 100644 index 0000000000..0198434fe4 --- /dev/null +++ b/scanners/typo3scan/templates/hpa.yaml @@ -0,0 +1,28 @@ +{{- if .Values.autoscaling.enabled }} +apiVersion: autoscaling/v2beta1 +kind: HorizontalPodAutoscaler +metadata: + name: {{ include "typo3scan.fullname" . }} + labels: + {{- include "typo3scan.labels" . | nindent 4 }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ include "typo3scan.fullname" . }} + minReplicas: {{ .Values.autoscaling.minReplicas }} + maxReplicas: {{ .Values.autoscaling.maxReplicas }} + metrics: + {{- if .Values.autoscaling.targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }} + {{- end }} + {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }} + - type: Resource + resource: + name: memory + targetAverageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }} + {{- end }} +{{- end }} diff --git a/scanners/typo3scan/templates/ingress.yaml b/scanners/typo3scan/templates/ingress.yaml new file mode 100644 index 0000000000..07a78a1ffd --- /dev/null +++ b/scanners/typo3scan/templates/ingress.yaml @@ -0,0 +1,61 @@ +{{- if .Values.ingress.enabled -}} +{{- $fullName := include "typo3scan.fullname" . -}} +{{- $svcPort := .Values.service.port -}} +{{- if and .Values.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }} + {{- if not (hasKey .Values.ingress.annotations "kubernetes.io/ingress.class") }} + {{- $_ := set .Values.ingress.annotations "kubernetes.io/ingress.class" .Values.ingress.className}} + {{- end }} +{{- end }} +{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: networking.k8s.io/v1 +{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: networking.k8s.io/v1beta1 +{{- else -}} +apiVersion: extensions/v1beta1 +{{- end }} +kind: Ingress +metadata: + name: {{ $fullName }} + labels: + {{- include "typo3scan.labels" . | nindent 4 }} + {{- with .Values.ingress.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- if and .Values.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }} + ingressClassName: {{ .Values.ingress.className }} + {{- end }} + {{- if .Values.ingress.tls }} + tls: + {{- range .Values.ingress.tls }} + - hosts: + {{- range .hosts }} + - {{ . | quote }} + {{- end }} + secretName: {{ .secretName }} + {{- end }} + {{- end }} + rules: + {{- range .Values.ingress.hosts }} + - host: {{ .host | quote }} + http: + paths: + {{- range .paths }} + - path: {{ .path }} + {{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }} + pathType: {{ .pathType }} + {{- end }} + backend: + {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }} + service: + name: {{ $fullName }} + port: + number: {{ $svcPort }} + {{- else }} + serviceName: {{ $fullName }} + servicePort: {{ $svcPort }} + {{- end }} + {{- end }} + {{- end }} +{{- end }} diff --git a/scanners/typo3scan/templates/service.yaml b/scanners/typo3scan/templates/service.yaml new file mode 100644 index 0000000000..3f6be05287 --- /dev/null +++ b/scanners/typo3scan/templates/service.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "typo3scan.fullname" . }} + labels: + {{- include "typo3scan.labels" . | nindent 4 }} +spec: + type: {{ .Values.service.type }} + ports: + - port: {{ .Values.service.port }} + targetPort: http + protocol: TCP + name: http + selector: + {{- include "typo3scan.selectorLabels" . | nindent 4 }} diff --git a/scanners/typo3scan/templates/serviceaccount.yaml b/scanners/typo3scan/templates/serviceaccount.yaml new file mode 100644 index 0000000000..4f7443a1c8 --- /dev/null +++ b/scanners/typo3scan/templates/serviceaccount.yaml @@ -0,0 +1,12 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "typo3scan.serviceAccountName" . }} + labels: + {{- include "typo3scan.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} diff --git a/scanners/typo3scan/templates/tests/test-connection.yaml b/scanners/typo3scan/templates/tests/test-connection.yaml new file mode 100644 index 0000000000..40fd70039c --- /dev/null +++ b/scanners/typo3scan/templates/tests/test-connection.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Pod +metadata: + name: "{{ include "typo3scan.fullname" . }}-test-connection" + labels: + {{- include "typo3scan.labels" . | nindent 4 }} + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['{{ include "typo3scan.fullname" . }}:{{ .Values.service.port }}'] + restartPolicy: Never diff --git a/scanners/typo3scan/values.yaml b/scanners/typo3scan/values.yaml new file mode 100644 index 0000000000..72d36a624c --- /dev/null +++ b/scanners/typo3scan/values.yaml @@ -0,0 +1,60 @@ +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 + +parser: + image: + # parser.image.repository -- Parser image repository + repository: docker.io/securecodebox/parser-typo3scan + # parser.image.tag -- Parser image tag + # @default -- defaults to the charts version + tag: null + # parser.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ + ttlSecondsAfterFinished: null + # parser.env -- Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) + env: [] + +scanner: + image: + # scanner.image.repository -- Container Image to run the scan + repository: docker.io/securecodebox/typo3scan + # scanner.image.tag -- defaults to the charts appVersion + tag: null + + # scanner.nameAppend -- append a string to the default scantype name. + nameAppend: null + + # scanner.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ + ttlSecondsAfterFinished: null + # scanner.backoffLimit -- There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) + # @default -- 3 + backoffLimit: 3 + + # scanner.resources -- CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) + resources: {} + # resources: + # requests: + # memory: "256Mi" + # cpu: "250m" + # limits: + # memory: "512Mi" + # cpu: "500m" + + # scanner.env -- Optional environment variables mapped into each scanJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) + env: [] + + # scanner.extraVolumes -- Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) + extraVolumes: [] + + # scanner.extraVolumeMounts -- Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) + extraVolumeMounts: [] + + # scanner.extraContainers -- Optional additional Containers started with each scanJob (see: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) + extraContainers: [] + + # scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) + securityContext: {} + +cascadingRules: + # cascadingRules.enabled -- Enables or disables the installation of the default cascading rules for this scanner + enabled: true From 7fbf32b9c1693196213275cdf40adeb501ff1cc7 Mon Sep 17 00:00:00 2001 From: Ilyesbdlala Date: Thu, 19 Aug 2021 11:01:11 +0000 Subject: [PATCH 02/42] Updating Helm Docs Signed-off-by: GitHub Actions --- scanners/typo3scan/README.md | 46 ++++++++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+) create mode 100644 scanners/typo3scan/README.md diff --git a/scanners/typo3scan/README.md b/scanners/typo3scan/README.md new file mode 100644 index 0000000000..c29eb1a152 --- /dev/null +++ b/scanners/typo3scan/README.md @@ -0,0 +1,46 @@ +# typo3scan + +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.16.0](https://img.shields.io/badge/AppVersion-1.16.0-informational?style=flat-square) + +A Helm chart for the Typo3 security scanner that integrates with the secureCodeBox + +**Homepage:** + +## Maintainers + +| Name | Email | Url | +| ---- | ------ | --- | +| iteratec GmbH | | | +| | secureCodeBox@iteratec.com | | + +## Source Code + +* + +## Requirements + +Kubernetes: `>=v1.11.0-0` + +## Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| cascadingRules.enabled | bool | `true` | Enables or disables the installation of the default cascading rules for this scanner | +| parser.env | list | `[]` | Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) | +| parser.image.repository | string | `"docker.io/securecodebox/parser-typo3scan"` | Parser image repository | +| parser.image.tag | string | defaults to the charts version | Parser image tag | +| parser.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | +| scanner.backoffLimit | int | 3 | There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) | +| scanner.env | list | `[]` | Optional environment variables mapped into each scanJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) | +| scanner.extraContainers | list | `[]` | Optional additional Containers started with each scanJob (see: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) | +| scanner.extraVolumeMounts | list | `[]` | Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | +| scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | +| scanner.image.repository | string | `"docker.io/securecodebox/typo3scan"` | Container Image to run the scan | +| scanner.image.tag | string | `nil` | defaults to the charts appVersion | +| scanner.nameAppend | string | `nil` | append a string to the default scantype name. | +| scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | +| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | + +---------------------------------------------- +Autogenerated from chart metadata using [helm-docs v1.5.0](https://github.com/norwoodj/helm-docs/releases/v1.5.0) From 60c0b0212702f40df0907aaf07d98cb1d60ac057 Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Thu, 19 Aug 2021 18:18:10 +0200 Subject: [PATCH 03/42] Added Typo3Scanner Parser (parser.js) --- scanners/typo3scan/parser/Dockerfile | 4 ++ scanners/typo3scan/parser/package.json | 12 +++++ scanners/typo3scan/parser/parser.js | 63 ++++++++++++++++++++++++++ 3 files changed, 79 insertions(+) create mode 100644 scanners/typo3scan/parser/package.json create mode 100644 scanners/typo3scan/parser/parser.js diff --git a/scanners/typo3scan/parser/Dockerfile b/scanners/typo3scan/parser/Dockerfile index 4dd33baf1d..1eaf917120 100644 --- a/scanners/typo3scan/parser/Dockerfile +++ b/scanners/typo3scan/parser/Dockerfile @@ -1,3 +1,7 @@ +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 + ARG baseImageTag FROM node:12-alpine as build RUN mkdir -p /home/app diff --git a/scanners/typo3scan/parser/package.json b/scanners/typo3scan/parser/package.json new file mode 100644 index 0000000000..44345ae701 --- /dev/null +++ b/scanners/typo3scan/parser/package.json @@ -0,0 +1,12 @@ +{ + "name": "typo3scan-parser", + "version": "1.0.0", + "description": "Parses result files for the type : 'typo3scan-json'", + "main": "", + "scripts": {}, + "keywords": [], + "author": "iteratec GmbH", + "license": "Apache-2.0", + "dependencies": {}, + "devDependencies": {} +} \ No newline at end of file diff --git a/scanners/typo3scan/parser/parser.js b/scanners/typo3scan/parser/parser.js new file mode 100644 index 0000000000..c869a90a2f --- /dev/null +++ b/scanners/typo3scan/parser/parser.js @@ -0,0 +1,63 @@ +// SPDX-FileCopyrightText: 2021 iteratec GmbH +// +// SPDX-License-Identifier: Apache-2.0 + +async function parse(fileContent) { + let findings = JSON.parse(fileContent) + + if (typeof fileContent === "string") { + findings = fileContent + .split("\n") + .map((vulnJson) => JSON.parse(vulnJson)); + } + findings = findings[0] // Trimming the begining of the JS Object + let domain = Object.keys(findings)[0]; // Getting the first key (and the only key) + + let parsed_findings = findings[domain] + + // Parsing Vulnerabilities + let vulns = parsed_findings.Vulnerabilities + let parsed_vulnerabilities = vulns.map((vuln) => { + return { + name: vuln.Type, + description: `Vulnerability of type ${vuln.Type} found`, + category: "Vulnerability", + location: domain, + osi_layer: "APPLICATION", + severity: "HIGH", + attributes: { + Typo3_Version: parsed_findings.Version, + Advisory: vuln.Advisory, + Subcomponent: vuln.Subcomponent, + Versions_affected: vuln.Affected, + Advisory_URL: vuln['Advisory URL'], + + } + }; + }); + + // Parsing Extenstions + let extensions = parsed_findings.Extensions + let parsed_extensions = extensions.map((ext) => { + return { + name: ext.Name, + description: `Extension ${ext.Name} (${ext.Title}) found`, + category: "Extension", + location: ext.Url, + osi_layer: "APPLICATION", + severity: "INFORMATIONAL", + attributes: { + Typo3_Version: parsed_findings.Version, + Repository: ext.Repo, + Extension_Version: ext.Version, + Version_File: ext['Version File'], + Vulnerabilities: ext.Vulnerabilities + } + }; + }); + + let results = parsed_vulnerabilities.concat(parsed_extensions) + return results +} + +module.exports.parse = parse; \ No newline at end of file From 6798ffe9132c1301b713d1e04fd19bc676b326fd Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Fri, 20 Aug 2021 15:40:32 +0200 Subject: [PATCH 04/42] Added parser tests and templates folder --- scanners/typo3scan/examples/scan.yaml | 12 + scanners/typo3scan/parser/Dockerfile | 3 +- .../parser/__testFiles__/empty.jsonl | 0 .../parser/__testFiles__/localhost.jsonl | 437 ++++++++++++++++++ scanners/typo3scan/parser/package-lock.json | 8 + scanners/typo3scan/parser/parser.js | 9 +- scanners/typo3scan/parser/parser.test.js | 38 ++ scanners/typo3scan/templates/NOTES.txt | 22 - scanners/typo3scan/templates/_helpers.tpl | 62 --- .../typo3scan/templates/cascading-rules.yaml | 9 + scanners/typo3scan/templates/deployment.yaml | 61 --- scanners/typo3scan/templates/hpa.yaml | 28 -- scanners/typo3scan/templates/ingress.yaml | 61 --- scanners/typo3scan/templates/service.yaml | 15 - .../typo3scan/templates/serviceaccount.yaml | 12 - .../templates/tests/test-connection.yaml | 15 - .../templates/typ3scan-parse-definition.yaml | 9 + .../templates/typo3scan-scan-type.yaml | 19 + 18 files changed, 541 insertions(+), 279 deletions(-) create mode 100644 scanners/typo3scan/examples/scan.yaml create mode 100644 scanners/typo3scan/parser/__testFiles__/empty.jsonl create mode 100644 scanners/typo3scan/parser/__testFiles__/localhost.jsonl create mode 100644 scanners/typo3scan/parser/package-lock.json create mode 100644 scanners/typo3scan/parser/parser.test.js delete mode 100644 scanners/typo3scan/templates/NOTES.txt delete mode 100644 scanners/typo3scan/templates/_helpers.tpl create mode 100644 scanners/typo3scan/templates/cascading-rules.yaml delete mode 100644 scanners/typo3scan/templates/deployment.yaml delete mode 100644 scanners/typo3scan/templates/hpa.yaml delete mode 100644 scanners/typo3scan/templates/ingress.yaml delete mode 100644 scanners/typo3scan/templates/service.yaml delete mode 100644 scanners/typo3scan/templates/serviceaccount.yaml delete mode 100644 scanners/typo3scan/templates/tests/test-connection.yaml create mode 100644 scanners/typo3scan/templates/typ3scan-parse-definition.yaml create mode 100644 scanners/typo3scan/templates/typo3scan-scan-type.yaml diff --git a/scanners/typo3scan/examples/scan.yaml b/scanners/typo3scan/examples/scan.yaml new file mode 100644 index 0000000000..c3923cb987 --- /dev/null +++ b/scanners/typo3scan/examples/scan.yaml @@ -0,0 +1,12 @@ + + apiVersion: "execution.securecodebox.io/v1" + kind: Scan + metadata: + name: "typo3scan-juice-shop-cluster-internal" #TODO Add Typo3 Website Target ? + spec: + scanType: "typo3scan" + parameters: + # Only show vulnuerable extensions + - "-vuln" + # Set the number of threads to use for enumerating extensions at 10 + - "--threads 10" \ No newline at end of file diff --git a/scanners/typo3scan/parser/Dockerfile b/scanners/typo3scan/parser/Dockerfile index 1eaf917120..523c4b8dec 100644 --- a/scanners/typo3scan/parser/Dockerfile +++ b/scanners/typo3scan/parser/Dockerfile @@ -2,6 +2,7 @@ # # SPDX-License-Identifier: Apache-2.0 +ARG namespace ARG baseImageTag FROM node:12-alpine as build RUN mkdir -p /home/app @@ -11,5 +12,5 @@ RUN npm ci --production FROM securecodebox/parser-sdk-nodejs:${baseImageTag:-latest} WORKDIR /home/app/parser-wrapper/parser/ -COPY --from=build --chown=app:app /home/app/node_modules/ ./node_modules/ +#COPY --from=build --chown=app:app /home/app/node_modules/ ./node_modules/ # TODO No external Dependencies are installed (so no node_modules folder) COPY --chown=app:app ./parser.js ./parser.js \ No newline at end of file diff --git a/scanners/typo3scan/parser/__testFiles__/empty.jsonl b/scanners/typo3scan/parser/__testFiles__/empty.jsonl new file mode 100644 index 0000000000..e69de29bb2 diff --git a/scanners/typo3scan/parser/__testFiles__/localhost.jsonl b/scanners/typo3scan/parser/__testFiles__/localhost.jsonl new file mode 100644 index 0000000000..9f92b52f9b --- /dev/null +++ b/scanners/typo3scan/parser/__testFiles__/localhost.jsonl @@ -0,0 +1,437 @@ +{ + "http://localhost:80":{ + "Backend":"http://localhost:80/typo3/index.php", + "Version":"8.7", + "Vulnerabilities":[ + { + "Advisory":"TYPO3-CORE-SA-2019-026", + "Type":"Insecure Deserialization", + "Subcomponent":"Query Generator & Query View (ext:lowlevel, ext:core)", + "Affected":"8.7.29 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-026" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-025", + "Type":"SQL Injection", + "Subcomponent":"Query Generator (ext:lowlevel)", + "Affected":"8.7.29 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-025" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-024", + "Type":"Directory Traversal", + "Subcomponent":"Extension Manager (ext:extensionmanger)", + "Affected":"8.7.29 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-024" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-023", + "Type":"Cross-Site Scripting", + "Subcomponent":"Filelist Module (ext:filelist)", + "Affected":"8.7.29 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-023" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-022", + "Type":"Cross-Site Scripting", + "Subcomponent":"Link Handling (ext:core, ext:frontend)", + "Affected":"8.7.29 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-022" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-021", + "Type":"Cross-Site Scripting", + "Subcomponent":"Form Framework (ext:form)", + "Affected":"8.7.29 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-021" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-020", + "Type":"Insecure Deserialization", + "Subcomponent":"Backend & Core API (ext:backend, ext:core)", + "Affected":"8.7.26 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-020" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-019", + "Type":"Arbitrary Code Execution, Cross-Site Scripting", + "Subcomponent":"Backend API (ext:backend)", + "Affected":"8.7.26 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-019" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-018", + "Type":"Security Misconfiguration", + "Subcomponent":"Frontend Session Handling (ext:frontend)", + "Affected":"8.7.26 - 8.5.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-018" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-015", + "Type":"Cross-Site Scripting", + "Subcomponent":"Link Handling (ext:core)", + "Affected":"8.7.26 - 8.3.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-015" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-014", + "Type":"Information Disclosure", + "Subcomponent":"Backend User Interface (ext:backend)", + "Affected":"8.7.26 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-014" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-013", + "Type":"Cross-Site Scripting", + "Subcomponent":"Fluid Engine (package typo3fluid/fluid)", + "Affected":"8.7.24 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-013" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-012", + "Type":"Arbitrary Code Execution", + "Subcomponent":"Image Processing via ImageMagick (ext:core)", + "Affected":"8.7.24 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-012" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-011", + "Type":"Security Misconfiguration", + "Subcomponent":"User Session Handling (ext:core)", + "Affected":"8.7.24 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-011" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-008", + "Type":"Arbitrary Code Execution", + "Subcomponent":"File List (ext:filelist)", + "Affected":"8.7.22 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-008" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-007", + "Type":"Cross-Site Scripting", + "Subcomponent":"Form Framework (ext:form)", + "Affected":"8.7.22 - 8.5.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-007" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-006", + "Type":"Cross-Site Scripting", + "Subcomponent":"3rd party library Bootstrap CSS toolkit", + "Affected":"8.7.22 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-006" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-005", + "Type":"Cross-Site Scripting", + "Subcomponent":"Fluid (ext:fluid)", + "Affected":"8.7.22 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-005" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-003", + "Type":"Broken Access Control", + "Subcomponent":"Localization Handling", + "Affected":"8.7.22 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-003" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-002", + "Type":"Security Misconfiguration", + "Subcomponent":"Backend User Account Model (ext:core)", + "Affected":"8.7.22 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-002" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-001", + "Type":"Information Disclosure", + "Subcomponent":"RequireJS package configuration", + "Affected":"8.7.22 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-001" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-012", + "Type":"Denial of Service", + "Subcomponent":"Frontend Session Handling", + "Affected":"8.7.20 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-012" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-011", + "Type":"Denial of Service", + "Subcomponent":"Online media asset handling", + "Affected":"8.7.20 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-011" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-010", + "Type":"Information Disclosure", + "Subcomponent":"Install Tool", + "Affected":"8.7.20 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-010" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-009", + "Type":"Security Misconfiguration", + "Subcomponent":"Install Tool Session Handling", + "Affected":"8.7.20 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-009" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-008", + "Type":"Cross-Site Scripting", + "Subcomponent":"Frontend user login", + "Affected":"8.7.20 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-008" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-007", + "Type":"Cross-Site Scripting", + "Subcomponent":"Backend modal component", + "Affected":"8.7.20 - 8.5.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-007" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-006", + "Type":"Cross-Site Scripting", + "Subcomponent":"Online media asset rendering", + "Affected":"8.7.20 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-006" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-005", + "Type":"Cross-Site Scripting", + "Subcomponent":"3rd party JavaScript library CKEditor", + "Affected":"8.7.20 - 8.5.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-005" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-004", + "Type":"Insecure Deserialization", + "Subcomponent":"Form Framework (ext:form)", + "Affected":"8.7.16 - 8.5.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-004" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-003", + "Type":"Privilege Escalation & SQL Injection", + "Subcomponent":"Form Framework (ext:form)", + "Affected":"8.7.16 - 8.5.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-003" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-002", + "Type":"Insecure Deserialization & Arbitrary Code Execution", + "Subcomponent":"TYPO3 CMS", + "Affected":"8.7.16 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-002" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-001", + "Type":"Authentication Bypass", + "Subcomponent":"Salted Passwords (ext:saltedpasswords)", + "Affected":"8.7.16 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-001" + }, + { + "Advisory":"TYPO3-CORE-SA-2017-007", + "Type":"Arbitrary Code Execution", + "Subcomponent":"TYPO3 CMS", + "Affected":"8.7.4 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2017-007" + }, + { + "Advisory":"TYPO3-CORE-SA-2017-005", + "Type":"Information Disclosure", + "Subcomponent":"TYPO3 CMS", + "Affected":"8.7.4 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2017-005" + }, + { + "Advisory":"TYPO3-CORE-SA-2017-006", + "Type":"Information Disclosure", + "Subcomponent":"TYPO3 CMS", + "Affected":"8.7.4 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2017-006" + }, + { + "Advisory":"TYPO3-CORE-SA-2017-004", + "Type":"Cross-Site Scripting", + "Subcomponent":"TYPO3 CMS", + "Affected":"8.7.4 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2017-004" + }, + { + "Advisory":"TYPO3-CORE-SA-2020-011", + "Type":"Sensitive Data Exposure", + "Subcomponent":"Session Storage (ext:core)", + "Affected":"8.7.37 - 8.7.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2020-011" + }, + { + "Advisory":"TYPO3-CORE-SA-2020-010", + "Type":"Cross-Site Scripting", + "Subcomponent":"Fluid (ext:fluid)", + "Affected":"8.7.37 - 8.7.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2020-010" + }, + { + "Advisory":"TYPO3-CORE-SA-2020-009", + "Type":"Cross-Site Scripting", + "Subcomponent":"Fluid Engine (package typo3fluid/fluid)", + "Affected":"8.7.37 - 8.7.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2020-009" + }, + { + "Advisory":"TYPO3-CORE-SA-2021-008", + "Type":"Cross-Site Scripting", + "Subcomponent":"Content Preview Renderer (ext:backend)", + "Affected":"8.7.39 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-008" + }, + { + "Advisory":"TYPO3-CORE-SA-2021-006", + "Type":"Sensitive Data Exposure", + "Subcomponent":"Session Storage (ext:core)", + "Affected":"8.7.39 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-006" + }, + { + "Advisory":"TYPO3-CORE-SA-2021-003", + "Type":"Broken Access Control", + "Subcomponent":"Form Framework (ext:form)", + "Affected":"8.7.39 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-003" + }, + { + "Advisory":"TYPO3-CORE-SA-2021-002", + "Type":"Unrestricted File Upload", + "Subcomponent":"Form Framework (ext:form)", + "Affected":"8.7.39 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-002" + }, + { + "Advisory":"TYPO3-CORE-SA-2021-001", + "Type":"Open Redirection", + "Subcomponent":"Login Handling (ext:core)", + "Affected":"8.7.39 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-001" + }, + { + "Advisory":"TYPO3-CORE-SA-2021-013", + "Type":"Cross-Site-Scripting", + "Subcomponent":"Content Rendering, HTML Parser (ext:frontend, ext:core)", + "Affected":"8.7.41 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-013" + }, + { + "Advisory":"TYPO3-CORE-SA-2021-012", + "Type":"Information Disclosure", + "Subcomponent":"User Authentication (ext:core)", + "Affected":"8.7.40 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-012" + }, + { + "Advisory":"TYPO3-CORE-SA-2021-011", + "Type":"Cross-Site Scripting", + "Subcomponent":"Backend Grid View (ext:backend)", + "Affected":"8.7.40 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-011" + }, + { + "Advisory":"TYPO3-CORE-SA-2021-010", + "Type":"Cross-Site Scripting", + "Subcomponent":"Query Generator & Query View (ext:lowlevel, ext:core)", + "Affected":"8.7.40 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-010" + } + ], + "Extensions":[ + { + "Name":"extbase", + "Title":"Log4Php", + "Repo":"https://extensions.typo3.org/extension/extbase", + "Current":"1.1.1 (alpha)", + "Url":"http://localhost:80/typo3/sysext/extbase/", + "Version":"unknown", + "Version File":"not found", + "Vulnerabilities":[ + + ] + }, + { + "Name":"feedit", + "Title":"Frontend Editing", + "Repo":"https://extensions.typo3.org/extension/feedit", + "Current":"10.0.2 (stable)", + "Url":"http://localhost:80/typo3/sysext/feedit/", + "Version":"unknown", + "Version File":"not found", + "Vulnerabilities":[ + + ] + }, + { + "Name":"func", + "Title":"WebFunc", + "Repo":"https://extensions.typo3.org/extension/func", + "Current":"9.0.1 (stable)", + "Url":"http://localhost:80/typo3/sysext/func/", + "Version":"unknown", + "Version File":"not found", + "Vulnerabilities":[ + + ] + }, + { + "Name":"rsaauth", + "Title":"RSA authentication for TYPO3", + "Repo":"https://extensions.typo3.org/extension/rsaauth", + "Current":"10.0.1 (deprecated)", + "Url":"http://localhost:80/typo3/sysext/rsaauth/", + "Version":"unknown", + "Version File":"not found", + "Vulnerabilities":[ + + ] + }, + { + "Name":"sys_action", + "Title":"UserTask Center, Actions", + "Repo":"https://extensions.typo3.org/extension/sys_action", + "Current":"10.0.0 (stable)", + "Url":"http://localhost:80/typo3/sysext/sys_action/", + "Version":"unknown", + "Version File":"not found", + "Vulnerabilities":[ + + ] + }, + { + "Name":"taskcenter", + "Title":"UserTask Center", + "Repo":"https://extensions.typo3.org/extension/taskcenter", + "Current":"10.0.0 (stable)", + "Url":"http://localhost:80/typo3/sysext/taskcenter/", + "Version":"unknown", + "Version File":"not found", + "Vulnerabilities":[ + + ] + }, + { + "Name":"tstemplate", + "Title":"WebTemplate", + "Repo":"https://extensions.typo3.org/extension/tstemplate", + "Current":"0.0.5 (stable)", + "Url":"http://localhost:80/typo3/sysext/tstemplate/", + "Version":"unknown", + "Version File":"not found", + "Vulnerabilities":[ + + ] + } + ] + } +} \ No newline at end of file diff --git a/scanners/typo3scan/parser/package-lock.json b/scanners/typo3scan/parser/package-lock.json new file mode 100644 index 0000000000..9d7e47cb35 --- /dev/null +++ b/scanners/typo3scan/parser/package-lock.json @@ -0,0 +1,8 @@ +{ + "name": "typo3scan-parser", + "version": "1.0.0", + "lockfileVersion": 1, + "requires": true, + "dependencies": { + } +} diff --git a/scanners/typo3scan/parser/parser.js b/scanners/typo3scan/parser/parser.js index c869a90a2f..7fef367a41 100644 --- a/scanners/typo3scan/parser/parser.js +++ b/scanners/typo3scan/parser/parser.js @@ -39,13 +39,19 @@ async function parse(fileContent) { // Parsing Extenstions let extensions = parsed_findings.Extensions let parsed_extensions = extensions.map((ext) => { + + // Check if extension has vulnerabilities : if yes severity = HIGH + let severity = 'INFORMATIONAL' + if ( ext.Vulnerabilities.length > 0) { + severity = 'HIGH' + } return { name: ext.Name, description: `Extension ${ext.Name} (${ext.Title}) found`, category: "Extension", location: ext.Url, osi_layer: "APPLICATION", - severity: "INFORMATIONAL", + severity: severity, attributes: { Typo3_Version: parsed_findings.Version, Repository: ext.Repo, @@ -59,5 +65,4 @@ async function parse(fileContent) { let results = parsed_vulnerabilities.concat(parsed_extensions) return results } - module.exports.parse = parse; \ No newline at end of file diff --git a/scanners/typo3scan/parser/parser.test.js b/scanners/typo3scan/parser/parser.test.js new file mode 100644 index 0000000000..d592dd4530 --- /dev/null +++ b/scanners/typo3scan/parser/parser.test.js @@ -0,0 +1,38 @@ +// SPDX-FileCopyrightText: 2021 iteratec GmbH +// +// SPDX-License-Identifier: Apache-2.0 + +const fs = require("fs"); +const util = require("util"); + +const readFile = util.promisify(fs.readFile); + +const { parse } = require("./parser"); + +const { + validateParser, +} = require("@securecodebox/parser-sdk-nodejs/parser-utils"); + +test("example parser parses empty json files to zero findings", async () => { + const fileContent = await readFile(__dirname + "/__testFiles__/empty.jsonl", { + encoding: "utf8", + }); + + const findings = await parse(fileContent); + await expect(validateParser(findings)).resolves.toBeUndefined(); + expect(findings).toEqual([]); +}); + +test("example parser parses large json result successfully", async () => { + const fileContent = await readFile( + __dirname + "/__testFiles__/localhost.jsonl", + { + encoding: "utf8", + } + ); + + const findings = await parse(fileContent); + await expect(validateParser(findings)).resolves.toBeUndefined(); + expect(findings).toMatchSnapshot(); + }); + // TODO how to run these tests locally ("npx jest parser.test.js" ?? ) \ No newline at end of file diff --git a/scanners/typo3scan/templates/NOTES.txt b/scanners/typo3scan/templates/NOTES.txt deleted file mode 100644 index 6973440292..0000000000 --- a/scanners/typo3scan/templates/NOTES.txt +++ /dev/null @@ -1,22 +0,0 @@ -1. Get the application URL by running these commands: -{{- if .Values.ingress.enabled }} -{{- range $host := .Values.ingress.hosts }} - {{- range .paths }} - http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }} - {{- end }} -{{- end }} -{{- else if contains "NodePort" .Values.service.type }} - export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "typo3scan.fullname" . }}) - export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") - echo http://$NODE_IP:$NODE_PORT -{{- else if contains "LoadBalancer" .Values.service.type }} - NOTE: It may take a few minutes for the LoadBalancer IP to be available. - You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "typo3scan.fullname" . }}' - export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "typo3scan.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}") - echo http://$SERVICE_IP:{{ .Values.service.port }} -{{- else if contains "ClusterIP" .Values.service.type }} - export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "typo3scan.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") - export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}") - echo "Visit http://127.0.0.1:8080 to use your application" - kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT -{{- end }} diff --git a/scanners/typo3scan/templates/_helpers.tpl b/scanners/typo3scan/templates/_helpers.tpl deleted file mode 100644 index 81cabd0fd6..0000000000 --- a/scanners/typo3scan/templates/_helpers.tpl +++ /dev/null @@ -1,62 +0,0 @@ -{{/* -Expand the name of the chart. -*/}} -{{- define "typo3scan.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} -{{- end }} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "typo3scan.fullname" -}} -{{- if .Values.fullnameOverride }} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} -{{- else }} -{{- $name := default .Chart.Name .Values.nameOverride }} -{{- if contains $name .Release.Name }} -{{- .Release.Name | trunc 63 | trimSuffix "-" }} -{{- else }} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} -{{- end }} -{{- end }} -{{- end }} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "typo3scan.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} -{{- end }} - -{{/* -Common labels -*/}} -{{- define "typo3scan.labels" -}} -helm.sh/chart: {{ include "typo3scan.chart" . }} -{{ include "typo3scan.selectorLabels" . }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end }} - -{{/* -Selector labels -*/}} -{{- define "typo3scan.selectorLabels" -}} -app.kubernetes.io/name: {{ include "typo3scan.name" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- end }} - -{{/* -Create the name of the service account to use -*/}} -{{- define "typo3scan.serviceAccountName" -}} -{{- if .Values.serviceAccount.create }} -{{- default (include "typo3scan.fullname" .) .Values.serviceAccount.name }} -{{- else }} -{{- default "default" .Values.serviceAccount.name }} -{{- end }} -{{- end }} diff --git a/scanners/typo3scan/templates/cascading-rules.yaml b/scanners/typo3scan/templates/cascading-rules.yaml new file mode 100644 index 0000000000..de24d1fc3d --- /dev/null +++ b/scanners/typo3scan/templates/cascading-rules.yaml @@ -0,0 +1,9 @@ +# We only want to import the default cascading rules if they are enabled +{{ if .Values.cascadingRules.enabled }} +{{ range $path, $_ := .Files.Glob "cascading-rules/*" }} +# Include File +{{ $.Files.Get $path }} +# Separate multiple files +--- +{{ end }} +{{ end }} \ No newline at end of file diff --git a/scanners/typo3scan/templates/deployment.yaml b/scanners/typo3scan/templates/deployment.yaml deleted file mode 100644 index fe31fa948d..0000000000 --- a/scanners/typo3scan/templates/deployment.yaml +++ /dev/null @@ -1,61 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ include "typo3scan.fullname" . }} - labels: - {{- include "typo3scan.labels" . | nindent 4 }} -spec: - {{- if not .Values.autoscaling.enabled }} - replicas: {{ .Values.replicaCount }} - {{- end }} - selector: - matchLabels: - {{- include "typo3scan.selectorLabels" . | nindent 6 }} - template: - metadata: - {{- with .Values.podAnnotations }} - annotations: - {{- toYaml . | nindent 8 }} - {{- end }} - labels: - {{- include "typo3scan.selectorLabels" . | nindent 8 }} - spec: - {{- with .Values.imagePullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - serviceAccountName: {{ include "typo3scan.serviceAccountName" . }} - securityContext: - {{- toYaml .Values.podSecurityContext | nindent 8 }} - containers: - - name: {{ .Chart.Name }} - securityContext: - {{- toYaml .Values.securityContext | nindent 12 }} - image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" - imagePullPolicy: {{ .Values.image.pullPolicy }} - ports: - - name: http - containerPort: 80 - protocol: TCP - livenessProbe: - httpGet: - path: / - port: http - readinessProbe: - httpGet: - path: / - port: http - resources: - {{- toYaml .Values.resources | nindent 12 }} - {{- with .Values.nodeSelector }} - nodeSelector: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.affinity }} - affinity: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.tolerations }} - tolerations: - {{- toYaml . | nindent 8 }} - {{- end }} diff --git a/scanners/typo3scan/templates/hpa.yaml b/scanners/typo3scan/templates/hpa.yaml deleted file mode 100644 index 0198434fe4..0000000000 --- a/scanners/typo3scan/templates/hpa.yaml +++ /dev/null @@ -1,28 +0,0 @@ -{{- if .Values.autoscaling.enabled }} -apiVersion: autoscaling/v2beta1 -kind: HorizontalPodAutoscaler -metadata: - name: {{ include "typo3scan.fullname" . }} - labels: - {{- include "typo3scan.labels" . | nindent 4 }} -spec: - scaleTargetRef: - apiVersion: apps/v1 - kind: Deployment - name: {{ include "typo3scan.fullname" . }} - minReplicas: {{ .Values.autoscaling.minReplicas }} - maxReplicas: {{ .Values.autoscaling.maxReplicas }} - metrics: - {{- if .Values.autoscaling.targetCPUUtilizationPercentage }} - - type: Resource - resource: - name: cpu - targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }} - {{- end }} - {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }} - - type: Resource - resource: - name: memory - targetAverageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }} - {{- end }} -{{- end }} diff --git a/scanners/typo3scan/templates/ingress.yaml b/scanners/typo3scan/templates/ingress.yaml deleted file mode 100644 index 07a78a1ffd..0000000000 --- a/scanners/typo3scan/templates/ingress.yaml +++ /dev/null @@ -1,61 +0,0 @@ -{{- if .Values.ingress.enabled -}} -{{- $fullName := include "typo3scan.fullname" . -}} -{{- $svcPort := .Values.service.port -}} -{{- if and .Values.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }} - {{- if not (hasKey .Values.ingress.annotations "kubernetes.io/ingress.class") }} - {{- $_ := set .Values.ingress.annotations "kubernetes.io/ingress.class" .Values.ingress.className}} - {{- end }} -{{- end }} -{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}} -apiVersion: networking.k8s.io/v1 -{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}} -apiVersion: networking.k8s.io/v1beta1 -{{- else -}} -apiVersion: extensions/v1beta1 -{{- end }} -kind: Ingress -metadata: - name: {{ $fullName }} - labels: - {{- include "typo3scan.labels" . | nindent 4 }} - {{- with .Values.ingress.annotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} -spec: - {{- if and .Values.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }} - ingressClassName: {{ .Values.ingress.className }} - {{- end }} - {{- if .Values.ingress.tls }} - tls: - {{- range .Values.ingress.tls }} - - hosts: - {{- range .hosts }} - - {{ . | quote }} - {{- end }} - secretName: {{ .secretName }} - {{- end }} - {{- end }} - rules: - {{- range .Values.ingress.hosts }} - - host: {{ .host | quote }} - http: - paths: - {{- range .paths }} - - path: {{ .path }} - {{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }} - pathType: {{ .pathType }} - {{- end }} - backend: - {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }} - service: - name: {{ $fullName }} - port: - number: {{ $svcPort }} - {{- else }} - serviceName: {{ $fullName }} - servicePort: {{ $svcPort }} - {{- end }} - {{- end }} - {{- end }} -{{- end }} diff --git a/scanners/typo3scan/templates/service.yaml b/scanners/typo3scan/templates/service.yaml deleted file mode 100644 index 3f6be05287..0000000000 --- a/scanners/typo3scan/templates/service.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: {{ include "typo3scan.fullname" . }} - labels: - {{- include "typo3scan.labels" . | nindent 4 }} -spec: - type: {{ .Values.service.type }} - ports: - - port: {{ .Values.service.port }} - targetPort: http - protocol: TCP - name: http - selector: - {{- include "typo3scan.selectorLabels" . | nindent 4 }} diff --git a/scanners/typo3scan/templates/serviceaccount.yaml b/scanners/typo3scan/templates/serviceaccount.yaml deleted file mode 100644 index 4f7443a1c8..0000000000 --- a/scanners/typo3scan/templates/serviceaccount.yaml +++ /dev/null @@ -1,12 +0,0 @@ -{{- if .Values.serviceAccount.create -}} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ include "typo3scan.serviceAccountName" . }} - labels: - {{- include "typo3scan.labels" . | nindent 4 }} - {{- with .Values.serviceAccount.annotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} -{{- end }} diff --git a/scanners/typo3scan/templates/tests/test-connection.yaml b/scanners/typo3scan/templates/tests/test-connection.yaml deleted file mode 100644 index 40fd70039c..0000000000 --- a/scanners/typo3scan/templates/tests/test-connection.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: v1 -kind: Pod -metadata: - name: "{{ include "typo3scan.fullname" . }}-test-connection" - labels: - {{- include "typo3scan.labels" . | nindent 4 }} - annotations: - "helm.sh/hook": test -spec: - containers: - - name: wget - image: busybox - command: ['wget'] - args: ['{{ include "typo3scan.fullname" . }}:{{ .Values.service.port }}'] - restartPolicy: Never diff --git a/scanners/typo3scan/templates/typ3scan-parse-definition.yaml b/scanners/typo3scan/templates/typ3scan-parse-definition.yaml new file mode 100644 index 0000000000..38f32230f4 --- /dev/null +++ b/scanners/typo3scan/templates/typ3scan-parse-definition.yaml @@ -0,0 +1,9 @@ +apiVersion: execution.securecodebox.io/v1 +kind: ParseDefinition +metadata: + name: zap-json +spec: + image: docker.io/securecodebox/parser-zap + imagePullSecrets: + - name: dockerhub-token + ttlSecondsAfterFinished: 60 \ No newline at end of file diff --git a/scanners/typo3scan/templates/typo3scan-scan-type.yaml b/scanners/typo3scan/templates/typo3scan-scan-type.yaml new file mode 100644 index 0000000000..3d2cd2a044 --- /dev/null +++ b/scanners/typo3scan/templates/typo3scan-scan-type.yaml @@ -0,0 +1,19 @@ +apiVersion: "execution.securecodebox.io/v1" +kind: ScanType +metadata: + name: "typo3scan" +spec: + extractResults: + type: typo3scan-json + location: "/home/securecodebox/typo3scan-results.json" + jobTemplate: + spec: + ttlSecondsAfterFinished: 10 + template: + spec: + restartPolicy: Never + containers: + - name: typo3scan + image: "{{ .Values.scanner.image.repository }}:{{ .Values.scanner.image.tag | default .Chart.AppVersion }}" + command: + - "typo3scan.py " # TODO : Wrapper.sh already calls this ? \ No newline at end of file From 8f5e828677ca92374730fde133ceeb711e56c187 Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Mon, 23 Aug 2021 13:38:27 +0200 Subject: [PATCH 05/42] added gitkeep to add docs folder --- scanners/typo3scan/docs/.gitkeep | 0 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 scanners/typo3scan/docs/.gitkeep diff --git a/scanners/typo3scan/docs/.gitkeep b/scanners/typo3scan/docs/.gitkeep new file mode 100644 index 0000000000..e69de29bb2 From 22b3a29a4e8f4169d51e1db8cc39e78d889d4487 Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Mon, 23 Aug 2021 16:05:55 +0200 Subject: [PATCH 06/42] Fixed parser.js and added unit tests --- .../parser/__snapshots__/parser.test.js.snap | 1713 +++++++++++++++++ scanners/typo3scan/parser/parser.js | 98 +- scanners/typo3scan/parser/parser.test.js | 44 +- 3 files changed, 1783 insertions(+), 72 deletions(-) create mode 100644 scanners/typo3scan/parser/__snapshots__/parser.test.js.snap diff --git a/scanners/typo3scan/parser/__snapshots__/parser.test.js.snap b/scanners/typo3scan/parser/__snapshots__/parser.test.js.snap new file mode 100644 index 0000000000..ac05510fe3 --- /dev/null +++ b/scanners/typo3scan/parser/__snapshots__/parser.test.js.snap @@ -0,0 +1,1713 @@ +// Jest Snapshot v1, https://goo.gl/fbAQLP + +exports[`example parser parses large json result successfully 1`] = ` +Array [ + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-026", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-026", + "subcomponent": "Query Generator & Query View (ext:lowlevel, ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.29 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Insecure Deserialization found", + "location": "http://localhost:80", + "name": "Insecure Deserialization", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-025", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-025", + "subcomponent": "Query Generator (ext:lowlevel)", + "typo3_version": "8.7", + "versions_affected": "8.7.29 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type SQL Injection found", + "location": "http://localhost:80", + "name": "SQL Injection", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-024", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-024", + "subcomponent": "Extension Manager (ext:extensionmanger)", + "typo3_version": "8.7", + "versions_affected": "8.7.29 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Directory Traversal found", + "location": "http://localhost:80", + "name": "Directory Traversal", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-023", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-023", + "subcomponent": "Filelist Module (ext:filelist)", + "typo3_version": "8.7", + "versions_affected": "8.7.29 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-022", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-022", + "subcomponent": "Link Handling (ext:core, ext:frontend)", + "typo3_version": "8.7", + "versions_affected": "8.7.29 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-021", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-021", + "subcomponent": "Form Framework (ext:form)", + "typo3_version": "8.7", + "versions_affected": "8.7.29 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-020", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-020", + "subcomponent": "Backend & Core API (ext:backend, ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.26 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Insecure Deserialization found", + "location": "http://localhost:80", + "name": "Insecure Deserialization", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-019", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-019", + "subcomponent": "Backend API (ext:backend)", + "typo3_version": "8.7", + "versions_affected": "8.7.26 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Arbitrary Code Execution, Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Arbitrary Code Execution, Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-018", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-018", + "subcomponent": "Frontend Session Handling (ext:frontend)", + "typo3_version": "8.7", + "versions_affected": "8.7.26 - 8.5.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Security Misconfiguration found", + "location": "http://localhost:80", + "name": "Security Misconfiguration", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-015", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-015", + "subcomponent": "Link Handling (ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.26 - 8.3.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-014", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-014", + "subcomponent": "Backend User Interface (ext:backend)", + "typo3_version": "8.7", + "versions_affected": "8.7.26 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Information Disclosure found", + "location": "http://localhost:80", + "name": "Information Disclosure", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-013", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-013", + "subcomponent": "Fluid Engine (package typo3fluid/fluid)", + "typo3_version": "8.7", + "versions_affected": "8.7.24 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-012", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-012", + "subcomponent": "Image Processing via ImageMagick (ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.24 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Arbitrary Code Execution found", + "location": "http://localhost:80", + "name": "Arbitrary Code Execution", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-011", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-011", + "subcomponent": "User Session Handling (ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.24 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Security Misconfiguration found", + "location": "http://localhost:80", + "name": "Security Misconfiguration", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-008", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-008", + "subcomponent": "File List (ext:filelist)", + "typo3_version": "8.7", + "versions_affected": "8.7.22 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Arbitrary Code Execution found", + "location": "http://localhost:80", + "name": "Arbitrary Code Execution", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-007", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-007", + "subcomponent": "Form Framework (ext:form)", + "typo3_version": "8.7", + "versions_affected": "8.7.22 - 8.5.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-006", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-006", + "subcomponent": "3rd party library Bootstrap CSS toolkit", + "typo3_version": "8.7", + "versions_affected": "8.7.22 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-005", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-005", + "subcomponent": "Fluid (ext:fluid)", + "typo3_version": "8.7", + "versions_affected": "8.7.22 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-003", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-003", + "subcomponent": "Localization Handling", + "typo3_version": "8.7", + "versions_affected": "8.7.22 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Broken Access Control found", + "location": "http://localhost:80", + "name": "Broken Access Control", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-002", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-002", + "subcomponent": "Backend User Account Model (ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.22 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Security Misconfiguration found", + "location": "http://localhost:80", + "name": "Security Misconfiguration", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-001", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-001", + "subcomponent": "RequireJS package configuration", + "typo3_version": "8.7", + "versions_affected": "8.7.22 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Information Disclosure found", + "location": "http://localhost:80", + "name": "Information Disclosure", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-012", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-012", + "subcomponent": "Frontend Session Handling", + "typo3_version": "8.7", + "versions_affected": "8.7.20 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Denial of Service found", + "location": "http://localhost:80", + "name": "Denial of Service", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-011", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-011", + "subcomponent": "Online media asset handling", + "typo3_version": "8.7", + "versions_affected": "8.7.20 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Denial of Service found", + "location": "http://localhost:80", + "name": "Denial of Service", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-010", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-010", + "subcomponent": "Install Tool", + "typo3_version": "8.7", + "versions_affected": "8.7.20 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Information Disclosure found", + "location": "http://localhost:80", + "name": "Information Disclosure", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-009", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-009", + "subcomponent": "Install Tool Session Handling", + "typo3_version": "8.7", + "versions_affected": "8.7.20 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Security Misconfiguration found", + "location": "http://localhost:80", + "name": "Security Misconfiguration", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-008", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-008", + "subcomponent": "Frontend user login", + "typo3_version": "8.7", + "versions_affected": "8.7.20 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-007", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-007", + "subcomponent": "Backend modal component", + "typo3_version": "8.7", + "versions_affected": "8.7.20 - 8.5.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-006", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-006", + "subcomponent": "Online media asset rendering", + "typo3_version": "8.7", + "versions_affected": "8.7.20 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-005", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-005", + "subcomponent": "3rd party JavaScript library CKEditor", + "typo3_version": "8.7", + "versions_affected": "8.7.20 - 8.5.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-004", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-004", + "subcomponent": "Form Framework (ext:form)", + "typo3_version": "8.7", + "versions_affected": "8.7.16 - 8.5.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Insecure Deserialization found", + "location": "http://localhost:80", + "name": "Insecure Deserialization", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-003", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-003", + "subcomponent": "Form Framework (ext:form)", + "typo3_version": "8.7", + "versions_affected": "8.7.16 - 8.5.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Privilege Escalation & SQL Injection found", + "location": "http://localhost:80", + "name": "Privilege Escalation & SQL Injection", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-002", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-002", + "subcomponent": "TYPO3 CMS", + "typo3_version": "8.7", + "versions_affected": "8.7.16 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Insecure Deserialization & Arbitrary Code Execution found", + "location": "http://localhost:80", + "name": "Insecure Deserialization & Arbitrary Code Execution", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-001", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-001", + "subcomponent": "Salted Passwords (ext:saltedpasswords)", + "typo3_version": "8.7", + "versions_affected": "8.7.16 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Authentication Bypass found", + "location": "http://localhost:80", + "name": "Authentication Bypass", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2017-007", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2017-007", + "subcomponent": "TYPO3 CMS", + "typo3_version": "8.7", + "versions_affected": "8.7.4 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Arbitrary Code Execution found", + "location": "http://localhost:80", + "name": "Arbitrary Code Execution", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2017-005", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2017-005", + "subcomponent": "TYPO3 CMS", + "typo3_version": "8.7", + "versions_affected": "8.7.4 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Information Disclosure found", + "location": "http://localhost:80", + "name": "Information Disclosure", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2017-006", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2017-006", + "subcomponent": "TYPO3 CMS", + "typo3_version": "8.7", + "versions_affected": "8.7.4 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Information Disclosure found", + "location": "http://localhost:80", + "name": "Information Disclosure", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2017-004", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2017-004", + "subcomponent": "TYPO3 CMS", + "typo3_version": "8.7", + "versions_affected": "8.7.4 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2020-011", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2020-011", + "subcomponent": "Session Storage (ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.37 - 8.7.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Sensitive Data Exposure found", + "location": "http://localhost:80", + "name": "Sensitive Data Exposure", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2020-010", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2020-010", + "subcomponent": "Fluid (ext:fluid)", + "typo3_version": "8.7", + "versions_affected": "8.7.37 - 8.7.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2020-009", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2020-009", + "subcomponent": "Fluid Engine (package typo3fluid/fluid)", + "typo3_version": "8.7", + "versions_affected": "8.7.37 - 8.7.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2021-008", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-008", + "subcomponent": "Content Preview Renderer (ext:backend)", + "typo3_version": "8.7", + "versions_affected": "8.7.39 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2021-006", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-006", + "subcomponent": "Session Storage (ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.39 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Sensitive Data Exposure found", + "location": "http://localhost:80", + "name": "Sensitive Data Exposure", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2021-003", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-003", + "subcomponent": "Form Framework (ext:form)", + "typo3_version": "8.7", + "versions_affected": "8.7.39 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Broken Access Control found", + "location": "http://localhost:80", + "name": "Broken Access Control", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2021-002", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-002", + "subcomponent": "Form Framework (ext:form)", + "typo3_version": "8.7", + "versions_affected": "8.7.39 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Unrestricted File Upload found", + "location": "http://localhost:80", + "name": "Unrestricted File Upload", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2021-001", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-001", + "subcomponent": "Login Handling (ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.39 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Open Redirection found", + "location": "http://localhost:80", + "name": "Open Redirection", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2021-013", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-013", + "subcomponent": "Content Rendering, HTML Parser (ext:frontend, ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.41 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site-Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site-Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2021-012", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-012", + "subcomponent": "User Authentication (ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.40 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Information Disclosure found", + "location": "http://localhost:80", + "name": "Information Disclosure", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2021-011", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-011", + "subcomponent": "Backend Grid View (ext:backend)", + "typo3_version": "8.7", + "versions_affected": "8.7.40 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2021-010", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-010", + "subcomponent": "Query Generator & Query View (ext:lowlevel, ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.40 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "extension_Version": "unknown", + "repository": "https://extensions.typo3.org/extension/extbase", + "typo3_version": "8.7", + "version_file": "not found", + "vulnerabilities": Array [], + }, + "category": "Extension", + "description": "Extension extbase (Log4Php) found", + "location": "http://localhost:80/typo3/sysext/extbase/", + "name": "extbase", + "osi_layer": "APPLICATION", + "severity": "INFORMATIONAL", + }, + Object { + "attributes": Object { + "extension_Version": "unknown", + "repository": "https://extensions.typo3.org/extension/feedit", + "typo3_version": "8.7", + "version_file": "not found", + "vulnerabilities": Array [], + }, + "category": "Extension", + "description": "Extension feedit (Frontend Editing) found", + "location": "http://localhost:80/typo3/sysext/feedit/", + "name": "feedit", + "osi_layer": "APPLICATION", + "severity": "INFORMATIONAL", + }, + Object { + "attributes": Object { + "extension_Version": "unknown", + "repository": "https://extensions.typo3.org/extension/func", + "typo3_version": "8.7", + "version_file": "not found", + "vulnerabilities": Array [], + }, + "category": "Extension", + "description": "Extension func (WebFunc) found", + "location": "http://localhost:80/typo3/sysext/func/", + "name": "func", + "osi_layer": "APPLICATION", + "severity": "INFORMATIONAL", + }, + Object { + "attributes": Object { + "extension_Version": "unknown", + "repository": "https://extensions.typo3.org/extension/rsaauth", + "typo3_version": "8.7", + "version_file": "not found", + "vulnerabilities": Array [], + }, + "category": "Extension", + "description": "Extension rsaauth (RSA authentication for TYPO3) found", + "location": "http://localhost:80/typo3/sysext/rsaauth/", + "name": "rsaauth", + "osi_layer": "APPLICATION", + "severity": "INFORMATIONAL", + }, + Object { + "attributes": Object { + "extension_Version": "unknown", + "repository": "https://extensions.typo3.org/extension/sys_action", + "typo3_version": "8.7", + "version_file": "not found", + "vulnerabilities": Array [], + }, + "category": "Extension", + "description": "Extension sys_action (UserTask Center, Actions) found", + "location": "http://localhost:80/typo3/sysext/sys_action/", + "name": "sys_action", + "osi_layer": "APPLICATION", + "severity": "INFORMATIONAL", + }, + Object { + "attributes": Object { + "extension_Version": "unknown", + "repository": "https://extensions.typo3.org/extension/taskcenter", + "typo3_version": "8.7", + "version_file": "not found", + "vulnerabilities": Array [], + }, + "category": "Extension", + "description": "Extension taskcenter (UserTask Center) found", + "location": "http://localhost:80/typo3/sysext/taskcenter/", + "name": "taskcenter", + "osi_layer": "APPLICATION", + "severity": "INFORMATIONAL", + }, + Object { + "attributes": Object { + "extension_Version": "unknown", + "repository": "https://extensions.typo3.org/extension/tstemplate", + "typo3_version": "8.7", + "version_file": "not found", + "vulnerabilities": Array [], + }, + "category": "Extension", + "description": "Extension tstemplate (WebTemplate) found", + "location": "http://localhost:80/typo3/sysext/tstemplate/", + "name": "tstemplate", + "osi_layer": "APPLICATION", + "severity": "INFORMATIONAL", + }, +] +`; + +exports[`example parser parses large json result successfully 2`] = ` +Array [ + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-026", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-026", + "subcomponent": "Query Generator & Query View (ext:lowlevel, ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.29 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Insecure Deserialization found", + "location": "http://localhost:80", + "name": "Insecure Deserialization", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-025", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-025", + "subcomponent": "Query Generator (ext:lowlevel)", + "typo3_version": "8.7", + "versions_affected": "8.7.29 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type SQL Injection found", + "location": "http://localhost:80", + "name": "SQL Injection", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-024", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-024", + "subcomponent": "Extension Manager (ext:extensionmanger)", + "typo3_version": "8.7", + "versions_affected": "8.7.29 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Directory Traversal found", + "location": "http://localhost:80", + "name": "Directory Traversal", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-023", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-023", + "subcomponent": "Filelist Module (ext:filelist)", + "typo3_version": "8.7", + "versions_affected": "8.7.29 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-022", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-022", + "subcomponent": "Link Handling (ext:core, ext:frontend)", + "typo3_version": "8.7", + "versions_affected": "8.7.29 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-021", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-021", + "subcomponent": "Form Framework (ext:form)", + "typo3_version": "8.7", + "versions_affected": "8.7.29 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-020", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-020", + "subcomponent": "Backend & Core API (ext:backend, ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.26 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Insecure Deserialization found", + "location": "http://localhost:80", + "name": "Insecure Deserialization", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-019", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-019", + "subcomponent": "Backend API (ext:backend)", + "typo3_version": "8.7", + "versions_affected": "8.7.26 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Arbitrary Code Execution, Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Arbitrary Code Execution, Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-018", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-018", + "subcomponent": "Frontend Session Handling (ext:frontend)", + "typo3_version": "8.7", + "versions_affected": "8.7.26 - 8.5.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Security Misconfiguration found", + "location": "http://localhost:80", + "name": "Security Misconfiguration", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-015", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-015", + "subcomponent": "Link Handling (ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.26 - 8.3.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-014", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-014", + "subcomponent": "Backend User Interface (ext:backend)", + "typo3_version": "8.7", + "versions_affected": "8.7.26 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Information Disclosure found", + "location": "http://localhost:80", + "name": "Information Disclosure", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-013", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-013", + "subcomponent": "Fluid Engine (package typo3fluid/fluid)", + "typo3_version": "8.7", + "versions_affected": "8.7.24 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-012", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-012", + "subcomponent": "Image Processing via ImageMagick (ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.24 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Arbitrary Code Execution found", + "location": "http://localhost:80", + "name": "Arbitrary Code Execution", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-011", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-011", + "subcomponent": "User Session Handling (ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.24 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Security Misconfiguration found", + "location": "http://localhost:80", + "name": "Security Misconfiguration", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-008", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-008", + "subcomponent": "File List (ext:filelist)", + "typo3_version": "8.7", + "versions_affected": "8.7.22 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Arbitrary Code Execution found", + "location": "http://localhost:80", + "name": "Arbitrary Code Execution", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-007", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-007", + "subcomponent": "Form Framework (ext:form)", + "typo3_version": "8.7", + "versions_affected": "8.7.22 - 8.5.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-006", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-006", + "subcomponent": "3rd party library Bootstrap CSS toolkit", + "typo3_version": "8.7", + "versions_affected": "8.7.22 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-005", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-005", + "subcomponent": "Fluid (ext:fluid)", + "typo3_version": "8.7", + "versions_affected": "8.7.22 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-003", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-003", + "subcomponent": "Localization Handling", + "typo3_version": "8.7", + "versions_affected": "8.7.22 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Broken Access Control found", + "location": "http://localhost:80", + "name": "Broken Access Control", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-002", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-002", + "subcomponent": "Backend User Account Model (ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.22 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Security Misconfiguration found", + "location": "http://localhost:80", + "name": "Security Misconfiguration", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-001", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-001", + "subcomponent": "RequireJS package configuration", + "typo3_version": "8.7", + "versions_affected": "8.7.22 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Information Disclosure found", + "location": "http://localhost:80", + "name": "Information Disclosure", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-012", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-012", + "subcomponent": "Frontend Session Handling", + "typo3_version": "8.7", + "versions_affected": "8.7.20 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Denial of Service found", + "location": "http://localhost:80", + "name": "Denial of Service", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-011", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-011", + "subcomponent": "Online media asset handling", + "typo3_version": "8.7", + "versions_affected": "8.7.20 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Denial of Service found", + "location": "http://localhost:80", + "name": "Denial of Service", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-010", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-010", + "subcomponent": "Install Tool", + "typo3_version": "8.7", + "versions_affected": "8.7.20 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Information Disclosure found", + "location": "http://localhost:80", + "name": "Information Disclosure", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-009", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-009", + "subcomponent": "Install Tool Session Handling", + "typo3_version": "8.7", + "versions_affected": "8.7.20 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Security Misconfiguration found", + "location": "http://localhost:80", + "name": "Security Misconfiguration", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-008", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-008", + "subcomponent": "Frontend user login", + "typo3_version": "8.7", + "versions_affected": "8.7.20 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-007", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-007", + "subcomponent": "Backend modal component", + "typo3_version": "8.7", + "versions_affected": "8.7.20 - 8.5.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-006", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-006", + "subcomponent": "Online media asset rendering", + "typo3_version": "8.7", + "versions_affected": "8.7.20 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-005", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-005", + "subcomponent": "3rd party JavaScript library CKEditor", + "typo3_version": "8.7", + "versions_affected": "8.7.20 - 8.5.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-004", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-004", + "subcomponent": "Form Framework (ext:form)", + "typo3_version": "8.7", + "versions_affected": "8.7.16 - 8.5.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Insecure Deserialization found", + "location": "http://localhost:80", + "name": "Insecure Deserialization", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-003", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-003", + "subcomponent": "Form Framework (ext:form)", + "typo3_version": "8.7", + "versions_affected": "8.7.16 - 8.5.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Privilege Escalation & SQL Injection found", + "location": "http://localhost:80", + "name": "Privilege Escalation & SQL Injection", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-002", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-002", + "subcomponent": "TYPO3 CMS", + "typo3_version": "8.7", + "versions_affected": "8.7.16 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Insecure Deserialization & Arbitrary Code Execution found", + "location": "http://localhost:80", + "name": "Insecure Deserialization & Arbitrary Code Execution", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-001", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-001", + "subcomponent": "Salted Passwords (ext:saltedpasswords)", + "typo3_version": "8.7", + "versions_affected": "8.7.16 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Authentication Bypass found", + "location": "http://localhost:80", + "name": "Authentication Bypass", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2017-007", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2017-007", + "subcomponent": "TYPO3 CMS", + "typo3_version": "8.7", + "versions_affected": "8.7.4 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Arbitrary Code Execution found", + "location": "http://localhost:80", + "name": "Arbitrary Code Execution", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2017-005", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2017-005", + "subcomponent": "TYPO3 CMS", + "typo3_version": "8.7", + "versions_affected": "8.7.4 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Information Disclosure found", + "location": "http://localhost:80", + "name": "Information Disclosure", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2017-006", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2017-006", + "subcomponent": "TYPO3 CMS", + "typo3_version": "8.7", + "versions_affected": "8.7.4 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Information Disclosure found", + "location": "http://localhost:80", + "name": "Information Disclosure", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2017-004", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2017-004", + "subcomponent": "TYPO3 CMS", + "typo3_version": "8.7", + "versions_affected": "8.7.4 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2020-011", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2020-011", + "subcomponent": "Session Storage (ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.37 - 8.7.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Sensitive Data Exposure found", + "location": "http://localhost:80", + "name": "Sensitive Data Exposure", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2020-010", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2020-010", + "subcomponent": "Fluid (ext:fluid)", + "typo3_version": "8.7", + "versions_affected": "8.7.37 - 8.7.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2020-009", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2020-009", + "subcomponent": "Fluid Engine (package typo3fluid/fluid)", + "typo3_version": "8.7", + "versions_affected": "8.7.37 - 8.7.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2021-008", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-008", + "subcomponent": "Content Preview Renderer (ext:backend)", + "typo3_version": "8.7", + "versions_affected": "8.7.39 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2021-006", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-006", + "subcomponent": "Session Storage (ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.39 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Sensitive Data Exposure found", + "location": "http://localhost:80", + "name": "Sensitive Data Exposure", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2021-003", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-003", + "subcomponent": "Form Framework (ext:form)", + "typo3_version": "8.7", + "versions_affected": "8.7.39 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Broken Access Control found", + "location": "http://localhost:80", + "name": "Broken Access Control", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2021-002", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-002", + "subcomponent": "Form Framework (ext:form)", + "typo3_version": "8.7", + "versions_affected": "8.7.39 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Unrestricted File Upload found", + "location": "http://localhost:80", + "name": "Unrestricted File Upload", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2021-001", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-001", + "subcomponent": "Login Handling (ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.39 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Open Redirection found", + "location": "http://localhost:80", + "name": "Open Redirection", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2021-013", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-013", + "subcomponent": "Content Rendering, HTML Parser (ext:frontend, ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.41 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site-Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site-Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2021-012", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-012", + "subcomponent": "User Authentication (ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.40 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Information Disclosure found", + "location": "http://localhost:80", + "name": "Information Disclosure", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2021-011", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-011", + "subcomponent": "Backend Grid View (ext:backend)", + "typo3_version": "8.7", + "versions_affected": "8.7.40 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2021-010", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-010", + "subcomponent": "Query Generator & Query View (ext:lowlevel, ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.40 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "extension_Version": "unknown", + "repository": "https://extensions.typo3.org/extension/extbase", + "typo3_version": "8.7", + "version_file": "not found", + "vulnerabilities": Array [], + }, + "category": "Extension", + "description": "Extension extbase (Log4Php) found", + "location": "http://localhost:80/typo3/sysext/extbase/", + "name": "extbase", + "osi_layer": "APPLICATION", + "severity": "INFORMATIONAL", + }, + Object { + "attributes": Object { + "extension_Version": "unknown", + "repository": "https://extensions.typo3.org/extension/feedit", + "typo3_version": "8.7", + "version_file": "not found", + "vulnerabilities": Array [], + }, + "category": "Extension", + "description": "Extension feedit (Frontend Editing) found", + "location": "http://localhost:80/typo3/sysext/feedit/", + "name": "feedit", + "osi_layer": "APPLICATION", + "severity": "INFORMATIONAL", + }, + Object { + "attributes": Object { + "extension_Version": "unknown", + "repository": "https://extensions.typo3.org/extension/func", + "typo3_version": "8.7", + "version_file": "not found", + "vulnerabilities": Array [], + }, + "category": "Extension", + "description": "Extension func (WebFunc) found", + "location": "http://localhost:80/typo3/sysext/func/", + "name": "func", + "osi_layer": "APPLICATION", + "severity": "INFORMATIONAL", + }, + Object { + "attributes": Object { + "extension_Version": "unknown", + "repository": "https://extensions.typo3.org/extension/rsaauth", + "typo3_version": "8.7", + "version_file": "not found", + "vulnerabilities": Array [], + }, + "category": "Extension", + "description": "Extension rsaauth (RSA authentication for TYPO3) found", + "location": "http://localhost:80/typo3/sysext/rsaauth/", + "name": "rsaauth", + "osi_layer": "APPLICATION", + "severity": "INFORMATIONAL", + }, + Object { + "attributes": Object { + "extension_Version": "unknown", + "repository": "https://extensions.typo3.org/extension/sys_action", + "typo3_version": "8.7", + "version_file": "not found", + "vulnerabilities": Array [], + }, + "category": "Extension", + "description": "Extension sys_action (UserTask Center, Actions) found", + "location": "http://localhost:80/typo3/sysext/sys_action/", + "name": "sys_action", + "osi_layer": "APPLICATION", + "severity": "INFORMATIONAL", + }, + Object { + "attributes": Object { + "extension_Version": "unknown", + "repository": "https://extensions.typo3.org/extension/taskcenter", + "typo3_version": "8.7", + "version_file": "not found", + "vulnerabilities": Array [], + }, + "category": "Extension", + "description": "Extension taskcenter (UserTask Center) found", + "location": "http://localhost:80/typo3/sysext/taskcenter/", + "name": "taskcenter", + "osi_layer": "APPLICATION", + "severity": "INFORMATIONAL", + }, + Object { + "attributes": Object { + "extension_Version": "unknown", + "repository": "https://extensions.typo3.org/extension/tstemplate", + "typo3_version": "8.7", + "version_file": "not found", + "vulnerabilities": Array [ + Object { + "Current": "stable", + "Name": "news", + "Repo": "https://extensions.typo3.org/extension/news", + "Title": "News system", + "Url": "http://localhost:80/typo3/sysext/news/", + "Version": "3.1.0", + "Version File": "http://localhost:80/typo3conf/ext/news/Documentation/Settings.yml", + "Vulnerabilities": Array [ + Object { + "Advisory": "TYPO3-EXT-SA-2017-001", + "Affected": "3.2.6 - 0.0.0", + "Vulnerability Type": "SQL Injection", + }, + Object { + "Advisory": "TYPO3-EXT-SA-2015-017", + "Affected": "3.2.1 - 0.0.0", + "Vulnerability Type": "Cross-Site Scripting", + }, + ], + }, + ], + }, + "category": "Extension", + "description": "Extension tstemplate (WebTemplate) found", + "location": "http://localhost:80/typo3/sysext/tstemplate/", + "name": "tstemplate", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, +] +`; diff --git a/scanners/typo3scan/parser/parser.js b/scanners/typo3scan/parser/parser.js index 7fef367a41..96ad79a7d1 100644 --- a/scanners/typo3scan/parser/parser.js +++ b/scanners/typo3scan/parser/parser.js @@ -4,65 +4,61 @@ async function parse(fileContent) { let findings = JSON.parse(fileContent) + let results = '' - if (typeof fileContent === "string") { - findings = fileContent - .split("\n") - .map((vulnJson) => JSON.parse(vulnJson)); - } - findings = findings[0] // Trimming the begining of the JS Object - let domain = Object.keys(findings)[0]; // Getting the first key (and the only key) + Object.keys(findings).forEach(key => { + let domain = key; + let domain_findings = findings[domain] + let vulns = domain_findings.Vulnerabilities - let parsed_findings = findings[domain] + // Parsing Vulnerabilities + let parsed_vulnerabilities = vulns.map((vuln) => { + return { + name: vuln.Type, + description: `Vulnerability of type ${vuln.Type} found`, + category: "Vulnerability", + location: domain, + osi_layer: "APPLICATION", + severity: "HIGH", + attributes: { + typo3_version: domain_findings.Version, + advisory: vuln.Advisory, + subcomponent: vuln.Subcomponent, + versions_affected: vuln.Affected, + advisory_url: vuln['Advisory URL'], - // Parsing Vulnerabilities - let vulns = parsed_findings.Vulnerabilities - let parsed_vulnerabilities = vulns.map((vuln) => { - return { - name: vuln.Type, - description: `Vulnerability of type ${vuln.Type} found`, - category: "Vulnerability", - location: domain, - osi_layer: "APPLICATION", - severity: "HIGH", - attributes: { - Typo3_Version: parsed_findings.Version, - Advisory: vuln.Advisory, - Subcomponent: vuln.Subcomponent, - Versions_affected: vuln.Affected, - Advisory_URL: vuln['Advisory URL'], + } + }; + }); + // Parsing Extenstions + let extensions = domain_findings.Extensions + let parsed_extensions = extensions.map((ext) => { + // Check if extension has vulnerabilities : if yes severity = HIGH + let severity = 'INFORMATIONAL' + if (ext.Vulnerabilities.length > 0) { + severity = 'HIGH' } - }; - }); + return { + name: ext.Name, + description: `Extension ${ext.Name} (${ext.Title}) found`, + category: "Extension", + location: ext.Url, + osi_layer: "APPLICATION", + severity: severity, + attributes: { + typo3_version: domain_findings.Version, + repository: ext.Repo, + extension_Version: ext.Version, + version_file: ext['Version File'], + vulnerabilities: ext.Vulnerabilities + } + }; + }); - // Parsing Extenstions - let extensions = parsed_findings.Extensions - let parsed_extensions = extensions.map((ext) => { + results = parsed_vulnerabilities.concat(parsed_extensions) - // Check if extension has vulnerabilities : if yes severity = HIGH - let severity = 'INFORMATIONAL' - if ( ext.Vulnerabilities.length > 0) { - severity = 'HIGH' - } - return { - name: ext.Name, - description: `Extension ${ext.Name} (${ext.Title}) found`, - category: "Extension", - location: ext.Url, - osi_layer: "APPLICATION", - severity: severity, - attributes: { - Typo3_Version: parsed_findings.Version, - Repository: ext.Repo, - Extension_Version: ext.Version, - Version_File: ext['Version File'], - Vulnerabilities: ext.Vulnerabilities - } - }; }); - - let results = parsed_vulnerabilities.concat(parsed_extensions) return results } module.exports.parse = parse; \ No newline at end of file diff --git a/scanners/typo3scan/parser/parser.test.js b/scanners/typo3scan/parser/parser.test.js index d592dd4530..14aadc97f9 100644 --- a/scanners/typo3scan/parser/parser.test.js +++ b/scanners/typo3scan/parser/parser.test.js @@ -10,29 +10,31 @@ const readFile = util.promisify(fs.readFile); const { parse } = require("./parser"); const { - validateParser, + validateParser, } = require("@securecodebox/parser-sdk-nodejs/parser-utils"); -test("example parser parses empty json files to zero findings", async () => { - const fileContent = await readFile(__dirname + "/__testFiles__/empty.jsonl", { - encoding: "utf8", - }); +test("parser parses large json result without vulnuerable extensions successfully", async () => { + const fileContent = await readFile( + __dirname + "/__testFiles__/localhost.json", + { + encoding: "utf8", + } + ); - const findings = await parse(fileContent); - await expect(validateParser(findings)).resolves.toBeUndefined(); - expect(findings).toEqual([]); + const findings = await parse(fileContent); + await expect(validateParser(findings)).resolves.toBeUndefined(); + expect(findings).toMatchSnapshot(); }); -test("example parser parses large json result successfully", async () => { - const fileContent = await readFile( - __dirname + "/__testFiles__/localhost.jsonl", - { - encoding: "utf8", - } - ); - - const findings = await parse(fileContent); - await expect(validateParser(findings)).resolves.toBeUndefined(); - expect(findings).toMatchSnapshot(); - }); - // TODO how to run these tests locally ("npx jest parser.test.js" ?? ) \ No newline at end of file +test("parser parses large json result with vulnuerable extensions successfully", async () => { + const fileContent = await readFile( + __dirname + "/__testFiles__/localhost_vuln_extensions.json", + { + encoding: "utf8", + } + ); + + const findings = await parse(fileContent); + await expect(validateParser(findings)).resolves.toBeUndefined(); + expect(findings).toMatchSnapshot(); +}); \ No newline at end of file From 35ee92e9a58d0fd00deb40be79335a6c6f35e90d Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Mon, 23 Aug 2021 16:07:30 +0200 Subject: [PATCH 07/42] Added example scan output --- .../parser/__testFiles__/empty.jsonl | 0 .../{localhost.jsonl => localhost.json} | 0 .../localhost_vuln_extensions.json | 457 ++++++++++++++++++ 3 files changed, 457 insertions(+) delete mode 100644 scanners/typo3scan/parser/__testFiles__/empty.jsonl rename scanners/typo3scan/parser/__testFiles__/{localhost.jsonl => localhost.json} (100%) create mode 100644 scanners/typo3scan/parser/__testFiles__/localhost_vuln_extensions.json diff --git a/scanners/typo3scan/parser/__testFiles__/empty.jsonl b/scanners/typo3scan/parser/__testFiles__/empty.jsonl deleted file mode 100644 index e69de29bb2..0000000000 diff --git a/scanners/typo3scan/parser/__testFiles__/localhost.jsonl b/scanners/typo3scan/parser/__testFiles__/localhost.json similarity index 100% rename from scanners/typo3scan/parser/__testFiles__/localhost.jsonl rename to scanners/typo3scan/parser/__testFiles__/localhost.json diff --git a/scanners/typo3scan/parser/__testFiles__/localhost_vuln_extensions.json b/scanners/typo3scan/parser/__testFiles__/localhost_vuln_extensions.json new file mode 100644 index 0000000000..003a8448d1 --- /dev/null +++ b/scanners/typo3scan/parser/__testFiles__/localhost_vuln_extensions.json @@ -0,0 +1,457 @@ +{ + "http://localhost:80":{ + "Backend":"http://localhost:80/typo3/index.php", + "Version":"8.7", + "Vulnerabilities":[ + { + "Advisory":"TYPO3-CORE-SA-2019-026", + "Type":"Insecure Deserialization", + "Subcomponent":"Query Generator & Query View (ext:lowlevel, ext:core)", + "Affected":"8.7.29 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-026" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-025", + "Type":"SQL Injection", + "Subcomponent":"Query Generator (ext:lowlevel)", + "Affected":"8.7.29 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-025" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-024", + "Type":"Directory Traversal", + "Subcomponent":"Extension Manager (ext:extensionmanger)", + "Affected":"8.7.29 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-024" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-023", + "Type":"Cross-Site Scripting", + "Subcomponent":"Filelist Module (ext:filelist)", + "Affected":"8.7.29 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-023" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-022", + "Type":"Cross-Site Scripting", + "Subcomponent":"Link Handling (ext:core, ext:frontend)", + "Affected":"8.7.29 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-022" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-021", + "Type":"Cross-Site Scripting", + "Subcomponent":"Form Framework (ext:form)", + "Affected":"8.7.29 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-021" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-020", + "Type":"Insecure Deserialization", + "Subcomponent":"Backend & Core API (ext:backend, ext:core)", + "Affected":"8.7.26 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-020" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-019", + "Type":"Arbitrary Code Execution, Cross-Site Scripting", + "Subcomponent":"Backend API (ext:backend)", + "Affected":"8.7.26 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-019" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-018", + "Type":"Security Misconfiguration", + "Subcomponent":"Frontend Session Handling (ext:frontend)", + "Affected":"8.7.26 - 8.5.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-018" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-015", + "Type":"Cross-Site Scripting", + "Subcomponent":"Link Handling (ext:core)", + "Affected":"8.7.26 - 8.3.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-015" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-014", + "Type":"Information Disclosure", + "Subcomponent":"Backend User Interface (ext:backend)", + "Affected":"8.7.26 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-014" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-013", + "Type":"Cross-Site Scripting", + "Subcomponent":"Fluid Engine (package typo3fluid/fluid)", + "Affected":"8.7.24 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-013" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-012", + "Type":"Arbitrary Code Execution", + "Subcomponent":"Image Processing via ImageMagick (ext:core)", + "Affected":"8.7.24 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-012" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-011", + "Type":"Security Misconfiguration", + "Subcomponent":"User Session Handling (ext:core)", + "Affected":"8.7.24 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-011" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-008", + "Type":"Arbitrary Code Execution", + "Subcomponent":"File List (ext:filelist)", + "Affected":"8.7.22 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-008" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-007", + "Type":"Cross-Site Scripting", + "Subcomponent":"Form Framework (ext:form)", + "Affected":"8.7.22 - 8.5.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-007" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-006", + "Type":"Cross-Site Scripting", + "Subcomponent":"3rd party library Bootstrap CSS toolkit", + "Affected":"8.7.22 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-006" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-005", + "Type":"Cross-Site Scripting", + "Subcomponent":"Fluid (ext:fluid)", + "Affected":"8.7.22 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-005" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-003", + "Type":"Broken Access Control", + "Subcomponent":"Localization Handling", + "Affected":"8.7.22 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-003" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-002", + "Type":"Security Misconfiguration", + "Subcomponent":"Backend User Account Model (ext:core)", + "Affected":"8.7.22 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-002" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-001", + "Type":"Information Disclosure", + "Subcomponent":"RequireJS package configuration", + "Affected":"8.7.22 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-001" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-012", + "Type":"Denial of Service", + "Subcomponent":"Frontend Session Handling", + "Affected":"8.7.20 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-012" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-011", + "Type":"Denial of Service", + "Subcomponent":"Online media asset handling", + "Affected":"8.7.20 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-011" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-010", + "Type":"Information Disclosure", + "Subcomponent":"Install Tool", + "Affected":"8.7.20 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-010" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-009", + "Type":"Security Misconfiguration", + "Subcomponent":"Install Tool Session Handling", + "Affected":"8.7.20 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-009" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-008", + "Type":"Cross-Site Scripting", + "Subcomponent":"Frontend user login", + "Affected":"8.7.20 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-008" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-007", + "Type":"Cross-Site Scripting", + "Subcomponent":"Backend modal component", + "Affected":"8.7.20 - 8.5.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-007" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-006", + "Type":"Cross-Site Scripting", + "Subcomponent":"Online media asset rendering", + "Affected":"8.7.20 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-006" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-005", + "Type":"Cross-Site Scripting", + "Subcomponent":"3rd party JavaScript library CKEditor", + "Affected":"8.7.20 - 8.5.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-005" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-004", + "Type":"Insecure Deserialization", + "Subcomponent":"Form Framework (ext:form)", + "Affected":"8.7.16 - 8.5.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-004" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-003", + "Type":"Privilege Escalation & SQL Injection", + "Subcomponent":"Form Framework (ext:form)", + "Affected":"8.7.16 - 8.5.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-003" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-002", + "Type":"Insecure Deserialization & Arbitrary Code Execution", + "Subcomponent":"TYPO3 CMS", + "Affected":"8.7.16 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-002" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-001", + "Type":"Authentication Bypass", + "Subcomponent":"Salted Passwords (ext:saltedpasswords)", + "Affected":"8.7.16 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-001" + }, + { + "Advisory":"TYPO3-CORE-SA-2017-007", + "Type":"Arbitrary Code Execution", + "Subcomponent":"TYPO3 CMS", + "Affected":"8.7.4 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2017-007" + }, + { + "Advisory":"TYPO3-CORE-SA-2017-005", + "Type":"Information Disclosure", + "Subcomponent":"TYPO3 CMS", + "Affected":"8.7.4 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2017-005" + }, + { + "Advisory":"TYPO3-CORE-SA-2017-006", + "Type":"Information Disclosure", + "Subcomponent":"TYPO3 CMS", + "Affected":"8.7.4 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2017-006" + }, + { + "Advisory":"TYPO3-CORE-SA-2017-004", + "Type":"Cross-Site Scripting", + "Subcomponent":"TYPO3 CMS", + "Affected":"8.7.4 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2017-004" + }, + { + "Advisory":"TYPO3-CORE-SA-2020-011", + "Type":"Sensitive Data Exposure", + "Subcomponent":"Session Storage (ext:core)", + "Affected":"8.7.37 - 8.7.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2020-011" + }, + { + "Advisory":"TYPO3-CORE-SA-2020-010", + "Type":"Cross-Site Scripting", + "Subcomponent":"Fluid (ext:fluid)", + "Affected":"8.7.37 - 8.7.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2020-010" + }, + { + "Advisory":"TYPO3-CORE-SA-2020-009", + "Type":"Cross-Site Scripting", + "Subcomponent":"Fluid Engine (package typo3fluid/fluid)", + "Affected":"8.7.37 - 8.7.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2020-009" + }, + { + "Advisory":"TYPO3-CORE-SA-2021-008", + "Type":"Cross-Site Scripting", + "Subcomponent":"Content Preview Renderer (ext:backend)", + "Affected":"8.7.39 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-008" + }, + { + "Advisory":"TYPO3-CORE-SA-2021-006", + "Type":"Sensitive Data Exposure", + "Subcomponent":"Session Storage (ext:core)", + "Affected":"8.7.39 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-006" + }, + { + "Advisory":"TYPO3-CORE-SA-2021-003", + "Type":"Broken Access Control", + "Subcomponent":"Form Framework (ext:form)", + "Affected":"8.7.39 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-003" + }, + { + "Advisory":"TYPO3-CORE-SA-2021-002", + "Type":"Unrestricted File Upload", + "Subcomponent":"Form Framework (ext:form)", + "Affected":"8.7.39 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-002" + }, + { + "Advisory":"TYPO3-CORE-SA-2021-001", + "Type":"Open Redirection", + "Subcomponent":"Login Handling (ext:core)", + "Affected":"8.7.39 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-001" + }, + { + "Advisory":"TYPO3-CORE-SA-2021-013", + "Type":"Cross-Site-Scripting", + "Subcomponent":"Content Rendering, HTML Parser (ext:frontend, ext:core)", + "Affected":"8.7.41 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-013" + }, + { + "Advisory":"TYPO3-CORE-SA-2021-012", + "Type":"Information Disclosure", + "Subcomponent":"User Authentication (ext:core)", + "Affected":"8.7.40 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-012" + }, + { + "Advisory":"TYPO3-CORE-SA-2021-011", + "Type":"Cross-Site Scripting", + "Subcomponent":"Backend Grid View (ext:backend)", + "Affected":"8.7.40 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-011" + }, + { + "Advisory":"TYPO3-CORE-SA-2021-010", + "Type":"Cross-Site Scripting", + "Subcomponent":"Query Generator & Query View (ext:lowlevel, ext:core)", + "Affected":"8.7.40 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-010" + } + ], + "Extensions":[ + { + "Name":"extbase", + "Title":"Log4Php", + "Repo":"https://extensions.typo3.org/extension/extbase", + "Current":"1.1.1 (alpha)", + "Url":"http://localhost:80/typo3/sysext/extbase/", + "Version":"unknown", + "Version File":"not found", + "Vulnerabilities":[ + + ] + }, + { + "Name":"feedit", + "Title":"Frontend Editing", + "Repo":"https://extensions.typo3.org/extension/feedit", + "Current":"10.0.2 (stable)", + "Url":"http://localhost:80/typo3/sysext/feedit/", + "Version":"unknown", + "Version File":"not found", + "Vulnerabilities":[ + + ] + }, + { + "Name":"func", + "Title":"WebFunc", + "Repo":"https://extensions.typo3.org/extension/func", + "Current":"9.0.1 (stable)", + "Url":"http://localhost:80/typo3/sysext/func/", + "Version":"unknown", + "Version File":"not found", + "Vulnerabilities":[ + + ] + }, + { + "Name":"rsaauth", + "Title":"RSA authentication for TYPO3", + "Repo":"https://extensions.typo3.org/extension/rsaauth", + "Current":"10.0.1 (deprecated)", + "Url":"http://localhost:80/typo3/sysext/rsaauth/", + "Version":"unknown", + "Version File":"not found", + "Vulnerabilities":[ + + ] + }, + { + "Name":"sys_action", + "Title":"UserTask Center, Actions", + "Repo":"https://extensions.typo3.org/extension/sys_action", + "Current":"10.0.0 (stable)", + "Url":"http://localhost:80/typo3/sysext/sys_action/", + "Version":"unknown", + "Version File":"not found", + "Vulnerabilities":[ + + ] + }, + { + "Name":"taskcenter", + "Title":"UserTask Center", + "Repo":"https://extensions.typo3.org/extension/taskcenter", + "Current":"10.0.0 (stable)", + "Url":"http://localhost:80/typo3/sysext/taskcenter/", + "Version":"unknown", + "Version File":"not found", + "Vulnerabilities":[ + + ] + }, + { + "Name":"tstemplate", + "Title":"WebTemplate", + "Repo":"https://extensions.typo3.org/extension/tstemplate", + "Current":"0.0.5 (stable)", + "Url":"http://localhost:80/typo3/sysext/tstemplate/", + "Version":"unknown", + "Version File":"not found", + "Vulnerabilities":[ + { + "Name":"news", + "Title":"News system", + "Repo":"https://extensions.typo3.org/extension/news", + "Current":"stable", + "Url":"http://localhost:80/typo3/sysext/news/", + "Version":"3.1.0", + "Version File":"http://localhost:80/typo3conf/ext/news/Documentation/Settings.yml", + "Vulnerabilities":[ + { + "Advisory":"TYPO3-EXT-SA-2017-001", + "Vulnerability Type":"SQL Injection", + "Affected":"3.2.6 - 0.0.0" + }, + { + "Advisory":"TYPO3-EXT-SA-2015-017", + "Vulnerability Type":"Cross-Site Scripting", + "Affected":"3.2.1 - 0.0.0" + } + ] + } + ] + } + ] + } + } \ No newline at end of file From 6dd47e0078dc369c3a3f4158aff31b0ecdf7ab5e Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Mon, 23 Aug 2021 16:09:03 +0200 Subject: [PATCH 08/42] Minor fixes --- scanners/typo3scan/Chart.yaml | 2 +- scanners/typo3scan/examples/scan.yaml | 6 ++++-- scanners/typo3scan/parser/Dockerfile | 2 +- scanners/typo3scan/scanner/Dockerfile | 6 +++--- scanners/typo3scan/scanner/wrapper.sh | 2 +- scanners/typo3scan/templates/typo3scan-scan-type.yaml | 5 ++++- scanners/typo3scan/values.yaml | 2 +- 7 files changed, 15 insertions(+), 10 deletions(-) diff --git a/scanners/typo3scan/Chart.yaml b/scanners/typo3scan/Chart.yaml index 7639f8111e..d0e47b97aa 100644 --- a/scanners/typo3scan/Chart.yaml +++ b/scanners/typo3scan/Chart.yaml @@ -34,7 +34,7 @@ keywords: - secureCodeBox home: https://docs.securecodebox.io/docs/scanners/typo3scan -#TODO Scanner doesn't have an icon +#icon: Scanner doesn't have an icon sources: - https://github.com/secureCodeBox/secureCodeBox diff --git a/scanners/typo3scan/examples/scan.yaml b/scanners/typo3scan/examples/scan.yaml index c3923cb987..62dcbccd22 100644 --- a/scanners/typo3scan/examples/scan.yaml +++ b/scanners/typo3scan/examples/scan.yaml @@ -2,11 +2,13 @@ apiVersion: "execution.securecodebox.io/v1" kind: Scan metadata: - name: "typo3scan-juice-shop-cluster-internal" #TODO Add Typo3 Website Target ? + name: "https://www.typo3example.com" # Placeholder website, change to the website you want to scan spec: scanType: "typo3scan" parameters: + - "-d" + - "https://www.typo3example.com" # Change to the website you want to scan # Only show vulnuerable extensions - - "-vuln" + - "--vuln" # Set the number of threads to use for enumerating extensions at 10 - "--threads 10" \ No newline at end of file diff --git a/scanners/typo3scan/parser/Dockerfile b/scanners/typo3scan/parser/Dockerfile index 523c4b8dec..a433e58463 100644 --- a/scanners/typo3scan/parser/Dockerfile +++ b/scanners/typo3scan/parser/Dockerfile @@ -12,5 +12,5 @@ RUN npm ci --production FROM securecodebox/parser-sdk-nodejs:${baseImageTag:-latest} WORKDIR /home/app/parser-wrapper/parser/ -#COPY --from=build --chown=app:app /home/app/node_modules/ ./node_modules/ # TODO No external Dependencies are installed (so no node_modules folder) +#COPY --from=build --chown=app:app /home/app/node_modules/ ./node_modules/ # No external Dependencies are installed (so no node_modules folder) COPY --chown=app:app ./parser.js ./parser.js \ No newline at end of file diff --git a/scanners/typo3scan/scanner/Dockerfile b/scanners/typo3scan/scanner/Dockerfile index b40bdd0e54..513773b870 100644 --- a/scanners/typo3scan/scanner/Dockerfile +++ b/scanners/typo3scan/scanner/Dockerfile @@ -19,10 +19,10 @@ RUN mkdir /home/securecodebox/ RUN chown -R typo3scan:typo3scan /home/securecodebox/ USER 1001 -#clone Repo -WORKDIR /home/securecodebox/ +#Clone Repo +WORKDIR /home/typo3scan/ RUN git clone https://github.com/whoot/Typo3Scan.git -WORKDIR /home/securecodebox/Typo3Scan +WORKDIR /home/typo3scan/Typo3Scan #Install Typo3Scan python requirements RUN python3 -m pip install -r requirements.txt diff --git a/scanners/typo3scan/scanner/wrapper.sh b/scanners/typo3scan/scanner/wrapper.sh index a45c6d6676..f96a4be25b 100644 --- a/scanners/typo3scan/scanner/wrapper.sh +++ b/scanners/typo3scan/scanner/wrapper.sh @@ -2,7 +2,7 @@ # # SPDX-License-Identifier: Apache-2.0 -python3 typo3scan.py --no-interaction --json $@ +python3 typo3scan.py $@ if [ -f ./typo3scan.json ]; then mv ./typo3scan.json /home/securecodebox/typo3scan-results.json diff --git a/scanners/typo3scan/templates/typo3scan-scan-type.yaml b/scanners/typo3scan/templates/typo3scan-scan-type.yaml index 3d2cd2a044..369992545d 100644 --- a/scanners/typo3scan/templates/typo3scan-scan-type.yaml +++ b/scanners/typo3scan/templates/typo3scan-scan-type.yaml @@ -16,4 +16,7 @@ spec: - name: typo3scan image: "{{ .Values.scanner.image.repository }}:{{ .Values.scanner.image.tag | default .Chart.AppVersion }}" command: - - "typo3scan.py " # TODO : Wrapper.sh already calls this ? \ No newline at end of file + - "sh" + - "/home/typo3scan/Typo3Scan/wrapper.sh" + - "--no-interaction" + - "--json" \ No newline at end of file diff --git a/scanners/typo3scan/values.yaml b/scanners/typo3scan/values.yaml index 72d36a624c..2f795f7f99 100644 --- a/scanners/typo3scan/values.yaml +++ b/scanners/typo3scan/values.yaml @@ -17,7 +17,7 @@ parser: scanner: image: # scanner.image.repository -- Container Image to run the scan - repository: docker.io/securecodebox/typo3scan + repository: docker.io/securecodebox/scanner-typo3scan # scanner.image.tag -- defaults to the charts appVersion tag: null From f43e8874f0273dc267d4b403c5264f20c3f25638 Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Mon, 23 Aug 2021 16:38:46 +0200 Subject: [PATCH 09/42] Added .helm-docs.gotml file for documentation --- scanners/typo3scan/.helm-docs.gotmpl | 50 ++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) create mode 100644 scanners/typo3scan/.helm-docs.gotmpl diff --git a/scanners/typo3scan/.helm-docs.gotmpl b/scanners/typo3scan/.helm-docs.gotmpl new file mode 100644 index 0000000000..7082057735 --- /dev/null +++ b/scanners/typo3scan/.helm-docs.gotmpl @@ -0,0 +1,50 @@ +{{- /* +SPDX-FileCopyrightText: 2021 iteratec GmbH + +SPDX-License-Identifier: Apache-2.0 +*/ -}} + +{{- define "extra.docsSection" -}} +--- +title: "Typo3Scan" +category: "scanner" +type: "Network" +state: "released" +appVersion: "{{ template "chart.appVersion" . }}" +usecase: "Automation of the process of detecting the Typo3 CMS, and it's installed extensions" +--- +{{- end }} + +{{- define "extra.dockerDeploymentSection" -}} +## Supported Tags +- `latest` (represents the latest stable release build) +- tagged releases, e.g. `{{ template "chart.appVersion" . }}` +{{- end }} + +{{- define "extra.chartAboutSection" -}} +## What is Typo3Scan? +Typo3Scan is an open source penetration testing tool to automate the process of detecting the Typo3 CMS and it's installed extensions. It also has a database with known vulnerabilities for core and extensions. + +To learn more about the Typo3Scan scanner itself visit [https://github.com/whoot/Typo3Scan]. +{{- end }} + +{{- define "extra.scannerConfigurationSection" -}} +## Scanner Configuration + +The Typo3Scan targets are specified with the `-d` parameter. The target should be a hostname, an IP address or an IP range. + +Additional Typo3Scan scan features can be configured via the parameter attribute. + +Some useful example parameters listed below: + +- `--vuln` : Check for extensions with known vulnerabilities only. +- `--timeout TIMEOUT` : Request Timeout. Default: 10 seconds +- `--auth USER:PASS`: Username and Password for HTTP Basic Authorization. +- `--cookie NAME=VALUE`: Can be used for authenticiation based on cookies. +- `--agent USER-AGENT`: Set custom User-Agent for requests. +- `--threads THREADS`: The number of threads to use for enumerating extensions. Default: 5 +- `--json`: Output results to json file +- `--force`: Force enumeration +- `--no-interaction`: Do not ask any interactive question + +{{- end }} \ No newline at end of file From dbf7cf0d8daa1c36a9bd0e4d7f2932c80594e899 Mon Sep 17 00:00:00 2001 From: Ilyesbdlala Date: Mon, 23 Aug 2021 14:41:43 +0000 Subject: [PATCH 10/42] Updating Helm Docs Signed-off-by: GitHub Actions --- scanners/typo3scan/README.md | 92 ++++++++++------ scanners/typo3scan/docs/README.ArtifactHub.md | 77 ++++++++++++++ .../typo3scan/docs/README.DockerHub-Parser.md | 82 ++++++++++++++ .../docs/README.DockerHub-Scanner.md | 100 ++++++++++++++++++ 4 files changed, 317 insertions(+), 34 deletions(-) create mode 100644 scanners/typo3scan/docs/README.ArtifactHub.md create mode 100644 scanners/typo3scan/docs/README.DockerHub-Parser.md create mode 100644 scanners/typo3scan/docs/README.DockerHub-Scanner.md diff --git a/scanners/typo3scan/README.md b/scanners/typo3scan/README.md index c29eb1a152..6008d6efa4 100644 --- a/scanners/typo3scan/README.md +++ b/scanners/typo3scan/README.md @@ -1,46 +1,70 @@ -# typo3scan +--- +title: "Typo3Scan" +category: "scanner" +type: "Network" +state: "released" +appVersion: "1.16.0" +usecase: "Automation of the process of detecting the Typo3 CMS, and it's installed extensions" +--- -![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.16.0](https://img.shields.io/badge/AppVersion-1.16.0-informational?style=flat-square) + + -## Maintainers +

+ License Apache-2.0 + GitHub release (latest SemVer) + OWASP Incubator Project + Artifact HUB + GitHub Repo stars + Twitter Follower +

-| Name | Email | Url | -| ---- | ------ | --- | -| iteratec GmbH | | | -| | secureCodeBox@iteratec.com | | +## What is Typo3Scan? +Typo3Scan is an open source penetration testing tool to automate the process of detecting the Typo3 CMS and it's installed extensions. It also has a database with known vulnerabilities for core and extensions. -## Source Code +To learn more about the Typo3Scan scanner itself visit [https://github.com/whoot/Typo3Scan]. -* +## Deployment +The typo3scan chart can be deployed via helm: + +```bash +# Install HelmChart (use -n to configure another namespace) +helm upgrade --install typo3scan secureCodeBox/typo3scan +``` + +## Scanner Configuration + +The Typo3Scan targets are specified with the `-d` parameter. The target should be a hostname, an IP address or an IP range. + +Additional Typo3Scan scan features can be configured via the parameter attribute. + +Some useful example parameters listed below: + +- `--vuln` : Check for extensions with known vulnerabilities only. +- `--timeout TIMEOUT` : Request Timeout. Default: 10 seconds +- `--auth USER:PASS`: Username and Password for HTTP Basic Authorization. +- `--cookie NAME=VALUE`: Can be used for authenticiation based on cookies. +- `--agent USER-AGENT`: Set custom User-Agent for requests. +- `--threads THREADS`: The number of threads to use for enumerating extensions. Default: 5 +- `--json`: Output results to json file +- `--force`: Force enumeration +- `--no-interaction`: Do not ask any interactive question ## Requirements Kubernetes: `>=v1.11.0-0` -## Values - -| Key | Type | Default | Description | -|-----|------|---------|-------------| -| cascadingRules.enabled | bool | `true` | Enables or disables the installation of the default cascading rules for this scanner | -| parser.env | list | `[]` | Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) | -| parser.image.repository | string | `"docker.io/securecodebox/parser-typo3scan"` | Parser image repository | -| parser.image.tag | string | defaults to the charts version | Parser image tag | -| parser.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | -| scanner.backoffLimit | int | 3 | There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) | -| scanner.env | list | `[]` | Optional environment variables mapped into each scanJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) | -| scanner.extraContainers | list | `[]` | Optional additional Containers started with each scanJob (see: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) | -| scanner.extraVolumeMounts | list | `[]` | Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | -| scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | -| scanner.image.repository | string | `"docker.io/securecodebox/typo3scan"` | Container Image to run the scan | -| scanner.image.tag | string | `nil` | defaults to the charts appVersion | -| scanner.nameAppend | string | `nil` | append a string to the default scantype name. | -| scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | -| scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | - ----------------------------------------------- -Autogenerated from chart metadata using [helm-docs v1.5.0](https://github.com/norwoodj/helm-docs/releases/v1.5.0) diff --git a/scanners/typo3scan/docs/README.ArtifactHub.md b/scanners/typo3scan/docs/README.ArtifactHub.md new file mode 100644 index 0000000000..40f995091a --- /dev/null +++ b/scanners/typo3scan/docs/README.ArtifactHub.md @@ -0,0 +1,77 @@ + + + +

+ License Apache-2.0 + GitHub release (latest SemVer) + OWASP Incubator Project + Artifact HUB + GitHub Repo stars + Twitter Follower +

+ +## What is OWASP secureCodeBox? + +

+ secureCodeBox Logo +

+ +_[OWASP secureCodeBox][scb-github]_ is an automated and scalable open source solution that can be used to integrate various *security vulnerability scanners* with a simple and lightweight interface. The _secureCodeBox_ mission is to support *DevSecOps* Teams to make it easy to automate security vulnerability testing in different scenarios. + +With the _secureCodeBox_ we provide a toolchain for continuous scanning of applications to find the low-hanging fruit issues early in the development process and free the resources of the penetration tester to concentrate on the major security issues. + +The secureCodeBox project is running on [Kubernetes](https://kubernetes.io/). To install it you need [Helm](https://helm.sh), a package manager for Kubernetes. It is also possible to start the different integrated security vulnerability scanners based on a docker infrastructure. + +### Quickstart with secureCodeBox on kubernetes + +You can find resources to help you get started on our [documentation website](https://docs.securecodebox.io) including instruction on how to [install the secureCodeBox project](https://docs.securecodebox.io/docs/getting-started/installation) and guides to help you [run your first scans](https://docs.securecodebox.io/docs/getting-started/first-scans) with it. + +## What is Typo3Scan? +Typo3Scan is an open source penetration testing tool to automate the process of detecting the Typo3 CMS and it's installed extensions. It also has a database with known vulnerabilities for core and extensions. + +To learn more about the Typo3Scan scanner itself visit [https://github.com/whoot/Typo3Scan]. + +## Deployment +The typo3scan chart can be deployed via helm: + +```bash +# Install HelmChart (use -n to configure another namespace) +helm upgrade --install typo3scan secureCodeBox/typo3scan +``` + +## Scanner Configuration + +The Typo3Scan targets are specified with the `-d` parameter. The target should be a hostname, an IP address or an IP range. + +Additional Typo3Scan scan features can be configured via the parameter attribute. + +Some useful example parameters listed below: + +- `--vuln` : Check for extensions with known vulnerabilities only. +- `--timeout TIMEOUT` : Request Timeout. Default: 10 seconds +- `--auth USER:PASS`: Username and Password for HTTP Basic Authorization. +- `--cookie NAME=VALUE`: Can be used for authenticiation based on cookies. +- `--agent USER-AGENT`: Set custom User-Agent for requests. +- `--threads THREADS`: The number of threads to use for enumerating extensions. Default: 5 +- `--json`: Output results to json file +- `--force`: Force enumeration +- `--no-interaction`: Do not ask any interactive question + +## Requirements + +Kubernetes: `>=v1.11.0-0` + diff --git a/scanners/typo3scan/docs/README.DockerHub-Parser.md b/scanners/typo3scan/docs/README.DockerHub-Parser.md new file mode 100644 index 0000000000..7f54db0de5 --- /dev/null +++ b/scanners/typo3scan/docs/README.DockerHub-Parser.md @@ -0,0 +1,82 @@ + + + +

+ License Apache-2.0 + GitHub release (latest SemVer) + OWASP Incubator Project + Artifact HUB + GitHub Repo stars + Twitter Follower +

+ +## What is OWASP secureCodeBox? + +

+ secureCodeBox Logo +

+ +_[OWASP secureCodeBox][scb-github]_ is an automated and scalable open source solution that can be used to integrate various *security vulnerability scanners* with a simple and lightweight interface. The _secureCodeBox_ mission is to support *DevSecOps* Teams to make it easy to automate security vulnerability testing in different scenarios. + +With the _secureCodeBox_ we provide a toolchain for continuous scanning of applications to find the low-hanging fruit issues early in the development process and free the resources of the penetration tester to concentrate on the major security issues. + +The secureCodeBox project is running on [Kubernetes](https://kubernetes.io/). To install it you need [Helm](https://helm.sh), a package manager for Kubernetes. It is also possible to start the different integrated security vulnerability scanners based on a docker infrastructure. + +### Quickstart with secureCodeBox on kubernetes + +You can find resources to help you get started on our [documentation website](https://docs.securecodebox.io) including instruction on how to [install the secureCodeBox project](https://docs.securecodebox.io/docs/getting-started/installation) and guides to help you [run your first scans](https://docs.securecodebox.io/docs/getting-started/first-scans) with it. + +## Supported Tags +- `latest` (represents the latest stable release build) +- tagged releases, e.g. `1.16.0` + +## How to use this image +This `parser` image is intended to work in combination with the corresponding security scanner docker image to parse the `findings` results. For more information details please take a look at the documentation page: https://docs.securecodebox.io/docs/scanners/typo3scan. + +```bash +docker pull securecodebox/parser-typo3scan +``` + +## What is Typo3Scan? +Typo3Scan is an open source penetration testing tool to automate the process of detecting the Typo3 CMS and it's installed extensions. It also has a database with known vulnerabilities for core and extensions. + +To learn more about the Typo3Scan scanner itself visit [https://github.com/whoot/Typo3Scan]. + +## Community + +You are welcome, please join us on... 👋 + +- [GitHub][scb-github] +- [Slack][scb-slack] +- [Twitter][scb-twitter] + +secureCodeBox is an official [OWASP][scb-owasp] project. + +## License +[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0) + +As with all Docker images, these likely also contain other software which may be under other licenses (such as Bash, etc from the base distribution, along with any direct or indirect dependencies of the primary software being contained). + +As for any pre-built image usage, it is the image user's responsibility to ensure that any use of this image complies with any relevant licenses for all software contained within. + +[scb-owasp]: https://www.owasp.org/index.php/OWASP_secureCodeBox +[scb-docs]: https://docs.securecodebox.io/ +[scb-site]: https://www.securecodebox.io/ +[scb-github]: https://github.com/secureCodeBox/ +[scb-twitter]: https://twitter.com/secureCodeBox +[scb-slack]: https://join.slack.com/t/securecodebox/shared_invite/enQtNDU3MTUyOTM0NTMwLTBjOWRjNjVkNGEyMjQ0ZGMyNDdlYTQxYWQ4MzNiNGY3MDMxNThkZjJmMzY2NDRhMTk3ZWM3OWFkYmY1YzUxNTU +[scb-license]: https://github.com/secureCodeBox/secureCodeBox/blob/master/LICENSE diff --git a/scanners/typo3scan/docs/README.DockerHub-Scanner.md b/scanners/typo3scan/docs/README.DockerHub-Scanner.md new file mode 100644 index 0000000000..ccecec0f79 --- /dev/null +++ b/scanners/typo3scan/docs/README.DockerHub-Scanner.md @@ -0,0 +1,100 @@ + + + +

+ License Apache-2.0 + GitHub release (latest SemVer) + OWASP Incubator Project + Artifact HUB + GitHub Repo stars + Twitter Follower +

+ +## What is OWASP secureCodeBox? + +

+ secureCodeBox Logo +

+ +_[OWASP secureCodeBox][scb-github]_ is an automated and scalable open source solution that can be used to integrate various *security vulnerability scanners* with a simple and lightweight interface. The _secureCodeBox_ mission is to support *DevSecOps* Teams to make it easy to automate security vulnerability testing in different scenarios. + +With the _secureCodeBox_ we provide a toolchain for continuous scanning of applications to find the low-hanging fruit issues early in the development process and free the resources of the penetration tester to concentrate on the major security issues. + +The secureCodeBox project is running on [Kubernetes](https://kubernetes.io/). To install it you need [Helm](https://helm.sh), a package manager for Kubernetes. It is also possible to start the different integrated security vulnerability scanners based on a docker infrastructure. + +### Quickstart with secureCodeBox on kubernetes + +You can find resources to help you get started on our [documentation website](https://docs.securecodebox.io) including instruction on how to [install the secureCodeBox project](https://docs.securecodebox.io/docs/getting-started/installation) and guides to help you [run your first scans](https://docs.securecodebox.io/docs/getting-started/first-scans) with it. + +## Supported Tags +- `latest` (represents the latest stable release build) +- tagged releases, e.g. `1.16.0` + +## How to use this image +This `scanner` image is intended to work in combination with the corresponding `parser` image to parse the scanner `findings` to generic secureCodeBox results. For more information details please take a look at the [project page][scb-docs] or [documentation page][https://docs.securecodebox.io/docs/scanners/typo3scan]. + +```bash +docker pull securecodebox/scanner-typo3scan +``` + +## What is Typo3Scan? +Typo3Scan is an open source penetration testing tool to automate the process of detecting the Typo3 CMS and it's installed extensions. It also has a database with known vulnerabilities for core and extensions. + +To learn more about the Typo3Scan scanner itself visit [https://github.com/whoot/Typo3Scan]. + +## Scanner Configuration + +The Typo3Scan targets are specified with the `-d` parameter. The target should be a hostname, an IP address or an IP range. + +Additional Typo3Scan scan features can be configured via the parameter attribute. + +Some useful example parameters listed below: + +- `--vuln` : Check for extensions with known vulnerabilities only. +- `--timeout TIMEOUT` : Request Timeout. Default: 10 seconds +- `--auth USER:PASS`: Username and Password for HTTP Basic Authorization. +- `--cookie NAME=VALUE`: Can be used for authenticiation based on cookies. +- `--agent USER-AGENT`: Set custom User-Agent for requests. +- `--threads THREADS`: The number of threads to use for enumerating extensions. Default: 5 +- `--json`: Output results to json file +- `--force`: Force enumeration +- `--no-interaction`: Do not ask any interactive question + +## Community + +You are welcome, please join us on... 👋 + +- [GitHub][scb-github] +- [Slack][scb-slack] +- [Twitter][scb-twitter] + +secureCodeBox is an official [OWASP][scb-owasp] project. + +## License +[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0) + +As with all Docker images, these likely also contain other software which may be under other licenses (such as Bash, etc from the base distribution, along with any direct or indirect dependencies of the primary software being contained). + +As for any pre-built image usage, it is the image user's responsibility to ensure that any use of this image complies with any relevant licenses for all software contained within. + +[scb-owasp]: https://www.owasp.org/index.php/OWASP_secureCodeBox +[scb-docs]: https://docs.securecodebox.io/ +[scb-site]: https://www.securecodebox.io/ +[scb-github]: https://github.com/secureCodeBox/ +[scb-twitter]: https://twitter.com/secureCodeBox +[scb-slack]: https://join.slack.com/t/securecodebox/shared_invite/enQtNDU3MTUyOTM0NTMwLTBjOWRjNjVkNGEyMjQ0ZGMyNDdlYTQxYWQ4MzNiNGY3MDMxNThkZjJmMzY2NDRhMTk3ZWM3OWFkYmY1YzUxNTU +[scb-license]: https://github.com/secureCodeBox/secureCodeBox/blob/master/LICENSE From db39bb7c74dd7d2d3fe2c631cfb3b9fe2ae1cf69 Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Mon, 23 Aug 2021 16:53:16 +0200 Subject: [PATCH 11/42] updated jest snapshots --- .../parser/__snapshots__/parser.test.js.snap | 56 +++++++++---------- scanners/typo3scan/parser/package.json | 4 +- 2 files changed, 31 insertions(+), 29 deletions(-) diff --git a/scanners/typo3scan/parser/__snapshots__/parser.test.js.snap b/scanners/typo3scan/parser/__snapshots__/parser.test.js.snap index ac05510fe3..44b9408c13 100644 --- a/scanners/typo3scan/parser/__snapshots__/parser.test.js.snap +++ b/scanners/typo3scan/parser/__snapshots__/parser.test.js.snap @@ -1,6 +1,6 @@ // Jest Snapshot v1, https://goo.gl/fbAQLP -exports[`example parser parses large json result successfully 1`] = ` +exports[`parser parses large json result with vulnuerable extensions successfully 1`] = ` Array [ Object { "attributes": Object { @@ -833,19 +833,41 @@ Array [ "repository": "https://extensions.typo3.org/extension/tstemplate", "typo3_version": "8.7", "version_file": "not found", - "vulnerabilities": Array [], + "vulnerabilities": Array [ + Object { + "Current": "stable", + "Name": "news", + "Repo": "https://extensions.typo3.org/extension/news", + "Title": "News system", + "Url": "http://localhost:80/typo3/sysext/news/", + "Version": "3.1.0", + "Version File": "http://localhost:80/typo3conf/ext/news/Documentation/Settings.yml", + "Vulnerabilities": Array [ + Object { + "Advisory": "TYPO3-EXT-SA-2017-001", + "Affected": "3.2.6 - 0.0.0", + "Vulnerability Type": "SQL Injection", + }, + Object { + "Advisory": "TYPO3-EXT-SA-2015-017", + "Affected": "3.2.1 - 0.0.0", + "Vulnerability Type": "Cross-Site Scripting", + }, + ], + }, + ], }, "category": "Extension", "description": "Extension tstemplate (WebTemplate) found", "location": "http://localhost:80/typo3/sysext/tstemplate/", "name": "tstemplate", "osi_layer": "APPLICATION", - "severity": "INFORMATIONAL", + "severity": "HIGH", }, ] `; -exports[`example parser parses large json result successfully 2`] = ` +exports[`parser parses large json result without vulnuerable extensions successfully 1`] = ` Array [ Object { "attributes": Object { @@ -1678,36 +1700,14 @@ Array [ "repository": "https://extensions.typo3.org/extension/tstemplate", "typo3_version": "8.7", "version_file": "not found", - "vulnerabilities": Array [ - Object { - "Current": "stable", - "Name": "news", - "Repo": "https://extensions.typo3.org/extension/news", - "Title": "News system", - "Url": "http://localhost:80/typo3/sysext/news/", - "Version": "3.1.0", - "Version File": "http://localhost:80/typo3conf/ext/news/Documentation/Settings.yml", - "Vulnerabilities": Array [ - Object { - "Advisory": "TYPO3-EXT-SA-2017-001", - "Affected": "3.2.6 - 0.0.0", - "Vulnerability Type": "SQL Injection", - }, - Object { - "Advisory": "TYPO3-EXT-SA-2015-017", - "Affected": "3.2.1 - 0.0.0", - "Vulnerability Type": "Cross-Site Scripting", - }, - ], - }, - ], + "vulnerabilities": Array [], }, "category": "Extension", "description": "Extension tstemplate (WebTemplate) found", "location": "http://localhost:80/typo3/sysext/tstemplate/", "name": "tstemplate", "osi_layer": "APPLICATION", - "severity": "HIGH", + "severity": "INFORMATIONAL", }, ] `; diff --git a/scanners/typo3scan/parser/package.json b/scanners/typo3scan/parser/package.json index 44345ae701..a31125910a 100644 --- a/scanners/typo3scan/parser/package.json +++ b/scanners/typo3scan/parser/package.json @@ -3,7 +3,9 @@ "version": "1.0.0", "description": "Parses result files for the type : 'typo3scan-json'", "main": "", - "scripts": {}, + "scripts": { + "test": "npx jest parser.test.js" + }, "keywords": [], "author": "iteratec GmbH", "license": "Apache-2.0", From 4bd88b23822aec0edcde2666bc72faffcb1cd310 Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Mon, 9 Aug 2021 13:00:54 +0200 Subject: [PATCH 12/42] Update Kubernetes Versions used in CI Signed-off-by: Jannik Hollenbach Signed-off-by: Ilyes Ben Dlala --- .github/workflows/ci.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index d62a53db49..91574ded8b 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -374,7 +374,7 @@ jobs: - name: "Start kind cluster" run: | kind version - kind create cluster --image kindest/node:v1.21.1@sha256:69860bda5563ac81e3c0057d654b5253219618a22ec3a346306239bba8cfa1a6 --wait 3m + kind create cluster --image kindest/node:v1.22.0@sha256:b8bda84bb3a190e6e028b1760d277454a72267a5454b57db34437c34a588d047 - name: "Inspect kind cluster" run: | @@ -771,10 +771,10 @@ jobs: strategy: matrix: k8sVersion: + - v1.22.0@sha256:b8bda84bb3a190e6e028b1760d277454a72267a5454b57db34437c34a588d047 - v1.21.1@sha256:69860bda5563ac81e3c0057d654b5253219618a22ec3a346306239bba8cfa1a6 - v1.20.7@sha256:cbeaf907fc78ac97ce7b625e4bf0de16e3ea725daf6b04f930bd14c67c671ff9 - v1.19.11@sha256:07db187ae84b4b7de440a73886f008cf903fcf5764ba8106a9fd5243d6f32729 - - v1.18.19@sha256:7af1492e19b3192a79f606e43c35fb741e520d195f96399284515f077b3b622c steps: - uses: actions/checkout@master - name: "Start kind cluster" From 01b07155996e122f939b42627008eb98f9c8bd7e Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Mon, 9 Aug 2021 15:51:13 +0200 Subject: [PATCH 13/42] Add back wait flag Signed-off-by: Ilyes Ben Dlala --- .github/workflows/ci.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 91574ded8b..566c975f04 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -374,7 +374,7 @@ jobs: - name: "Start kind cluster" run: | kind version - kind create cluster --image kindest/node:v1.22.0@sha256:b8bda84bb3a190e6e028b1760d277454a72267a5454b57db34437c34a588d047 + kind create cluster --wait 3m --image kindest/node:v1.22.0@sha256:b8bda84bb3a190e6e028b1760d277454a72267a5454b57db34437c34a588d047 - name: "Inspect kind cluster" run: | From 16b185faab14f7e373b34154e49291d6647dd151 Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Thu, 12 Aug 2021 19:08:47 +0200 Subject: [PATCH 14/42] Revert helmignore to include the scripts again This cas caused the configmaps to contain a empty list of scripts as the scipts weren't included in the chart anymore :( Signed-off-by: Jannik Hollenbach Signed-off-by: Ilyes Ben Dlala --- scanners/zap-advanced/.helmignore | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/scanners/zap-advanced/.helmignore b/scanners/zap-advanced/.helmignore index 197df5afa0..b397826cf6 100644 --- a/scanners/zap-advanced/.helmignore +++ b/scanners/zap-advanced/.helmignore @@ -5,8 +5,13 @@ .DS_Store parser/ -scanner/ -examples/ +# this doesn't look too good but is required so that the scanners/scripts folder is included +scanner/*.* +scanner/zapclient/ +scanner/tests/ +scanner/venv/ +scanner/.pytest_cache/ +scanner/.idea/examples/ docs/ integration-tests/ coverage/ From 6ec459c483f4a216e47d4cd53964f6fa446cf16b Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Mon, 16 Aug 2021 10:34:32 +0200 Subject: [PATCH 15/42] Fix missing new line Signed-off-by: Jannik Hollenbach Signed-off-by: Ilyes Ben Dlala --- scanners/zap-advanced/.helmignore | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/scanners/zap-advanced/.helmignore b/scanners/zap-advanced/.helmignore index b397826cf6..b887daa2e3 100644 --- a/scanners/zap-advanced/.helmignore +++ b/scanners/zap-advanced/.helmignore @@ -11,7 +11,8 @@ scanner/zapclient/ scanner/tests/ scanner/venv/ scanner/.pytest_cache/ -scanner/.idea/examples/ +scanner/.idea/ +examples/ docs/ integration-tests/ coverage/ From df3696bd6df2b5fb73c23e1ebb1fd41bd275bd3b Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Thu, 19 Aug 2021 12:57:10 +0200 Subject: [PATCH 16/42] Created Dockerfile of the Typo3Scanner Signed-off-by: Ilyes Ben Dlala --- scanners/typo3scan/.helmignore | 23 +++++++ scanners/typo3scan/Chart.yaml | 44 +++++++++++++ scanners/typo3scan/parser/Dockerfile | 11 ++++ scanners/typo3scan/scanner/Dockerfile | 31 ++++++++++ scanners/typo3scan/scanner/wrapper.sh | 11 ++++ scanners/typo3scan/templates/NOTES.txt | 22 +++++++ scanners/typo3scan/templates/_helpers.tpl | 62 +++++++++++++++++++ scanners/typo3scan/templates/deployment.yaml | 61 ++++++++++++++++++ scanners/typo3scan/templates/hpa.yaml | 28 +++++++++ scanners/typo3scan/templates/ingress.yaml | 61 ++++++++++++++++++ scanners/typo3scan/templates/service.yaml | 15 +++++ .../typo3scan/templates/serviceaccount.yaml | 12 ++++ .../templates/tests/test-connection.yaml | 15 +++++ scanners/typo3scan/values.yaml | 60 ++++++++++++++++++ 14 files changed, 456 insertions(+) create mode 100644 scanners/typo3scan/.helmignore create mode 100644 scanners/typo3scan/Chart.yaml create mode 100644 scanners/typo3scan/parser/Dockerfile create mode 100644 scanners/typo3scan/scanner/Dockerfile create mode 100644 scanners/typo3scan/scanner/wrapper.sh create mode 100644 scanners/typo3scan/templates/NOTES.txt create mode 100644 scanners/typo3scan/templates/_helpers.tpl create mode 100644 scanners/typo3scan/templates/deployment.yaml create mode 100644 scanners/typo3scan/templates/hpa.yaml create mode 100644 scanners/typo3scan/templates/ingress.yaml create mode 100644 scanners/typo3scan/templates/service.yaml create mode 100644 scanners/typo3scan/templates/serviceaccount.yaml create mode 100644 scanners/typo3scan/templates/tests/test-connection.yaml create mode 100644 scanners/typo3scan/values.yaml diff --git a/scanners/typo3scan/.helmignore b/scanners/typo3scan/.helmignore new file mode 100644 index 0000000000..0e8a0eb36f --- /dev/null +++ b/scanners/typo3scan/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/scanners/typo3scan/Chart.yaml b/scanners/typo3scan/Chart.yaml new file mode 100644 index 0000000000..7639f8111e --- /dev/null +++ b/scanners/typo3scan/Chart.yaml @@ -0,0 +1,44 @@ +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 +apiVersion: v2 +name: typo3scan +description: A Helm chart for the Typo3 security scanner that integrates with the secureCodeBox + +# A chart can be either an 'application' or a 'library' chart. +# +# Application charts are a collection of templates that can be packaged into versioned archives +# to be deployed. +# +# Library charts provide useful utilities or functions for the chart developer. They're included as +# a dependency of application charts to inject those utilities and functions into the rendering +# pipeline. Library charts do not define any templates and therefore cannot be deployed. +type: application + +# This is the chart version. This version number should be incremented each time you make changes +# to the chart and its templates, including the app version. +# Versions are expected to follow Semantic Versioning (https://semver.org/) +version: 0.1.0 + +# This is the version number of the application being deployed. This version number should be +# incremented each time you make changes to the application. Versions are not expected to +# follow Semantic Versioning. They should reflect the version the application is using. +# It is recommended to use it with quotes. +appVersion: "1.16.0" +kubeVersion: ">=v1.11.0-0" +keywords: + - security + - typo3scan + - typo3 + - scanner + - secureCodeBox + +home: https://docs.securecodebox.io/docs/scanners/typo3scan +#TODO Scanner doesn't have an icon + +sources: + - https://github.com/secureCodeBox/secureCodeBox + +maintainers: + - name: iteratec GmbH + - email: secureCodeBox@iteratec.com diff --git a/scanners/typo3scan/parser/Dockerfile b/scanners/typo3scan/parser/Dockerfile new file mode 100644 index 0000000000..4dd33baf1d --- /dev/null +++ b/scanners/typo3scan/parser/Dockerfile @@ -0,0 +1,11 @@ +ARG baseImageTag +FROM node:12-alpine as build +RUN mkdir -p /home/app +WORKDIR /home/app +COPY package.json package-lock.json ./ +RUN npm ci --production + +FROM securecodebox/parser-sdk-nodejs:${baseImageTag:-latest} +WORKDIR /home/app/parser-wrapper/parser/ +COPY --from=build --chown=app:app /home/app/node_modules/ ./node_modules/ +COPY --chown=app:app ./parser.js ./parser.js \ No newline at end of file diff --git a/scanners/typo3scan/scanner/Dockerfile b/scanners/typo3scan/scanner/Dockerfile new file mode 100644 index 0000000000..b40bdd0e54 --- /dev/null +++ b/scanners/typo3scan/scanner/Dockerfile @@ -0,0 +1,31 @@ +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 + +FROM alpine:3.12 + +#Install Python3 +ENV PYTHONUNBUFFERED=1 +RUN apk add --update --no-cache python3 && ln -sf python3 /usr/bin/python +RUN python3 -m ensurepip +RUN pip3 install --no-cache --upgrade pip setuptools + +#Install git +RUN apk add git + +#Create typo3scan user/group and give access +RUN addgroup --system --gid 1001 typo3scan && adduser typo3scan --system --uid 1001 --ingroup typo3scan +RUN mkdir /home/securecodebox/ +RUN chown -R typo3scan:typo3scan /home/securecodebox/ +USER 1001 + +#clone Repo +WORKDIR /home/securecodebox/ +RUN git clone https://github.com/whoot/Typo3Scan.git +WORKDIR /home/securecodebox/Typo3Scan + +#Install Typo3Scan python requirements +RUN python3 -m pip install -r requirements.txt +COPY wrapper.sh ./wrapper.sh + +ENTRYPOINT [ "sh", "./wrapper.sh" ] \ No newline at end of file diff --git a/scanners/typo3scan/scanner/wrapper.sh b/scanners/typo3scan/scanner/wrapper.sh new file mode 100644 index 0000000000..a45c6d6676 --- /dev/null +++ b/scanners/typo3scan/scanner/wrapper.sh @@ -0,0 +1,11 @@ +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 + +python3 typo3scan.py --no-interaction --json $@ + +if [ -f ./typo3scan.json ]; then + mv ./typo3scan.json /home/securecodebox/typo3scan-results.json +fi + +exit 0 diff --git a/scanners/typo3scan/templates/NOTES.txt b/scanners/typo3scan/templates/NOTES.txt new file mode 100644 index 0000000000..6973440292 --- /dev/null +++ b/scanners/typo3scan/templates/NOTES.txt @@ -0,0 +1,22 @@ +1. Get the application URL by running these commands: +{{- if .Values.ingress.enabled }} +{{- range $host := .Values.ingress.hosts }} + {{- range .paths }} + http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }} + {{- end }} +{{- end }} +{{- else if contains "NodePort" .Values.service.type }} + export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "typo3scan.fullname" . }}) + export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") + echo http://$NODE_IP:$NODE_PORT +{{- else if contains "LoadBalancer" .Values.service.type }} + NOTE: It may take a few minutes for the LoadBalancer IP to be available. + You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "typo3scan.fullname" . }}' + export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "typo3scan.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}") + echo http://$SERVICE_IP:{{ .Values.service.port }} +{{- else if contains "ClusterIP" .Values.service.type }} + export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "typo3scan.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") + export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}") + echo "Visit http://127.0.0.1:8080 to use your application" + kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT +{{- end }} diff --git a/scanners/typo3scan/templates/_helpers.tpl b/scanners/typo3scan/templates/_helpers.tpl new file mode 100644 index 0000000000..81cabd0fd6 --- /dev/null +++ b/scanners/typo3scan/templates/_helpers.tpl @@ -0,0 +1,62 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "typo3scan.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "typo3scan.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "typo3scan.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "typo3scan.labels" -}} +helm.sh/chart: {{ include "typo3scan.chart" . }} +{{ include "typo3scan.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "typo3scan.selectorLabels" -}} +app.kubernetes.io/name: {{ include "typo3scan.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "typo3scan.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "typo3scan.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} diff --git a/scanners/typo3scan/templates/deployment.yaml b/scanners/typo3scan/templates/deployment.yaml new file mode 100644 index 0000000000..fe31fa948d --- /dev/null +++ b/scanners/typo3scan/templates/deployment.yaml @@ -0,0 +1,61 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "typo3scan.fullname" . }} + labels: + {{- include "typo3scan.labels" . | nindent 4 }} +spec: + {{- if not .Values.autoscaling.enabled }} + replicas: {{ .Values.replicaCount }} + {{- end }} + selector: + matchLabels: + {{- include "typo3scan.selectorLabels" . | nindent 6 }} + template: + metadata: + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "typo3scan.selectorLabels" . | nindent 8 }} + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "typo3scan.serviceAccountName" . }} + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} + containers: + - name: {{ .Chart.Name }} + securityContext: + {{- toYaml .Values.securityContext | nindent 12 }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + ports: + - name: http + containerPort: 80 + protocol: TCP + livenessProbe: + httpGet: + path: / + port: http + readinessProbe: + httpGet: + path: / + port: http + resources: + {{- toYaml .Values.resources | nindent 12 }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} diff --git a/scanners/typo3scan/templates/hpa.yaml b/scanners/typo3scan/templates/hpa.yaml new file mode 100644 index 0000000000..0198434fe4 --- /dev/null +++ b/scanners/typo3scan/templates/hpa.yaml @@ -0,0 +1,28 @@ +{{- if .Values.autoscaling.enabled }} +apiVersion: autoscaling/v2beta1 +kind: HorizontalPodAutoscaler +metadata: + name: {{ include "typo3scan.fullname" . }} + labels: + {{- include "typo3scan.labels" . | nindent 4 }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ include "typo3scan.fullname" . }} + minReplicas: {{ .Values.autoscaling.minReplicas }} + maxReplicas: {{ .Values.autoscaling.maxReplicas }} + metrics: + {{- if .Values.autoscaling.targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }} + {{- end }} + {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }} + - type: Resource + resource: + name: memory + targetAverageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }} + {{- end }} +{{- end }} diff --git a/scanners/typo3scan/templates/ingress.yaml b/scanners/typo3scan/templates/ingress.yaml new file mode 100644 index 0000000000..07a78a1ffd --- /dev/null +++ b/scanners/typo3scan/templates/ingress.yaml @@ -0,0 +1,61 @@ +{{- if .Values.ingress.enabled -}} +{{- $fullName := include "typo3scan.fullname" . -}} +{{- $svcPort := .Values.service.port -}} +{{- if and .Values.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }} + {{- if not (hasKey .Values.ingress.annotations "kubernetes.io/ingress.class") }} + {{- $_ := set .Values.ingress.annotations "kubernetes.io/ingress.class" .Values.ingress.className}} + {{- end }} +{{- end }} +{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: networking.k8s.io/v1 +{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: networking.k8s.io/v1beta1 +{{- else -}} +apiVersion: extensions/v1beta1 +{{- end }} +kind: Ingress +metadata: + name: {{ $fullName }} + labels: + {{- include "typo3scan.labels" . | nindent 4 }} + {{- with .Values.ingress.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- if and .Values.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }} + ingressClassName: {{ .Values.ingress.className }} + {{- end }} + {{- if .Values.ingress.tls }} + tls: + {{- range .Values.ingress.tls }} + - hosts: + {{- range .hosts }} + - {{ . | quote }} + {{- end }} + secretName: {{ .secretName }} + {{- end }} + {{- end }} + rules: + {{- range .Values.ingress.hosts }} + - host: {{ .host | quote }} + http: + paths: + {{- range .paths }} + - path: {{ .path }} + {{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }} + pathType: {{ .pathType }} + {{- end }} + backend: + {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }} + service: + name: {{ $fullName }} + port: + number: {{ $svcPort }} + {{- else }} + serviceName: {{ $fullName }} + servicePort: {{ $svcPort }} + {{- end }} + {{- end }} + {{- end }} +{{- end }} diff --git a/scanners/typo3scan/templates/service.yaml b/scanners/typo3scan/templates/service.yaml new file mode 100644 index 0000000000..3f6be05287 --- /dev/null +++ b/scanners/typo3scan/templates/service.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "typo3scan.fullname" . }} + labels: + {{- include "typo3scan.labels" . | nindent 4 }} +spec: + type: {{ .Values.service.type }} + ports: + - port: {{ .Values.service.port }} + targetPort: http + protocol: TCP + name: http + selector: + {{- include "typo3scan.selectorLabels" . | nindent 4 }} diff --git a/scanners/typo3scan/templates/serviceaccount.yaml b/scanners/typo3scan/templates/serviceaccount.yaml new file mode 100644 index 0000000000..4f7443a1c8 --- /dev/null +++ b/scanners/typo3scan/templates/serviceaccount.yaml @@ -0,0 +1,12 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "typo3scan.serviceAccountName" . }} + labels: + {{- include "typo3scan.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} diff --git a/scanners/typo3scan/templates/tests/test-connection.yaml b/scanners/typo3scan/templates/tests/test-connection.yaml new file mode 100644 index 0000000000..40fd70039c --- /dev/null +++ b/scanners/typo3scan/templates/tests/test-connection.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Pod +metadata: + name: "{{ include "typo3scan.fullname" . }}-test-connection" + labels: + {{- include "typo3scan.labels" . | nindent 4 }} + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['{{ include "typo3scan.fullname" . }}:{{ .Values.service.port }}'] + restartPolicy: Never diff --git a/scanners/typo3scan/values.yaml b/scanners/typo3scan/values.yaml new file mode 100644 index 0000000000..72d36a624c --- /dev/null +++ b/scanners/typo3scan/values.yaml @@ -0,0 +1,60 @@ +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 + +parser: + image: + # parser.image.repository -- Parser image repository + repository: docker.io/securecodebox/parser-typo3scan + # parser.image.tag -- Parser image tag + # @default -- defaults to the charts version + tag: null + # parser.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ + ttlSecondsAfterFinished: null + # parser.env -- Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) + env: [] + +scanner: + image: + # scanner.image.repository -- Container Image to run the scan + repository: docker.io/securecodebox/typo3scan + # scanner.image.tag -- defaults to the charts appVersion + tag: null + + # scanner.nameAppend -- append a string to the default scantype name. + nameAppend: null + + # scanner.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ + ttlSecondsAfterFinished: null + # scanner.backoffLimit -- There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) + # @default -- 3 + backoffLimit: 3 + + # scanner.resources -- CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) + resources: {} + # resources: + # requests: + # memory: "256Mi" + # cpu: "250m" + # limits: + # memory: "512Mi" + # cpu: "500m" + + # scanner.env -- Optional environment variables mapped into each scanJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) + env: [] + + # scanner.extraVolumes -- Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) + extraVolumes: [] + + # scanner.extraVolumeMounts -- Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) + extraVolumeMounts: [] + + # scanner.extraContainers -- Optional additional Containers started with each scanJob (see: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) + extraContainers: [] + + # scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) + securityContext: {} + +cascadingRules: + # cascadingRules.enabled -- Enables or disables the installation of the default cascading rules for this scanner + enabled: true From 7cc30c3aed8ac32fc6853858e162ea5b06188aee Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Thu, 19 Aug 2021 18:18:10 +0200 Subject: [PATCH 17/42] Added Typo3Scanner Parser (parser.js) Signed-off-by: Ilyes Ben Dlala --- scanners/typo3scan/parser/Dockerfile | 4 ++ scanners/typo3scan/parser/package.json | 12 +++++ scanners/typo3scan/parser/parser.js | 63 ++++++++++++++++++++++++++ 3 files changed, 79 insertions(+) create mode 100644 scanners/typo3scan/parser/package.json create mode 100644 scanners/typo3scan/parser/parser.js diff --git a/scanners/typo3scan/parser/Dockerfile b/scanners/typo3scan/parser/Dockerfile index 4dd33baf1d..1eaf917120 100644 --- a/scanners/typo3scan/parser/Dockerfile +++ b/scanners/typo3scan/parser/Dockerfile @@ -1,3 +1,7 @@ +# SPDX-FileCopyrightText: 2021 iteratec GmbH +# +# SPDX-License-Identifier: Apache-2.0 + ARG baseImageTag FROM node:12-alpine as build RUN mkdir -p /home/app diff --git a/scanners/typo3scan/parser/package.json b/scanners/typo3scan/parser/package.json new file mode 100644 index 0000000000..44345ae701 --- /dev/null +++ b/scanners/typo3scan/parser/package.json @@ -0,0 +1,12 @@ +{ + "name": "typo3scan-parser", + "version": "1.0.0", + "description": "Parses result files for the type : 'typo3scan-json'", + "main": "", + "scripts": {}, + "keywords": [], + "author": "iteratec GmbH", + "license": "Apache-2.0", + "dependencies": {}, + "devDependencies": {} +} \ No newline at end of file diff --git a/scanners/typo3scan/parser/parser.js b/scanners/typo3scan/parser/parser.js new file mode 100644 index 0000000000..c869a90a2f --- /dev/null +++ b/scanners/typo3scan/parser/parser.js @@ -0,0 +1,63 @@ +// SPDX-FileCopyrightText: 2021 iteratec GmbH +// +// SPDX-License-Identifier: Apache-2.0 + +async function parse(fileContent) { + let findings = JSON.parse(fileContent) + + if (typeof fileContent === "string") { + findings = fileContent + .split("\n") + .map((vulnJson) => JSON.parse(vulnJson)); + } + findings = findings[0] // Trimming the begining of the JS Object + let domain = Object.keys(findings)[0]; // Getting the first key (and the only key) + + let parsed_findings = findings[domain] + + // Parsing Vulnerabilities + let vulns = parsed_findings.Vulnerabilities + let parsed_vulnerabilities = vulns.map((vuln) => { + return { + name: vuln.Type, + description: `Vulnerability of type ${vuln.Type} found`, + category: "Vulnerability", + location: domain, + osi_layer: "APPLICATION", + severity: "HIGH", + attributes: { + Typo3_Version: parsed_findings.Version, + Advisory: vuln.Advisory, + Subcomponent: vuln.Subcomponent, + Versions_affected: vuln.Affected, + Advisory_URL: vuln['Advisory URL'], + + } + }; + }); + + // Parsing Extenstions + let extensions = parsed_findings.Extensions + let parsed_extensions = extensions.map((ext) => { + return { + name: ext.Name, + description: `Extension ${ext.Name} (${ext.Title}) found`, + category: "Extension", + location: ext.Url, + osi_layer: "APPLICATION", + severity: "INFORMATIONAL", + attributes: { + Typo3_Version: parsed_findings.Version, + Repository: ext.Repo, + Extension_Version: ext.Version, + Version_File: ext['Version File'], + Vulnerabilities: ext.Vulnerabilities + } + }; + }); + + let results = parsed_vulnerabilities.concat(parsed_extensions) + return results +} + +module.exports.parse = parse; \ No newline at end of file From fe26011ca72199ff4fee077989a4a278e793cc87 Mon Sep 17 00:00:00 2001 From: Ilyesbdlala Date: Thu, 19 Aug 2021 11:01:11 +0000 Subject: [PATCH 18/42] Updating Helm Docs Signed-off-by: GitHub Actions Signed-off-by: Ilyes Ben Dlala --- scanners/typo3scan/README.md | 46 ++++++++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+) create mode 100644 scanners/typo3scan/README.md diff --git a/scanners/typo3scan/README.md b/scanners/typo3scan/README.md new file mode 100644 index 0000000000..c29eb1a152 --- /dev/null +++ b/scanners/typo3scan/README.md @@ -0,0 +1,46 @@ +# typo3scan + +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.16.0](https://img.shields.io/badge/AppVersion-1.16.0-informational?style=flat-square) + +A Helm chart for the Typo3 security scanner that integrates with the secureCodeBox + +**Homepage:** + +## Maintainers + +| Name | Email | Url | +| ---- | ------ | --- | +| iteratec GmbH | | | +| | secureCodeBox@iteratec.com | | + +## Source Code + +* + +## Requirements + +Kubernetes: `>=v1.11.0-0` + +## Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| cascadingRules.enabled | bool | `true` | Enables or disables the installation of the default cascading rules for this scanner | +| parser.env | list | `[]` | Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) | +| parser.image.repository | string | `"docker.io/securecodebox/parser-typo3scan"` | Parser image repository | +| parser.image.tag | string | defaults to the charts version | Parser image tag | +| parser.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | +| scanner.backoffLimit | int | 3 | There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) | +| scanner.env | list | `[]` | Optional environment variables mapped into each scanJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) | +| scanner.extraContainers | list | `[]` | Optional additional Containers started with each scanJob (see: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) | +| scanner.extraVolumeMounts | list | `[]` | Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | +| scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | +| scanner.image.repository | string | `"docker.io/securecodebox/typo3scan"` | Container Image to run the scan | +| scanner.image.tag | string | `nil` | defaults to the charts appVersion | +| scanner.nameAppend | string | `nil` | append a string to the default scantype name. | +| scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | +| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | + +---------------------------------------------- +Autogenerated from chart metadata using [helm-docs v1.5.0](https://github.com/norwoodj/helm-docs/releases/v1.5.0) From 2fb51c84e257d23c3f69c513dc553fae2060edda Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Fri, 20 Aug 2021 15:40:32 +0200 Subject: [PATCH 19/42] Added parser tests and templates folder Signed-off-by: Ilyes Ben Dlala --- scanners/typo3scan/examples/scan.yaml | 12 + scanners/typo3scan/parser/Dockerfile | 3 +- .../parser/__testFiles__/empty.jsonl | 0 .../parser/__testFiles__/localhost.jsonl | 437 ++++++++++++++++++ scanners/typo3scan/parser/package-lock.json | 8 + scanners/typo3scan/parser/parser.js | 9 +- scanners/typo3scan/parser/parser.test.js | 38 ++ scanners/typo3scan/templates/NOTES.txt | 22 - scanners/typo3scan/templates/_helpers.tpl | 62 --- .../typo3scan/templates/cascading-rules.yaml | 9 + scanners/typo3scan/templates/deployment.yaml | 61 --- scanners/typo3scan/templates/hpa.yaml | 28 -- scanners/typo3scan/templates/ingress.yaml | 61 --- scanners/typo3scan/templates/service.yaml | 15 - .../typo3scan/templates/serviceaccount.yaml | 12 - .../templates/tests/test-connection.yaml | 15 - .../templates/typ3scan-parse-definition.yaml | 9 + .../templates/typo3scan-scan-type.yaml | 19 + 18 files changed, 541 insertions(+), 279 deletions(-) create mode 100644 scanners/typo3scan/examples/scan.yaml create mode 100644 scanners/typo3scan/parser/__testFiles__/empty.jsonl create mode 100644 scanners/typo3scan/parser/__testFiles__/localhost.jsonl create mode 100644 scanners/typo3scan/parser/package-lock.json create mode 100644 scanners/typo3scan/parser/parser.test.js delete mode 100644 scanners/typo3scan/templates/NOTES.txt delete mode 100644 scanners/typo3scan/templates/_helpers.tpl create mode 100644 scanners/typo3scan/templates/cascading-rules.yaml delete mode 100644 scanners/typo3scan/templates/deployment.yaml delete mode 100644 scanners/typo3scan/templates/hpa.yaml delete mode 100644 scanners/typo3scan/templates/ingress.yaml delete mode 100644 scanners/typo3scan/templates/service.yaml delete mode 100644 scanners/typo3scan/templates/serviceaccount.yaml delete mode 100644 scanners/typo3scan/templates/tests/test-connection.yaml create mode 100644 scanners/typo3scan/templates/typ3scan-parse-definition.yaml create mode 100644 scanners/typo3scan/templates/typo3scan-scan-type.yaml diff --git a/scanners/typo3scan/examples/scan.yaml b/scanners/typo3scan/examples/scan.yaml new file mode 100644 index 0000000000..c3923cb987 --- /dev/null +++ b/scanners/typo3scan/examples/scan.yaml @@ -0,0 +1,12 @@ + + apiVersion: "execution.securecodebox.io/v1" + kind: Scan + metadata: + name: "typo3scan-juice-shop-cluster-internal" #TODO Add Typo3 Website Target ? + spec: + scanType: "typo3scan" + parameters: + # Only show vulnuerable extensions + - "-vuln" + # Set the number of threads to use for enumerating extensions at 10 + - "--threads 10" \ No newline at end of file diff --git a/scanners/typo3scan/parser/Dockerfile b/scanners/typo3scan/parser/Dockerfile index 1eaf917120..523c4b8dec 100644 --- a/scanners/typo3scan/parser/Dockerfile +++ b/scanners/typo3scan/parser/Dockerfile @@ -2,6 +2,7 @@ # # SPDX-License-Identifier: Apache-2.0 +ARG namespace ARG baseImageTag FROM node:12-alpine as build RUN mkdir -p /home/app @@ -11,5 +12,5 @@ RUN npm ci --production FROM securecodebox/parser-sdk-nodejs:${baseImageTag:-latest} WORKDIR /home/app/parser-wrapper/parser/ -COPY --from=build --chown=app:app /home/app/node_modules/ ./node_modules/ +#COPY --from=build --chown=app:app /home/app/node_modules/ ./node_modules/ # TODO No external Dependencies are installed (so no node_modules folder) COPY --chown=app:app ./parser.js ./parser.js \ No newline at end of file diff --git a/scanners/typo3scan/parser/__testFiles__/empty.jsonl b/scanners/typo3scan/parser/__testFiles__/empty.jsonl new file mode 100644 index 0000000000..e69de29bb2 diff --git a/scanners/typo3scan/parser/__testFiles__/localhost.jsonl b/scanners/typo3scan/parser/__testFiles__/localhost.jsonl new file mode 100644 index 0000000000..9f92b52f9b --- /dev/null +++ b/scanners/typo3scan/parser/__testFiles__/localhost.jsonl @@ -0,0 +1,437 @@ +{ + "http://localhost:80":{ + "Backend":"http://localhost:80/typo3/index.php", + "Version":"8.7", + "Vulnerabilities":[ + { + "Advisory":"TYPO3-CORE-SA-2019-026", + "Type":"Insecure Deserialization", + "Subcomponent":"Query Generator & Query View (ext:lowlevel, ext:core)", + "Affected":"8.7.29 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-026" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-025", + "Type":"SQL Injection", + "Subcomponent":"Query Generator (ext:lowlevel)", + "Affected":"8.7.29 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-025" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-024", + "Type":"Directory Traversal", + "Subcomponent":"Extension Manager (ext:extensionmanger)", + "Affected":"8.7.29 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-024" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-023", + "Type":"Cross-Site Scripting", + "Subcomponent":"Filelist Module (ext:filelist)", + "Affected":"8.7.29 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-023" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-022", + "Type":"Cross-Site Scripting", + "Subcomponent":"Link Handling (ext:core, ext:frontend)", + "Affected":"8.7.29 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-022" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-021", + "Type":"Cross-Site Scripting", + "Subcomponent":"Form Framework (ext:form)", + "Affected":"8.7.29 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-021" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-020", + "Type":"Insecure Deserialization", + "Subcomponent":"Backend & Core API (ext:backend, ext:core)", + "Affected":"8.7.26 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-020" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-019", + "Type":"Arbitrary Code Execution, Cross-Site Scripting", + "Subcomponent":"Backend API (ext:backend)", + "Affected":"8.7.26 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-019" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-018", + "Type":"Security Misconfiguration", + "Subcomponent":"Frontend Session Handling (ext:frontend)", + "Affected":"8.7.26 - 8.5.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-018" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-015", + "Type":"Cross-Site Scripting", + "Subcomponent":"Link Handling (ext:core)", + "Affected":"8.7.26 - 8.3.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-015" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-014", + "Type":"Information Disclosure", + "Subcomponent":"Backend User Interface (ext:backend)", + "Affected":"8.7.26 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-014" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-013", + "Type":"Cross-Site Scripting", + "Subcomponent":"Fluid Engine (package typo3fluid/fluid)", + "Affected":"8.7.24 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-013" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-012", + "Type":"Arbitrary Code Execution", + "Subcomponent":"Image Processing via ImageMagick (ext:core)", + "Affected":"8.7.24 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-012" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-011", + "Type":"Security Misconfiguration", + "Subcomponent":"User Session Handling (ext:core)", + "Affected":"8.7.24 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-011" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-008", + "Type":"Arbitrary Code Execution", + "Subcomponent":"File List (ext:filelist)", + "Affected":"8.7.22 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-008" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-007", + "Type":"Cross-Site Scripting", + "Subcomponent":"Form Framework (ext:form)", + "Affected":"8.7.22 - 8.5.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-007" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-006", + "Type":"Cross-Site Scripting", + "Subcomponent":"3rd party library Bootstrap CSS toolkit", + "Affected":"8.7.22 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-006" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-005", + "Type":"Cross-Site Scripting", + "Subcomponent":"Fluid (ext:fluid)", + "Affected":"8.7.22 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-005" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-003", + "Type":"Broken Access Control", + "Subcomponent":"Localization Handling", + "Affected":"8.7.22 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-003" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-002", + "Type":"Security Misconfiguration", + "Subcomponent":"Backend User Account Model (ext:core)", + "Affected":"8.7.22 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-002" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-001", + "Type":"Information Disclosure", + "Subcomponent":"RequireJS package configuration", + "Affected":"8.7.22 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-001" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-012", + "Type":"Denial of Service", + "Subcomponent":"Frontend Session Handling", + "Affected":"8.7.20 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-012" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-011", + "Type":"Denial of Service", + "Subcomponent":"Online media asset handling", + "Affected":"8.7.20 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-011" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-010", + "Type":"Information Disclosure", + "Subcomponent":"Install Tool", + "Affected":"8.7.20 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-010" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-009", + "Type":"Security Misconfiguration", + "Subcomponent":"Install Tool Session Handling", + "Affected":"8.7.20 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-009" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-008", + "Type":"Cross-Site Scripting", + "Subcomponent":"Frontend user login", + "Affected":"8.7.20 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-008" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-007", + "Type":"Cross-Site Scripting", + "Subcomponent":"Backend modal component", + "Affected":"8.7.20 - 8.5.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-007" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-006", + "Type":"Cross-Site Scripting", + "Subcomponent":"Online media asset rendering", + "Affected":"8.7.20 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-006" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-005", + "Type":"Cross-Site Scripting", + "Subcomponent":"3rd party JavaScript library CKEditor", + "Affected":"8.7.20 - 8.5.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-005" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-004", + "Type":"Insecure Deserialization", + "Subcomponent":"Form Framework (ext:form)", + "Affected":"8.7.16 - 8.5.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-004" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-003", + "Type":"Privilege Escalation & SQL Injection", + "Subcomponent":"Form Framework (ext:form)", + "Affected":"8.7.16 - 8.5.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-003" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-002", + "Type":"Insecure Deserialization & Arbitrary Code Execution", + "Subcomponent":"TYPO3 CMS", + "Affected":"8.7.16 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-002" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-001", + "Type":"Authentication Bypass", + "Subcomponent":"Salted Passwords (ext:saltedpasswords)", + "Affected":"8.7.16 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-001" + }, + { + "Advisory":"TYPO3-CORE-SA-2017-007", + "Type":"Arbitrary Code Execution", + "Subcomponent":"TYPO3 CMS", + "Affected":"8.7.4 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2017-007" + }, + { + "Advisory":"TYPO3-CORE-SA-2017-005", + "Type":"Information Disclosure", + "Subcomponent":"TYPO3 CMS", + "Affected":"8.7.4 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2017-005" + }, + { + "Advisory":"TYPO3-CORE-SA-2017-006", + "Type":"Information Disclosure", + "Subcomponent":"TYPO3 CMS", + "Affected":"8.7.4 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2017-006" + }, + { + "Advisory":"TYPO3-CORE-SA-2017-004", + "Type":"Cross-Site Scripting", + "Subcomponent":"TYPO3 CMS", + "Affected":"8.7.4 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2017-004" + }, + { + "Advisory":"TYPO3-CORE-SA-2020-011", + "Type":"Sensitive Data Exposure", + "Subcomponent":"Session Storage (ext:core)", + "Affected":"8.7.37 - 8.7.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2020-011" + }, + { + "Advisory":"TYPO3-CORE-SA-2020-010", + "Type":"Cross-Site Scripting", + "Subcomponent":"Fluid (ext:fluid)", + "Affected":"8.7.37 - 8.7.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2020-010" + }, + { + "Advisory":"TYPO3-CORE-SA-2020-009", + "Type":"Cross-Site Scripting", + "Subcomponent":"Fluid Engine (package typo3fluid/fluid)", + "Affected":"8.7.37 - 8.7.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2020-009" + }, + { + "Advisory":"TYPO3-CORE-SA-2021-008", + "Type":"Cross-Site Scripting", + "Subcomponent":"Content Preview Renderer (ext:backend)", + "Affected":"8.7.39 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-008" + }, + { + "Advisory":"TYPO3-CORE-SA-2021-006", + "Type":"Sensitive Data Exposure", + "Subcomponent":"Session Storage (ext:core)", + "Affected":"8.7.39 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-006" + }, + { + "Advisory":"TYPO3-CORE-SA-2021-003", + "Type":"Broken Access Control", + "Subcomponent":"Form Framework (ext:form)", + "Affected":"8.7.39 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-003" + }, + { + "Advisory":"TYPO3-CORE-SA-2021-002", + "Type":"Unrestricted File Upload", + "Subcomponent":"Form Framework (ext:form)", + "Affected":"8.7.39 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-002" + }, + { + "Advisory":"TYPO3-CORE-SA-2021-001", + "Type":"Open Redirection", + "Subcomponent":"Login Handling (ext:core)", + "Affected":"8.7.39 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-001" + }, + { + "Advisory":"TYPO3-CORE-SA-2021-013", + "Type":"Cross-Site-Scripting", + "Subcomponent":"Content Rendering, HTML Parser (ext:frontend, ext:core)", + "Affected":"8.7.41 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-013" + }, + { + "Advisory":"TYPO3-CORE-SA-2021-012", + "Type":"Information Disclosure", + "Subcomponent":"User Authentication (ext:core)", + "Affected":"8.7.40 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-012" + }, + { + "Advisory":"TYPO3-CORE-SA-2021-011", + "Type":"Cross-Site Scripting", + "Subcomponent":"Backend Grid View (ext:backend)", + "Affected":"8.7.40 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-011" + }, + { + "Advisory":"TYPO3-CORE-SA-2021-010", + "Type":"Cross-Site Scripting", + "Subcomponent":"Query Generator & Query View (ext:lowlevel, ext:core)", + "Affected":"8.7.40 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-010" + } + ], + "Extensions":[ + { + "Name":"extbase", + "Title":"Log4Php", + "Repo":"https://extensions.typo3.org/extension/extbase", + "Current":"1.1.1 (alpha)", + "Url":"http://localhost:80/typo3/sysext/extbase/", + "Version":"unknown", + "Version File":"not found", + "Vulnerabilities":[ + + ] + }, + { + "Name":"feedit", + "Title":"Frontend Editing", + "Repo":"https://extensions.typo3.org/extension/feedit", + "Current":"10.0.2 (stable)", + "Url":"http://localhost:80/typo3/sysext/feedit/", + "Version":"unknown", + "Version File":"not found", + "Vulnerabilities":[ + + ] + }, + { + "Name":"func", + "Title":"WebFunc", + "Repo":"https://extensions.typo3.org/extension/func", + "Current":"9.0.1 (stable)", + "Url":"http://localhost:80/typo3/sysext/func/", + "Version":"unknown", + "Version File":"not found", + "Vulnerabilities":[ + + ] + }, + { + "Name":"rsaauth", + "Title":"RSA authentication for TYPO3", + "Repo":"https://extensions.typo3.org/extension/rsaauth", + "Current":"10.0.1 (deprecated)", + "Url":"http://localhost:80/typo3/sysext/rsaauth/", + "Version":"unknown", + "Version File":"not found", + "Vulnerabilities":[ + + ] + }, + { + "Name":"sys_action", + "Title":"UserTask Center, Actions", + "Repo":"https://extensions.typo3.org/extension/sys_action", + "Current":"10.0.0 (stable)", + "Url":"http://localhost:80/typo3/sysext/sys_action/", + "Version":"unknown", + "Version File":"not found", + "Vulnerabilities":[ + + ] + }, + { + "Name":"taskcenter", + "Title":"UserTask Center", + "Repo":"https://extensions.typo3.org/extension/taskcenter", + "Current":"10.0.0 (stable)", + "Url":"http://localhost:80/typo3/sysext/taskcenter/", + "Version":"unknown", + "Version File":"not found", + "Vulnerabilities":[ + + ] + }, + { + "Name":"tstemplate", + "Title":"WebTemplate", + "Repo":"https://extensions.typo3.org/extension/tstemplate", + "Current":"0.0.5 (stable)", + "Url":"http://localhost:80/typo3/sysext/tstemplate/", + "Version":"unknown", + "Version File":"not found", + "Vulnerabilities":[ + + ] + } + ] + } +} \ No newline at end of file diff --git a/scanners/typo3scan/parser/package-lock.json b/scanners/typo3scan/parser/package-lock.json new file mode 100644 index 0000000000..9d7e47cb35 --- /dev/null +++ b/scanners/typo3scan/parser/package-lock.json @@ -0,0 +1,8 @@ +{ + "name": "typo3scan-parser", + "version": "1.0.0", + "lockfileVersion": 1, + "requires": true, + "dependencies": { + } +} diff --git a/scanners/typo3scan/parser/parser.js b/scanners/typo3scan/parser/parser.js index c869a90a2f..7fef367a41 100644 --- a/scanners/typo3scan/parser/parser.js +++ b/scanners/typo3scan/parser/parser.js @@ -39,13 +39,19 @@ async function parse(fileContent) { // Parsing Extenstions let extensions = parsed_findings.Extensions let parsed_extensions = extensions.map((ext) => { + + // Check if extension has vulnerabilities : if yes severity = HIGH + let severity = 'INFORMATIONAL' + if ( ext.Vulnerabilities.length > 0) { + severity = 'HIGH' + } return { name: ext.Name, description: `Extension ${ext.Name} (${ext.Title}) found`, category: "Extension", location: ext.Url, osi_layer: "APPLICATION", - severity: "INFORMATIONAL", + severity: severity, attributes: { Typo3_Version: parsed_findings.Version, Repository: ext.Repo, @@ -59,5 +65,4 @@ async function parse(fileContent) { let results = parsed_vulnerabilities.concat(parsed_extensions) return results } - module.exports.parse = parse; \ No newline at end of file diff --git a/scanners/typo3scan/parser/parser.test.js b/scanners/typo3scan/parser/parser.test.js new file mode 100644 index 0000000000..d592dd4530 --- /dev/null +++ b/scanners/typo3scan/parser/parser.test.js @@ -0,0 +1,38 @@ +// SPDX-FileCopyrightText: 2021 iteratec GmbH +// +// SPDX-License-Identifier: Apache-2.0 + +const fs = require("fs"); +const util = require("util"); + +const readFile = util.promisify(fs.readFile); + +const { parse } = require("./parser"); + +const { + validateParser, +} = require("@securecodebox/parser-sdk-nodejs/parser-utils"); + +test("example parser parses empty json files to zero findings", async () => { + const fileContent = await readFile(__dirname + "/__testFiles__/empty.jsonl", { + encoding: "utf8", + }); + + const findings = await parse(fileContent); + await expect(validateParser(findings)).resolves.toBeUndefined(); + expect(findings).toEqual([]); +}); + +test("example parser parses large json result successfully", async () => { + const fileContent = await readFile( + __dirname + "/__testFiles__/localhost.jsonl", + { + encoding: "utf8", + } + ); + + const findings = await parse(fileContent); + await expect(validateParser(findings)).resolves.toBeUndefined(); + expect(findings).toMatchSnapshot(); + }); + // TODO how to run these tests locally ("npx jest parser.test.js" ?? ) \ No newline at end of file diff --git a/scanners/typo3scan/templates/NOTES.txt b/scanners/typo3scan/templates/NOTES.txt deleted file mode 100644 index 6973440292..0000000000 --- a/scanners/typo3scan/templates/NOTES.txt +++ /dev/null @@ -1,22 +0,0 @@ -1. Get the application URL by running these commands: -{{- if .Values.ingress.enabled }} -{{- range $host := .Values.ingress.hosts }} - {{- range .paths }} - http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }} - {{- end }} -{{- end }} -{{- else if contains "NodePort" .Values.service.type }} - export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "typo3scan.fullname" . }}) - export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") - echo http://$NODE_IP:$NODE_PORT -{{- else if contains "LoadBalancer" .Values.service.type }} - NOTE: It may take a few minutes for the LoadBalancer IP to be available. - You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "typo3scan.fullname" . }}' - export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "typo3scan.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}") - echo http://$SERVICE_IP:{{ .Values.service.port }} -{{- else if contains "ClusterIP" .Values.service.type }} - export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "typo3scan.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") - export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}") - echo "Visit http://127.0.0.1:8080 to use your application" - kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT -{{- end }} diff --git a/scanners/typo3scan/templates/_helpers.tpl b/scanners/typo3scan/templates/_helpers.tpl deleted file mode 100644 index 81cabd0fd6..0000000000 --- a/scanners/typo3scan/templates/_helpers.tpl +++ /dev/null @@ -1,62 +0,0 @@ -{{/* -Expand the name of the chart. -*/}} -{{- define "typo3scan.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} -{{- end }} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "typo3scan.fullname" -}} -{{- if .Values.fullnameOverride }} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} -{{- else }} -{{- $name := default .Chart.Name .Values.nameOverride }} -{{- if contains $name .Release.Name }} -{{- .Release.Name | trunc 63 | trimSuffix "-" }} -{{- else }} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} -{{- end }} -{{- end }} -{{- end }} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "typo3scan.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} -{{- end }} - -{{/* -Common labels -*/}} -{{- define "typo3scan.labels" -}} -helm.sh/chart: {{ include "typo3scan.chart" . }} -{{ include "typo3scan.selectorLabels" . }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end }} - -{{/* -Selector labels -*/}} -{{- define "typo3scan.selectorLabels" -}} -app.kubernetes.io/name: {{ include "typo3scan.name" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- end }} - -{{/* -Create the name of the service account to use -*/}} -{{- define "typo3scan.serviceAccountName" -}} -{{- if .Values.serviceAccount.create }} -{{- default (include "typo3scan.fullname" .) .Values.serviceAccount.name }} -{{- else }} -{{- default "default" .Values.serviceAccount.name }} -{{- end }} -{{- end }} diff --git a/scanners/typo3scan/templates/cascading-rules.yaml b/scanners/typo3scan/templates/cascading-rules.yaml new file mode 100644 index 0000000000..de24d1fc3d --- /dev/null +++ b/scanners/typo3scan/templates/cascading-rules.yaml @@ -0,0 +1,9 @@ +# We only want to import the default cascading rules if they are enabled +{{ if .Values.cascadingRules.enabled }} +{{ range $path, $_ := .Files.Glob "cascading-rules/*" }} +# Include File +{{ $.Files.Get $path }} +# Separate multiple files +--- +{{ end }} +{{ end }} \ No newline at end of file diff --git a/scanners/typo3scan/templates/deployment.yaml b/scanners/typo3scan/templates/deployment.yaml deleted file mode 100644 index fe31fa948d..0000000000 --- a/scanners/typo3scan/templates/deployment.yaml +++ /dev/null @@ -1,61 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ include "typo3scan.fullname" . }} - labels: - {{- include "typo3scan.labels" . | nindent 4 }} -spec: - {{- if not .Values.autoscaling.enabled }} - replicas: {{ .Values.replicaCount }} - {{- end }} - selector: - matchLabels: - {{- include "typo3scan.selectorLabels" . | nindent 6 }} - template: - metadata: - {{- with .Values.podAnnotations }} - annotations: - {{- toYaml . | nindent 8 }} - {{- end }} - labels: - {{- include "typo3scan.selectorLabels" . | nindent 8 }} - spec: - {{- with .Values.imagePullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - serviceAccountName: {{ include "typo3scan.serviceAccountName" . }} - securityContext: - {{- toYaml .Values.podSecurityContext | nindent 8 }} - containers: - - name: {{ .Chart.Name }} - securityContext: - {{- toYaml .Values.securityContext | nindent 12 }} - image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" - imagePullPolicy: {{ .Values.image.pullPolicy }} - ports: - - name: http - containerPort: 80 - protocol: TCP - livenessProbe: - httpGet: - path: / - port: http - readinessProbe: - httpGet: - path: / - port: http - resources: - {{- toYaml .Values.resources | nindent 12 }} - {{- with .Values.nodeSelector }} - nodeSelector: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.affinity }} - affinity: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.tolerations }} - tolerations: - {{- toYaml . | nindent 8 }} - {{- end }} diff --git a/scanners/typo3scan/templates/hpa.yaml b/scanners/typo3scan/templates/hpa.yaml deleted file mode 100644 index 0198434fe4..0000000000 --- a/scanners/typo3scan/templates/hpa.yaml +++ /dev/null @@ -1,28 +0,0 @@ -{{- if .Values.autoscaling.enabled }} -apiVersion: autoscaling/v2beta1 -kind: HorizontalPodAutoscaler -metadata: - name: {{ include "typo3scan.fullname" . }} - labels: - {{- include "typo3scan.labels" . | nindent 4 }} -spec: - scaleTargetRef: - apiVersion: apps/v1 - kind: Deployment - name: {{ include "typo3scan.fullname" . }} - minReplicas: {{ .Values.autoscaling.minReplicas }} - maxReplicas: {{ .Values.autoscaling.maxReplicas }} - metrics: - {{- if .Values.autoscaling.targetCPUUtilizationPercentage }} - - type: Resource - resource: - name: cpu - targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }} - {{- end }} - {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }} - - type: Resource - resource: - name: memory - targetAverageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }} - {{- end }} -{{- end }} diff --git a/scanners/typo3scan/templates/ingress.yaml b/scanners/typo3scan/templates/ingress.yaml deleted file mode 100644 index 07a78a1ffd..0000000000 --- a/scanners/typo3scan/templates/ingress.yaml +++ /dev/null @@ -1,61 +0,0 @@ -{{- if .Values.ingress.enabled -}} -{{- $fullName := include "typo3scan.fullname" . -}} -{{- $svcPort := .Values.service.port -}} -{{- if and .Values.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }} - {{- if not (hasKey .Values.ingress.annotations "kubernetes.io/ingress.class") }} - {{- $_ := set .Values.ingress.annotations "kubernetes.io/ingress.class" .Values.ingress.className}} - {{- end }} -{{- end }} -{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}} -apiVersion: networking.k8s.io/v1 -{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}} -apiVersion: networking.k8s.io/v1beta1 -{{- else -}} -apiVersion: extensions/v1beta1 -{{- end }} -kind: Ingress -metadata: - name: {{ $fullName }} - labels: - {{- include "typo3scan.labels" . | nindent 4 }} - {{- with .Values.ingress.annotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} -spec: - {{- if and .Values.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }} - ingressClassName: {{ .Values.ingress.className }} - {{- end }} - {{- if .Values.ingress.tls }} - tls: - {{- range .Values.ingress.tls }} - - hosts: - {{- range .hosts }} - - {{ . | quote }} - {{- end }} - secretName: {{ .secretName }} - {{- end }} - {{- end }} - rules: - {{- range .Values.ingress.hosts }} - - host: {{ .host | quote }} - http: - paths: - {{- range .paths }} - - path: {{ .path }} - {{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }} - pathType: {{ .pathType }} - {{- end }} - backend: - {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }} - service: - name: {{ $fullName }} - port: - number: {{ $svcPort }} - {{- else }} - serviceName: {{ $fullName }} - servicePort: {{ $svcPort }} - {{- end }} - {{- end }} - {{- end }} -{{- end }} diff --git a/scanners/typo3scan/templates/service.yaml b/scanners/typo3scan/templates/service.yaml deleted file mode 100644 index 3f6be05287..0000000000 --- a/scanners/typo3scan/templates/service.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: {{ include "typo3scan.fullname" . }} - labels: - {{- include "typo3scan.labels" . | nindent 4 }} -spec: - type: {{ .Values.service.type }} - ports: - - port: {{ .Values.service.port }} - targetPort: http - protocol: TCP - name: http - selector: - {{- include "typo3scan.selectorLabels" . | nindent 4 }} diff --git a/scanners/typo3scan/templates/serviceaccount.yaml b/scanners/typo3scan/templates/serviceaccount.yaml deleted file mode 100644 index 4f7443a1c8..0000000000 --- a/scanners/typo3scan/templates/serviceaccount.yaml +++ /dev/null @@ -1,12 +0,0 @@ -{{- if .Values.serviceAccount.create -}} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ include "typo3scan.serviceAccountName" . }} - labels: - {{- include "typo3scan.labels" . | nindent 4 }} - {{- with .Values.serviceAccount.annotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} -{{- end }} diff --git a/scanners/typo3scan/templates/tests/test-connection.yaml b/scanners/typo3scan/templates/tests/test-connection.yaml deleted file mode 100644 index 40fd70039c..0000000000 --- a/scanners/typo3scan/templates/tests/test-connection.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: v1 -kind: Pod -metadata: - name: "{{ include "typo3scan.fullname" . }}-test-connection" - labels: - {{- include "typo3scan.labels" . | nindent 4 }} - annotations: - "helm.sh/hook": test -spec: - containers: - - name: wget - image: busybox - command: ['wget'] - args: ['{{ include "typo3scan.fullname" . }}:{{ .Values.service.port }}'] - restartPolicy: Never diff --git a/scanners/typo3scan/templates/typ3scan-parse-definition.yaml b/scanners/typo3scan/templates/typ3scan-parse-definition.yaml new file mode 100644 index 0000000000..38f32230f4 --- /dev/null +++ b/scanners/typo3scan/templates/typ3scan-parse-definition.yaml @@ -0,0 +1,9 @@ +apiVersion: execution.securecodebox.io/v1 +kind: ParseDefinition +metadata: + name: zap-json +spec: + image: docker.io/securecodebox/parser-zap + imagePullSecrets: + - name: dockerhub-token + ttlSecondsAfterFinished: 60 \ No newline at end of file diff --git a/scanners/typo3scan/templates/typo3scan-scan-type.yaml b/scanners/typo3scan/templates/typo3scan-scan-type.yaml new file mode 100644 index 0000000000..3d2cd2a044 --- /dev/null +++ b/scanners/typo3scan/templates/typo3scan-scan-type.yaml @@ -0,0 +1,19 @@ +apiVersion: "execution.securecodebox.io/v1" +kind: ScanType +metadata: + name: "typo3scan" +spec: + extractResults: + type: typo3scan-json + location: "/home/securecodebox/typo3scan-results.json" + jobTemplate: + spec: + ttlSecondsAfterFinished: 10 + template: + spec: + restartPolicy: Never + containers: + - name: typo3scan + image: "{{ .Values.scanner.image.repository }}:{{ .Values.scanner.image.tag | default .Chart.AppVersion }}" + command: + - "typo3scan.py " # TODO : Wrapper.sh already calls this ? \ No newline at end of file From f5d3486dba577f43f8159e9c73e3ee9d70073397 Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Mon, 23 Aug 2021 13:38:27 +0200 Subject: [PATCH 20/42] added gitkeep to add docs folder Signed-off-by: Ilyes Ben Dlala --- scanners/typo3scan/docs/.gitkeep | 0 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 scanners/typo3scan/docs/.gitkeep diff --git a/scanners/typo3scan/docs/.gitkeep b/scanners/typo3scan/docs/.gitkeep new file mode 100644 index 0000000000..e69de29bb2 From 0eb1ef005dd5c45f692e03cf5e5023e0f2cf052c Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Mon, 23 Aug 2021 16:05:55 +0200 Subject: [PATCH 21/42] Fixed parser.js and added unit tests Signed-off-by: Ilyes Ben Dlala --- .../parser/__snapshots__/parser.test.js.snap | 1713 +++++++++++++++++ scanners/typo3scan/parser/parser.js | 98 +- scanners/typo3scan/parser/parser.test.js | 44 +- 3 files changed, 1783 insertions(+), 72 deletions(-) create mode 100644 scanners/typo3scan/parser/__snapshots__/parser.test.js.snap diff --git a/scanners/typo3scan/parser/__snapshots__/parser.test.js.snap b/scanners/typo3scan/parser/__snapshots__/parser.test.js.snap new file mode 100644 index 0000000000..ac05510fe3 --- /dev/null +++ b/scanners/typo3scan/parser/__snapshots__/parser.test.js.snap @@ -0,0 +1,1713 @@ +// Jest Snapshot v1, https://goo.gl/fbAQLP + +exports[`example parser parses large json result successfully 1`] = ` +Array [ + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-026", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-026", + "subcomponent": "Query Generator & Query View (ext:lowlevel, ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.29 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Insecure Deserialization found", + "location": "http://localhost:80", + "name": "Insecure Deserialization", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-025", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-025", + "subcomponent": "Query Generator (ext:lowlevel)", + "typo3_version": "8.7", + "versions_affected": "8.7.29 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type SQL Injection found", + "location": "http://localhost:80", + "name": "SQL Injection", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-024", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-024", + "subcomponent": "Extension Manager (ext:extensionmanger)", + "typo3_version": "8.7", + "versions_affected": "8.7.29 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Directory Traversal found", + "location": "http://localhost:80", + "name": "Directory Traversal", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-023", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-023", + "subcomponent": "Filelist Module (ext:filelist)", + "typo3_version": "8.7", + "versions_affected": "8.7.29 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-022", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-022", + "subcomponent": "Link Handling (ext:core, ext:frontend)", + "typo3_version": "8.7", + "versions_affected": "8.7.29 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-021", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-021", + "subcomponent": "Form Framework (ext:form)", + "typo3_version": "8.7", + "versions_affected": "8.7.29 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-020", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-020", + "subcomponent": "Backend & Core API (ext:backend, ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.26 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Insecure Deserialization found", + "location": "http://localhost:80", + "name": "Insecure Deserialization", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-019", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-019", + "subcomponent": "Backend API (ext:backend)", + "typo3_version": "8.7", + "versions_affected": "8.7.26 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Arbitrary Code Execution, Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Arbitrary Code Execution, Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-018", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-018", + "subcomponent": "Frontend Session Handling (ext:frontend)", + "typo3_version": "8.7", + "versions_affected": "8.7.26 - 8.5.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Security Misconfiguration found", + "location": "http://localhost:80", + "name": "Security Misconfiguration", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-015", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-015", + "subcomponent": "Link Handling (ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.26 - 8.3.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-014", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-014", + "subcomponent": "Backend User Interface (ext:backend)", + "typo3_version": "8.7", + "versions_affected": "8.7.26 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Information Disclosure found", + "location": "http://localhost:80", + "name": "Information Disclosure", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-013", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-013", + "subcomponent": "Fluid Engine (package typo3fluid/fluid)", + "typo3_version": "8.7", + "versions_affected": "8.7.24 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-012", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-012", + "subcomponent": "Image Processing via ImageMagick (ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.24 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Arbitrary Code Execution found", + "location": "http://localhost:80", + "name": "Arbitrary Code Execution", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-011", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-011", + "subcomponent": "User Session Handling (ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.24 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Security Misconfiguration found", + "location": "http://localhost:80", + "name": "Security Misconfiguration", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-008", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-008", + "subcomponent": "File List (ext:filelist)", + "typo3_version": "8.7", + "versions_affected": "8.7.22 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Arbitrary Code Execution found", + "location": "http://localhost:80", + "name": "Arbitrary Code Execution", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-007", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-007", + "subcomponent": "Form Framework (ext:form)", + "typo3_version": "8.7", + "versions_affected": "8.7.22 - 8.5.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-006", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-006", + "subcomponent": "3rd party library Bootstrap CSS toolkit", + "typo3_version": "8.7", + "versions_affected": "8.7.22 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-005", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-005", + "subcomponent": "Fluid (ext:fluid)", + "typo3_version": "8.7", + "versions_affected": "8.7.22 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-003", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-003", + "subcomponent": "Localization Handling", + "typo3_version": "8.7", + "versions_affected": "8.7.22 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Broken Access Control found", + "location": "http://localhost:80", + "name": "Broken Access Control", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-002", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-002", + "subcomponent": "Backend User Account Model (ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.22 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Security Misconfiguration found", + "location": "http://localhost:80", + "name": "Security Misconfiguration", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-001", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-001", + "subcomponent": "RequireJS package configuration", + "typo3_version": "8.7", + "versions_affected": "8.7.22 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Information Disclosure found", + "location": "http://localhost:80", + "name": "Information Disclosure", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-012", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-012", + "subcomponent": "Frontend Session Handling", + "typo3_version": "8.7", + "versions_affected": "8.7.20 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Denial of Service found", + "location": "http://localhost:80", + "name": "Denial of Service", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-011", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-011", + "subcomponent": "Online media asset handling", + "typo3_version": "8.7", + "versions_affected": "8.7.20 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Denial of Service found", + "location": "http://localhost:80", + "name": "Denial of Service", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-010", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-010", + "subcomponent": "Install Tool", + "typo3_version": "8.7", + "versions_affected": "8.7.20 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Information Disclosure found", + "location": "http://localhost:80", + "name": "Information Disclosure", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-009", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-009", + "subcomponent": "Install Tool Session Handling", + "typo3_version": "8.7", + "versions_affected": "8.7.20 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Security Misconfiguration found", + "location": "http://localhost:80", + "name": "Security Misconfiguration", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-008", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-008", + "subcomponent": "Frontend user login", + "typo3_version": "8.7", + "versions_affected": "8.7.20 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-007", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-007", + "subcomponent": "Backend modal component", + "typo3_version": "8.7", + "versions_affected": "8.7.20 - 8.5.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-006", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-006", + "subcomponent": "Online media asset rendering", + "typo3_version": "8.7", + "versions_affected": "8.7.20 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-005", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-005", + "subcomponent": "3rd party JavaScript library CKEditor", + "typo3_version": "8.7", + "versions_affected": "8.7.20 - 8.5.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-004", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-004", + "subcomponent": "Form Framework (ext:form)", + "typo3_version": "8.7", + "versions_affected": "8.7.16 - 8.5.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Insecure Deserialization found", + "location": "http://localhost:80", + "name": "Insecure Deserialization", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-003", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-003", + "subcomponent": "Form Framework (ext:form)", + "typo3_version": "8.7", + "versions_affected": "8.7.16 - 8.5.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Privilege Escalation & SQL Injection found", + "location": "http://localhost:80", + "name": "Privilege Escalation & SQL Injection", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-002", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-002", + "subcomponent": "TYPO3 CMS", + "typo3_version": "8.7", + "versions_affected": "8.7.16 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Insecure Deserialization & Arbitrary Code Execution found", + "location": "http://localhost:80", + "name": "Insecure Deserialization & Arbitrary Code Execution", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-001", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-001", + "subcomponent": "Salted Passwords (ext:saltedpasswords)", + "typo3_version": "8.7", + "versions_affected": "8.7.16 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Authentication Bypass found", + "location": "http://localhost:80", + "name": "Authentication Bypass", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2017-007", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2017-007", + "subcomponent": "TYPO3 CMS", + "typo3_version": "8.7", + "versions_affected": "8.7.4 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Arbitrary Code Execution found", + "location": "http://localhost:80", + "name": "Arbitrary Code Execution", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2017-005", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2017-005", + "subcomponent": "TYPO3 CMS", + "typo3_version": "8.7", + "versions_affected": "8.7.4 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Information Disclosure found", + "location": "http://localhost:80", + "name": "Information Disclosure", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2017-006", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2017-006", + "subcomponent": "TYPO3 CMS", + "typo3_version": "8.7", + "versions_affected": "8.7.4 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Information Disclosure found", + "location": "http://localhost:80", + "name": "Information Disclosure", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2017-004", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2017-004", + "subcomponent": "TYPO3 CMS", + "typo3_version": "8.7", + "versions_affected": "8.7.4 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2020-011", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2020-011", + "subcomponent": "Session Storage (ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.37 - 8.7.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Sensitive Data Exposure found", + "location": "http://localhost:80", + "name": "Sensitive Data Exposure", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2020-010", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2020-010", + "subcomponent": "Fluid (ext:fluid)", + "typo3_version": "8.7", + "versions_affected": "8.7.37 - 8.7.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2020-009", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2020-009", + "subcomponent": "Fluid Engine (package typo3fluid/fluid)", + "typo3_version": "8.7", + "versions_affected": "8.7.37 - 8.7.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2021-008", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-008", + "subcomponent": "Content Preview Renderer (ext:backend)", + "typo3_version": "8.7", + "versions_affected": "8.7.39 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2021-006", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-006", + "subcomponent": "Session Storage (ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.39 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Sensitive Data Exposure found", + "location": "http://localhost:80", + "name": "Sensitive Data Exposure", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2021-003", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-003", + "subcomponent": "Form Framework (ext:form)", + "typo3_version": "8.7", + "versions_affected": "8.7.39 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Broken Access Control found", + "location": "http://localhost:80", + "name": "Broken Access Control", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2021-002", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-002", + "subcomponent": "Form Framework (ext:form)", + "typo3_version": "8.7", + "versions_affected": "8.7.39 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Unrestricted File Upload found", + "location": "http://localhost:80", + "name": "Unrestricted File Upload", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2021-001", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-001", + "subcomponent": "Login Handling (ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.39 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Open Redirection found", + "location": "http://localhost:80", + "name": "Open Redirection", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2021-013", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-013", + "subcomponent": "Content Rendering, HTML Parser (ext:frontend, ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.41 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site-Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site-Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2021-012", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-012", + "subcomponent": "User Authentication (ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.40 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Information Disclosure found", + "location": "http://localhost:80", + "name": "Information Disclosure", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2021-011", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-011", + "subcomponent": "Backend Grid View (ext:backend)", + "typo3_version": "8.7", + "versions_affected": "8.7.40 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2021-010", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-010", + "subcomponent": "Query Generator & Query View (ext:lowlevel, ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.40 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "extension_Version": "unknown", + "repository": "https://extensions.typo3.org/extension/extbase", + "typo3_version": "8.7", + "version_file": "not found", + "vulnerabilities": Array [], + }, + "category": "Extension", + "description": "Extension extbase (Log4Php) found", + "location": "http://localhost:80/typo3/sysext/extbase/", + "name": "extbase", + "osi_layer": "APPLICATION", + "severity": "INFORMATIONAL", + }, + Object { + "attributes": Object { + "extension_Version": "unknown", + "repository": "https://extensions.typo3.org/extension/feedit", + "typo3_version": "8.7", + "version_file": "not found", + "vulnerabilities": Array [], + }, + "category": "Extension", + "description": "Extension feedit (Frontend Editing) found", + "location": "http://localhost:80/typo3/sysext/feedit/", + "name": "feedit", + "osi_layer": "APPLICATION", + "severity": "INFORMATIONAL", + }, + Object { + "attributes": Object { + "extension_Version": "unknown", + "repository": "https://extensions.typo3.org/extension/func", + "typo3_version": "8.7", + "version_file": "not found", + "vulnerabilities": Array [], + }, + "category": "Extension", + "description": "Extension func (WebFunc) found", + "location": "http://localhost:80/typo3/sysext/func/", + "name": "func", + "osi_layer": "APPLICATION", + "severity": "INFORMATIONAL", + }, + Object { + "attributes": Object { + "extension_Version": "unknown", + "repository": "https://extensions.typo3.org/extension/rsaauth", + "typo3_version": "8.7", + "version_file": "not found", + "vulnerabilities": Array [], + }, + "category": "Extension", + "description": "Extension rsaauth (RSA authentication for TYPO3) found", + "location": "http://localhost:80/typo3/sysext/rsaauth/", + "name": "rsaauth", + "osi_layer": "APPLICATION", + "severity": "INFORMATIONAL", + }, + Object { + "attributes": Object { + "extension_Version": "unknown", + "repository": "https://extensions.typo3.org/extension/sys_action", + "typo3_version": "8.7", + "version_file": "not found", + "vulnerabilities": Array [], + }, + "category": "Extension", + "description": "Extension sys_action (UserTask Center, Actions) found", + "location": "http://localhost:80/typo3/sysext/sys_action/", + "name": "sys_action", + "osi_layer": "APPLICATION", + "severity": "INFORMATIONAL", + }, + Object { + "attributes": Object { + "extension_Version": "unknown", + "repository": "https://extensions.typo3.org/extension/taskcenter", + "typo3_version": "8.7", + "version_file": "not found", + "vulnerabilities": Array [], + }, + "category": "Extension", + "description": "Extension taskcenter (UserTask Center) found", + "location": "http://localhost:80/typo3/sysext/taskcenter/", + "name": "taskcenter", + "osi_layer": "APPLICATION", + "severity": "INFORMATIONAL", + }, + Object { + "attributes": Object { + "extension_Version": "unknown", + "repository": "https://extensions.typo3.org/extension/tstemplate", + "typo3_version": "8.7", + "version_file": "not found", + "vulnerabilities": Array [], + }, + "category": "Extension", + "description": "Extension tstemplate (WebTemplate) found", + "location": "http://localhost:80/typo3/sysext/tstemplate/", + "name": "tstemplate", + "osi_layer": "APPLICATION", + "severity": "INFORMATIONAL", + }, +] +`; + +exports[`example parser parses large json result successfully 2`] = ` +Array [ + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-026", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-026", + "subcomponent": "Query Generator & Query View (ext:lowlevel, ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.29 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Insecure Deserialization found", + "location": "http://localhost:80", + "name": "Insecure Deserialization", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-025", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-025", + "subcomponent": "Query Generator (ext:lowlevel)", + "typo3_version": "8.7", + "versions_affected": "8.7.29 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type SQL Injection found", + "location": "http://localhost:80", + "name": "SQL Injection", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-024", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-024", + "subcomponent": "Extension Manager (ext:extensionmanger)", + "typo3_version": "8.7", + "versions_affected": "8.7.29 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Directory Traversal found", + "location": "http://localhost:80", + "name": "Directory Traversal", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-023", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-023", + "subcomponent": "Filelist Module (ext:filelist)", + "typo3_version": "8.7", + "versions_affected": "8.7.29 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-022", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-022", + "subcomponent": "Link Handling (ext:core, ext:frontend)", + "typo3_version": "8.7", + "versions_affected": "8.7.29 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-021", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-021", + "subcomponent": "Form Framework (ext:form)", + "typo3_version": "8.7", + "versions_affected": "8.7.29 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-020", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-020", + "subcomponent": "Backend & Core API (ext:backend, ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.26 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Insecure Deserialization found", + "location": "http://localhost:80", + "name": "Insecure Deserialization", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-019", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-019", + "subcomponent": "Backend API (ext:backend)", + "typo3_version": "8.7", + "versions_affected": "8.7.26 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Arbitrary Code Execution, Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Arbitrary Code Execution, Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-018", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-018", + "subcomponent": "Frontend Session Handling (ext:frontend)", + "typo3_version": "8.7", + "versions_affected": "8.7.26 - 8.5.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Security Misconfiguration found", + "location": "http://localhost:80", + "name": "Security Misconfiguration", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-015", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-015", + "subcomponent": "Link Handling (ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.26 - 8.3.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-014", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-014", + "subcomponent": "Backend User Interface (ext:backend)", + "typo3_version": "8.7", + "versions_affected": "8.7.26 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Information Disclosure found", + "location": "http://localhost:80", + "name": "Information Disclosure", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-013", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-013", + "subcomponent": "Fluid Engine (package typo3fluid/fluid)", + "typo3_version": "8.7", + "versions_affected": "8.7.24 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-012", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-012", + "subcomponent": "Image Processing via ImageMagick (ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.24 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Arbitrary Code Execution found", + "location": "http://localhost:80", + "name": "Arbitrary Code Execution", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-011", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-011", + "subcomponent": "User Session Handling (ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.24 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Security Misconfiguration found", + "location": "http://localhost:80", + "name": "Security Misconfiguration", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-008", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-008", + "subcomponent": "File List (ext:filelist)", + "typo3_version": "8.7", + "versions_affected": "8.7.22 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Arbitrary Code Execution found", + "location": "http://localhost:80", + "name": "Arbitrary Code Execution", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-007", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-007", + "subcomponent": "Form Framework (ext:form)", + "typo3_version": "8.7", + "versions_affected": "8.7.22 - 8.5.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-006", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-006", + "subcomponent": "3rd party library Bootstrap CSS toolkit", + "typo3_version": "8.7", + "versions_affected": "8.7.22 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-005", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-005", + "subcomponent": "Fluid (ext:fluid)", + "typo3_version": "8.7", + "versions_affected": "8.7.22 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-003", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-003", + "subcomponent": "Localization Handling", + "typo3_version": "8.7", + "versions_affected": "8.7.22 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Broken Access Control found", + "location": "http://localhost:80", + "name": "Broken Access Control", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-002", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-002", + "subcomponent": "Backend User Account Model (ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.22 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Security Misconfiguration found", + "location": "http://localhost:80", + "name": "Security Misconfiguration", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2019-001", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2019-001", + "subcomponent": "RequireJS package configuration", + "typo3_version": "8.7", + "versions_affected": "8.7.22 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Information Disclosure found", + "location": "http://localhost:80", + "name": "Information Disclosure", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-012", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-012", + "subcomponent": "Frontend Session Handling", + "typo3_version": "8.7", + "versions_affected": "8.7.20 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Denial of Service found", + "location": "http://localhost:80", + "name": "Denial of Service", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-011", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-011", + "subcomponent": "Online media asset handling", + "typo3_version": "8.7", + "versions_affected": "8.7.20 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Denial of Service found", + "location": "http://localhost:80", + "name": "Denial of Service", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-010", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-010", + "subcomponent": "Install Tool", + "typo3_version": "8.7", + "versions_affected": "8.7.20 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Information Disclosure found", + "location": "http://localhost:80", + "name": "Information Disclosure", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-009", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-009", + "subcomponent": "Install Tool Session Handling", + "typo3_version": "8.7", + "versions_affected": "8.7.20 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Security Misconfiguration found", + "location": "http://localhost:80", + "name": "Security Misconfiguration", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-008", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-008", + "subcomponent": "Frontend user login", + "typo3_version": "8.7", + "versions_affected": "8.7.20 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-007", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-007", + "subcomponent": "Backend modal component", + "typo3_version": "8.7", + "versions_affected": "8.7.20 - 8.5.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-006", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-006", + "subcomponent": "Online media asset rendering", + "typo3_version": "8.7", + "versions_affected": "8.7.20 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-005", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-005", + "subcomponent": "3rd party JavaScript library CKEditor", + "typo3_version": "8.7", + "versions_affected": "8.7.20 - 8.5.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-004", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-004", + "subcomponent": "Form Framework (ext:form)", + "typo3_version": "8.7", + "versions_affected": "8.7.16 - 8.5.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Insecure Deserialization found", + "location": "http://localhost:80", + "name": "Insecure Deserialization", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-003", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-003", + "subcomponent": "Form Framework (ext:form)", + "typo3_version": "8.7", + "versions_affected": "8.7.16 - 8.5.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Privilege Escalation & SQL Injection found", + "location": "http://localhost:80", + "name": "Privilege Escalation & SQL Injection", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-002", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-002", + "subcomponent": "TYPO3 CMS", + "typo3_version": "8.7", + "versions_affected": "8.7.16 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Insecure Deserialization & Arbitrary Code Execution found", + "location": "http://localhost:80", + "name": "Insecure Deserialization & Arbitrary Code Execution", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2018-001", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2018-001", + "subcomponent": "Salted Passwords (ext:saltedpasswords)", + "typo3_version": "8.7", + "versions_affected": "8.7.16 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Authentication Bypass found", + "location": "http://localhost:80", + "name": "Authentication Bypass", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2017-007", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2017-007", + "subcomponent": "TYPO3 CMS", + "typo3_version": "8.7", + "versions_affected": "8.7.4 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Arbitrary Code Execution found", + "location": "http://localhost:80", + "name": "Arbitrary Code Execution", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2017-005", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2017-005", + "subcomponent": "TYPO3 CMS", + "typo3_version": "8.7", + "versions_affected": "8.7.4 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Information Disclosure found", + "location": "http://localhost:80", + "name": "Information Disclosure", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2017-006", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2017-006", + "subcomponent": "TYPO3 CMS", + "typo3_version": "8.7", + "versions_affected": "8.7.4 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Information Disclosure found", + "location": "http://localhost:80", + "name": "Information Disclosure", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2017-004", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2017-004", + "subcomponent": "TYPO3 CMS", + "typo3_version": "8.7", + "versions_affected": "8.7.4 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2020-011", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2020-011", + "subcomponent": "Session Storage (ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.37 - 8.7.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Sensitive Data Exposure found", + "location": "http://localhost:80", + "name": "Sensitive Data Exposure", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2020-010", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2020-010", + "subcomponent": "Fluid (ext:fluid)", + "typo3_version": "8.7", + "versions_affected": "8.7.37 - 8.7.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2020-009", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2020-009", + "subcomponent": "Fluid Engine (package typo3fluid/fluid)", + "typo3_version": "8.7", + "versions_affected": "8.7.37 - 8.7.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2021-008", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-008", + "subcomponent": "Content Preview Renderer (ext:backend)", + "typo3_version": "8.7", + "versions_affected": "8.7.39 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2021-006", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-006", + "subcomponent": "Session Storage (ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.39 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Sensitive Data Exposure found", + "location": "http://localhost:80", + "name": "Sensitive Data Exposure", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2021-003", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-003", + "subcomponent": "Form Framework (ext:form)", + "typo3_version": "8.7", + "versions_affected": "8.7.39 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Broken Access Control found", + "location": "http://localhost:80", + "name": "Broken Access Control", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2021-002", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-002", + "subcomponent": "Form Framework (ext:form)", + "typo3_version": "8.7", + "versions_affected": "8.7.39 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Unrestricted File Upload found", + "location": "http://localhost:80", + "name": "Unrestricted File Upload", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2021-001", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-001", + "subcomponent": "Login Handling (ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.39 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Open Redirection found", + "location": "http://localhost:80", + "name": "Open Redirection", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2021-013", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-013", + "subcomponent": "Content Rendering, HTML Parser (ext:frontend, ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.41 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site-Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site-Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2021-012", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-012", + "subcomponent": "User Authentication (ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.40 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Information Disclosure found", + "location": "http://localhost:80", + "name": "Information Disclosure", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2021-011", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-011", + "subcomponent": "Backend Grid View (ext:backend)", + "typo3_version": "8.7", + "versions_affected": "8.7.40 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "advisory": "TYPO3-CORE-SA-2021-010", + "advisory_url": "https://typo3.org/security/advisory/typo3-core-sa-2021-010", + "subcomponent": "Query Generator & Query View (ext:lowlevel, ext:core)", + "typo3_version": "8.7", + "versions_affected": "8.7.40 - 8.0.0", + }, + "category": "Vulnerability", + "description": "Vulnerability of type Cross-Site Scripting found", + "location": "http://localhost:80", + "name": "Cross-Site Scripting", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, + Object { + "attributes": Object { + "extension_Version": "unknown", + "repository": "https://extensions.typo3.org/extension/extbase", + "typo3_version": "8.7", + "version_file": "not found", + "vulnerabilities": Array [], + }, + "category": "Extension", + "description": "Extension extbase (Log4Php) found", + "location": "http://localhost:80/typo3/sysext/extbase/", + "name": "extbase", + "osi_layer": "APPLICATION", + "severity": "INFORMATIONAL", + }, + Object { + "attributes": Object { + "extension_Version": "unknown", + "repository": "https://extensions.typo3.org/extension/feedit", + "typo3_version": "8.7", + "version_file": "not found", + "vulnerabilities": Array [], + }, + "category": "Extension", + "description": "Extension feedit (Frontend Editing) found", + "location": "http://localhost:80/typo3/sysext/feedit/", + "name": "feedit", + "osi_layer": "APPLICATION", + "severity": "INFORMATIONAL", + }, + Object { + "attributes": Object { + "extension_Version": "unknown", + "repository": "https://extensions.typo3.org/extension/func", + "typo3_version": "8.7", + "version_file": "not found", + "vulnerabilities": Array [], + }, + "category": "Extension", + "description": "Extension func (WebFunc) found", + "location": "http://localhost:80/typo3/sysext/func/", + "name": "func", + "osi_layer": "APPLICATION", + "severity": "INFORMATIONAL", + }, + Object { + "attributes": Object { + "extension_Version": "unknown", + "repository": "https://extensions.typo3.org/extension/rsaauth", + "typo3_version": "8.7", + "version_file": "not found", + "vulnerabilities": Array [], + }, + "category": "Extension", + "description": "Extension rsaauth (RSA authentication for TYPO3) found", + "location": "http://localhost:80/typo3/sysext/rsaauth/", + "name": "rsaauth", + "osi_layer": "APPLICATION", + "severity": "INFORMATIONAL", + }, + Object { + "attributes": Object { + "extension_Version": "unknown", + "repository": "https://extensions.typo3.org/extension/sys_action", + "typo3_version": "8.7", + "version_file": "not found", + "vulnerabilities": Array [], + }, + "category": "Extension", + "description": "Extension sys_action (UserTask Center, Actions) found", + "location": "http://localhost:80/typo3/sysext/sys_action/", + "name": "sys_action", + "osi_layer": "APPLICATION", + "severity": "INFORMATIONAL", + }, + Object { + "attributes": Object { + "extension_Version": "unknown", + "repository": "https://extensions.typo3.org/extension/taskcenter", + "typo3_version": "8.7", + "version_file": "not found", + "vulnerabilities": Array [], + }, + "category": "Extension", + "description": "Extension taskcenter (UserTask Center) found", + "location": "http://localhost:80/typo3/sysext/taskcenter/", + "name": "taskcenter", + "osi_layer": "APPLICATION", + "severity": "INFORMATIONAL", + }, + Object { + "attributes": Object { + "extension_Version": "unknown", + "repository": "https://extensions.typo3.org/extension/tstemplate", + "typo3_version": "8.7", + "version_file": "not found", + "vulnerabilities": Array [ + Object { + "Current": "stable", + "Name": "news", + "Repo": "https://extensions.typo3.org/extension/news", + "Title": "News system", + "Url": "http://localhost:80/typo3/sysext/news/", + "Version": "3.1.0", + "Version File": "http://localhost:80/typo3conf/ext/news/Documentation/Settings.yml", + "Vulnerabilities": Array [ + Object { + "Advisory": "TYPO3-EXT-SA-2017-001", + "Affected": "3.2.6 - 0.0.0", + "Vulnerability Type": "SQL Injection", + }, + Object { + "Advisory": "TYPO3-EXT-SA-2015-017", + "Affected": "3.2.1 - 0.0.0", + "Vulnerability Type": "Cross-Site Scripting", + }, + ], + }, + ], + }, + "category": "Extension", + "description": "Extension tstemplate (WebTemplate) found", + "location": "http://localhost:80/typo3/sysext/tstemplate/", + "name": "tstemplate", + "osi_layer": "APPLICATION", + "severity": "HIGH", + }, +] +`; diff --git a/scanners/typo3scan/parser/parser.js b/scanners/typo3scan/parser/parser.js index 7fef367a41..96ad79a7d1 100644 --- a/scanners/typo3scan/parser/parser.js +++ b/scanners/typo3scan/parser/parser.js @@ -4,65 +4,61 @@ async function parse(fileContent) { let findings = JSON.parse(fileContent) + let results = '' - if (typeof fileContent === "string") { - findings = fileContent - .split("\n") - .map((vulnJson) => JSON.parse(vulnJson)); - } - findings = findings[0] // Trimming the begining of the JS Object - let domain = Object.keys(findings)[0]; // Getting the first key (and the only key) + Object.keys(findings).forEach(key => { + let domain = key; + let domain_findings = findings[domain] + let vulns = domain_findings.Vulnerabilities - let parsed_findings = findings[domain] + // Parsing Vulnerabilities + let parsed_vulnerabilities = vulns.map((vuln) => { + return { + name: vuln.Type, + description: `Vulnerability of type ${vuln.Type} found`, + category: "Vulnerability", + location: domain, + osi_layer: "APPLICATION", + severity: "HIGH", + attributes: { + typo3_version: domain_findings.Version, + advisory: vuln.Advisory, + subcomponent: vuln.Subcomponent, + versions_affected: vuln.Affected, + advisory_url: vuln['Advisory URL'], - // Parsing Vulnerabilities - let vulns = parsed_findings.Vulnerabilities - let parsed_vulnerabilities = vulns.map((vuln) => { - return { - name: vuln.Type, - description: `Vulnerability of type ${vuln.Type} found`, - category: "Vulnerability", - location: domain, - osi_layer: "APPLICATION", - severity: "HIGH", - attributes: { - Typo3_Version: parsed_findings.Version, - Advisory: vuln.Advisory, - Subcomponent: vuln.Subcomponent, - Versions_affected: vuln.Affected, - Advisory_URL: vuln['Advisory URL'], + } + }; + }); + // Parsing Extenstions + let extensions = domain_findings.Extensions + let parsed_extensions = extensions.map((ext) => { + // Check if extension has vulnerabilities : if yes severity = HIGH + let severity = 'INFORMATIONAL' + if (ext.Vulnerabilities.length > 0) { + severity = 'HIGH' } - }; - }); + return { + name: ext.Name, + description: `Extension ${ext.Name} (${ext.Title}) found`, + category: "Extension", + location: ext.Url, + osi_layer: "APPLICATION", + severity: severity, + attributes: { + typo3_version: domain_findings.Version, + repository: ext.Repo, + extension_Version: ext.Version, + version_file: ext['Version File'], + vulnerabilities: ext.Vulnerabilities + } + }; + }); - // Parsing Extenstions - let extensions = parsed_findings.Extensions - let parsed_extensions = extensions.map((ext) => { + results = parsed_vulnerabilities.concat(parsed_extensions) - // Check if extension has vulnerabilities : if yes severity = HIGH - let severity = 'INFORMATIONAL' - if ( ext.Vulnerabilities.length > 0) { - severity = 'HIGH' - } - return { - name: ext.Name, - description: `Extension ${ext.Name} (${ext.Title}) found`, - category: "Extension", - location: ext.Url, - osi_layer: "APPLICATION", - severity: severity, - attributes: { - Typo3_Version: parsed_findings.Version, - Repository: ext.Repo, - Extension_Version: ext.Version, - Version_File: ext['Version File'], - Vulnerabilities: ext.Vulnerabilities - } - }; }); - - let results = parsed_vulnerabilities.concat(parsed_extensions) return results } module.exports.parse = parse; \ No newline at end of file diff --git a/scanners/typo3scan/parser/parser.test.js b/scanners/typo3scan/parser/parser.test.js index d592dd4530..14aadc97f9 100644 --- a/scanners/typo3scan/parser/parser.test.js +++ b/scanners/typo3scan/parser/parser.test.js @@ -10,29 +10,31 @@ const readFile = util.promisify(fs.readFile); const { parse } = require("./parser"); const { - validateParser, + validateParser, } = require("@securecodebox/parser-sdk-nodejs/parser-utils"); -test("example parser parses empty json files to zero findings", async () => { - const fileContent = await readFile(__dirname + "/__testFiles__/empty.jsonl", { - encoding: "utf8", - }); +test("parser parses large json result without vulnuerable extensions successfully", async () => { + const fileContent = await readFile( + __dirname + "/__testFiles__/localhost.json", + { + encoding: "utf8", + } + ); - const findings = await parse(fileContent); - await expect(validateParser(findings)).resolves.toBeUndefined(); - expect(findings).toEqual([]); + const findings = await parse(fileContent); + await expect(validateParser(findings)).resolves.toBeUndefined(); + expect(findings).toMatchSnapshot(); }); -test("example parser parses large json result successfully", async () => { - const fileContent = await readFile( - __dirname + "/__testFiles__/localhost.jsonl", - { - encoding: "utf8", - } - ); - - const findings = await parse(fileContent); - await expect(validateParser(findings)).resolves.toBeUndefined(); - expect(findings).toMatchSnapshot(); - }); - // TODO how to run these tests locally ("npx jest parser.test.js" ?? ) \ No newline at end of file +test("parser parses large json result with vulnuerable extensions successfully", async () => { + const fileContent = await readFile( + __dirname + "/__testFiles__/localhost_vuln_extensions.json", + { + encoding: "utf8", + } + ); + + const findings = await parse(fileContent); + await expect(validateParser(findings)).resolves.toBeUndefined(); + expect(findings).toMatchSnapshot(); +}); \ No newline at end of file From bec1c34efa5418c033c05f4624ed63af6e3b3a1d Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Mon, 23 Aug 2021 16:07:30 +0200 Subject: [PATCH 22/42] Added example scan output Signed-off-by: Ilyes Ben Dlala --- .../parser/__testFiles__/empty.jsonl | 0 .../{localhost.jsonl => localhost.json} | 0 .../localhost_vuln_extensions.json | 457 ++++++++++++++++++ 3 files changed, 457 insertions(+) delete mode 100644 scanners/typo3scan/parser/__testFiles__/empty.jsonl rename scanners/typo3scan/parser/__testFiles__/{localhost.jsonl => localhost.json} (100%) create mode 100644 scanners/typo3scan/parser/__testFiles__/localhost_vuln_extensions.json diff --git a/scanners/typo3scan/parser/__testFiles__/empty.jsonl b/scanners/typo3scan/parser/__testFiles__/empty.jsonl deleted file mode 100644 index e69de29bb2..0000000000 diff --git a/scanners/typo3scan/parser/__testFiles__/localhost.jsonl b/scanners/typo3scan/parser/__testFiles__/localhost.json similarity index 100% rename from scanners/typo3scan/parser/__testFiles__/localhost.jsonl rename to scanners/typo3scan/parser/__testFiles__/localhost.json diff --git a/scanners/typo3scan/parser/__testFiles__/localhost_vuln_extensions.json b/scanners/typo3scan/parser/__testFiles__/localhost_vuln_extensions.json new file mode 100644 index 0000000000..003a8448d1 --- /dev/null +++ b/scanners/typo3scan/parser/__testFiles__/localhost_vuln_extensions.json @@ -0,0 +1,457 @@ +{ + "http://localhost:80":{ + "Backend":"http://localhost:80/typo3/index.php", + "Version":"8.7", + "Vulnerabilities":[ + { + "Advisory":"TYPO3-CORE-SA-2019-026", + "Type":"Insecure Deserialization", + "Subcomponent":"Query Generator & Query View (ext:lowlevel, ext:core)", + "Affected":"8.7.29 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-026" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-025", + "Type":"SQL Injection", + "Subcomponent":"Query Generator (ext:lowlevel)", + "Affected":"8.7.29 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-025" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-024", + "Type":"Directory Traversal", + "Subcomponent":"Extension Manager (ext:extensionmanger)", + "Affected":"8.7.29 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-024" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-023", + "Type":"Cross-Site Scripting", + "Subcomponent":"Filelist Module (ext:filelist)", + "Affected":"8.7.29 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-023" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-022", + "Type":"Cross-Site Scripting", + "Subcomponent":"Link Handling (ext:core, ext:frontend)", + "Affected":"8.7.29 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-022" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-021", + "Type":"Cross-Site Scripting", + "Subcomponent":"Form Framework (ext:form)", + "Affected":"8.7.29 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-021" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-020", + "Type":"Insecure Deserialization", + "Subcomponent":"Backend & Core API (ext:backend, ext:core)", + "Affected":"8.7.26 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-020" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-019", + "Type":"Arbitrary Code Execution, Cross-Site Scripting", + "Subcomponent":"Backend API (ext:backend)", + "Affected":"8.7.26 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-019" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-018", + "Type":"Security Misconfiguration", + "Subcomponent":"Frontend Session Handling (ext:frontend)", + "Affected":"8.7.26 - 8.5.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-018" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-015", + "Type":"Cross-Site Scripting", + "Subcomponent":"Link Handling (ext:core)", + "Affected":"8.7.26 - 8.3.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-015" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-014", + "Type":"Information Disclosure", + "Subcomponent":"Backend User Interface (ext:backend)", + "Affected":"8.7.26 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-014" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-013", + "Type":"Cross-Site Scripting", + "Subcomponent":"Fluid Engine (package typo3fluid/fluid)", + "Affected":"8.7.24 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-013" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-012", + "Type":"Arbitrary Code Execution", + "Subcomponent":"Image Processing via ImageMagick (ext:core)", + "Affected":"8.7.24 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-012" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-011", + "Type":"Security Misconfiguration", + "Subcomponent":"User Session Handling (ext:core)", + "Affected":"8.7.24 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-011" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-008", + "Type":"Arbitrary Code Execution", + "Subcomponent":"File List (ext:filelist)", + "Affected":"8.7.22 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-008" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-007", + "Type":"Cross-Site Scripting", + "Subcomponent":"Form Framework (ext:form)", + "Affected":"8.7.22 - 8.5.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-007" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-006", + "Type":"Cross-Site Scripting", + "Subcomponent":"3rd party library Bootstrap CSS toolkit", + "Affected":"8.7.22 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-006" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-005", + "Type":"Cross-Site Scripting", + "Subcomponent":"Fluid (ext:fluid)", + "Affected":"8.7.22 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-005" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-003", + "Type":"Broken Access Control", + "Subcomponent":"Localization Handling", + "Affected":"8.7.22 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-003" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-002", + "Type":"Security Misconfiguration", + "Subcomponent":"Backend User Account Model (ext:core)", + "Affected":"8.7.22 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-002" + }, + { + "Advisory":"TYPO3-CORE-SA-2019-001", + "Type":"Information Disclosure", + "Subcomponent":"RequireJS package configuration", + "Affected":"8.7.22 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2019-001" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-012", + "Type":"Denial of Service", + "Subcomponent":"Frontend Session Handling", + "Affected":"8.7.20 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-012" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-011", + "Type":"Denial of Service", + "Subcomponent":"Online media asset handling", + "Affected":"8.7.20 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-011" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-010", + "Type":"Information Disclosure", + "Subcomponent":"Install Tool", + "Affected":"8.7.20 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-010" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-009", + "Type":"Security Misconfiguration", + "Subcomponent":"Install Tool Session Handling", + "Affected":"8.7.20 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-009" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-008", + "Type":"Cross-Site Scripting", + "Subcomponent":"Frontend user login", + "Affected":"8.7.20 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-008" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-007", + "Type":"Cross-Site Scripting", + "Subcomponent":"Backend modal component", + "Affected":"8.7.20 - 8.5.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-007" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-006", + "Type":"Cross-Site Scripting", + "Subcomponent":"Online media asset rendering", + "Affected":"8.7.20 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-006" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-005", + "Type":"Cross-Site Scripting", + "Subcomponent":"3rd party JavaScript library CKEditor", + "Affected":"8.7.20 - 8.5.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-005" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-004", + "Type":"Insecure Deserialization", + "Subcomponent":"Form Framework (ext:form)", + "Affected":"8.7.16 - 8.5.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-004" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-003", + "Type":"Privilege Escalation & SQL Injection", + "Subcomponent":"Form Framework (ext:form)", + "Affected":"8.7.16 - 8.5.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-003" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-002", + "Type":"Insecure Deserialization & Arbitrary Code Execution", + "Subcomponent":"TYPO3 CMS", + "Affected":"8.7.16 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-002" + }, + { + "Advisory":"TYPO3-CORE-SA-2018-001", + "Type":"Authentication Bypass", + "Subcomponent":"Salted Passwords (ext:saltedpasswords)", + "Affected":"8.7.16 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2018-001" + }, + { + "Advisory":"TYPO3-CORE-SA-2017-007", + "Type":"Arbitrary Code Execution", + "Subcomponent":"TYPO3 CMS", + "Affected":"8.7.4 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2017-007" + }, + { + "Advisory":"TYPO3-CORE-SA-2017-005", + "Type":"Information Disclosure", + "Subcomponent":"TYPO3 CMS", + "Affected":"8.7.4 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2017-005" + }, + { + "Advisory":"TYPO3-CORE-SA-2017-006", + "Type":"Information Disclosure", + "Subcomponent":"TYPO3 CMS", + "Affected":"8.7.4 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2017-006" + }, + { + "Advisory":"TYPO3-CORE-SA-2017-004", + "Type":"Cross-Site Scripting", + "Subcomponent":"TYPO3 CMS", + "Affected":"8.7.4 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2017-004" + }, + { + "Advisory":"TYPO3-CORE-SA-2020-011", + "Type":"Sensitive Data Exposure", + "Subcomponent":"Session Storage (ext:core)", + "Affected":"8.7.37 - 8.7.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2020-011" + }, + { + "Advisory":"TYPO3-CORE-SA-2020-010", + "Type":"Cross-Site Scripting", + "Subcomponent":"Fluid (ext:fluid)", + "Affected":"8.7.37 - 8.7.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2020-010" + }, + { + "Advisory":"TYPO3-CORE-SA-2020-009", + "Type":"Cross-Site Scripting", + "Subcomponent":"Fluid Engine (package typo3fluid/fluid)", + "Affected":"8.7.37 - 8.7.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2020-009" + }, + { + "Advisory":"TYPO3-CORE-SA-2021-008", + "Type":"Cross-Site Scripting", + "Subcomponent":"Content Preview Renderer (ext:backend)", + "Affected":"8.7.39 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-008" + }, + { + "Advisory":"TYPO3-CORE-SA-2021-006", + "Type":"Sensitive Data Exposure", + "Subcomponent":"Session Storage (ext:core)", + "Affected":"8.7.39 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-006" + }, + { + "Advisory":"TYPO3-CORE-SA-2021-003", + "Type":"Broken Access Control", + "Subcomponent":"Form Framework (ext:form)", + "Affected":"8.7.39 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-003" + }, + { + "Advisory":"TYPO3-CORE-SA-2021-002", + "Type":"Unrestricted File Upload", + "Subcomponent":"Form Framework (ext:form)", + "Affected":"8.7.39 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-002" + }, + { + "Advisory":"TYPO3-CORE-SA-2021-001", + "Type":"Open Redirection", + "Subcomponent":"Login Handling (ext:core)", + "Affected":"8.7.39 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-001" + }, + { + "Advisory":"TYPO3-CORE-SA-2021-013", + "Type":"Cross-Site-Scripting", + "Subcomponent":"Content Rendering, HTML Parser (ext:frontend, ext:core)", + "Affected":"8.7.41 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-013" + }, + { + "Advisory":"TYPO3-CORE-SA-2021-012", + "Type":"Information Disclosure", + "Subcomponent":"User Authentication (ext:core)", + "Affected":"8.7.40 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-012" + }, + { + "Advisory":"TYPO3-CORE-SA-2021-011", + "Type":"Cross-Site Scripting", + "Subcomponent":"Backend Grid View (ext:backend)", + "Affected":"8.7.40 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-011" + }, + { + "Advisory":"TYPO3-CORE-SA-2021-010", + "Type":"Cross-Site Scripting", + "Subcomponent":"Query Generator & Query View (ext:lowlevel, ext:core)", + "Affected":"8.7.40 - 8.0.0", + "Advisory URL":"https://typo3.org/security/advisory/typo3-core-sa-2021-010" + } + ], + "Extensions":[ + { + "Name":"extbase", + "Title":"Log4Php", + "Repo":"https://extensions.typo3.org/extension/extbase", + "Current":"1.1.1 (alpha)", + "Url":"http://localhost:80/typo3/sysext/extbase/", + "Version":"unknown", + "Version File":"not found", + "Vulnerabilities":[ + + ] + }, + { + "Name":"feedit", + "Title":"Frontend Editing", + "Repo":"https://extensions.typo3.org/extension/feedit", + "Current":"10.0.2 (stable)", + "Url":"http://localhost:80/typo3/sysext/feedit/", + "Version":"unknown", + "Version File":"not found", + "Vulnerabilities":[ + + ] + }, + { + "Name":"func", + "Title":"WebFunc", + "Repo":"https://extensions.typo3.org/extension/func", + "Current":"9.0.1 (stable)", + "Url":"http://localhost:80/typo3/sysext/func/", + "Version":"unknown", + "Version File":"not found", + "Vulnerabilities":[ + + ] + }, + { + "Name":"rsaauth", + "Title":"RSA authentication for TYPO3", + "Repo":"https://extensions.typo3.org/extension/rsaauth", + "Current":"10.0.1 (deprecated)", + "Url":"http://localhost:80/typo3/sysext/rsaauth/", + "Version":"unknown", + "Version File":"not found", + "Vulnerabilities":[ + + ] + }, + { + "Name":"sys_action", + "Title":"UserTask Center, Actions", + "Repo":"https://extensions.typo3.org/extension/sys_action", + "Current":"10.0.0 (stable)", + "Url":"http://localhost:80/typo3/sysext/sys_action/", + "Version":"unknown", + "Version File":"not found", + "Vulnerabilities":[ + + ] + }, + { + "Name":"taskcenter", + "Title":"UserTask Center", + "Repo":"https://extensions.typo3.org/extension/taskcenter", + "Current":"10.0.0 (stable)", + "Url":"http://localhost:80/typo3/sysext/taskcenter/", + "Version":"unknown", + "Version File":"not found", + "Vulnerabilities":[ + + ] + }, + { + "Name":"tstemplate", + "Title":"WebTemplate", + "Repo":"https://extensions.typo3.org/extension/tstemplate", + "Current":"0.0.5 (stable)", + "Url":"http://localhost:80/typo3/sysext/tstemplate/", + "Version":"unknown", + "Version File":"not found", + "Vulnerabilities":[ + { + "Name":"news", + "Title":"News system", + "Repo":"https://extensions.typo3.org/extension/news", + "Current":"stable", + "Url":"http://localhost:80/typo3/sysext/news/", + "Version":"3.1.0", + "Version File":"http://localhost:80/typo3conf/ext/news/Documentation/Settings.yml", + "Vulnerabilities":[ + { + "Advisory":"TYPO3-EXT-SA-2017-001", + "Vulnerability Type":"SQL Injection", + "Affected":"3.2.6 - 0.0.0" + }, + { + "Advisory":"TYPO3-EXT-SA-2015-017", + "Vulnerability Type":"Cross-Site Scripting", + "Affected":"3.2.1 - 0.0.0" + } + ] + } + ] + } + ] + } + } \ No newline at end of file From eb444d9be7352ec3eb9680d7bfbd51f2c0251abe Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Mon, 23 Aug 2021 16:09:03 +0200 Subject: [PATCH 23/42] Minor fixes Signed-off-by: Ilyes Ben Dlala --- scanners/typo3scan/Chart.yaml | 2 +- scanners/typo3scan/examples/scan.yaml | 6 ++++-- scanners/typo3scan/parser/Dockerfile | 2 +- scanners/typo3scan/scanner/Dockerfile | 6 +++--- scanners/typo3scan/scanner/wrapper.sh | 2 +- scanners/typo3scan/templates/typo3scan-scan-type.yaml | 5 ++++- scanners/typo3scan/values.yaml | 2 +- 7 files changed, 15 insertions(+), 10 deletions(-) diff --git a/scanners/typo3scan/Chart.yaml b/scanners/typo3scan/Chart.yaml index 7639f8111e..d0e47b97aa 100644 --- a/scanners/typo3scan/Chart.yaml +++ b/scanners/typo3scan/Chart.yaml @@ -34,7 +34,7 @@ keywords: - secureCodeBox home: https://docs.securecodebox.io/docs/scanners/typo3scan -#TODO Scanner doesn't have an icon +#icon: Scanner doesn't have an icon sources: - https://github.com/secureCodeBox/secureCodeBox diff --git a/scanners/typo3scan/examples/scan.yaml b/scanners/typo3scan/examples/scan.yaml index c3923cb987..62dcbccd22 100644 --- a/scanners/typo3scan/examples/scan.yaml +++ b/scanners/typo3scan/examples/scan.yaml @@ -2,11 +2,13 @@ apiVersion: "execution.securecodebox.io/v1" kind: Scan metadata: - name: "typo3scan-juice-shop-cluster-internal" #TODO Add Typo3 Website Target ? + name: "https://www.typo3example.com" # Placeholder website, change to the website you want to scan spec: scanType: "typo3scan" parameters: + - "-d" + - "https://www.typo3example.com" # Change to the website you want to scan # Only show vulnuerable extensions - - "-vuln" + - "--vuln" # Set the number of threads to use for enumerating extensions at 10 - "--threads 10" \ No newline at end of file diff --git a/scanners/typo3scan/parser/Dockerfile b/scanners/typo3scan/parser/Dockerfile index 523c4b8dec..a433e58463 100644 --- a/scanners/typo3scan/parser/Dockerfile +++ b/scanners/typo3scan/parser/Dockerfile @@ -12,5 +12,5 @@ RUN npm ci --production FROM securecodebox/parser-sdk-nodejs:${baseImageTag:-latest} WORKDIR /home/app/parser-wrapper/parser/ -#COPY --from=build --chown=app:app /home/app/node_modules/ ./node_modules/ # TODO No external Dependencies are installed (so no node_modules folder) +#COPY --from=build --chown=app:app /home/app/node_modules/ ./node_modules/ # No external Dependencies are installed (so no node_modules folder) COPY --chown=app:app ./parser.js ./parser.js \ No newline at end of file diff --git a/scanners/typo3scan/scanner/Dockerfile b/scanners/typo3scan/scanner/Dockerfile index b40bdd0e54..513773b870 100644 --- a/scanners/typo3scan/scanner/Dockerfile +++ b/scanners/typo3scan/scanner/Dockerfile @@ -19,10 +19,10 @@ RUN mkdir /home/securecodebox/ RUN chown -R typo3scan:typo3scan /home/securecodebox/ USER 1001 -#clone Repo -WORKDIR /home/securecodebox/ +#Clone Repo +WORKDIR /home/typo3scan/ RUN git clone https://github.com/whoot/Typo3Scan.git -WORKDIR /home/securecodebox/Typo3Scan +WORKDIR /home/typo3scan/Typo3Scan #Install Typo3Scan python requirements RUN python3 -m pip install -r requirements.txt diff --git a/scanners/typo3scan/scanner/wrapper.sh b/scanners/typo3scan/scanner/wrapper.sh index a45c6d6676..f96a4be25b 100644 --- a/scanners/typo3scan/scanner/wrapper.sh +++ b/scanners/typo3scan/scanner/wrapper.sh @@ -2,7 +2,7 @@ # # SPDX-License-Identifier: Apache-2.0 -python3 typo3scan.py --no-interaction --json $@ +python3 typo3scan.py $@ if [ -f ./typo3scan.json ]; then mv ./typo3scan.json /home/securecodebox/typo3scan-results.json diff --git a/scanners/typo3scan/templates/typo3scan-scan-type.yaml b/scanners/typo3scan/templates/typo3scan-scan-type.yaml index 3d2cd2a044..369992545d 100644 --- a/scanners/typo3scan/templates/typo3scan-scan-type.yaml +++ b/scanners/typo3scan/templates/typo3scan-scan-type.yaml @@ -16,4 +16,7 @@ spec: - name: typo3scan image: "{{ .Values.scanner.image.repository }}:{{ .Values.scanner.image.tag | default .Chart.AppVersion }}" command: - - "typo3scan.py " # TODO : Wrapper.sh already calls this ? \ No newline at end of file + - "sh" + - "/home/typo3scan/Typo3Scan/wrapper.sh" + - "--no-interaction" + - "--json" \ No newline at end of file diff --git a/scanners/typo3scan/values.yaml b/scanners/typo3scan/values.yaml index 72d36a624c..2f795f7f99 100644 --- a/scanners/typo3scan/values.yaml +++ b/scanners/typo3scan/values.yaml @@ -17,7 +17,7 @@ parser: scanner: image: # scanner.image.repository -- Container Image to run the scan - repository: docker.io/securecodebox/typo3scan + repository: docker.io/securecodebox/scanner-typo3scan # scanner.image.tag -- defaults to the charts appVersion tag: null From cb7931175525f64c813f2ba1953892c89200fec2 Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Mon, 23 Aug 2021 16:38:46 +0200 Subject: [PATCH 24/42] Added .helm-docs.gotml file for documentation Signed-off-by: Ilyes Ben Dlala --- scanners/typo3scan/.helm-docs.gotmpl | 50 ++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) create mode 100644 scanners/typo3scan/.helm-docs.gotmpl diff --git a/scanners/typo3scan/.helm-docs.gotmpl b/scanners/typo3scan/.helm-docs.gotmpl new file mode 100644 index 0000000000..7082057735 --- /dev/null +++ b/scanners/typo3scan/.helm-docs.gotmpl @@ -0,0 +1,50 @@ +{{- /* +SPDX-FileCopyrightText: 2021 iteratec GmbH + +SPDX-License-Identifier: Apache-2.0 +*/ -}} + +{{- define "extra.docsSection" -}} +--- +title: "Typo3Scan" +category: "scanner" +type: "Network" +state: "released" +appVersion: "{{ template "chart.appVersion" . }}" +usecase: "Automation of the process of detecting the Typo3 CMS, and it's installed extensions" +--- +{{- end }} + +{{- define "extra.dockerDeploymentSection" -}} +## Supported Tags +- `latest` (represents the latest stable release build) +- tagged releases, e.g. `{{ template "chart.appVersion" . }}` +{{- end }} + +{{- define "extra.chartAboutSection" -}} +## What is Typo3Scan? +Typo3Scan is an open source penetration testing tool to automate the process of detecting the Typo3 CMS and it's installed extensions. It also has a database with known vulnerabilities for core and extensions. + +To learn more about the Typo3Scan scanner itself visit [https://github.com/whoot/Typo3Scan]. +{{- end }} + +{{- define "extra.scannerConfigurationSection" -}} +## Scanner Configuration + +The Typo3Scan targets are specified with the `-d` parameter. The target should be a hostname, an IP address or an IP range. + +Additional Typo3Scan scan features can be configured via the parameter attribute. + +Some useful example parameters listed below: + +- `--vuln` : Check for extensions with known vulnerabilities only. +- `--timeout TIMEOUT` : Request Timeout. Default: 10 seconds +- `--auth USER:PASS`: Username and Password for HTTP Basic Authorization. +- `--cookie NAME=VALUE`: Can be used for authenticiation based on cookies. +- `--agent USER-AGENT`: Set custom User-Agent for requests. +- `--threads THREADS`: The number of threads to use for enumerating extensions. Default: 5 +- `--json`: Output results to json file +- `--force`: Force enumeration +- `--no-interaction`: Do not ask any interactive question + +{{- end }} \ No newline at end of file From 1f3f607da5a0a85264722b1a9958a53fb717583f Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Mon, 23 Aug 2021 16:53:16 +0200 Subject: [PATCH 25/42] updated jest snapshots Signed-off-by: Ilyes Ben Dlala --- .../parser/__snapshots__/parser.test.js.snap | 56 +++++++++---------- scanners/typo3scan/parser/package.json | 4 +- 2 files changed, 31 insertions(+), 29 deletions(-) diff --git a/scanners/typo3scan/parser/__snapshots__/parser.test.js.snap b/scanners/typo3scan/parser/__snapshots__/parser.test.js.snap index ac05510fe3..44b9408c13 100644 --- a/scanners/typo3scan/parser/__snapshots__/parser.test.js.snap +++ b/scanners/typo3scan/parser/__snapshots__/parser.test.js.snap @@ -1,6 +1,6 @@ // Jest Snapshot v1, https://goo.gl/fbAQLP -exports[`example parser parses large json result successfully 1`] = ` +exports[`parser parses large json result with vulnuerable extensions successfully 1`] = ` Array [ Object { "attributes": Object { @@ -833,19 +833,41 @@ Array [ "repository": "https://extensions.typo3.org/extension/tstemplate", "typo3_version": "8.7", "version_file": "not found", - "vulnerabilities": Array [], + "vulnerabilities": Array [ + Object { + "Current": "stable", + "Name": "news", + "Repo": "https://extensions.typo3.org/extension/news", + "Title": "News system", + "Url": "http://localhost:80/typo3/sysext/news/", + "Version": "3.1.0", + "Version File": "http://localhost:80/typo3conf/ext/news/Documentation/Settings.yml", + "Vulnerabilities": Array [ + Object { + "Advisory": "TYPO3-EXT-SA-2017-001", + "Affected": "3.2.6 - 0.0.0", + "Vulnerability Type": "SQL Injection", + }, + Object { + "Advisory": "TYPO3-EXT-SA-2015-017", + "Affected": "3.2.1 - 0.0.0", + "Vulnerability Type": "Cross-Site Scripting", + }, + ], + }, + ], }, "category": "Extension", "description": "Extension tstemplate (WebTemplate) found", "location": "http://localhost:80/typo3/sysext/tstemplate/", "name": "tstemplate", "osi_layer": "APPLICATION", - "severity": "INFORMATIONAL", + "severity": "HIGH", }, ] `; -exports[`example parser parses large json result successfully 2`] = ` +exports[`parser parses large json result without vulnuerable extensions successfully 1`] = ` Array [ Object { "attributes": Object { @@ -1678,36 +1700,14 @@ Array [ "repository": "https://extensions.typo3.org/extension/tstemplate", "typo3_version": "8.7", "version_file": "not found", - "vulnerabilities": Array [ - Object { - "Current": "stable", - "Name": "news", - "Repo": "https://extensions.typo3.org/extension/news", - "Title": "News system", - "Url": "http://localhost:80/typo3/sysext/news/", - "Version": "3.1.0", - "Version File": "http://localhost:80/typo3conf/ext/news/Documentation/Settings.yml", - "Vulnerabilities": Array [ - Object { - "Advisory": "TYPO3-EXT-SA-2017-001", - "Affected": "3.2.6 - 0.0.0", - "Vulnerability Type": "SQL Injection", - }, - Object { - "Advisory": "TYPO3-EXT-SA-2015-017", - "Affected": "3.2.1 - 0.0.0", - "Vulnerability Type": "Cross-Site Scripting", - }, - ], - }, - ], + "vulnerabilities": Array [], }, "category": "Extension", "description": "Extension tstemplate (WebTemplate) found", "location": "http://localhost:80/typo3/sysext/tstemplate/", "name": "tstemplate", "osi_layer": "APPLICATION", - "severity": "HIGH", + "severity": "INFORMATIONAL", }, ] `; diff --git a/scanners/typo3scan/parser/package.json b/scanners/typo3scan/parser/package.json index 44345ae701..a31125910a 100644 --- a/scanners/typo3scan/parser/package.json +++ b/scanners/typo3scan/parser/package.json @@ -3,7 +3,9 @@ "version": "1.0.0", "description": "Parses result files for the type : 'typo3scan-json'", "main": "", - "scripts": {}, + "scripts": { + "test": "npx jest parser.test.js" + }, "keywords": [], "author": "iteratec GmbH", "license": "Apache-2.0", From de33cc222d683103f489983181f97422b066c6b8 Mon Sep 17 00:00:00 2001 From: Ilyesbdlala Date: Mon, 23 Aug 2021 14:41:43 +0000 Subject: [PATCH 26/42] Updating Helm Docs Signed-off-by: GitHub Actions Signed-off-by: Ilyes Ben Dlala --- scanners/typo3scan/README.md | 92 ++++++++++------ scanners/typo3scan/docs/README.ArtifactHub.md | 77 ++++++++++++++ .../typo3scan/docs/README.DockerHub-Parser.md | 82 ++++++++++++++ .../docs/README.DockerHub-Scanner.md | 100 ++++++++++++++++++ 4 files changed, 317 insertions(+), 34 deletions(-) create mode 100644 scanners/typo3scan/docs/README.ArtifactHub.md create mode 100644 scanners/typo3scan/docs/README.DockerHub-Parser.md create mode 100644 scanners/typo3scan/docs/README.DockerHub-Scanner.md diff --git a/scanners/typo3scan/README.md b/scanners/typo3scan/README.md index c29eb1a152..6008d6efa4 100644 --- a/scanners/typo3scan/README.md +++ b/scanners/typo3scan/README.md @@ -1,46 +1,70 @@ -# typo3scan +--- +title: "Typo3Scan" +category: "scanner" +type: "Network" +state: "released" +appVersion: "1.16.0" +usecase: "Automation of the process of detecting the Typo3 CMS, and it's installed extensions" +--- -![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.16.0](https://img.shields.io/badge/AppVersion-1.16.0-informational?style=flat-square) + + -## Maintainers +

+ License Apache-2.0 + GitHub release (latest SemVer) + OWASP Incubator Project + Artifact HUB + GitHub Repo stars + Twitter Follower +

-| Name | Email | Url | -| ---- | ------ | --- | -| iteratec GmbH | | | -| | secureCodeBox@iteratec.com | | +## What is Typo3Scan? +Typo3Scan is an open source penetration testing tool to automate the process of detecting the Typo3 CMS and it's installed extensions. It also has a database with known vulnerabilities for core and extensions. -## Source Code +To learn more about the Typo3Scan scanner itself visit [https://github.com/whoot/Typo3Scan]. -* +## Deployment +The typo3scan chart can be deployed via helm: + +```bash +# Install HelmChart (use -n to configure another namespace) +helm upgrade --install typo3scan secureCodeBox/typo3scan +``` + +## Scanner Configuration + +The Typo3Scan targets are specified with the `-d` parameter. The target should be a hostname, an IP address or an IP range. + +Additional Typo3Scan scan features can be configured via the parameter attribute. + +Some useful example parameters listed below: + +- `--vuln` : Check for extensions with known vulnerabilities only. +- `--timeout TIMEOUT` : Request Timeout. Default: 10 seconds +- `--auth USER:PASS`: Username and Password for HTTP Basic Authorization. +- `--cookie NAME=VALUE`: Can be used for authenticiation based on cookies. +- `--agent USER-AGENT`: Set custom User-Agent for requests. +- `--threads THREADS`: The number of threads to use for enumerating extensions. Default: 5 +- `--json`: Output results to json file +- `--force`: Force enumeration +- `--no-interaction`: Do not ask any interactive question ## Requirements Kubernetes: `>=v1.11.0-0` -## Values - -| Key | Type | Default | Description | -|-----|------|---------|-------------| -| cascadingRules.enabled | bool | `true` | Enables or disables the installation of the default cascading rules for this scanner | -| parser.env | list | `[]` | Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) | -| parser.image.repository | string | `"docker.io/securecodebox/parser-typo3scan"` | Parser image repository | -| parser.image.tag | string | defaults to the charts version | Parser image tag | -| parser.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | -| scanner.backoffLimit | int | 3 | There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) | -| scanner.env | list | `[]` | Optional environment variables mapped into each scanJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) | -| scanner.extraContainers | list | `[]` | Optional additional Containers started with each scanJob (see: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) | -| scanner.extraVolumeMounts | list | `[]` | Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | -| scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | -| scanner.image.repository | string | `"docker.io/securecodebox/typo3scan"` | Container Image to run the scan | -| scanner.image.tag | string | `nil` | defaults to the charts appVersion | -| scanner.nameAppend | string | `nil` | append a string to the default scantype name. | -| scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | -| scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | - ----------------------------------------------- -Autogenerated from chart metadata using [helm-docs v1.5.0](https://github.com/norwoodj/helm-docs/releases/v1.5.0) diff --git a/scanners/typo3scan/docs/README.ArtifactHub.md b/scanners/typo3scan/docs/README.ArtifactHub.md new file mode 100644 index 0000000000..40f995091a --- /dev/null +++ b/scanners/typo3scan/docs/README.ArtifactHub.md @@ -0,0 +1,77 @@ + + + +

+ License Apache-2.0 + GitHub release (latest SemVer) + OWASP Incubator Project + Artifact HUB + GitHub Repo stars + Twitter Follower +

+ +## What is OWASP secureCodeBox? + +

+ secureCodeBox Logo +

+ +_[OWASP secureCodeBox][scb-github]_ is an automated and scalable open source solution that can be used to integrate various *security vulnerability scanners* with a simple and lightweight interface. The _secureCodeBox_ mission is to support *DevSecOps* Teams to make it easy to automate security vulnerability testing in different scenarios. + +With the _secureCodeBox_ we provide a toolchain for continuous scanning of applications to find the low-hanging fruit issues early in the development process and free the resources of the penetration tester to concentrate on the major security issues. + +The secureCodeBox project is running on [Kubernetes](https://kubernetes.io/). To install it you need [Helm](https://helm.sh), a package manager for Kubernetes. It is also possible to start the different integrated security vulnerability scanners based on a docker infrastructure. + +### Quickstart with secureCodeBox on kubernetes + +You can find resources to help you get started on our [documentation website](https://docs.securecodebox.io) including instruction on how to [install the secureCodeBox project](https://docs.securecodebox.io/docs/getting-started/installation) and guides to help you [run your first scans](https://docs.securecodebox.io/docs/getting-started/first-scans) with it. + +## What is Typo3Scan? +Typo3Scan is an open source penetration testing tool to automate the process of detecting the Typo3 CMS and it's installed extensions. It also has a database with known vulnerabilities for core and extensions. + +To learn more about the Typo3Scan scanner itself visit [https://github.com/whoot/Typo3Scan]. + +## Deployment +The typo3scan chart can be deployed via helm: + +```bash +# Install HelmChart (use -n to configure another namespace) +helm upgrade --install typo3scan secureCodeBox/typo3scan +``` + +## Scanner Configuration + +The Typo3Scan targets are specified with the `-d` parameter. The target should be a hostname, an IP address or an IP range. + +Additional Typo3Scan scan features can be configured via the parameter attribute. + +Some useful example parameters listed below: + +- `--vuln` : Check for extensions with known vulnerabilities only. +- `--timeout TIMEOUT` : Request Timeout. Default: 10 seconds +- `--auth USER:PASS`: Username and Password for HTTP Basic Authorization. +- `--cookie NAME=VALUE`: Can be used for authenticiation based on cookies. +- `--agent USER-AGENT`: Set custom User-Agent for requests. +- `--threads THREADS`: The number of threads to use for enumerating extensions. Default: 5 +- `--json`: Output results to json file +- `--force`: Force enumeration +- `--no-interaction`: Do not ask any interactive question + +## Requirements + +Kubernetes: `>=v1.11.0-0` + diff --git a/scanners/typo3scan/docs/README.DockerHub-Parser.md b/scanners/typo3scan/docs/README.DockerHub-Parser.md new file mode 100644 index 0000000000..7f54db0de5 --- /dev/null +++ b/scanners/typo3scan/docs/README.DockerHub-Parser.md @@ -0,0 +1,82 @@ + + + +

+ License Apache-2.0 + GitHub release (latest SemVer) + OWASP Incubator Project + Artifact HUB + GitHub Repo stars + Twitter Follower +

+ +## What is OWASP secureCodeBox? + +

+ secureCodeBox Logo +

+ +_[OWASP secureCodeBox][scb-github]_ is an automated and scalable open source solution that can be used to integrate various *security vulnerability scanners* with a simple and lightweight interface. The _secureCodeBox_ mission is to support *DevSecOps* Teams to make it easy to automate security vulnerability testing in different scenarios. + +With the _secureCodeBox_ we provide a toolchain for continuous scanning of applications to find the low-hanging fruit issues early in the development process and free the resources of the penetration tester to concentrate on the major security issues. + +The secureCodeBox project is running on [Kubernetes](https://kubernetes.io/). To install it you need [Helm](https://helm.sh), a package manager for Kubernetes. It is also possible to start the different integrated security vulnerability scanners based on a docker infrastructure. + +### Quickstart with secureCodeBox on kubernetes + +You can find resources to help you get started on our [documentation website](https://docs.securecodebox.io) including instruction on how to [install the secureCodeBox project](https://docs.securecodebox.io/docs/getting-started/installation) and guides to help you [run your first scans](https://docs.securecodebox.io/docs/getting-started/first-scans) with it. + +## Supported Tags +- `latest` (represents the latest stable release build) +- tagged releases, e.g. `1.16.0` + +## How to use this image +This `parser` image is intended to work in combination with the corresponding security scanner docker image to parse the `findings` results. For more information details please take a look at the documentation page: https://docs.securecodebox.io/docs/scanners/typo3scan. + +```bash +docker pull securecodebox/parser-typo3scan +``` + +## What is Typo3Scan? +Typo3Scan is an open source penetration testing tool to automate the process of detecting the Typo3 CMS and it's installed extensions. It also has a database with known vulnerabilities for core and extensions. + +To learn more about the Typo3Scan scanner itself visit [https://github.com/whoot/Typo3Scan]. + +## Community + +You are welcome, please join us on... 👋 + +- [GitHub][scb-github] +- [Slack][scb-slack] +- [Twitter][scb-twitter] + +secureCodeBox is an official [OWASP][scb-owasp] project. + +## License +[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0) + +As with all Docker images, these likely also contain other software which may be under other licenses (such as Bash, etc from the base distribution, along with any direct or indirect dependencies of the primary software being contained). + +As for any pre-built image usage, it is the image user's responsibility to ensure that any use of this image complies with any relevant licenses for all software contained within. + +[scb-owasp]: https://www.owasp.org/index.php/OWASP_secureCodeBox +[scb-docs]: https://docs.securecodebox.io/ +[scb-site]: https://www.securecodebox.io/ +[scb-github]: https://github.com/secureCodeBox/ +[scb-twitter]: https://twitter.com/secureCodeBox +[scb-slack]: https://join.slack.com/t/securecodebox/shared_invite/enQtNDU3MTUyOTM0NTMwLTBjOWRjNjVkNGEyMjQ0ZGMyNDdlYTQxYWQ4MzNiNGY3MDMxNThkZjJmMzY2NDRhMTk3ZWM3OWFkYmY1YzUxNTU +[scb-license]: https://github.com/secureCodeBox/secureCodeBox/blob/master/LICENSE diff --git a/scanners/typo3scan/docs/README.DockerHub-Scanner.md b/scanners/typo3scan/docs/README.DockerHub-Scanner.md new file mode 100644 index 0000000000..ccecec0f79 --- /dev/null +++ b/scanners/typo3scan/docs/README.DockerHub-Scanner.md @@ -0,0 +1,100 @@ + + + +

+ License Apache-2.0 + GitHub release (latest SemVer) + OWASP Incubator Project + Artifact HUB + GitHub Repo stars + Twitter Follower +

+ +## What is OWASP secureCodeBox? + +

+ secureCodeBox Logo +

+ +_[OWASP secureCodeBox][scb-github]_ is an automated and scalable open source solution that can be used to integrate various *security vulnerability scanners* with a simple and lightweight interface. The _secureCodeBox_ mission is to support *DevSecOps* Teams to make it easy to automate security vulnerability testing in different scenarios. + +With the _secureCodeBox_ we provide a toolchain for continuous scanning of applications to find the low-hanging fruit issues early in the development process and free the resources of the penetration tester to concentrate on the major security issues. + +The secureCodeBox project is running on [Kubernetes](https://kubernetes.io/). To install it you need [Helm](https://helm.sh), a package manager for Kubernetes. It is also possible to start the different integrated security vulnerability scanners based on a docker infrastructure. + +### Quickstart with secureCodeBox on kubernetes + +You can find resources to help you get started on our [documentation website](https://docs.securecodebox.io) including instruction on how to [install the secureCodeBox project](https://docs.securecodebox.io/docs/getting-started/installation) and guides to help you [run your first scans](https://docs.securecodebox.io/docs/getting-started/first-scans) with it. + +## Supported Tags +- `latest` (represents the latest stable release build) +- tagged releases, e.g. `1.16.0` + +## How to use this image +This `scanner` image is intended to work in combination with the corresponding `parser` image to parse the scanner `findings` to generic secureCodeBox results. For more information details please take a look at the [project page][scb-docs] or [documentation page][https://docs.securecodebox.io/docs/scanners/typo3scan]. + +```bash +docker pull securecodebox/scanner-typo3scan +``` + +## What is Typo3Scan? +Typo3Scan is an open source penetration testing tool to automate the process of detecting the Typo3 CMS and it's installed extensions. It also has a database with known vulnerabilities for core and extensions. + +To learn more about the Typo3Scan scanner itself visit [https://github.com/whoot/Typo3Scan]. + +## Scanner Configuration + +The Typo3Scan targets are specified with the `-d` parameter. The target should be a hostname, an IP address or an IP range. + +Additional Typo3Scan scan features can be configured via the parameter attribute. + +Some useful example parameters listed below: + +- `--vuln` : Check for extensions with known vulnerabilities only. +- `--timeout TIMEOUT` : Request Timeout. Default: 10 seconds +- `--auth USER:PASS`: Username and Password for HTTP Basic Authorization. +- `--cookie NAME=VALUE`: Can be used for authenticiation based on cookies. +- `--agent USER-AGENT`: Set custom User-Agent for requests. +- `--threads THREADS`: The number of threads to use for enumerating extensions. Default: 5 +- `--json`: Output results to json file +- `--force`: Force enumeration +- `--no-interaction`: Do not ask any interactive question + +## Community + +You are welcome, please join us on... 👋 + +- [GitHub][scb-github] +- [Slack][scb-slack] +- [Twitter][scb-twitter] + +secureCodeBox is an official [OWASP][scb-owasp] project. + +## License +[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0) + +As with all Docker images, these likely also contain other software which may be under other licenses (such as Bash, etc from the base distribution, along with any direct or indirect dependencies of the primary software being contained). + +As for any pre-built image usage, it is the image user's responsibility to ensure that any use of this image complies with any relevant licenses for all software contained within. + +[scb-owasp]: https://www.owasp.org/index.php/OWASP_secureCodeBox +[scb-docs]: https://docs.securecodebox.io/ +[scb-site]: https://www.securecodebox.io/ +[scb-github]: https://github.com/secureCodeBox/ +[scb-twitter]: https://twitter.com/secureCodeBox +[scb-slack]: https://join.slack.com/t/securecodebox/shared_invite/enQtNDU3MTUyOTM0NTMwLTBjOWRjNjVkNGEyMjQ0ZGMyNDdlYTQxYWQ4MzNiNGY3MDMxNThkZjJmMzY2NDRhMTk3ZWM3OWFkYmY1YzUxNTU +[scb-license]: https://github.com/secureCodeBox/secureCodeBox/blob/master/LICENSE From ae1a995e7368d107667b089ec5053069514d561f Mon Sep 17 00:00:00 2001 From: Sebastian Franz <32578476+SebieF@users.noreply.github.com> Date: Tue, 24 Aug 2021 12:48:23 +0200 Subject: [PATCH 27/42] Delete unnecessary .gitkeep file --- scanners/typo3scan/docs/.gitkeep | 0 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 scanners/typo3scan/docs/.gitkeep diff --git a/scanners/typo3scan/docs/.gitkeep b/scanners/typo3scan/docs/.gitkeep deleted file mode 100644 index e69de29bb2..0000000000 From 2f9aa67af74a92c832cebeb5abde1d6ef2f8b077 Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Tue, 24 Aug 2021 13:48:56 +0200 Subject: [PATCH 28/42] Apply suggestions from code review Co-authored-by: Sebastian Franz <32578476+SebieF@users.noreply.github.com> --- scanners/typo3scan/Chart.yaml | 10 +++------- scanners/typo3scan/examples/scan.yaml | 2 +- scanners/typo3scan/scanner/Dockerfile | 6 +++--- .../typo3scan/templates/typ3scan-parse-definition.yaml | 4 ++-- 4 files changed, 9 insertions(+), 13 deletions(-) diff --git a/scanners/typo3scan/Chart.yaml b/scanners/typo3scan/Chart.yaml index d0e47b97aa..7f305f3a65 100644 --- a/scanners/typo3scan/Chart.yaml +++ b/scanners/typo3scan/Chart.yaml @@ -14,17 +14,13 @@ description: A Helm chart for the Typo3 security scanner that integrates with th # a dependency of application charts to inject those utilities and functions into the rendering # pipeline. Library charts do not define any templates and therefore cannot be deployed. type: application - -# This is the chart version. This version number should be incremented each time you make changes -# to the chart and its templates, including the app version. -# Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 0.1.0 - +# version - gets automatically set to the secureCodeBox release version when the helm charts gets published +version: v3.1.0-alpha1 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to # follow Semantic Versioning. They should reflect the version the application is using. # It is recommended to use it with quotes. -appVersion: "1.16.0" +appVersion: "0.7.2" kubeVersion: ">=v1.11.0-0" keywords: - security diff --git a/scanners/typo3scan/examples/scan.yaml b/scanners/typo3scan/examples/scan.yaml index 62dcbccd22..fd35353ac7 100644 --- a/scanners/typo3scan/examples/scan.yaml +++ b/scanners/typo3scan/examples/scan.yaml @@ -2,7 +2,7 @@ apiVersion: "execution.securecodebox.io/v1" kind: Scan metadata: - name: "https://www.typo3example.com" # Placeholder website, change to the website you want to scan + name: typo3scan-example spec: scanType: "typo3scan" parameters: diff --git a/scanners/typo3scan/scanner/Dockerfile b/scanners/typo3scan/scanner/Dockerfile index 513773b870..9699b26ed9 100644 --- a/scanners/typo3scan/scanner/Dockerfile +++ b/scanners/typo3scan/scanner/Dockerfile @@ -6,9 +6,9 @@ FROM alpine:3.12 #Install Python3 ENV PYTHONUNBUFFERED=1 -RUN apk add --update --no-cache python3 && ln -sf python3 /usr/bin/python -RUN python3 -m ensurepip -RUN pip3 install --no-cache --upgrade pip setuptools +RUN apk add --update --no-cache python3 && ln -sf python3 /usr/bin/python \ + && python3 -m ensurepip \ + && pip3 install --no-cache --upgrade pip setuptools #Install git RUN apk add git diff --git a/scanners/typo3scan/templates/typ3scan-parse-definition.yaml b/scanners/typo3scan/templates/typ3scan-parse-definition.yaml index 38f32230f4..2f5dd70086 100644 --- a/scanners/typo3scan/templates/typ3scan-parse-definition.yaml +++ b/scanners/typo3scan/templates/typ3scan-parse-definition.yaml @@ -1,9 +1,9 @@ apiVersion: execution.securecodebox.io/v1 kind: ParseDefinition metadata: - name: zap-json + name: typo3scan-json spec: - image: docker.io/securecodebox/parser-zap + image: "{{ .Values.parser.image.repository }}:{{ .Values.parser.image.tag | default .Chart.Version }}" imagePullSecrets: - name: dockerhub-token ttlSecondsAfterFinished: 60 \ No newline at end of file From 2a82efd7a143c7848365cdd9ed31d28762ff0a5f Mon Sep 17 00:00:00 2001 From: Ilyesbdlala Date: Tue, 24 Aug 2021 11:49:14 +0000 Subject: [PATCH 29/42] Updating Helm Docs Signed-off-by: GitHub Actions --- scanners/typo3scan/README.md | 2 +- scanners/typo3scan/docs/README.DockerHub-Parser.md | 2 +- scanners/typo3scan/docs/README.DockerHub-Scanner.md | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/scanners/typo3scan/README.md b/scanners/typo3scan/README.md index 6008d6efa4..5ef724c510 100644 --- a/scanners/typo3scan/README.md +++ b/scanners/typo3scan/README.md @@ -3,7 +3,7 @@ title: "Typo3Scan" category: "scanner" type: "Network" state: "released" -appVersion: "1.16.0" +appVersion: "0.7.2" usecase: "Automation of the process of detecting the Typo3 CMS, and it's installed extensions" --- diff --git a/scanners/typo3scan/docs/README.DockerHub-Parser.md b/scanners/typo3scan/docs/README.DockerHub-Parser.md index 7f54db0de5..4821c2dd4d 100644 --- a/scanners/typo3scan/docs/README.DockerHub-Parser.md +++ b/scanners/typo3scan/docs/README.DockerHub-Parser.md @@ -42,7 +42,7 @@ You can find resources to help you get started on our [documentation website](ht ## Supported Tags - `latest` (represents the latest stable release build) -- tagged releases, e.g. `1.16.0` +- tagged releases, e.g. `0.7.2` ## How to use this image This `parser` image is intended to work in combination with the corresponding security scanner docker image to parse the `findings` results. For more information details please take a look at the documentation page: https://docs.securecodebox.io/docs/scanners/typo3scan. diff --git a/scanners/typo3scan/docs/README.DockerHub-Scanner.md b/scanners/typo3scan/docs/README.DockerHub-Scanner.md index ccecec0f79..192b44220e 100644 --- a/scanners/typo3scan/docs/README.DockerHub-Scanner.md +++ b/scanners/typo3scan/docs/README.DockerHub-Scanner.md @@ -42,7 +42,7 @@ You can find resources to help you get started on our [documentation website](ht ## Supported Tags - `latest` (represents the latest stable release build) -- tagged releases, e.g. `1.16.0` +- tagged releases, e.g. `0.7.2` ## How to use this image This `scanner` image is intended to work in combination with the corresponding `parser` image to parse the scanner `findings` to generic secureCodeBox results. For more information details please take a look at the [project page][scb-docs] or [documentation page][https://docs.securecodebox.io/docs/scanners/typo3scan]. From de665dbb994e674bc26c553073f50b3798232398 Mon Sep 17 00:00:00 2001 From: Sebastian Date: Tue, 24 Aug 2021 14:12:27 +0200 Subject: [PATCH 30/42] Deleting unrelated files Sorry. Signed-off-by: Sebastian --- .../parser/__testFiles__/nikto-errored.json | 1 - tests/integration/scanner/typo3scan.test.js | 44 ------------------- 2 files changed, 45 deletions(-) delete mode 100644 scanners/nikto/parser/__testFiles__/nikto-errored.json delete mode 100644 tests/integration/scanner/typo3scan.test.js diff --git a/scanners/nikto/parser/__testFiles__/nikto-errored.json b/scanners/nikto/parser/__testFiles__/nikto-errored.json deleted file mode 100644 index 7805249966..0000000000 --- a/scanners/nikto/parser/__testFiles__/nikto-errored.json +++ /dev/null @@ -1 +0,0 @@ -{"id": "000029","OSVDB": "0","url":"/","msg":"No web server found on xxxx:80"} diff --git a/tests/integration/scanner/typo3scan.test.js b/tests/integration/scanner/typo3scan.test.js deleted file mode 100644 index f308ebf71b..0000000000 --- a/tests/integration/scanner/typo3scan.test.js +++ /dev/null @@ -1,44 +0,0 @@ -// SPDX-FileCopyrightText: 2021 iteratec GmbH -// -// SPDX-License-Identifier: Apache-2.0 - -const { scan } = require("../helpers"); - -jest.retryTimes(3); - -test( - "localhost port scan should only find a host finding", - async () => { - const { categories, severities, count } = await scan( - "typo3scan-localhost", - "nmap", - ["localhost"], - 90 - ); - - expect(count).toBe(1); - expect(categories).toMatchInlineSnapshot(` - Object { - "Host": 1, - } - `); - expect(severities).toMatchInlineSnapshot(` - Object { - "informational": 1, - } - `); - }, - 3 * 60 * 1000 -); - -test( - "invalid port scan should be marked as errored", - async () => { - await expect( - scan("nmap-localhost", "nmap", ["-invalidFlag", "localhost"], 90) - ).rejects.toThrow( - 'Scan failed with description "Failed to run the Scan Container, check k8s Job and its logs for more details"' - ); - }, - 3 * 60 * 1000 -); From eda8d64699c053b15a6ead2eef9990b975aa7b3a Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Wed, 25 Aug 2021 11:21:35 +0200 Subject: [PATCH 31/42] Added default icon to Chart.yaml Signed-off-by: Ilyes Ben Dlala --- scanners/typo3scan/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scanners/typo3scan/Chart.yaml b/scanners/typo3scan/Chart.yaml index 7f305f3a65..8d1ccc0829 100644 --- a/scanners/typo3scan/Chart.yaml +++ b/scanners/typo3scan/Chart.yaml @@ -30,7 +30,7 @@ keywords: - secureCodeBox home: https://docs.securecodebox.io/docs/scanners/typo3scan -#icon: Scanner doesn't have an icon +icon: https://docs.securecodebox.io/img/integrationIcons/Default.svg sources: - https://github.com/secureCodeBox/secureCodeBox From 06ab19b75553abdeab2ee22ee7d724911146391c Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Wed, 25 Aug 2021 11:23:02 +0200 Subject: [PATCH 32/42] Changed variables in parser.js to const when reasonable Signed-off-by: Ilyes Ben Dlala --- scanners/typo3scan/parser/parser.js | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/scanners/typo3scan/parser/parser.js b/scanners/typo3scan/parser/parser.js index 96ad79a7d1..6534910d2d 100644 --- a/scanners/typo3scan/parser/parser.js +++ b/scanners/typo3scan/parser/parser.js @@ -3,16 +3,16 @@ // SPDX-License-Identifier: Apache-2.0 async function parse(fileContent) { - let findings = JSON.parse(fileContent) + const findings = JSON.parse(fileContent) let results = '' Object.keys(findings).forEach(key => { - let domain = key; - let domain_findings = findings[domain] - let vulns = domain_findings.Vulnerabilities + const domain = key; + const domain_findings = findings[domain] + const vulns = domain_findings.Vulnerabilities // Parsing Vulnerabilities - let parsed_vulnerabilities = vulns.map((vuln) => { + const parsed_vulnerabilities = vulns.map((vuln) => { return { name: vuln.Type, description: `Vulnerability of type ${vuln.Type} found`, @@ -31,8 +31,8 @@ async function parse(fileContent) { }; }); // Parsing Extenstions - let extensions = domain_findings.Extensions - let parsed_extensions = extensions.map((ext) => { + const extensions = domain_findings.Extensions + const parsed_extensions = extensions.map((ext) => { // Check if extension has vulnerabilities : if yes severity = HIGH let severity = 'INFORMATIONAL' From c27e1f108e1211d4f8528dc5d9b17a18f1a8874e Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Wed, 25 Aug 2021 13:19:35 +0200 Subject: [PATCH 33/42] Changed typo3 scanner dockerfile to multistage Signed-off-by: Ilyes Ben Dlala --- scanners/typo3scan/scanner/Dockerfile | 28 +++++++++++++-------------- 1 file changed, 13 insertions(+), 15 deletions(-) diff --git a/scanners/typo3scan/scanner/Dockerfile b/scanners/typo3scan/scanner/Dockerfile index 9699b26ed9..fa99f9da8f 100644 --- a/scanners/typo3scan/scanner/Dockerfile +++ b/scanners/typo3scan/scanner/Dockerfile @@ -2,30 +2,28 @@ # # SPDX-License-Identifier: Apache-2.0 -FROM alpine:3.12 +#Base Image +FROM python:3.9-alpine as base -#Install Python3 -ENV PYTHONUNBUFFERED=1 -RUN apk add --update --no-cache python3 && ln -sf python3 /usr/bin/python \ - && python3 -m ensurepip \ - && pip3 install --no-cache --upgrade pip setuptools +#Install git and Clone Repo +RUN apk add git \ + && git clone https://github.com/whoot/Typo3Scan.git \ + && cd Typo3Scan \ + && rm -r .git .github doc +COPY wrapper.sh /Typo3Scan/wrapper.sh -#Install git -RUN apk add git +#Runtime Image +FROM python:3.9-alpine as runtime #Create typo3scan user/group and give access RUN addgroup --system --gid 1001 typo3scan && adduser typo3scan --system --uid 1001 --ingroup typo3scan -RUN mkdir /home/securecodebox/ -RUN chown -R typo3scan:typo3scan /home/securecodebox/ +COPY --from=base /Typo3Scan /home/typo3scan/Typo3Scan +RUN mkdir /home/securecodebox/ \ + && chown -R typo3scan:typo3scan /home/securecodebox/ /home/typo3scan/ USER 1001 - -#Clone Repo -WORKDIR /home/typo3scan/ -RUN git clone https://github.com/whoot/Typo3Scan.git WORKDIR /home/typo3scan/Typo3Scan #Install Typo3Scan python requirements RUN python3 -m pip install -r requirements.txt -COPY wrapper.sh ./wrapper.sh ENTRYPOINT [ "sh", "./wrapper.sh" ] \ No newline at end of file From cf39b0b0b001f916407b9d7fcc8eeb299f218097 Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Wed, 25 Aug 2021 17:03:26 +0200 Subject: [PATCH 34/42] Fix typo in helm-docs.gotmpl Signed-off-by: Ilyes Ben Dlala Co-authored-by: Sebastian Franz <32578476+SebieF@users.noreply.github.com> --- scanners/typo3scan/.helm-docs.gotmpl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scanners/typo3scan/.helm-docs.gotmpl b/scanners/typo3scan/.helm-docs.gotmpl index 7082057735..535bd662b9 100644 --- a/scanners/typo3scan/.helm-docs.gotmpl +++ b/scanners/typo3scan/.helm-docs.gotmpl @@ -11,7 +11,7 @@ category: "scanner" type: "Network" state: "released" appVersion: "{{ template "chart.appVersion" . }}" -usecase: "Automation of the process of detecting the Typo3 CMS, and it's installed extensions" +usecase: "Automation of the process of detecting the Typo3 CMS and its installed extensions" --- {{- end }} From fe36bb3a4df871e58e747624996eb467bb987e91 Mon Sep 17 00:00:00 2001 From: Ilyesbdlala Date: Wed, 25 Aug 2021 15:03:47 +0000 Subject: [PATCH 35/42] Updating Helm Docs Signed-off-by: GitHub Actions --- scanners/typo3scan/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scanners/typo3scan/README.md b/scanners/typo3scan/README.md index 5ef724c510..a2da717e4c 100644 --- a/scanners/typo3scan/README.md +++ b/scanners/typo3scan/README.md @@ -4,7 +4,7 @@ category: "scanner" type: "Network" state: "released" appVersion: "0.7.2" -usecase: "Automation of the process of detecting the Typo3 CMS, and it's installed extensions" +usecase: "Automation of the process of detecting the Typo3 CMS and its installed extensions" ---