Vulnerability Scanner for Open Source

Finally, Google has released the OSV-scanner as a free tool that gives opensource developers access to vulnerability information which may relevant to their projects.

With the new launching OSV.dev service, it allows all the different opensource ecosystems and vulnerability databases to publish and consume information in one simple, precise, and machine readable format (JSON).

OSV-scanner is an effort to provide supported fronted to the OSV database (OSV.dev) that connects a project's list of dependencies with vulnerabilities that affect them. 

There are a few ways to use OSV:

• Use the API 
• Use the command line
• Integrate with OpenSSF Scorecard's vulnerability check
  

So, let's get start running the OSV-scanner on your project to find all the dependencies that are being used by analyzing manifests, SBOMs, and commit hashes. The scanner hen connects this information with the centralized OSV database and displays the vulnerabilities relevant to your project.

Links:

• Announcing OSV-Scanner: Vulnerability Scanner for Open Source - (Dec 13, 2022)
  
• Announcing a unified vulnerability schema for open source - (Jun 24, 2021) 
  
• Launching OSV - Better vulnerability triage for open source - (Feb 5, 2021)
  
• SLSA
• https://github.com/ossf/osv-schema
• OpenSSF Scorecard 
  

Publish kev-catalog on GitHub

The cisa-alerts.py script has been renamed to kev-catalog.py and been published to GitHub today. Just download, setup and run the script.

$ git clone https://github.com/myseq/kev-catalog

$ cd kev-catalog/

$ pip3 install -r requirements.txt

$ python3 kev-catalog.py -v 

kev-catalog.py

Links:

• https://github.com/myseq/kev-catalog
  

Update on cisa-alerts.py

cisa-alerts.py

Update on 'cisa-alerts.py'. 

• Search CVE within catalog.
• Search string within catalog.
• Specify the top N vendors and products.
• Specify the last N days of CVE added to catalog.

 

cisa-alerts.py -e 2017-0143

cisa-alerts.py -s keep

cisa-alerts.py -l 4 -i 6

Links:

• https://github.com/myseq/

7 Newly Added Known Exploited Vulnerabilities

cisa-alerts.py

 

With the update of the cisa-alerts script today, it can now show the details of what's new in CISA's Known Exploited vulnerabilites JSON file.

There are 7 newly added Known Exploited vulnerabilities, and 1 of them is for Microsoft Windows User Profile Service Privilege Escalation Vulnerability (cve-2021-34484). 

All the 7 vulnerabilities need to be patched by Apr 21, 2022 (20 days for remediation).

Links:

• https://www.cisa.gov/uscert/ncas/current-activity/2022/03/31/cisa-adds-seven-known-exploited-vulnerabilities-catalog
  

Update on Known Exploited Vulnerabilities

Quick update on known exploited vulnerabilities catalog by CISA.

• Total vulns : 602
• Overdue vulns : 247
• Upcoming vulns : 355
• Vendors : 120
• Products: 326
  

cisa-alerts.py

32 vulnerabilities are added to the list (19 from Microsoft). All the details is available for download at CISA. Please refer to the previous post.

(If you notice there is a extra .2 at the catalog version, it is from CISA)

2022.03.28.2

Links:

• https://myseq.blogspot.com/2022/03/cisa-known-exploited-vuln-catalog.html

CISA Known Exploited Vuln Catalog

On Nov 3, 2021, the Cybersecurity and Infrastructure Security Agency (CISA), a branch of the U.S. Department of Homeland Security (DHS), released Binding Operational Directive (BOD) 22-01. It is tend to be high-level and high-impact, and unusually direct to mitigate a specific list of vulnerabilities in a strict time frame.

CISA BOD 22-01 has three lines specific to patching requirements:

1. Remediate each vulnerability according to the timelines set forth in the CISA-managed vulnerability catalog.
2. The catalog will list exploited vulnerabilities that carry significant risk to the federal enterprise with the requirement to remediate within six months for vulnerabilities with a Common Vulnerabilities and Exposures (CVE) ID assigned prior to 2021 and within two weeks for all other vulnerabilities.
3. These default timelines may be adjusted in the case of grave risk to the Federal Enterprise.

Overall, this seems to follow patching guidance many commercial entities already use.This catalog is called Known Exploited Vulnerability (KEV) catalog and it is strongly recommends that everyone to review and monitor the catalog and remediate the listed vulnerabilities to strengthen their security and resilience posture.

CISA will update this catalog with additional exploited vulnerabilities as they become known, subject to CISA review and when they satisfy the following thresholds:

• The vulnerability has an assigned Common Vulnerabilities and Exposures (CVE) ID.
• There is reliable evidence that the vulnerability has been actively exploited in the wild.
• There is a clear remediation action for the vulnerability, such as a vendor provided update.

cisa-alerts.py

 

The simple python script shows the top-n vendors and the top-n products found in the json file. It also can show the Kenna query string on CVE, with overdue and upcoming CVE.

Links:

• https://cyber.dhs.gov/bod/22-01/
  
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://github.com/myseq/
  

Online Tools for JSON Programming

Let's introduce 2 online tools that help me to do JSON programming here.

 

 

HttpBin - A simple HTTP Request & Response Service.

•  https://httpbin.org/

 

ReqBin -  ReqBin is an online API testing tool for REST and SOAP APIs.

• https://reqbin.com/ 

For manual testing REST API with Postman and curl:

• https://svitla.com/blog/testing-rest-api-with-postman-and-curl
  

JSON/CSV in Python

Two simple tutorials to convert between JSON and CSV data.

How to convert JSON to CSV

How to convert CSV to JSON

Links:

• https://www.youtube.com/watch?v=YLCSVv46ERo
• https://www.youtube.com/watch?v=LeFDBRAhRls
  
  

JSON Hijacking

I've been introduced to this JSON Hijacking topic recently. It is a very nice write-up.

Basically this vulnerability requires that you are exposing a JSON service which…

• Returns sensitive data with a JSON array.
• Responds to GET requests.
• Has JavaScript enabled (very likely the case)
• Supports the __defineSetter__ method.

This type of attack seems similar as a variant of a Cross Site Request Forgery (CSRF) attack.