fluent-plugin-jfrog-siem 0.1.7 → 2.0.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/.rspec +1 -0
- data/CHANGELOG.md +36 -0
- data/Gemfile.lock +90 -0
- data/README.md +10 -3
- data/Rakefile +1 -1
- data/fluent-plugin-jfrog-siem.gemspec +8 -3
- data/lib/fluent/plugin/in_jfrog_siem.rb +41 -215
- data/lib/fluent/plugin/position_file.rb +32 -0
- data/lib/fluent/plugin/violations.json +380 -0
- data/lib/fluent/plugin/xray.rb +164 -0
- data/spec/position_file_spec.rb +56 -0
- data/spec/spec_helper.rb +111 -0
- data/spec/xray_spec.rb +135 -0
- data/test/helper.rb +1 -0
- data/test/plugin/test_in_jfrog_siem.rb +31 -5
- metadata +76 -10
- data/elastic.conf +0 -18
- data/splunk.conf +0 -18
|
@@ -0,0 +1,32 @@
|
|
|
1
|
+
class PositionFile
|
|
2
|
+
|
|
3
|
+
def initialize(pos_file_path)
|
|
4
|
+
@pos_file_path = pos_file_path
|
|
5
|
+
end
|
|
6
|
+
|
|
7
|
+
def processed?(violation)
|
|
8
|
+
File.exist?(pos_file_name(violation)) && found?(violation)
|
|
9
|
+
end
|
|
10
|
+
|
|
11
|
+
def write(violation)
|
|
12
|
+
File.open(pos_file_name(violation), 'a') do |f|
|
|
13
|
+
f << violation_entry(violation)
|
|
14
|
+
f << "\n"
|
|
15
|
+
end
|
|
16
|
+
end
|
|
17
|
+
|
|
18
|
+
private
|
|
19
|
+
def found?(violation)
|
|
20
|
+
return File.open(pos_file_name(violation)) { |f| f.find { |line| line.include? violation_entry(violation) } }
|
|
21
|
+
end
|
|
22
|
+
|
|
23
|
+
def violation_entry(violation)
|
|
24
|
+
created_date = DateTime.parse(violation['created']).strftime("%Y-%m-%dT%H:%M:%SZ")
|
|
25
|
+
[created_date, violation['watch_name'], violation['issue_id']].join(',')
|
|
26
|
+
end
|
|
27
|
+
|
|
28
|
+
def pos_file_name(violation)
|
|
29
|
+
pos_file_date = DateTime.parse(violation['created']).strftime("%Y-%m-%d")
|
|
30
|
+
@pos_file_path + "jfrog_siem_log_#{pos_file_date}.siem.pos"
|
|
31
|
+
end
|
|
32
|
+
end
|
|
@@ -0,0 +1,380 @@
|
|
|
1
|
+
{
|
|
2
|
+
"total_violations":54,
|
|
3
|
+
"violations":[
|
|
4
|
+
{
|
|
5
|
+
"description":"Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to bypass validation via a request with a 'org.apache.struts.taglib.html.Constants.CANCEL' parameter, which causes the action to be canceled but would not be detected from applications that do not use the isCancelled check.",
|
|
6
|
+
"severity":"High",
|
|
7
|
+
"type":"Security",
|
|
8
|
+
"infected_components":[
|
|
9
|
+
"gav://struts:struts:1.1"
|
|
10
|
+
],
|
|
11
|
+
"created":"2021-06-16T21:22:18Z",
|
|
12
|
+
"watch_name":"maven-watch1",
|
|
13
|
+
"issue_id":"XRAY-55418",
|
|
14
|
+
"violation_details_url":"http://localhost:8046/xray/api/v1/violations?watch_id=ff9cf61f42a095cd97ea0ec0&issue_id=XRAY-55418&comp_id=gav:%2F%2Fstruts:struts:1.1",
|
|
15
|
+
"impacted_artifacts":[
|
|
16
|
+
"default/maven-repo-1/struts/struts/1.1/struts-1.1.jar"
|
|
17
|
+
]
|
|
18
|
+
},
|
|
19
|
+
{
|
|
20
|
+
"description":"The Apache Software License, Version 1.1",
|
|
21
|
+
"severity":"High",
|
|
22
|
+
"type":"License",
|
|
23
|
+
"infected_components":[
|
|
24
|
+
"gav://struts:struts:1.1"
|
|
25
|
+
],
|
|
26
|
+
"created":"2021-06-16T21:22:18Z",
|
|
27
|
+
"watch_name":"license-watch",
|
|
28
|
+
"issue_id":"Apache-1.1",
|
|
29
|
+
"violation_details_url":"http://localhost:8046/xray/api/v1/violations?watch_id=b241c1986818d68993093e35&issue_id=Apache-1.1&comp_id=gav:%2F%2Fstruts:struts:1.1",
|
|
30
|
+
"impacted_artifacts":[
|
|
31
|
+
"default/maven-repo-1/struts/struts/1.1/struts-1.1.jar"
|
|
32
|
+
]
|
|
33
|
+
},
|
|
34
|
+
{
|
|
35
|
+
"description":"The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.",
|
|
36
|
+
"severity":"High",
|
|
37
|
+
"type":"Security",
|
|
38
|
+
"infected_components":[
|
|
39
|
+
"gav://struts:struts:1.1"
|
|
40
|
+
],
|
|
41
|
+
"created":"2021-06-16T21:22:18Z",
|
|
42
|
+
"watch_name":"maven-watch1",
|
|
43
|
+
"issue_id":"XRAY-55648",
|
|
44
|
+
"violation_details_url":"http://localhost:8046/xray/api/v1/violations?watch_id=ff9cf61f42a095cd97ea0ec0&issue_id=XRAY-55648&comp_id=gav:%2F%2Fstruts:struts:1.1",
|
|
45
|
+
"impacted_artifacts":[
|
|
46
|
+
"default/maven-repo-1/struts/struts/1.1/struts-1.1.jar"
|
|
47
|
+
]
|
|
48
|
+
},
|
|
49
|
+
{
|
|
50
|
+
"description":"Cross-site scripting (XSS) vulnerability in Apache Struts before 1.2.9-162.31.1 on SUSE Linux Enterprise (SLE) 11, before 1.2.9-108.2 on SUSE openSUSE 10.3, before 1.2.9-198.2 on SUSE openSUSE 11.0, and before 1.2.9-162.163.2 on SUSE openSUSE 11.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to \"insufficient quoting of parameters.\"",
|
|
51
|
+
"severity":"Medium",
|
|
52
|
+
"type":"Security",
|
|
53
|
+
"infected_components":[
|
|
54
|
+
"gav://struts:struts:1.1"
|
|
55
|
+
],
|
|
56
|
+
"created":"2021-06-16T21:22:18Z",
|
|
57
|
+
"watch_name":"maven-watch1",
|
|
58
|
+
"issue_id":"XRAY-55444",
|
|
59
|
+
"violation_details_url":"http://localhost:8046/xray/api/v1/violations?watch_id=ff9cf61f42a095cd97ea0ec0&issue_id=XRAY-55444&comp_id=gav:%2F%2Fstruts:struts:1.1",
|
|
60
|
+
"impacted_artifacts":[
|
|
61
|
+
"default/maven-repo-1/struts/struts/1.1/struts-1.1.jar"
|
|
62
|
+
]
|
|
63
|
+
},
|
|
64
|
+
{
|
|
65
|
+
"description":"Cross-site scripting (XSS) vulnerability in (1) LookupDispatchAction and possibly (2) DispatchAction and (3) ActionDispatcher in Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to inject arbitrary web script or HTML via the parameter name, which is not filtered in the resulting error message.",
|
|
66
|
+
"severity":"Medium",
|
|
67
|
+
"type":"Security",
|
|
68
|
+
"infected_components":[
|
|
69
|
+
"gav://struts:struts:1.1"
|
|
70
|
+
],
|
|
71
|
+
"created":"2021-06-16T21:22:18Z",
|
|
72
|
+
"watch_name":"maven-watch1",
|
|
73
|
+
"issue_id":"XRAY-55420",
|
|
74
|
+
"violation_details_url":"http://localhost:8046/xray/api/v1/violations?watch_id=ff9cf61f42a095cd97ea0ec0&issue_id=XRAY-55420&comp_id=gav:%2F%2Fstruts:struts:1.1",
|
|
75
|
+
"impacted_artifacts":[
|
|
76
|
+
"default/maven-repo-1/struts/struts/1.1/struts-1.1.jar"
|
|
77
|
+
]
|
|
78
|
+
},
|
|
79
|
+
{
|
|
80
|
+
"description":"ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.",
|
|
81
|
+
"severity":"High",
|
|
82
|
+
"type":"Security",
|
|
83
|
+
"infected_components":[
|
|
84
|
+
"gav://struts:struts:1.1"
|
|
85
|
+
],
|
|
86
|
+
"created":"2021-06-16T21:22:18Z",
|
|
87
|
+
"watch_name":"maven-watch1",
|
|
88
|
+
"issue_id":"XRAY-55419",
|
|
89
|
+
"violation_details_url":"http://localhost:8046/xray/api/v1/violations?watch_id=ff9cf61f42a095cd97ea0ec0&issue_id=XRAY-55419&comp_id=gav:%2F%2Fstruts:struts:1.1",
|
|
90
|
+
"impacted_artifacts":[
|
|
91
|
+
"default/maven-repo-1/struts/struts/1.1/struts-1.1.jar"
|
|
92
|
+
]
|
|
93
|
+
},
|
|
94
|
+
{
|
|
95
|
+
"description":"The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.",
|
|
96
|
+
"severity":"High",
|
|
97
|
+
"type":"Security",
|
|
98
|
+
"infected_components":[
|
|
99
|
+
"gav://struts:struts:1.2.4"
|
|
100
|
+
],
|
|
101
|
+
"created":"2021-06-16T21:22:27Z",
|
|
102
|
+
"watch_name":"maven-watch-2",
|
|
103
|
+
"issue_id":"XRAY-55648",
|
|
104
|
+
"violation_details_url":"http://localhost:8046/xray/api/v1/violations?watch_id=2a3ee020bf1a86b84d122c0c&issue_id=XRAY-55648&comp_id=gav:%2F%2Fstruts:struts:1.2.4",
|
|
105
|
+
"impacted_artifacts":[
|
|
106
|
+
"default/maven-repo-2/struts/struts/1.2.4/struts-1.2.4.jar"
|
|
107
|
+
]
|
|
108
|
+
},
|
|
109
|
+
{
|
|
110
|
+
"description":"ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.",
|
|
111
|
+
"severity":"High",
|
|
112
|
+
"type":"Security",
|
|
113
|
+
"infected_components":[
|
|
114
|
+
"gav://struts:struts:1.2.4"
|
|
115
|
+
],
|
|
116
|
+
"created":"2021-06-16T21:22:27Z",
|
|
117
|
+
"watch_name":"maven-watch-2",
|
|
118
|
+
"issue_id":"XRAY-55419",
|
|
119
|
+
"violation_details_url":"http://localhost:8046/xray/api/v1/violations?watch_id=2a3ee020bf1a86b84d122c0c&issue_id=XRAY-55419&comp_id=gav:%2F%2Fstruts:struts:1.2.4",
|
|
120
|
+
"impacted_artifacts":[
|
|
121
|
+
"default/maven-repo-2/struts/struts/1.2.4/struts-1.2.4.jar"
|
|
122
|
+
]
|
|
123
|
+
},
|
|
124
|
+
{
|
|
125
|
+
"description":"Cross-site scripting (XSS) vulnerability in (1) LookupDispatchAction and possibly (2) DispatchAction and (3) ActionDispatcher in Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to inject arbitrary web script or HTML via the parameter name, which is not filtered in the resulting error message.",
|
|
126
|
+
"severity":"Medium",
|
|
127
|
+
"type":"Security",
|
|
128
|
+
"infected_components":[
|
|
129
|
+
"gav://struts:struts:1.2.4"
|
|
130
|
+
],
|
|
131
|
+
"created":"2021-06-16T21:22:27Z",
|
|
132
|
+
"watch_name":"maven-watch-2",
|
|
133
|
+
"issue_id":"XRAY-55420",
|
|
134
|
+
"violation_details_url":"http://localhost:8046/xray/api/v1/violations?watch_id=2a3ee020bf1a86b84d122c0c&issue_id=XRAY-55420&comp_id=gav:%2F%2Fstruts:struts:1.2.4",
|
|
135
|
+
"impacted_artifacts":[
|
|
136
|
+
"default/maven-repo-2/struts/struts/1.2.4/struts-1.2.4.jar"
|
|
137
|
+
]
|
|
138
|
+
},
|
|
139
|
+
{
|
|
140
|
+
"description":"The Apache Software License, Version 2.0",
|
|
141
|
+
"severity":"High",
|
|
142
|
+
"type":"License",
|
|
143
|
+
"infected_components":[
|
|
144
|
+
"gav://struts:struts:1.2.4"
|
|
145
|
+
],
|
|
146
|
+
"created":"2021-06-16T21:22:27Z",
|
|
147
|
+
"watch_name":"license-watch",
|
|
148
|
+
"issue_id":"Apache-2.0",
|
|
149
|
+
"violation_details_url":"http://localhost:8046/xray/api/v1/violations?watch_id=b241c1986818d68993093e35&issue_id=Apache-2.0&comp_id=gav:%2F%2Fstruts:struts:1.2.4",
|
|
150
|
+
"impacted_artifacts":[
|
|
151
|
+
"default/maven-repo-2/struts/struts/1.2.4/struts-1.2.4.jar"
|
|
152
|
+
]
|
|
153
|
+
},
|
|
154
|
+
{
|
|
155
|
+
"description":"Cross-site scripting (XSS) vulnerability in Apache Struts before 1.2.9-162.31.1 on SUSE Linux Enterprise (SLE) 11, before 1.2.9-108.2 on SUSE openSUSE 10.3, before 1.2.9-198.2 on SUSE openSUSE 11.0, and before 1.2.9-162.163.2 on SUSE openSUSE 11.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to \"insufficient quoting of parameters.\"",
|
|
156
|
+
"severity":"Medium",
|
|
157
|
+
"type":"Security",
|
|
158
|
+
"infected_components":[
|
|
159
|
+
"gav://struts:struts:1.2.4"
|
|
160
|
+
],
|
|
161
|
+
"created":"2021-06-16T21:22:27Z",
|
|
162
|
+
"watch_name":"maven-watch-2",
|
|
163
|
+
"issue_id":"XRAY-55444",
|
|
164
|
+
"violation_details_url":"http://localhost:8046/xray/api/v1/violations?watch_id=2a3ee020bf1a86b84d122c0c&issue_id=XRAY-55444&comp_id=gav:%2F%2Fstruts:struts:1.2.4",
|
|
165
|
+
"impacted_artifacts":[
|
|
166
|
+
"default/maven-repo-2/struts/struts/1.2.4/struts-1.2.4.jar"
|
|
167
|
+
]
|
|
168
|
+
},
|
|
169
|
+
{
|
|
170
|
+
"description":"Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to bypass validation via a request with a 'org.apache.struts.taglib.html.Constants.CANCEL' parameter, which causes the action to be canceled but would not be detected from applications that do not use the isCancelled check.",
|
|
171
|
+
"severity":"High",
|
|
172
|
+
"type":"Security",
|
|
173
|
+
"infected_components":[
|
|
174
|
+
"gav://struts:struts:1.2.4"
|
|
175
|
+
],
|
|
176
|
+
"created":"2021-06-16T21:22:27Z",
|
|
177
|
+
"watch_name":"maven-watch-2",
|
|
178
|
+
"issue_id":"XRAY-55418",
|
|
179
|
+
"violation_details_url":"http://localhost:8046/xray/api/v1/violations?watch_id=2a3ee020bf1a86b84d122c0c&issue_id=XRAY-55418&comp_id=gav:%2F%2Fstruts:struts:1.2.4",
|
|
180
|
+
"impacted_artifacts":[
|
|
181
|
+
"default/maven-repo-2/struts/struts/1.2.4/struts-1.2.4.jar"
|
|
182
|
+
]
|
|
183
|
+
},
|
|
184
|
+
{
|
|
185
|
+
"description":"Unicode Terms of Use",
|
|
186
|
+
"severity":"High",
|
|
187
|
+
"type":"License",
|
|
188
|
+
"infected_components":[
|
|
189
|
+
"gav://org.apache.struts:struts2-core:2.0.9"
|
|
190
|
+
],
|
|
191
|
+
"created":"2021-06-16T21:22:37Z",
|
|
192
|
+
"watch_name":"license-watch",
|
|
193
|
+
"issue_id":"Unicode-TOU",
|
|
194
|
+
"violation_details_url":"http://localhost:8046/xray/api/v1/violations?watch_id=b241c1986818d68993093e35&issue_id=Unicode-TOU&comp_id=gav:%2F%2Forg.apache.struts:struts2-core:2.0.9",
|
|
195
|
+
"impacted_artifacts":[
|
|
196
|
+
"default/maven-repo-3/org/apache/struts/struts2-core/2.0.9/struts2-core-2.0.9.jar"
|
|
197
|
+
]
|
|
198
|
+
},
|
|
199
|
+
{
|
|
200
|
+
"description":"BSD 3-Clause \"New\" or \"Revised\" License",
|
|
201
|
+
"severity":"High",
|
|
202
|
+
"type":"License",
|
|
203
|
+
"infected_components":[
|
|
204
|
+
"gav://org.apache.struts:struts2-core:2.0.9"
|
|
205
|
+
],
|
|
206
|
+
"created":"2021-06-16T21:22:37Z",
|
|
207
|
+
"watch_name":"license-watch",
|
|
208
|
+
"issue_id":"BSD-3-Clause",
|
|
209
|
+
"violation_details_url":"http://localhost:8046/xray/api/v1/violations?watch_id=b241c1986818d68993093e35&issue_id=BSD-3-Clause&comp_id=gav:%2F%2Forg.apache.struts:struts2-core:2.0.9",
|
|
210
|
+
"impacted_artifacts":[
|
|
211
|
+
"default/maven-repo-3/org/apache/struts/struts2-core/2.0.9/struts2-core-2.0.9.jar"
|
|
212
|
+
]
|
|
213
|
+
},
|
|
214
|
+
{
|
|
215
|
+
"description":"The Apache Software License, Version 2.0",
|
|
216
|
+
"severity":"High",
|
|
217
|
+
"type":"License",
|
|
218
|
+
"infected_components":[
|
|
219
|
+
"gav://org.apache.struts:struts2-core:2.0.9"
|
|
220
|
+
],
|
|
221
|
+
"created":"2021-06-16T21:22:37Z",
|
|
222
|
+
"watch_name":"license-watch",
|
|
223
|
+
"issue_id":"Apache-2.0",
|
|
224
|
+
"violation_details_url":"http://localhost:8046/xray/api/v1/violations?watch_id=b241c1986818d68993093e35&issue_id=Apache-2.0&comp_id=gav:%2F%2Forg.apache.struts:struts2-core:2.0.9",
|
|
225
|
+
"impacted_artifacts":[
|
|
226
|
+
"default/maven-repo-3/org/apache/struts/struts2-core/2.0.9/struts2-core-2.0.9.jar"
|
|
227
|
+
]
|
|
228
|
+
},
|
|
229
|
+
{
|
|
230
|
+
"description":"The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fisheye, Crucible, and possibly other products, uses a permissive whitelist, which allows remote attackers to modify server-side context objects and bypass the \"#\" protection mechanism in ParameterInterceptors via the (1) #context, (2) #_memberAccess, (3) #root, (4) #this, (5) #_typeResolver, (6) #_classResolver, (7) #_traceEvaluations, (8) #_lastEvaluation, (9) #_keepLastEvaluation, and possibly other OGNL context variables, a different vulnerability than CVE-2008-6504.",
|
|
231
|
+
"severity":"Medium",
|
|
232
|
+
"type":"Security",
|
|
233
|
+
"infected_components":[
|
|
234
|
+
"gav://org.apache.struts:struts2-core:2.0.9"
|
|
235
|
+
],
|
|
236
|
+
"created":"2021-06-16T21:22:37Z",
|
|
237
|
+
"watch_name":"maven-watch-3",
|
|
238
|
+
"issue_id":"XRAY-55471",
|
|
239
|
+
"violation_details_url":"http://localhost:8046/xray/api/v1/violations?watch_id=2c5ecab8172f24086f4b3bf4&issue_id=XRAY-55471&comp_id=gav:%2F%2Forg.apache.struts:struts2-core:2.0.9",
|
|
240
|
+
"impacted_artifacts":[
|
|
241
|
+
"default/maven-repo-3/org/apache/struts/struts2-core/2.0.9/struts2-core-2.0.9.jar"
|
|
242
|
+
]
|
|
243
|
+
},
|
|
244
|
+
{
|
|
245
|
+
"description":"Academic Free License v2.1",
|
|
246
|
+
"severity":"High",
|
|
247
|
+
"type":"License",
|
|
248
|
+
"infected_components":[
|
|
249
|
+
"gav://org.apache.struts:struts2-core:2.0.9"
|
|
250
|
+
],
|
|
251
|
+
"created":"2021-06-16T21:22:37Z",
|
|
252
|
+
"watch_name":"license-watch",
|
|
253
|
+
"issue_id":"AFL-2.1",
|
|
254
|
+
"violation_details_url":"http://localhost:8046/xray/api/v1/violations?watch_id=b241c1986818d68993093e35&issue_id=AFL-2.1&comp_id=gav:%2F%2Forg.apache.struts:struts2-core:2.0.9",
|
|
255
|
+
"impacted_artifacts":[
|
|
256
|
+
"default/maven-repo-3/org/apache/struts/struts2-core/2.0.9/struts2-core-2.0.9.jar"
|
|
257
|
+
]
|
|
258
|
+
},
|
|
259
|
+
{
|
|
260
|
+
"description":"ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph Navigation Language (OGNL) statements and modify server-side context objects, as demonstrated by use of a \\u0023 representation for the # character.",
|
|
261
|
+
"severity":"Medium",
|
|
262
|
+
"type":"Security",
|
|
263
|
+
"infected_components":[
|
|
264
|
+
"gav://org.apache.struts:struts2-core:2.0.9"
|
|
265
|
+
],
|
|
266
|
+
"created":"2021-06-16T21:22:38Z",
|
|
267
|
+
"watch_name":"maven-watch-3",
|
|
268
|
+
"issue_id":"XRAY-55446",
|
|
269
|
+
"violation_details_url":"http://localhost:8046/xray/api/v1/violations?watch_id=2c5ecab8172f24086f4b3bf4&issue_id=XRAY-55446&comp_id=gav:%2F%2Forg.apache.struts:struts2-core:2.0.9",
|
|
270
|
+
"impacted_artifacts":[
|
|
271
|
+
"default/maven-repo-3/org/apache/struts/struts2-core/2.0.9/struts2-core-2.0.9.jar"
|
|
272
|
+
]
|
|
273
|
+
},
|
|
274
|
+
{
|
|
275
|
+
"description":"Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.x before 2.0.11.1 and 2.1.x before 2.1.1 allow remote attackers to inject arbitrary web script or HTML via vectors associated with improper handling of (1) \" (double quote) characters in the href attribute of an s:a tag and (2) parameters in the action attribute of an s:url tag.",
|
|
276
|
+
"severity":"Medium",
|
|
277
|
+
"type":"Security",
|
|
278
|
+
"infected_components":[
|
|
279
|
+
"gav://org.apache.struts:struts2-core:2.0.9"
|
|
280
|
+
],
|
|
281
|
+
"created":"2021-06-16T21:22:38Z",
|
|
282
|
+
"watch_name":"maven-watch-3",
|
|
283
|
+
"issue_id":"XRAY-55448",
|
|
284
|
+
"violation_details_url":"http://localhost:8046/xray/api/v1/violations?watch_id=2c5ecab8172f24086f4b3bf4&issue_id=XRAY-55448&comp_id=gav:%2F%2Forg.apache.struts:struts2-core:2.0.9",
|
|
285
|
+
"impacted_artifacts":[
|
|
286
|
+
"default/maven-repo-3/org/apache/struts/struts2-core/2.0.9/struts2-core-2.0.9.jar"
|
|
287
|
+
]
|
|
288
|
+
},
|
|
289
|
+
{
|
|
290
|
+
"description":"Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.",
|
|
291
|
+
"severity":"Critical",
|
|
292
|
+
"type":"Security",
|
|
293
|
+
"infected_components":[
|
|
294
|
+
"gav://org.apache.struts:struts2-core:2.0.9"
|
|
295
|
+
],
|
|
296
|
+
"created":"2021-06-16T21:22:38Z",
|
|
297
|
+
"watch_name":"maven-watch-3",
|
|
298
|
+
"issue_id":"XRAY-129844",
|
|
299
|
+
"violation_details_url":"http://localhost:8046/xray/api/v1/violations?watch_id=2c5ecab8172f24086f4b3bf4&issue_id=XRAY-129844&comp_id=gav:%2F%2Forg.apache.struts:struts2-core:2.0.9",
|
|
300
|
+
"impacted_artifacts":[
|
|
301
|
+
"default/maven-repo-3/org/apache/struts/struts2-core/2.0.9/struts2-core-2.0.9.jar"
|
|
302
|
+
]
|
|
303
|
+
},
|
|
304
|
+
{
|
|
305
|
+
"description":"The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.",
|
|
306
|
+
"severity":"High",
|
|
307
|
+
"type":"Security",
|
|
308
|
+
"infected_components":[
|
|
309
|
+
"gav://org.apache.struts:struts2-core:2.0.9"
|
|
310
|
+
],
|
|
311
|
+
"created":"2021-06-16T21:22:38Z",
|
|
312
|
+
"watch_name":"maven-watch-3",
|
|
313
|
+
"issue_id":"XRAY-55522",
|
|
314
|
+
"violation_details_url":"http://localhost:8046/xray/api/v1/violations?watch_id=2c5ecab8172f24086f4b3bf4&issue_id=XRAY-55522&comp_id=gav:%2F%2Forg.apache.struts:struts2-core:2.0.9",
|
|
315
|
+
"impacted_artifacts":[
|
|
316
|
+
"default/maven-repo-3/org/apache/struts/struts2-core/2.0.9/struts2-core-2.0.9.jar"
|
|
317
|
+
]
|
|
318
|
+
},
|
|
319
|
+
{
|
|
320
|
+
"description":"Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both \"${}\" and \"%{}\" sequences, which causes the OGNL code to be evaluated twice.",
|
|
321
|
+
"severity":"High",
|
|
322
|
+
"type":"Security",
|
|
323
|
+
"infected_components":[
|
|
324
|
+
"gav://org.apache.struts:struts2-core:2.0.9"
|
|
325
|
+
],
|
|
326
|
+
"created":"2021-06-16T21:22:38Z",
|
|
327
|
+
"watch_name":"maven-watch-3",
|
|
328
|
+
"issue_id":"XRAY-55575",
|
|
329
|
+
"violation_details_url":"http://localhost:8046/xray/api/v1/violations?watch_id=2c5ecab8172f24086f4b3bf4&issue_id=XRAY-55575&comp_id=gav:%2F%2Forg.apache.struts:struts2-core:2.0.9",
|
|
330
|
+
"impacted_artifacts":[
|
|
331
|
+
"default/maven-repo-3/org/apache/struts/struts2-core/2.0.9/struts2-core-2.0.9.jar"
|
|
332
|
+
]
|
|
333
|
+
},
|
|
334
|
+
{
|
|
335
|
+
"description":"Apache Struts JSP Page Handling Unspecified XSS",
|
|
336
|
+
"severity":"Medium",
|
|
337
|
+
"type":"Security",
|
|
338
|
+
"infected_components":[
|
|
339
|
+
"gav://org.apache.struts:struts2-core:2.0.9"
|
|
340
|
+
],
|
|
341
|
+
"created":"2021-06-16T21:22:38Z",
|
|
342
|
+
"watch_name":"maven-watch-3",
|
|
343
|
+
"issue_id":"XRAY-81164",
|
|
344
|
+
"violation_details_url":"http://localhost:8046/xray/api/v1/violations?watch_id=2c5ecab8172f24086f4b3bf4&issue_id=XRAY-81164&comp_id=gav:%2F%2Forg.apache.struts:struts2-core:2.0.9",
|
|
345
|
+
"impacted_artifacts":[
|
|
346
|
+
"default/maven-repo-3/org/apache/struts/struts2-core/2.0.9/struts2-core-2.0.9.jar"
|
|
347
|
+
]
|
|
348
|
+
},
|
|
349
|
+
{
|
|
350
|
+
"description":"Apache Struts <s:textfield> Tag <s:include> Handling XSS",
|
|
351
|
+
"severity":"Medium",
|
|
352
|
+
"type":"Security",
|
|
353
|
+
"infected_components":[
|
|
354
|
+
"gav://org.apache.struts:struts2-core:2.0.9"
|
|
355
|
+
],
|
|
356
|
+
"created":"2021-06-16T21:22:38Z",
|
|
357
|
+
"watch_name":"maven-watch-3",
|
|
358
|
+
"issue_id":"XRAY-81187",
|
|
359
|
+
"violation_details_url":"http://localhost:8046/xray/api/v1/violations?watch_id=2c5ecab8172f24086f4b3bf4&issue_id=XRAY-81187&comp_id=gav:%2F%2Forg.apache.struts:struts2-core:2.0.9",
|
|
360
|
+
"impacted_artifacts":[
|
|
361
|
+
"default/maven-repo-3/org/apache/struts/struts2-core/2.0.9/struts2-core-2.0.9.jar"
|
|
362
|
+
]
|
|
363
|
+
},
|
|
364
|
+
{
|
|
365
|
+
"description":"Apache Struts EL / OGNL Interpretation Unspecified Remote Code Execution",
|
|
366
|
+
"severity":"High",
|
|
367
|
+
"type":"Security",
|
|
368
|
+
"infected_components":[
|
|
369
|
+
"gav://org.apache.struts:struts2-core:2.0.9"
|
|
370
|
+
],
|
|
371
|
+
"created":"2021-06-16T21:22:38Z",
|
|
372
|
+
"watch_name":"maven-watch-3",
|
|
373
|
+
"issue_id":"XRAY-87424",
|
|
374
|
+
"violation_details_url":"http://localhost:8046/xray/api/v1/violations?watch_id=2c5ecab8172f24086f4b3bf4&issue_id=XRAY-87424&comp_id=gav:%2F%2Forg.apache.struts:struts2-core:2.0.9",
|
|
375
|
+
"impacted_artifacts":[
|
|
376
|
+
"default/maven-repo-3/org/apache/struts/struts2-core/2.0.9/struts2-core-2.0.9.jar"
|
|
377
|
+
]
|
|
378
|
+
}
|
|
379
|
+
]
|
|
380
|
+
}
|
|
@@ -0,0 +1,164 @@
|
|
|
1
|
+
require 'concurrent'
|
|
2
|
+
require 'concurrent-edge'
|
|
3
|
+
require 'json'
|
|
4
|
+
require "fluent/plugin/position_file"
|
|
5
|
+
|
|
6
|
+
class Xray
|
|
7
|
+
def initialize(jpd_url, username, api_key, wait_interval, batch_size, pos_file_path, router, tag)
|
|
8
|
+
@jpd_url = jpd_url
|
|
9
|
+
@username = username
|
|
10
|
+
@api_key = api_key
|
|
11
|
+
@wait_interval = wait_interval
|
|
12
|
+
@batch_size = batch_size
|
|
13
|
+
@pos_file_path = pos_file_path
|
|
14
|
+
@router = router
|
|
15
|
+
@tag = tag
|
|
16
|
+
end
|
|
17
|
+
|
|
18
|
+
def violations(date_since)
|
|
19
|
+
violations_channel = Concurrent::Channel.new(capacity: @batch_size)
|
|
20
|
+
page_number = 1
|
|
21
|
+
timer_task = Concurrent::TimerTask.new(execution_interval: @wait_interval, timeout_interval: 30) do
|
|
22
|
+
xray_json = {"filters": { "created_from": date_since }, "pagination": {"order_by": "created","limit": @batch_size ,"offset": page_number } }
|
|
23
|
+
resp = get_violations(xray_json)
|
|
24
|
+
page_violation_count = resp['violations'].length
|
|
25
|
+
puts "Total violations count is #{resp['total_violations']}"
|
|
26
|
+
if resp['total_violations'] > 0
|
|
27
|
+
puts "Number of Violations in page #{page_number} are #{page_violation_count}"
|
|
28
|
+
resp['violations'].each {|v| violations_channel = process(v, violations_channel) }
|
|
29
|
+
page_number += 1 if next_page?(page_violation_count)
|
|
30
|
+
end
|
|
31
|
+
end
|
|
32
|
+
timer_task.execute
|
|
33
|
+
|
|
34
|
+
violations_channel
|
|
35
|
+
end
|
|
36
|
+
|
|
37
|
+
def violation_details(violations_channel)
|
|
38
|
+
violations_channel.each do |v|
|
|
39
|
+
Concurrent::Promises.future(v) do |v|
|
|
40
|
+
pull_violation_details(v['violation_details_url'])
|
|
41
|
+
pos_file = PositionFile.new(@pos_file_path)
|
|
42
|
+
pos_file.write(v)
|
|
43
|
+
end
|
|
44
|
+
end
|
|
45
|
+
end
|
|
46
|
+
|
|
47
|
+
def pull_violation_details(xray_violation_detail_url)
|
|
48
|
+
begin
|
|
49
|
+
detailResp_json = data_normalization(get_violations_detail(xray_violation_detail_url))
|
|
50
|
+
time = Fluent::Engine.now
|
|
51
|
+
@router.emit(@tag, time, detailResp_json)
|
|
52
|
+
rescue => e
|
|
53
|
+
puts "error: #{e}"
|
|
54
|
+
raise Fluent::ConfigError, "Error pulling violation details url #{xray_violation_detail_url}: #{e}"
|
|
55
|
+
end
|
|
56
|
+
end
|
|
57
|
+
|
|
58
|
+
def get_violations_detail(xray_violation_detail_url)
|
|
59
|
+
response = RestClient::Request.new(
|
|
60
|
+
:method => :get,
|
|
61
|
+
:url => xray_violation_detail_url,
|
|
62
|
+
:user => @username,
|
|
63
|
+
:password => @api_key
|
|
64
|
+
).execute do |response, request, result|
|
|
65
|
+
case response.code
|
|
66
|
+
when 200
|
|
67
|
+
return JSON.parse(response.to_s)
|
|
68
|
+
else
|
|
69
|
+
puts "error: #{response.to_json}"
|
|
70
|
+
raise Fluent::ConfigError, "Cannot reach Artifactory URL to pull Xray SIEM violations."
|
|
71
|
+
end
|
|
72
|
+
end
|
|
73
|
+
end
|
|
74
|
+
|
|
75
|
+
def data_normalization(detailResp_json)
|
|
76
|
+
cve = []
|
|
77
|
+
cvss_v2_list = []
|
|
78
|
+
cvss_v3_list = []
|
|
79
|
+
policy_list = []
|
|
80
|
+
rule_list = []
|
|
81
|
+
impacted_artifact_url_list = []
|
|
82
|
+
if detailResp_json.key?('properties')
|
|
83
|
+
properties = detailResp_json['properties']
|
|
84
|
+
for index in 0..properties.length-1 do
|
|
85
|
+
if properties[index].key?('cve')
|
|
86
|
+
cve.push(properties[index]['cve'])
|
|
87
|
+
end
|
|
88
|
+
if properties[index].key?('cvss_v2')
|
|
89
|
+
cvss_v2_list.push(properties[index]['cvss_v2'])
|
|
90
|
+
end
|
|
91
|
+
if properties[index].key?('cvss_v3')
|
|
92
|
+
cvss_v3_list.push(properties[index]['cvss_v3'])
|
|
93
|
+
end
|
|
94
|
+
end
|
|
95
|
+
|
|
96
|
+
detailResp_json["cve"] = cve.sort.reverse[0]
|
|
97
|
+
cvss_v2 = cvss_v2_list.sort.reverse[0]
|
|
98
|
+
cvss_v3 = cvss_v3_list.sort.reverse[0]
|
|
99
|
+
if !cvss_v3.nil?
|
|
100
|
+
cvss = cvss_v3
|
|
101
|
+
elsif !cvss_v2.nil?
|
|
102
|
+
cvss = cvss_v2
|
|
103
|
+
end
|
|
104
|
+
cvss_score = cvss[0..2]
|
|
105
|
+
cvss_version = cvss.split(':')[1][0..2]
|
|
106
|
+
detailResp_json["cvss_score"] = cvss_score
|
|
107
|
+
detailResp_json["cvss_version"] = cvss_version
|
|
108
|
+
end
|
|
109
|
+
|
|
110
|
+
if detailResp_json.key?('matched_policies')
|
|
111
|
+
matched_policies = detailResp_json['matched_policies']
|
|
112
|
+
for index in 0..matched_policies.length-1 do
|
|
113
|
+
if matched_policies[index].key?('policy')
|
|
114
|
+
policy_list.push(matched_policies[index]['policy'])
|
|
115
|
+
end
|
|
116
|
+
if matched_policies[index].key?('rule')
|
|
117
|
+
rule_list.push(matched_policies[index]['rule'])
|
|
118
|
+
end
|
|
119
|
+
end
|
|
120
|
+
detailResp_json['policies'] = policy_list
|
|
121
|
+
detailResp_json['rules'] = rule_list
|
|
122
|
+
end
|
|
123
|
+
|
|
124
|
+
detailResp_json['impacted_artifacts'].each do |impacted_artifact|
|
|
125
|
+
matchdata = impacted_artifact.match /default\/(?<repo_name>[^\/]*)\/(?<path>.*)/
|
|
126
|
+
impacted_artifact_url = matchdata['repo_name'] + ":" + matchdata['path'] + " "
|
|
127
|
+
impacted_artifact_url_list.append(impacted_artifact_url)
|
|
128
|
+
end
|
|
129
|
+
detailResp_json['impacted_artifacts_url'] = impacted_artifact_url_list
|
|
130
|
+
return detailResp_json
|
|
131
|
+
end
|
|
132
|
+
|
|
133
|
+
def process(violation, violations_channel)
|
|
134
|
+
pos_file = PositionFile.new(@pos_file_path)
|
|
135
|
+
violations_channel << violation unless pos_file.processed?(violation)
|
|
136
|
+
violations_channel
|
|
137
|
+
end
|
|
138
|
+
|
|
139
|
+
private
|
|
140
|
+
def get_violations(xray_json)
|
|
141
|
+
response = RestClient::Request.new(
|
|
142
|
+
:method => :post,
|
|
143
|
+
:url => @jpd_url + "/xray/api/v1/violations",
|
|
144
|
+
:payload => xray_json.to_json,
|
|
145
|
+
:user => @username,
|
|
146
|
+
:password => @api_key,
|
|
147
|
+
:headers => { :accept => :json, :content_type => :json }
|
|
148
|
+
).execute do |response, request, result|
|
|
149
|
+
case response.code
|
|
150
|
+
when 200
|
|
151
|
+
return JSON.parse(response.to_str)
|
|
152
|
+
else
|
|
153
|
+
puts "error: #{response.to_json}"
|
|
154
|
+
raise Fluent::ConfigError, "Cannot reach Artifactory URL to pull Xray SIEM violations. #{response.to_json}"
|
|
155
|
+
end
|
|
156
|
+
end
|
|
157
|
+
end
|
|
158
|
+
|
|
159
|
+
def next_page?(count)
|
|
160
|
+
count == @batch_size
|
|
161
|
+
end
|
|
162
|
+
|
|
163
|
+
end
|
|
164
|
+
|