@cdxgen/cdxgen 13.4.0 → 13.6.0

package/lib/inventory/goBuildInfo.js

@@ -0,0 +1,140 @@
+// Bounded Go buildinfo reader for executable file components: recovers the
+// toolchain version a binary was built with, so a BOM can answer "which Go
+// programs predate the CVE-2026-111943 distrust list". Only the header and
+// the inline version string are read; pointer-based (pre-1.18) layouts are
+// reported as such and never followed.
+//
+// Layout: go/src/debug/buildinfo/buildinfo.go at tag go1.27.2. The 14-byte
+// magic `\xff Go buildinf:` is 16-byte aligned; the next two bytes are the
+// pointer size and flags. When flags&2 is set the version string follows as a
+// uvarint length plus bytes. The magic can appear anywhere in the file's
+// initial segment, so the search scans aligned offsets up to a cap.
+
+import { closeSync, fstatSync, openSync, readSync } from "node:fs";
+
+const BUILD_INFO_MAGIC = Buffer.from([
+  0xff, 0x20, 0x47, 0x6f, 0x20, 0x62, 0x75, 0x69, 0x6c, 0x64, 0x69, 0x6e, 0x66,
+  0x3a,
+]);
+// The buildinfo section follows text and rodata, often late in the file
+// (37 MB into a 40 MB gh binary), so the cap must cover large binaries.
+const MAX_SEARCH_BYTES = 512 * 1024 * 1024;
+const READ_CHUNK_BYTES = 64 * 1024;
+const MAX_VERSION_BYTES = 128;
+export const PRE_1_18_VERSION = "unknown-pre-1.18";
+
+function readUvarint(buffer, offset) {
+  let value = 0;
+  let shift = 0;
+  for (let i = 0; i < 10 && offset + i < buffer.length; i++) {
+    const byte = buffer[offset + i];
+    value += (byte & 0x7f) * 2 ** shift;
+    if (!(byte & 0x80)) {
+      return { value, next: offset + i + 1 };
+    }
+    shift += 7;
+  }
+  return undefined;
+}
+
+function parseHeaderAt(buffer, offset, limit) {
+  if (offset + 32 > limit) {
+    return undefined;
+  }
+  for (let i = 0; i < BUILD_INFO_MAGIC.length; i++) {
+    if (buffer[offset + i] !== BUILD_INFO_MAGIC[i]) {
+      return undefined;
+    }
+  }
+  const pointerSize = buffer[offset + 14];
+  const flags = buffer[offset + 15];
+  if (pointerSize !== 4 && pointerSize !== 8) {
+    return undefined;
+  }
+  if (!(flags & 0x02)) {
+    // Version lives behind pointers (pre-1.18 layout): not followed.
+    return PRE_1_18_VERSION;
+  }
+  // The inline strings start 16 bytes past the magic header (magic 14 +
+  // pointerSize 1 + flags 1, then a reserved 16-byte slot), as a uvarint
+  // length followed by the bytes.
+  const varint = readUvarint(buffer, offset + 32);
+  if (
+    !varint ||
+    varint.value === 0 ||
+    varint.value > MAX_VERSION_BYTES ||
+    varint.next + varint.value > limit
+  ) {
+    return undefined;
+  }
+  const version = buffer.toString(
+    "latin1",
+    varint.next,
+    varint.next + varint.value,
+  );
+  if (!/^go[0-9]/.test(version)) {
+    return undefined;
+  }
+  return version;
+}
+
+/**
+ * Read the Go toolchain version from an executable's buildinfo header.
+ *
+ * @param {string} filePath absolute path to a possible Go binary
+ * @returns {string|undefined} `go1.x.y`, `unknown-pre-1.18` for old layouts,
+ *   or undefined when the file carries no Go buildinfo
+ */
+export function readGoBuildVersion(filePath) {
+  if (typeof filePath !== "string" || !filePath) {
+    return undefined;
+  }
+  let fd;
+  try {
+    fd = openSync(filePath, "r");
+    const size = fstatSync(fd).size;
+    if (size < 32) {
+      return undefined;
+    }
+    const searchLimit = Math.min(size, MAX_SEARCH_BYTES);
+    // Each chunk examines the aligned offsets that start inside its 64 KiB
+    // window, reading a fixed overlap past it so a header near the window
+    // end is parsed whole; the next chunk starts at the next window.
+    const OVERLAP_BYTES = 256;
+    const chunk = Buffer.alloc(READ_CHUNK_BYTES + OVERLAP_BYTES);
+    for (
+      let position = 0;
+      position < searchLimit;
+      position += READ_CHUNK_BYTES
+    ) {
+      const want = Math.min(READ_CHUNK_BYTES + OVERLAP_BYTES, size - position);
+      const read = readSync(fd, chunk, 0, want, position);
+      if (read < 32) {
+        return undefined;
+      }
+      // position is a multiple of 16, so chunk offsets stay on the file's
+      // 16-byte grid.
+      for (
+        let offset = 0;
+        offset < READ_CHUNK_BYTES && offset + 32 <= read;
+        offset += 16
+      ) {
+        const version = parseHeaderAt(chunk, offset, read);
+        if (version) {
+          return version;
+        }
+      }
+    }
+    return undefined;
+  } catch {
+    return undefined;
+  } finally {
+    if (fd !== undefined) {
+      try {
+        closeSync(fd);
+      } catch {
+        // already closed
+      }
+    }
+  }
+}

package/lib/inventory/gtfobins.js

@@ -17,6 +17,15 @@ const MATCH_FIELDS = [
   "executable",
   "description",
 ];
+// Rows of these categories name an account, not a program: a user called
+// `node` or `git` is no use of the binary of that name, and the GECOS comment
+// in the description is free text about the account.
+const ACCOUNT_CATEGORIES = new Set([
+  "authorized_keys_snapshot",
+  "logged_in_users_snapshot",
+  "users_snapshot",
+]);
+const ACCOUNT_SKIPPED_FIELDS = new Set(["name", "description"]);
 const UNIX_PATH_PATTERN = /(?:^|[\s'"`=;|&(])((?:\.{0,2}\/|\/)[^\s'"`|;&()]+)/g;
 const STANDALONE_COMMAND_PATTERN =
   /(?:^|[\s;|&(])([a-z_][a-z0-9+._-]{1,})(?=$|[\s'"`|;&()])/gi;
@@ -250,7 +259,11 @@ export function createGtfoBinsProperties(name, linkedName) {
  */
 export function createGtfoBinsPropertiesFromRow(queryCategory, row) {
   const matches = new Map();
+  const isAccount = ACCOUNT_CATEGORIES.has(queryCategory);
   for (const field of MATCH_FIELDS) {
+    if (isAccount && ACCOUNT_SKIPPED_FIELDS.has(field)) {
+      continue;
+    }
     const fieldValue = row?.[field];
     if (!fieldValue) {
       continue;

package/lib/inventory/hbom.js

@@ -1,4 +1,6 @@
-import { basename } from "node:path";
+import { createHash } from "node:crypto";
+import { basename, win32 } from "node:path";
+import process from "node:process";
 
 import {
   isDryRun,
@@ -40,6 +42,18 @@ function getConfiguredHbomPathAllowlist() {
   );
 }
 
+// A Windows plan can be inspected from any host (`getCommandPlan`), where
+// node:path would not split a path on its backslashes.
+function isWindowsStyleCommand(command) {
+  return command.includes("\\") || /^[A-Za-z]:/u.test(command);
+}
+
+function getHbomCommandName(command) {
+  return isWindowsStyleCommand(command)
+    ? win32.basename(command)
+    : basename(command);
+}
+
 function isAllowedHbomCommand(command, allowlistValue = undefined) {
   const normalizedCommand = `${command ?? ""}`.trim();
   if (!normalizedCommand) {
@@ -51,7 +65,10 @@ function isAllowedHbomCommand(command, allowlistValue = undefined) {
   if (!allowlistEntries.length) {
     return true;
   }
-  const commandName = basename(normalizedCommand);
+  // Exact and case-sensitive on purpose: cdx-hbom applies the same allowlist
+  // again when it spawns, so a looser preflight would pass here and then run
+  // nothing, which silently degrades the BOM.
+  const commandName = getHbomCommandName(normalizedCommand);
   return allowlistEntries.some(
     (entry) => entry === normalizedCommand || entry === commandName,
   );
@@ -61,9 +78,27 @@ function formatHbomCommandTarget(command, args = []) {
   return `${command}${args.length ? ` ${args.join(" ")}` : ""}`;
 }
 
+// Windows plan entries carry a multi-kilobyte PowerShell script as their last
+// argument. Like the cdx-hbom trace and evidence, the preflight names it by
+// digest so a blocked run does not print every script.
+function summarizeHbomPlanArgs(planEntry) {
+  const args = [...(planEntry.args || [])];
+  if (planEntry.parser !== "windows-envelope" || !args.length) {
+    return args;
+  }
+  const digest = createHash("sha256")
+    .update(String(args.at(-1)))
+    .digest("hex")
+    .slice(0, 12);
+  return ["-Command", planEntry.id, "script", `sha256:${digest}`];
+}
+
 function buildHbomPlanActivities(planEntry, normalizedOptions) {
   const baseArgs = [...(planEntry.args || [])];
-  const baseTarget = formatHbomCommandTarget(planEntry.command, baseArgs);
+  const baseTarget = formatHbomCommandTarget(
+    planEntry.command,
+    summarizeHbomPlanArgs(planEntry),
+  );
   const activities = [
     {
       args: baseArgs,
@@ -115,7 +150,7 @@ function collectDisallowedHbomCommands(
     }
     const existingEntry = disallowedCommands.get(requestedCommand) ?? {
       command: requestedCommand,
-      commandName: basename(requestedCommand),
+      commandName: getHbomCommandName(requestedCommand),
       ids: new Set(),
       targets: new Set(),
     };
@@ -214,6 +249,28 @@ function createHbomAllowlistPreflightError(
   return new Error(messageLines.join("\n"));
 }
 
+/**
+ * Whether cdx-hbom spawns no command for these collector options.
+ *
+ * Only the Linux collector reads `includeCommandEnrichment: false` as "run no
+ * commands", and even there the privileged dmidecode step still runs. The
+ * Darwin collector ignores the option, and the Windows collector always runs
+ * its `windows-cim-platform` batch, so those plans are checked in full.
+ *
+ * @param {object} normalizedOptions Collector options from normalizeHbomOptions
+ * @returns {boolean} `true` when the allowlist has nothing to check
+ */
+function collectorSpawnsNoCommands(normalizedOptions) {
+  const targetPlatform = `${normalizedOptions.platform ?? process.platform}`
+    .trim()
+    .toLowerCase();
+  return (
+    normalizedOptions.includeCommandEnrichment === false &&
+    normalizedOptions.includePrivilegedEnrichment !== true &&
+    targetPlatform === "linux"
+  );
+}
+
 async function enforceSecureModeHbomAllowlists(hbomModule, normalizedOptions) {
   if (isDryRun || normalizedOptions?.isDryRun || !isSecureMode) {
     return;
@@ -249,7 +306,7 @@ async function enforceSecureModeHbomAllowlists(hbomModule, normalizedOptions) {
         : [];
   } else if (
     hasCommandAllowlist &&
-    normalizedOptions.includeCommandEnrichment !== false
+    !collectorSpawnsNoCommands(normalizedOptions)
   ) {
     traceActivities = hbomModule
       .getCommandPlan(normalizedOptions)
@@ -259,7 +316,7 @@ async function enforceSecureModeHbomAllowlists(hbomModule, normalizedOptions) {
   }
 
   const disallowedCommands =
-    hasCommandAllowlist && normalizedOptions.includeCommandEnrichment !== false
+    hasCommandAllowlist && !collectorSpawnsNoCommands(normalizedOptions)
       ? collectDisallowedHbomCommands(traceActivities, commandAllowlistValue)
       : [];
   const disallowedPaths = hasPathAllowlist
@@ -398,8 +455,11 @@ export function normalizeHbomOptions(options = {}) {
     timeoutValue === undefined || timeoutValue === null || timeoutValue === ""
       ? undefined
       : Number.parseInt(`${timeoutValue}`, 10);
+  // yargs negates `--no-command-enrichment` into `commandEnrichment: false`
+  // and never sets `noCommandEnrichment`, so the CLIs rely on this spelling.
   const includeCommandEnrichment =
-    options.includeCommandEnrichment ?? !options.noCommandEnrichment;
+    options.includeCommandEnrichment ??
+    (options.commandEnrichment !== false && !options.noCommandEnrichment);
   const allowPartial = options.allowPartial ?? !options.strict;
 
   return {

package/lib/inventory/hbomAnalysis.js

@@ -174,6 +174,22 @@ export function isHbomLikeBom(bomJson) {
   );
 }
 
+/**
+ * Explain how the permission-denied enrichments of an HBOM can be recovered.
+ *
+ * Windows never uses sudo: the elevated-only batch needs an already-elevated
+ * session, and a network logon is denied every WMI query.
+ *
+ * @param {string|undefined} platform `cdx:hbom:platform` of the HBOM
+ * @returns {string} Guidance for the platform; the Linux wording for any other platform
+ */
+export function getHbomPrivilegeGuidance(platform) {
+  if (`${platform ?? ""}`.toLowerCase() === "windows") {
+    return "Some Windows enrichments were denied. Run HBOM from a local session (a non-administrator over SSH or WinRM is denied every WMI query) and, for the TPM, BitLocker, storage-reliability and Secure Boot data, from an elevated (Run as administrator) prompt with --privileged. HBOM never prompts for elevation.";
+  }
+  return "Some Linux enrichments can likely succeed only with --privileged and a target environment that allows non-interactive sudo.";
+}
+
 /**
  * Return a component's `cdx:hbom:hardwareClass` property value.
  *