@newrelic/security-agent 0.0.1

package/index.js

@@ -0,0 +1,24 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+const API = require('./lib/nr-security-api');
+/**
+ * Entry point of CSEC agent.
+ * @param {*} agent  newrelic agent object
+ * @returns 
+ */
+function start(NRAgentObject) {
+    const agent = NRAgentObject.agent;
+    API.newrelic = NRAgentObject;
+    API.setNRAgent(agent);
+    if (!agent.config.security.agent.enabled || agent.config.security.enabled == null) {
+        return;
+    }
+    require('./lib/nr-security-agent');
+}
+module.exports = {
+    API,
+    start
+}

package/lib/instrumentation-security/core/constants.js

@@ -0,0 +1,66 @@
+
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+'use strict';
+
+const AWS_LAMBDA_NODE_EXEC_ENV_IDENTIFIER = /^AWS_Lambda_nodejs.*$/g;
+const AWS_EXECUTION_ENV_VAR = 'AWS_EXECUTION_ENV';
+
+module.exports = {
+
+    COLLECTOR_TYPE: 'NODE',
+    LANGUAGE: 'JavaScript',
+    AWS_LAMBDA_QUALIFIED_ARN_ENV_IDENTIFIER: 'AWS_LAMBDA_ARN',
+    AWS_LAMBDA_FUNCTION_NAME_ENV_IDENTIFIER: 'AWS_LAMBDA_FUNCTION_NAME',
+    AWS_LAMBDA_FUNCTION_VERSION_ENV_IDENTIFIER: 'AWS_LAMBDA_FUNCTION_VERSION',
+    AWS_SESSION_TOKEN_ENV_IDENTIFIER: 'AWS_SESSION_TOKEN',
+    LAMBDA_TASK_ROOT_ENV_IDENTIFIER: 'LAMBDA_TASK_ROOT',
+    LAMBDA_ENABLE_RESPONSE_BLOCKING: 'LAMBDA_ENABLE_RESPONSE_BLOCKING',
+    AWS_LAMBDA_NODE_EXEC_ENV_IDENTIFIER,
+    AWS_EXECUTION_ENV_VAR,
+    IS_LAMBDA_ENV: Array.isArray(
+        (process.env[AWS_EXECUTION_ENV_VAR] || '').match(AWS_LAMBDA_NODE_EXEC_ENV_IDENTIFIER)
+    ),
+    LAMBDA_RUNTIME_DIR_VAR: 'LAMBDA_RUNTIME_DIR',
+    EMPTY_APPLICATION_UUID: '--0--',
+    QUESTIONMARK: '?',
+    PIPE_SEP: '|',
+    ATTHERATE: '@',
+    EMPTY_STR: '',
+    COLON: ':',
+    OPEN_PARANTHESIS: '(',
+    CLOSE_PARANTHESIS: ')',
+    SLASH: '/',
+    INCOMING_MSG: 'IncomingMessage',
+    OBJECT: 'object',
+    STRING: 'string',
+    TRIGGER_VIA_RCI: 'triggerViaRCI',
+    RCI_METHOD_CALLS: 'rciMethodsCalls',
+    VULNERABLE: 'VULNERABLE',
+    UTF8: 'utf8',
+    CONTENT_TYPE: 'content-type',
+    TEXT_HTML: 'text/html',
+    APPLICATION_JSON: 'application/json',
+    APPLICATION_XML: 'application/xml',
+    APPLICATION_XHTML: 'application/xhtml+xml',
+    TEXT_PLAIN: 'text/plain',
+    APPLICATION_X_FORM_URLENCODED: 'application/x-www-form-urlencoded',
+    MULTIPART_FORM_DATA: 'multipart/form-data',
+    XFORFOR: 'x-forwarded-for',
+    DOUBLE_DOLLAR: '$$',
+    LOADING_MODULE: 'Loading module ',
+    EMPTY_STRING: '',
+    QUESTION_MARK: '?',
+    DOUBLE_PIPE: '||',
+    DOTDOTSLASH: '../',
+    SLASHDOTDOT: '/..',
+    UNDEFINED: 'undefined',
+    SELF_FD_PATH: '/proc/self/fd/',
+    SLASH: '/',
+    CSEC_LAST_FUZZ_REQUEST_TIME: 'CSEC_LAST_FUZZ_REQUEST_TIME',
+    NR_CSEC_FUZZ_REQUEST_ID: 'nr-csec-fuzz-request-id',
+
+};

package/lib/instrumentation-security/core/event-constants.js

@@ -0,0 +1,49 @@
+
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+const EVENT_TYPE = {
+    SYSTEM_COMMAND: 'SYSTEM_COMMAND',
+    SYSTEM_EXIT: 'SYSTEM_EXIT',
+    FILE_OPERATION: 'FILE_OPERATION',
+    FILE_INTEGRITY: 'FILE_INTEGRITY',
+    DB_COMMAND: 'SQL_DB_COMMAND',
+    NOSQL_DB_COMMAND: 'NOSQL_DB_COMMAND',
+    HTTP_REQUEST: 'HTTP_REQUEST',
+    CODE_INJECTION: 'CODE_INJECTION',
+    XXE: 'XXE',
+    CIPHER: 'CIPHER',
+    HASH: 'HASH',
+    RANDOM: 'RANDOM',
+    UNVALIDATED_REDIRECT: 'UNVALIDATED_REDIRECT',
+    REFLECTED_XSS: 'REFLECTED_XSS',
+    XPATH: 'XPATH',
+    LDAP: 'LDAP'
+}
+const  EVENT_CATEGORY =  {
+    MYSQL: 'MYSQL',
+    POSTGRES: 'POSTGRES',
+    ORACLE: 'ORACLE',
+    MONGO: 'MONGO',
+    MSSQL: 'MSSQL',
+    SQLITE: 'SQLITE',
+    FILE: 'FILE',
+    SYS: 'SYSTEM',
+    HTTP: 'HTTP',
+    CODE_INJECTION: 'CODE_INJECTION',
+    XXE: 'XXE',
+    CRYPTO: 'CRYPTO',
+    HASH: 'HASH',
+    WEAKRANDOM: 'WEAKRANDOM',
+    UNVALIDATED_REDIRECT: 'UNVALIDATED_REDIRECT',
+    REFLECTED_XSS: 'REFLECTED_XSS',
+    XPATH: 'XPATH',
+    LDAP: 'LDAP'
+}
+
+module.exports = {
+    EVENT_CATEGORY,
+    EVENT_TYPE
+}

package/lib/instrumentation-security/core/request-manager.js

@@ -0,0 +1,73 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+const requestMap = new Map();
+
+/**
+ * Utility to get request by transaction Id
+ * @param {*} id 
+ * @returns 
+ */
+function getRequestFromId(id) {
+    return requestMap.get(id);
+}
+
+/**
+ * Utility function to set request data corresponding to transacation Id
+ * @param {*} id 
+ * @param {*} requestData 
+ */
+function setRequest(id, requestData) {
+    requestMap.set(id, requestData);
+}
+
+/**
+ * Utility to get request using shim
+ * @param {*} shim 
+ * @returns 
+ */
+function getRequest(shim) {
+    const segment = shim.getActiveSegment();
+    if (segment) {
+        const transactionId = segment.transaction.id;
+        return getRequestFromId(transactionId);
+    }
+}
+
+/**
+ * Utility to update request body
+ * @param {*} shim 
+ * @param {*} data 
+ */
+function updateRequestBody(shim, data) {
+    const segment = shim.getActiveSegment();
+    if (segment) {
+        const transactionId = segment.transaction.id;
+        const requestData = getRequestFromId(transactionId);
+        if (requestData) {
+            requestData.body = data;
+            setRequest(transactionId, requestData);
+        }
+    }
+}
+
+/**
+ * Utility to clear data based on transaction Id 
+ * @param {*} transactionId 
+ */
+function gcRequestMap(transactionId) {
+    if (requestMap.has(transactionId)) {
+        requestMap.delete(transactionId);
+    }
+}
+
+module.exports = {
+    getRequestFromId,
+    getRequest,
+    setRequest,
+    updateRequestBody,
+    gcRequestMap,
+    requestMap
+}

package/lib/instrumentation-security/core/route-manager.js

@@ -0,0 +1,30 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+
+const routeMap = new Map();
+/**
+ * Utility to set route based on key value pair
+ * @param {*} key 
+ * @param {*} value 
+ */
+function setRoute(key, value){
+    routeMap.set(key,value);
+}
+
+/**
+ * Utility to get route corresponding to key
+ * @param {*} key 
+ * @returns 
+ */
+function getRoute(key){
+    return routeMap.get(key);
+}
+
+module.exports={
+    getRoute,
+    setRoute,
+    routeMap
+}

package/lib/instrumentation-security/core/sec-trace.js

@@ -0,0 +1,134 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+const path = require('path');
+const API = require("../../nr-security-api");
+const NRAgent = API.getNRAgent();
+const AGENT_DIR = path.join(__dirname, '../../');
+const NR_LIB = '/newrelic/lib';
+let LOAD_LIST;
+const { IS_LAMBDA_ENV, LAMBDA_RUNTIME_DIR_VAR } = require('./constants');
+const LAMBDA_RUNTIME_DIR = process.env[LAMBDA_RUNTIME_DIR_VAR];
+const PROMISE_SEPERATOR = '---------------------------------------------';
+const ANONYMOUS_FUNCTION = '<anonymous>';
+const NODE_MODULES_LITERAL = 'node_modules';
+const OPEN_BRACKET = '(';
+const CLOSE_BRACKET = ')';
+const COLON = ':';
+const ACYNC_HOOKS = 'async_hooks.js';
+const RUNINASYNCSCOPE = 'runInAsyncScope';
+
+/**
+ * Synchronously prints the stack trace from provided trace
+ * and extract user script.
+ *
+ * @param {*} trace
+ * @param {*} currentFile
+ *
+ * @returns {*} detected source info
+ */
+ function getSourceDetailsFromTrace (trace, currentFile, stakTrace) {
+    const info = {};
+    let sourceCaptured = false;
+    let evalObj;
+    let evalFlag = true;
+    let getEvalOrigin;
+    let isEval = false;
+    for (let i = 0; i < trace.length && i < 20; i++) {
+        const funcName = trace[i].getFunctionName();
+        const fileName = trace[i].getFileName();
+        const lineNumber = trace[i].getLineNumber();
+        
+        if (NRAgent && NRAgent.config.security.detection.rci.enabled && NRAgent.config.security.detection.deserialization.enabled) {
+            getEvalOrigin = trace[i].getEvalOrigin();
+            isEval = trace[i].isEval();
+        }
+
+        let prevMethodName = null;
+        if (i > 0 && isEval) {
+            const mname = trace[i - 1].getMethodName();
+            prevMethodName = mname || trace[i - 1].getFunctionName();
+        }
+
+        if (isEval && evalFlag && NRAgent && NRAgent.config.security.detection.rci.enabled && NRAgent.config.security.detection.deserialization.enabled) {
+            const serachStr = prevMethodName + OPEN_BRACKET + trace[i - 1].getFileName() + COLON + trace[i - 1].getLineNumber() + CLOSE_BRACKET;
+            evalObj = computeTrace(getEvalOrigin, prevMethodName, stakTrace, serachStr);
+            evalFlag = false;
+        }
+        if (fileName && !fileName.includes(AGENT_DIR) && !fileName.includes(NR_LIB) &&
+            !fileName.includes(PROMISE_SEPERATOR) &&
+            !isLambdaRuntimeFile(fileName)
+        ) {
+          
+            if (!sourceCaptured) {
+                info.source = {
+                    funcName: prevMethodName || ((funcName) || ANONYMOUS_FUNCTION),
+                    fileName: fileName,
+                    lineNumber: lineNumber
+                };
+                sourceCaptured = true;
+            }
+            if (!fileName.includes(NODE_MODULES_LITERAL) && !LOAD_LIST.includes(fileName) && !fileName.includes('node:') && !fileName.includes(NR_LIB)) {
+                info.fileName = fileName;
+                info.funcName = ((funcName) || ANONYMOUS_FUNCTION);
+                info.lineNumber = lineNumber;
+                // break;
+            }
+        }
+    }
+
+    if (!info.fileName && sourceCaptured) {
+        info.fileName = info.source.fileName;
+        info.funcName = ((info.source.funcName) ? info.source.funcName : ANONYMOUS_FUNCTION);
+        info.lineNumber = info.source.lineNumber;
+    }
+    if (evalObj) {
+        info.evalObj = evalObj;
+    }
+    return info;
+}
+
+
+function isLambdaRuntimeFile (fileName) {
+    return IS_LAMBDA_ENV && fileName.includes(LAMBDA_RUNTIME_DIR);
+}
+
+/**
+ * Sets the load list.
+ *
+ * @param {*} list
+ */
+ const setLoadList = list => {
+    LOAD_LIST = list;
+};
+
+
+function computeTrace (traceLine, apiCall, stakTrace, serachStr) {
+    const regex = /^(?:\s*at )?(?:(new) )?(?:(.*?) \()?(?:eval at ([^ ]+) \((.+?):(\d+):(\d+)\), )?(?:(.+?):(\d+):(\d+)|(native))(\)?)$/;
+    const evalObj = {};
+    try {
+        const line = traceLine.match(regex);
+        evalObj.apiCall = apiCall;
+        if (line) {
+            evalObj.funcName = line[2];
+            evalObj.fileName = line[7];
+            evalObj.lineNumber = line[8];
+            const indexUpTo = stakTrace.indexOf(serachStr);
+            const apicalls = stakTrace.slice(0, indexUpTo + 1);
+            if (indexUpTo == -1) {
+                apicalls.push(serachStr);
+            }
+            evalObj.invokedCalls = apicalls;
+        }
+    } catch (error) {
+    }
+
+    return evalObj;
+}
+
+module.exports = {
+    getSourceDetailsFromTrace,
+    setLoadList
+}

package/lib/instrumentation-security/core/sec-utils.js

@@ -0,0 +1,212 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+const stackTraceModule = require('./stack-trace');
+const path = require('path');
+const secTrace = require('./sec-trace');
+const requestManager = require('./request-manager');
+const routeManager = require('./route-manager');
+const async_hooks = require('async_hooks');
+
+const AGENT_DIR = path.join(__dirname, '../../');
+
+const NR_LIB = '/newrelic/lib';
+
+const ANONYMOUS_FUNCTION = '<anonymous>';
+const OPEN_PARANTHESIS = '(';
+const COLON = ':';
+const CLOSE_PARANTHESIS = ')';
+const SPACE_CHARACTER = ' ';
+const REPL_MODULE = 'repl';
+const NATIVES_MODULE = 'natives';
+const ASYNC_HOOKS_MODULE = 'async_hooks';
+const JS_EXTENSION = '.js';
+const ACYNC_HOOKS = 'async_hooks.js';
+const RUNINASYNCSCOPE = 'runInAsyncScope';
+const NODE_MODULE = 'node_modules';
+const DOUBLE_DOLLAR = '$$';
+const ATTHERATE = '@';
+
+const API = require("../../nr-security-api");
+const logger = API.getLogger();
+
+createSkipList();
+const fs =  require('fs');
+const cp = require('child_process');
+const requestIp = require('request-ip');
+const URL = require('url')
+
+/**
+ * Creates a list of loaded internal modules,
+ * which is used in sec-trace and by module-tracker.
+ *
+ * @returns {Array} loadList
+ */
+ function createSkipList () {
+    let loadList = [];
+    process.moduleLoadList.forEach(function (loadString) {
+        loadList.push(loadString.split(SPACE_CHARACTER).pop());
+    });
+    loadList = loadList.concat(require(REPL_MODULE)._builtinLibs);
+
+    loadList = loadList.concat(Object.keys(process.binding(NATIVES_MODULE)));
+    for (let i = 0; i < loadList.length; i++) {
+        loadList[i] += JS_EXTENSION;
+    }
+    require('./sec-trace').setLoadList(loadList);
+    return loadList;
+}
+
+
+function getTraceObject (shim) {
+    const trace = stackTraceModule.get();
+    const traceLength = 10;
+    const stkTrace = [];
+    for (let i = 0; i < trace.length && stkTrace.length < traceLength; i++) {
+        const funcName = trace[i].getFunctionName();
+        const fileName = trace[i].getFileName();
+        const lineNumber = trace[i].getLineNumber();
+
+        if (fileName && !fileName.includes(AGENT_DIR) && !fileName.includes(NR_LIB)) {
+            const functionName = funcName || ANONYMOUS_FUNCTION;
+            const resTrace = functionName + OPEN_PARANTHESIS + fileName + COLON + lineNumber + CLOSE_PARANTHESIS;
+            stkTrace.push(resTrace);
+        }
+    }
+    const request = requestManager.getRequest(shim);
+    const key = request.method + ATTHERATE + request.uri;
+    const routeFile = routeManager.getRoute(key);
+    if(routeFile){
+        stkTrace.push(routeFile);
+    }
+    const sourceDetails = secTrace.getSourceDetailsFromTrace(trace,__filename, stkTrace);
+    const traceObject = {
+        sourceDetails:sourceDetails,
+        stacktrace: stkTrace
+    }
+    return traceObject;
+}
+
+function getTraceObjectFallback (request) {
+    const trace = stackTraceModule.get();
+    const traceLength = 10;
+    const stkTrace = [];
+    for (let i = 0; i < trace.length && stkTrace.length < traceLength; i++) {
+        const funcName = trace[i].getFunctionName();
+        const fileName = trace[i].getFileName();
+        const lineNumber = trace[i].getLineNumber();
+
+        if (fileName && !fileName.includes(AGENT_DIR) && !fileName.includes(NR_LIB)) {
+            const functionName = funcName || ANONYMOUS_FUNCTION;
+            const resTrace = functionName + OPEN_PARANTHESIS + fileName + COLON + lineNumber + CLOSE_PARANTHESIS;
+            stkTrace.push(resTrace);
+        }
+    }
+    const key = request.method + ATTHERATE + request.uri;
+    const routeFile = routeManager.getRoute(key);
+    if(routeFile){
+        stkTrace.push(routeFile);
+    }
+    const sourceDetails = secTrace.getSourceDetailsFromTrace(trace,__filename, stkTrace);
+    const traceObject = {
+        sourceDetails:sourceDetails,
+        stacktrace: stkTrace
+    }
+    return traceObject;
+}
+
+
+function traceElementForRoute () {
+    const stkTrace = [];
+    const trace = stackTraceModule.get();
+    let methodName = null;
+
+    for (let i = 0; i < trace.length - 1; i++) {
+        const funcName = trace[i].getFunctionName();
+        const fileName = trace[i].getFileName();
+        const lineNumber = trace[i].getLineNumber();
+        if(i>0){
+            methodName = trace[i - 1].getMethodName();
+        }
+
+        if (fileName && !fileName.includes(AGENT_DIR) && fileName !== ACYNC_HOOKS && funcName !== RUNINASYNCSCOPE && !fileName.includes(NODE_MODULE)) {
+            const functionName = methodName || funcName || ANONYMOUS_FUNCTION;
+            const resTrace = functionName + OPEN_PARANTHESIS + fileName + COLON + lineNumber + CLOSE_PARANTHESIS + DOUBLE_DOLLAR + methodName;
+            stkTrace.push(resTrace);
+        }
+    }
+    return stkTrace;
+}
+
+function getExecutionId(){
+    return async_hooks.executionAsyncId();
+}
+
+function createPathIfNotExist (dir) {
+    try {
+        if (!fs.existsSync(dir)) {
+            fs.mkdirSync(dir, 777, { recursive: true });
+            logger.info(dir + ' Created');
+            fs.chmodSync(dir, 0o777);
+        } else {
+            fs.chmodSync(dir, 0o777);
+            logger.debug(dir + ' Already Exists');
+        }
+    } catch (error) {
+        logger.debug(dir + ' Not Created', error);
+    }
+}
+
+/**
+ * Utility function to add request data in a Map
+ * @param {*} shim 
+ * @param {*} request 
+ */
+function addRequestData(shim, request) {
+    try {
+      const data = Object.assign({});
+      const segment = shim.getActiveSegment();
+      if (segment && segment.transaction) {
+        data.body = null;
+        data.headers = request.headers;
+        data.url = request.url;
+        data.method = request.method;
+        data.httpVersion = request.httpVersion;
+        data.serverPort = segment.transaction.port;
+        data.contextPath = '/';
+        const queryObject = URL.parse(request.url, true).query;
+        data.parameterMap = {};
+        if (queryObject) {
+          Object.keys(queryObject).forEach(function (key) {
+            if (queryObject[key]) {
+              if (!data.parameterMap[key]) {
+                data.parameterMap[key] = new Array(queryObject[key].toString());
+              }
+            }
+          });
+        }
+        data.clientIP = requestIp.getClientIp(request);
+        const transactionId = segment.transaction.id;
+        const storedRequest = requestManager.getRequestFromId(transactionId);
+        if (storedRequest && storedRequest.uri) {
+          data.uri = storedRequest.uri;
+          data.parameterMap = storedRequest.parameterMap;
+        }
+        requestManager.setRequest(transactionId, data);
+      }
+    } catch (error) {
+      logger.debug("Error while preparing incoming request:", error);
+    }  
+  }
+  
+
+module.exports = {
+    getTraceObject,
+    traceElementForRoute,
+    getExecutionId,
+    createPathIfNotExist,
+    getTraceObjectFallback,
+    addRequestData
+}

package/lib/instrumentation-security/core/security-metadata.js

@@ -0,0 +1,34 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Method to create securityMetadata object
+ * @param {*} request 
+ * @param {*} interceptedArgs 
+ * @param {*} traceObject 
+ * @param {*} executionId 
+ * @param {*} eventType 
+ * @param {*} eventCategory 
+ * @returns 
+ */
+function getSecurityMetaData(request, interceptedArgs, traceObject, executionId, eventType, eventCategory) {
+    const securityMetadata = {};
+    const httpRequest = Object.assign({},request);
+    if(httpRequest.tempFiles){
+        delete httpRequest.tempFiles;
+    }
+    securityMetadata.request = httpRequest
+    securityMetadata.interceptedArgs = interceptedArgs;
+    securityMetadata.traceObject = traceObject
+    securityMetadata.executionId = executionId
+    securityMetadata.eventType = eventType
+    securityMetadata.eventCategory = eventCategory
+    return securityMetadata;
+
+}
+
+module.exports = {
+    getSecurityMetaData
+}