secure-scan 1.2.2

package/src/dependencies/database/cveDatabase.ts

@@ -0,0 +1,426 @@
+/**
+ * Known Vulnerable Packages Database
+ * Static database of known CVEs for offline vulnerability detection
+ * This is a sample database - in production, integrate with OSV, NVD, or Snyk APIs
+ */
+
+import { CVEInfo, PackageEcosystem, Severity } from '../types';
+
+/**
+ * CVE database entry
+ */
+export interface CVEDatabaseEntry {
+  ecosystem: PackageEcosystem;
+  packageName: string;
+  cve: CVEInfo;
+  vulnerableVersions: string[];
+}
+
+/**
+ * Sample CVE database with well-known vulnerabilities
+ */
+export const CVE_DATABASE: CVEDatabaseEntry[] = [
+  // Log4Shell - Critical Java vulnerability
+  {
+    ecosystem: 'maven',
+    packageName: 'org.apache.logging.log4j:log4j-core',
+    cve: {
+      id: 'CVE-2021-44228',
+      description: 'Apache Log4j2 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints.',
+      cvssScore: 10.0,
+      severity: Severity.CRITICAL,
+      publishedDate: '2021-12-10',
+      references: [
+        'https://nvd.nist.gov/vuln/detail/CVE-2021-44228',
+        'https://logging.apache.org/log4j/2.x/security.html'
+      ],
+      fixedVersion: '2.17.0',
+      cwes: ['CWE-502', 'CWE-400', 'CWE-20'],
+      exploitAvailable: true
+    },
+    vulnerableVersions: ['2.0-beta9', '2.0-rc1', '2.0-rc2', '2.0', '2.0.1', '2.0.2', '2.1', '2.2', '2.3', '2.4', '2.4.1', '2.5', '2.6', '2.6.1', '2.6.2', '2.7', '2.8', '2.8.1', '2.8.2', '2.9.0', '2.9.1', '2.10.0', '2.11.0', '2.11.1', '2.11.2', '2.12.0', '2.12.1', '2.13.0', '2.13.1', '2.13.2', '2.13.3', '2.14.0', '2.14.1', '2.15.0', '2.16.0']
+  },
+
+  // Lodash prototype pollution
+  {
+    ecosystem: 'npm',
+    packageName: 'lodash',
+    cve: {
+      id: 'CVE-2020-8203',
+      description: 'Prototype pollution vulnerability in lodash before 4.17.20 allows attackers to cause denial of service or execute arbitrary code via merge, mergeWith, and defaultsDeep functions.',
+      cvssScore: 7.4,
+      severity: Severity.HIGH,
+      publishedDate: '2020-07-15',
+      references: [
+        'https://nvd.nist.gov/vuln/detail/CVE-2020-8203',
+        'https://github.com/lodash/lodash/issues/4744'
+      ],
+      fixedVersion: '4.17.20',
+      cwes: ['CWE-1321'],
+      exploitAvailable: true
+    },
+    vulnerableVersions: ['<4.17.20']
+  },
+  {
+    ecosystem: 'npm',
+    packageName: 'lodash',
+    cve: {
+      id: 'CVE-2021-23337',
+      description: 'Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.',
+      cvssScore: 7.2,
+      severity: Severity.HIGH,
+      publishedDate: '2021-02-15',
+      references: [
+        'https://nvd.nist.gov/vuln/detail/CVE-2021-23337',
+        'https://snyk.io/vuln/SNYK-JS-LODASH-1040724'
+      ],
+      fixedVersion: '4.17.21',
+      cwes: ['CWE-94'],
+      exploitAvailable: true
+    },
+    vulnerableVersions: ['<4.17.21']
+  },
+
+  // Express.js vulnerabilities
+  {
+    ecosystem: 'npm',
+    packageName: 'express',
+    cve: {
+      id: 'CVE-2022-24999',
+      description: 'qs before 6.10.3 allows attackers to cause a Node process hang because an __ proto__ key can be used.',
+      cvssScore: 7.5,
+      severity: Severity.HIGH,
+      publishedDate: '2022-11-26',
+      references: [
+        'https://nvd.nist.gov/vuln/detail/CVE-2022-24999'
+      ],
+      fixedVersion: '4.18.2',
+      cwes: ['CWE-1321'],
+      exploitAvailable: false
+    },
+    vulnerableVersions: ['<4.18.2']
+  },
+
+  // Django vulnerabilities
+  {
+    ecosystem: 'pip',
+    packageName: 'django',
+    cve: {
+      id: 'CVE-2023-36053',
+      description: 'Django 3.2 before 3.2.20, 4.1 before 4.1.10, and 4.2 before 4.2.3 allows a denial of service via EmailValidator/URLValidator regex backtracking.',
+      cvssScore: 7.5,
+      severity: Severity.HIGH,
+      publishedDate: '2023-07-03',
+      references: [
+        'https://nvd.nist.gov/vuln/detail/CVE-2023-36053',
+        'https://www.djangoproject.com/weblog/2023/jul/03/security-releases/'
+      ],
+      fixedVersion: '4.2.3',
+      cwes: ['CWE-1333'],
+      exploitAvailable: false
+    },
+    vulnerableVersions: ['<3.2.20', '>=4.0,<4.1.10', '>=4.2,<4.2.3']
+  },
+  {
+    ecosystem: 'pip',
+    packageName: 'django',
+    cve: {
+      id: 'CVE-2023-41164',
+      description: 'Django 3.2.x before 3.2.21, 4.1.x before 4.1.11, and 4.2.x before 4.2.5 allows a denial of service in django.utils.encoding.uri_to_iri.',
+      cvssScore: 7.5,
+      severity: Severity.HIGH,
+      publishedDate: '2023-09-04',
+      references: [
+        'https://nvd.nist.gov/vuln/detail/CVE-2023-41164'
+      ],
+      fixedVersion: '4.2.5',
+      cwes: ['CWE-400'],
+      exploitAvailable: false
+    },
+    vulnerableVersions: ['<3.2.21', '>=4.0,<4.1.11', '>=4.2,<4.2.5']
+  },
+
+  // Flask vulnerabilities
+  {
+    ecosystem: 'pip',
+    packageName: 'flask',
+    cve: {
+      id: 'CVE-2023-30861',
+      description: 'Flask is a lightweight WSGI web application framework. Versions prior to 2.2.5 and 2.3.2 are vulnerable to possible disclosure of permanent session cookie.',
+      cvssScore: 7.5,
+      severity: Severity.HIGH,
+      publishedDate: '2023-05-02',
+      references: [
+        'https://nvd.nist.gov/vuln/detail/CVE-2023-30861',
+        'https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq'
+      ],
+      fixedVersion: '2.3.2',
+      cwes: ['CWE-539'],
+      exploitAvailable: false
+    },
+    vulnerableVersions: ['<2.2.5', '>=2.3,<2.3.2']
+  },
+
+  // Axios vulnerabilities
+  {
+    ecosystem: 'npm',
+    packageName: 'axios',
+    cve: {
+      id: 'CVE-2023-45857',
+      description: 'An issue in Axios allows a request to a non-HTTPS destination to leak the secret XSRF-TOKEN cookie value.',
+      cvssScore: 6.5,
+      severity: Severity.MEDIUM,
+      publishedDate: '2023-11-08',
+      references: [
+        'https://nvd.nist.gov/vuln/detail/CVE-2023-45857'
+      ],
+      fixedVersion: '1.6.0',
+      cwes: ['CWE-352'],
+      exploitAvailable: false
+    },
+    vulnerableVersions: ['>=0.8.1,<1.6.0']
+  },
+
+  // jQuery vulnerabilities
+  {
+    ecosystem: 'npm',
+    packageName: 'jquery',
+    cve: {
+      id: 'CVE-2020-11023',
+      description: 'In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources to one of jQuerys DOM manipulation methods may execute untrusted code.',
+      cvssScore: 6.1,
+      severity: Severity.MEDIUM,
+      publishedDate: '2020-04-29',
+      references: [
+        'https://nvd.nist.gov/vuln/detail/CVE-2020-11023',
+        'https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/'
+      ],
+      fixedVersion: '3.5.0',
+      cwes: ['CWE-79'],
+      exploitAvailable: true
+    },
+    vulnerableVersions: ['>=1.0.3,<3.5.0']
+  },
+
+  // Symfony vulnerabilities
+  {
+    ecosystem: 'composer',
+    packageName: 'symfony/http-kernel',
+    cve: {
+      id: 'CVE-2023-46733',
+      description: 'Symfony is a PHP framework. When using the RememberMe Bundle, an attacker can cause a session to survive an password change.',
+      cvssScore: 6.5,
+      severity: Severity.MEDIUM,
+      publishedDate: '2023-11-10',
+      references: [
+        'https://nvd.nist.gov/vuln/detail/CVE-2023-46733',
+        'https://symfony.com/cve-2023-46733'
+      ],
+      fixedVersion: '6.3.8',
+      cwes: ['CWE-613'],
+      exploitAvailable: false
+    },
+    vulnerableVersions: ['>=5.4,<5.4.31', '>=6.0,<6.3.8']
+  },
+
+  // Laravel vulnerabilities
+  {
+    ecosystem: 'composer',
+    packageName: 'laravel/framework',
+    cve: {
+      id: 'CVE-2021-43617',
+      description: 'Laravel Framework before 8.75.0 is vulnerable to cookie theft due to insecure default cookie serialization.',
+      cvssScore: 9.8,
+      severity: Severity.CRITICAL,
+      publishedDate: '2021-11-18',
+      references: [
+        'https://nvd.nist.gov/vuln/detail/CVE-2021-43617'
+      ],
+      fixedVersion: '8.75.0',
+      cwes: ['CWE-502'],
+      exploitAvailable: true
+    },
+    vulnerableVersions: ['<8.75.0']
+  },
+
+  // Spring Framework vulnerabilities
+  {
+    ecosystem: 'maven',
+    packageName: 'org.springframework:spring-core',
+    cve: {
+      id: 'CVE-2022-22965',
+      description: 'Spring Framework RCE via Data Binding on JDK 9+ (Spring4Shell)',
+      cvssScore: 9.8,
+      severity: Severity.CRITICAL,
+      publishedDate: '2022-03-31',
+      references: [
+        'https://nvd.nist.gov/vuln/detail/CVE-2022-22965',
+        'https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement'
+      ],
+      fixedVersion: '5.3.18',
+      cwes: ['CWE-94'],
+      exploitAvailable: true
+    },
+    vulnerableVersions: ['>=5.3.0,<5.3.18', '>=5.2.0,<5.2.20']
+  },
+
+  // Jackson vulnerabilities
+  {
+    ecosystem: 'maven',
+    packageName: 'com.fasterxml.jackson.core:jackson-databind',
+    cve: {
+      id: 'CVE-2020-36518',
+      description: 'jackson-databind allows Java stack overflow exception via a deeply nested JSON array.',
+      cvssScore: 7.5,
+      severity: Severity.HIGH,
+      publishedDate: '2022-03-11',
+      references: [
+        'https://nvd.nist.gov/vuln/detail/CVE-2020-36518'
+      ],
+      fixedVersion: '2.13.2.1',
+      cwes: ['CWE-787'],
+      exploitAvailable: false
+    },
+    vulnerableVersions: ['<2.13.2.1']
+  },
+
+  // Newtonsoft.Json vulnerabilities
+  {
+    ecosystem: 'nuget',
+    packageName: 'Newtonsoft.Json',
+    cve: {
+      id: 'CVE-2024-21907',
+      description: 'Newtonsoft.Json before 13.0.1 is vulnerable to a denial of service attack when parsing deeply nested JSON.',
+      cvssScore: 7.5,
+      severity: Severity.HIGH,
+      publishedDate: '2024-01-03',
+      references: [
+        'https://nvd.nist.gov/vuln/detail/CVE-2024-21907'
+      ],
+      fixedVersion: '13.0.1',
+      cwes: ['CWE-400'],
+      exploitAvailable: false
+    },
+    vulnerableVersions: ['<13.0.1']
+  },
+
+  // OpenSSL vulnerabilities
+  {
+    ecosystem: 'vcpkg',
+    packageName: 'openssl',
+    cve: {
+      id: 'CVE-2022-3602',
+      description: 'X.509 Email Address 4-byte Buffer Overflow in OpenSSL.',
+      cvssScore: 7.5,
+      severity: Severity.HIGH,
+      publishedDate: '2022-11-01',
+      references: [
+        'https://nvd.nist.gov/vuln/detail/CVE-2022-3602',
+        'https://www.openssl.org/news/secadv/20221101.txt'
+      ],
+      fixedVersion: '3.0.7',
+      cwes: ['CWE-120'],
+      exploitAvailable: true
+    },
+    vulnerableVersions: ['>=3.0.0,<3.0.7']
+  }
+];
+
+/**
+ * Check if a version matches a vulnerable version pattern
+ */
+export function isVersionVulnerable(version: string, vulnerablePatterns: string[]): boolean {
+  // Normalize version
+  const normalizedVersion = version.replace(/^[v=]/, '').trim();
+  
+  for (const pattern of vulnerablePatterns) {
+    if (matchVersionPattern(normalizedVersion, pattern)) {
+      return true;
+    }
+  }
+  
+  return false;
+}
+
+/**
+ * Match version against a pattern
+ * Supports: exact match, <version, <=version, >version, >=version, range
+ */
+function matchVersionPattern(version: string, pattern: string): boolean {
+  // Exact match
+  if (pattern === version) return true;
+  
+  // Less than
+  if (pattern.startsWith('<')) {
+    const targetVersion = pattern.replace(/^<=?/, '');
+    const isLessOrEqual = pattern.startsWith('<=');
+    const comparison = compareVersions(version, targetVersion);
+    return isLessOrEqual ? comparison <= 0 : comparison < 0;
+  }
+  
+  // Greater than
+  if (pattern.startsWith('>')) {
+    const targetVersion = pattern.replace(/^>=?/, '');
+    const isGreaterOrEqual = pattern.startsWith('>=');
+    const comparison = compareVersions(version, targetVersion);
+    return isGreaterOrEqual ? comparison >= 0 : comparison > 0;
+  }
+  
+  // Range (e.g., ">=1.0.0,<2.0.0")
+  if (pattern.includes(',')) {
+    const parts = pattern.split(',');
+    return parts.every(p => matchVersionPattern(version, p.trim()));
+  }
+  
+  // Wildcard match
+  if (pattern === '*') return true;
+  
+  return false;
+}
+
+/**
+ * Compare two semver versions
+ * Returns: -1 if a < b, 0 if a == b, 1 if a > b
+ */
+function compareVersions(a: string, b: string): number {
+  const partsA = a.split('.').map(p => parseInt(p, 10) || 0);
+  const partsB = b.split('.').map(p => parseInt(p, 10) || 0);
+  
+  const maxLength = Math.max(partsA.length, partsB.length);
+  
+  for (let i = 0; i < maxLength; i++) {
+    const partA = partsA[i] || 0;
+    const partB = partsB[i] || 0;
+    
+    if (partA < partB) return -1;
+    if (partA > partB) return 1;
+  }
+  
+  return 0;
+}
+
+/**
+ * Get CVEs for a package
+ */
+export function getCVEsForPackage(packageName: string, ecosystem: PackageEcosystem, version?: string): CVEInfo[] {
+  const entries = CVE_DATABASE.filter(e => 
+    e.packageName.toLowerCase() === packageName.toLowerCase() && 
+    e.ecosystem === ecosystem
+  );
+  
+  if (!version) {
+    return entries.map(e => e.cve);
+  }
+  
+  // Filter by vulnerable version
+  return entries
+    .filter(e => isVersionVulnerable(version, e.vulnerableVersions))
+    .map(e => e.cve);
+}
+
+/**
+ * Get all CVEs in the database
+ */
+export function getAllCVEs(): CVEDatabaseEntry[] {
+  return CVE_DATABASE;
+}

package/src/dependencies/database/index.ts

@@ -0,0 +1,6 @@
+/**
+ * Database Module Exports
+ */
+
+export * from './maliciousPackages';
+export * from './cveDatabase';