Skip to content

Commit 67406cc

Browse files
nabeelsaabnanabeelsaabna
committed
lets detect spring4shell
0 parents  commit 67406cc

File tree

535 files changed

+1674576
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

535 files changed

+1674576
-0
lines changed

‎.github/workflows/github_release.yml

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
name: github release
2+
3+
on:
4+
push:
5+
tags:
6+
- "v*"
7+
8+
jobs:
9+
goreleaser:
10+
runs-on: ubuntu-latest
11+
steps:
12+
- name: Checkout
13+
uses: actions/checkout@v2
14+
with:
15+
fetch-depth: 0
16+
17+
- name: Set up Go
18+
uses: actions/setup-go@v2
19+
with:
20+
go-version: 1.17
21+
22+
- name: Run GoReleaser
23+
uses: goreleaser/goreleaser-action@v2
24+
with:
25+
version: latest
26+
args: release --rm-dist
27+
env:
28+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.gitignore

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# Default ignored files
2+
/shelf/
3+
/workspace.xml
4+
# Editor-based HTTP Client requests
5+
/httpRequests/
6+
# Datasource local storage ignored files
7+
/dataSources/
8+
/dataSources.local.xml
9+
10+
*.iml
11+
.idea/

‎.goreleaser.yml

+63
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
project_name: spring4shell-detect
2+
3+
release:
4+
prerelease: auto
5+
name_template: "{{.ProjectName}}-v{{.Version}}"
6+
7+
github:
8+
owner: whitesource
9+
name: spring4shell-detect
10+
11+
before:
12+
hooks:
13+
- go mod tidy
14+
15+
checksum:
16+
algorithm: sha256
17+
# Disable the generation/upload of the checksum file.
18+
disable: false
19+
20+
builds:
21+
- <<: &build_defaults
22+
binary: spring4shell-detect
23+
main: ./main.go
24+
25+
id: linux
26+
goos: [ linux ]
27+
goarch: [ amd64, arm64 ]
28+
29+
- <<: *build_defaults
30+
id: windows
31+
goos: [ windows ]
32+
goarch: [ amd64, arm64 ]
33+
34+
- <<: *build_defaults
35+
id: macos
36+
goos: [ darwin ]
37+
goarch: [ amd64, arm64 ]
38+
39+
40+
archives:
41+
- <<: &archive_defaults
42+
name_template: "{{ .ProjectName }}-{{ .Version }}-{{ .Os }}-{{ .Arch }}"
43+
wrap_in_directory: "false"
44+
files:
45+
- none*
46+
id: unix
47+
builds: [ linux, macos ]
48+
format: tar.gz
49+
50+
- <<: *archive_defaults
51+
id: windows
52+
builds: [ windows ]
53+
format: zip
54+
55+
nfpms:
56+
- maintainer: WhiteSource
57+
vendor: WhiteSource
58+
homepage: https://github.com/whitesource/spring4shell-distribution
59+
description: Tool for discovering "spring4shell" exploit
60+
bindir: /usr/bin
61+
formats:
62+
- deb
63+
- rpm

‎LICENSE

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2021 nabeel
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎README.md

+95
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
# Spring4Shell Detect
2+
3+
WhiteSource spring4shell Detect is a free CLI tool that quickly scans your projects to find vulnerable Spring4shell versions
4+
containing the following known CVEs:
5+
6+
* CVE-2022-22963
7+
* CVE-2022-22965
8+
9+
It provides the exact path to direct and indirect dependencies, along with the fixed version for speedy remediation.
10+
11+
The supported packages managers are:
12+
13+
* gradle
14+
* maven
15+
* bundler
16+
17+
In addition, the tool will search for vulnerable files with the `.jar`,`.gem` extensions.
18+
19+
### Prerequisites:
20+
21+
* Download the spring4shell-detect binary based on your OS platform (see installation steps below)
22+
23+
---
24+
**NOTE**
25+
26+
1. For mac users, if the following message appears:
27+
"spring4shell-detect can't be opened because Apple cannot check it for malicious software", please follow the steps
28+
[described here](https://support.apple.com/en-il/guide/mac-help/mchleab3a043/mac)
29+
30+
31+
2. The relevant binaries must be installed for the scan to work, i.e:
32+
* `gradle` if the scanned project is a gradle project (contains a `settings.gradle` or a `build.gradle` file)
33+
* `mvn` if the scanned project is a maven project (contains a `pom.xml` file)
34+
* `ruby`/`jruby` and `gem`/`jgem` if the scanned project is a bundler project (contains a `Gemfile.lock`/`gems.locked` file)
35+
36+
37+
3. Building the projects before scanning will improve scan time and reduce potential scan errors
38+
39+
* maven projects __must__ be built prior to scanning, e.g. with the following command:
40+
```shell
41+
mvn install
42+
```
43+
44+
* bundler projects __must__ be built prior to scanning, e.g. with the following command:
45+
```shell
46+
jbundler install
47+
```
48+
49+
* It is not necessary to run `gradle build` prior to scanning a `gradle` project, but that will greatly decrease the
50+
scan time
51+
52+
---
53+
54+
## Usage
55+
56+
In order to scan your project, simply run the following command:
57+
58+
```shell
59+
spring4shell-detect scan -d PROJECT_DIR
60+
```
61+
62+
The folder can include source code that uses supported package managers in the project, as well binaries with the
63+
supported extensions mentioned above.
64+
It may error if it's run in a location which has protected folders it cannot access, such as Windows system folders.
65+
66+
## Installation
67+
68+
### Linux
69+
70+
```shell
71+
ARCH=amd64 # or ARCH=arm64
72+
wget "https://github.com/whitesource/spring4shell-detect/releases/latest/download/spring4shell-detect-1.0.0-linux-$ARCH.tar.gz"
73+
tar -xzvf spring4shell-detect-1.0.0-linux-$ARCH.tar.gz
74+
chmod +x spring4shell-detect
75+
./spring4shell-detect -h
76+
```
77+
78+
### Mac
79+
80+
```shell
81+
ARCH=amd64 # or ARCH=arm64
82+
wget "https://github.com/whitesource/spring4shell-detect/releases/latest/download/spring4shell-detect-1.0.0-darwin-$ARCH.tar.gz"
83+
tar -xzvf spring4shell-detect-1.0.0-darwin-$ARCH.tar.gz
84+
chmod +x spring4shell-detect
85+
./spring4shell-detect -h
86+
```
87+
88+
### Windows
89+
90+
```powershell
91+
Invoke-WebRequest -Uri "https://github.com/whitesource/spring4shell-detect/releases/latest/download/spring4shell-detect-1.0.0-windows-amd64.zip" -OutFile "spring4shell-detect.zip"
92+
Expand-Archive -LiteralPath 'spring4shell-detect.zip'
93+
cd spring4shell-detect
94+
.\spring4shell-detect.exe -h
95+
```

‎cmd/clioptions/options.go

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
package clioptions
2+
3+
import (
4+
"io"
5+
"os"
6+
)
7+
8+
// IOStreams provides the standard names for iostreams.
9+
type IOStreams struct {
10+
// In think, os.Stdin
11+
In io.Reader
12+
// Out think, os.Stdout
13+
Out io.Writer
14+
// ErrOut think, os.Stderr
15+
ErrOut io.Writer
16+
}
17+
18+
// StandardIOStreams returns an IOStreams from os.Stdin, os.Stdout
19+
func StandardIOStreams() IOStreams {
20+
return IOStreams{
21+
In: os.Stdin,
22+
Out: os.Stdout,
23+
ErrOut: os.Stderr,
24+
}
25+
}

‎cmd/clioptions/settings/fs.go

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
package settings
2+
3+
import (
4+
"github.com/go-logr/logr"
5+
"github.com/whitesource/spring4shell-detect/fs"
6+
"github.com/whitesource/spring4shell-detect/operations"
7+
fsop "github.com/whitesource/spring4shell-detect/operations/fs"
8+
rc "github.com/whitesource/spring4shell-detect/records"
9+
fsscreen "github.com/whitesource/spring4shell-detect/screening/fs"
10+
"github.com/whitesource/spring4shell-detect/utils/exec"
11+
)
12+
13+
type FilesystemResolver struct {
14+
Disabled bool
15+
}
16+
17+
func (r FilesystemResolver) Queries() map[rc.Organ]*fs.Query {
18+
if r.Disabled {
19+
return nil
20+
}
21+
22+
return map[rc.Organ]*fs.Query{rc.OFS: fsscreen.Query()}
23+
}
24+
25+
func (r FilesystemResolver) Surgeons(logger logr.Logger, commander exec.Commander) map[rc.Organ]operations.Surgeon {
26+
if r.Disabled {
27+
return nil
28+
}
29+
30+
return map[rc.Organ]operations.Surgeon{
31+
rc.OFS: fsop.NewSurgeon(logger, commander),
32+
}
33+
}

‎cmd/clioptions/settings/gradle.go

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
package settings
2+
3+
import (
4+
"github.com/go-logr/logr"
5+
"github.com/whitesource/spring4shell-detect/fs"
6+
"github.com/whitesource/spring4shell-detect/operations"
7+
gradleS "github.com/whitesource/spring4shell-detect/operations/gradle"
8+
rc "github.com/whitesource/spring4shell-detect/records"
9+
gradleQ "github.com/whitesource/spring4shell-detect/screening/gradle"
10+
"github.com/whitesource/spring4shell-detect/utils/exec"
11+
)
12+
13+
type GradleResolver struct {
14+
Disabled bool
15+
AdditionalArgs []string
16+
Configurations struct {
17+
Include []string
18+
Exclude []string
19+
}
20+
}
21+
22+
func (r GradleResolver) Queries() map[rc.Organ]*fs.Query {
23+
if r.Disabled {
24+
return nil
25+
}
26+
27+
return map[rc.Organ]*fs.Query{rc.OGradle: gradleQ.Query()}
28+
}
29+
30+
func (r GradleResolver) Surgeons(logger logr.Logger, commander exec.Commander) map[rc.Organ]operations.Surgeon {
31+
if r.Disabled {
32+
return nil
33+
}
34+
35+
return map[rc.Organ]operations.Surgeon{
36+
rc.OGradle: gradleS.NewSurgeon(logger, commander, r.AdditionalArgs, r.Configurations.Include, r.Configurations.Exclude),
37+
}
38+
}

‎cmd/clioptions/settings/maven.go

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
package settings
2+
3+
import (
4+
"github.com/go-logr/logr"
5+
"github.com/whitesource/spring4shell-detect/fs"
6+
"github.com/whitesource/spring4shell-detect/operations"
7+
mavenS "github.com/whitesource/spring4shell-detect/operations/maven"
8+
rc "github.com/whitesource/spring4shell-detect/records"
9+
mavenQ "github.com/whitesource/spring4shell-detect/screening/maven"
10+
"github.com/whitesource/spring4shell-detect/utils/exec"
11+
)
12+
13+
type MavenResolver struct {
14+
Disabled bool
15+
AdditionalArgs []string
16+
Scopes struct {
17+
Include []string
18+
Exclude []string
19+
}
20+
}
21+
22+
func (r MavenResolver) Queries() map[rc.Organ]*fs.Query {
23+
if r.Disabled {
24+
return nil
25+
}
26+
27+
return map[rc.Organ]*fs.Query{rc.OMaven: mavenQ.Query()}
28+
}
29+
30+
func (r MavenResolver) Surgeons(logger logr.Logger, commander exec.Commander) map[rc.Organ]operations.Surgeon {
31+
if r.Disabled {
32+
return nil
33+
}
34+
35+
return map[rc.Organ]operations.Surgeon{
36+
rc.OMaven: mavenS.NewSurgeon(logger, commander, r.AdditionalArgs, r.Scopes.Include, r.Scopes.Exclude),
37+
}
38+
}

‎cmd/clioptions/settings/ruby.go

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
package settings
2+
3+
import (
4+
"github.com/go-logr/logr"
5+
"github.com/whitesource/spring4shell-detect/fs"
6+
"github.com/whitesource/spring4shell-detect/operations"
7+
rubyS "github.com/whitesource/spring4shell-detect/operations/ruby"
8+
rc "github.com/whitesource/spring4shell-detect/records"
9+
rubyQ "github.com/whitesource/spring4shell-detect/screening/ruby"
10+
"github.com/whitesource/spring4shell-detect/utils/exec"
11+
)
12+
13+
type RubyResolver struct {
14+
Disabled bool
15+
}
16+
17+
func (r RubyResolver) Queries() map[rc.Organ]*fs.Query {
18+
if r.Disabled {
19+
return nil
20+
}
21+
22+
return map[rc.Organ]*fs.Query{rc.ORuby: rubyQ.Query()}
23+
}
24+
25+
func (r RubyResolver) Surgeons(logger logr.Logger, commander exec.Commander) map[rc.Organ]operations.Surgeon {
26+
if r.Disabled {
27+
return nil
28+
}
29+
30+
return map[rc.Organ]operations.Surgeon{
31+
rc.ORuby: rubyS.NewSurgeon(logger, commander),
32+
}
33+
}

0 commit comments

Comments
 (0)