Known Vulnerability Detection in Java and JavaScript code
Known Vulnerability Detection in Java and JavaScript code
Known vulnerabilities in the software you build should be tracked down and removed. If they're not, an attacker may exploit them and steal your data. In a recent SurveyNow commissioned survey, conducted in 2019, '57% of respondents who reported a breach, said that they were breached due to a vulnerability'.
Equifax failed to remove known vulnerabilities in 2017 from their Apache Struts built systems and millions of their customers lost their personal data. The problem is, it's easier said than done. There are often other priorities on a project and to make matters worse, our software solutions are often made from many sub-projects.
Some Kainos projects make use of npm audit and OWASP dependency-check to detect known vulnerabilities in JavaScript and Java projects respectively. We have written simple scripts to amalgamate the reports from both npm audit and dependency-check to make the job of detecting known vulnerabilities easier. In this post, we will explain how to make use of these scripts and how to integrate them into a Jenkins pipeline to build a known vulnerability report.
You should consider how frequently you run such a report in your pipeline and if you integrate it into your daily build. You should run such a report before every deployment to production.
npm audit
We use npm audit to detect known vulnerabilities in JavaScript code. npm audit can produce json output using the following syntax.
npm audit classifies vulnerabilities using the following classifications: Critical, High, Moderate, Low and Info. Any vulnerability that is classified as Critical or High should be investigated as soon as possible.
npm-audit-amalgamate
amalgamate.py will gather all the vulnerabilities found in a collection of npm audit json files and produce a single file which details all vulnerabilities, sorted by severity. The image below shows an example of the file that is produced.
dependency-check is executed as shown below.
dependency-check-amalgamate
amalgamate.py will gather all the vulnerabilities found in a collection of dependency-check json files and produce a single file that details the vulnerabilities found, sorted by severity. The image below shows an example of the file that is produced.
https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/resource-center/analyst-report/ponemon-state-of-vulnerability-response.pdf
https://github.com/KainosSoftwareLtd/npm-audit-amalgamate
https://github.com/KainosSoftwareLtd/dependency-check-amalgamate