From 5ac7c9b4d45dcfa3be851f112ac791d8bc660e67 Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Tue, 15 Jul 2025 17:15:50 +0200 Subject: [PATCH] Remove cmsseek integration Signed-off-by: Jannik Hollenbach --- .github/workflows/ci.yaml | 1 - .github/workflows/release-build.yaml | 2 - .github/workflows/scb-bot.yaml | 1 - .../docs/getting-started/upgrading.md | 1 + documentation/src/integrations.js | 9 - operator/internal/telemetry/telemetry.go | 2 +- scanners/cmseek/.gitignore | 5 - scanners/cmseek/.helm-docs.gotmpl | 54 ------ scanners/cmseek/.helmignore | 40 ----- scanners/cmseek/Chart.yaml | 33 ---- scanners/cmseek/README.md | 121 -------------- scanners/cmseek/Taskfile.yaml | 20 --- .../cmseek/cascading-rules/scan-joomla.yaml | 22 --- scanners/cmseek/docs/.gitkeep | 0 scanners/cmseek/docs/README.ArtifactHub.md | 143 ---------------- .../cmseek/docs/README.DockerHub-Parser.md | 84 ---------- .../cmseek/docs/README.DockerHub-Scanner.md | 99 ----------- .../examples/demo-old-joomla/findings.yaml | 61 ------- .../cmseek/examples/demo-old-joomla/scan.yaml | 14 -- .../cmseek/integration-tests/cmseek.test.js | 75 --------- scanners/cmseek/parser/Dockerfile | 9 - .../parser/__snapshots__/parser.test.js.snap | 157 ------------------ .../__snapshots__/parser.test.js.snap.license | 3 - .../__testFiles__/joomla_with_core_vulns.json | 56 ------- .../joomla_with_core_vulns.json.license | 3 - .../joomla_without_core_vulns.json | 10 -- .../joomla_without_core_vulns.json.license | 3 - .../parser/__testFiles__/not_joomla.json | 8 - .../__testFiles__/not_joomla.json.license | 3 - .../__testFiles__/test-empty-report.json | 1 - .../test-empty-report.json.license | 3 - scanners/cmseek/parser/parser.js | 111 ------------- scanners/cmseek/parser/parser.test.js | 60 ------- scanners/cmseek/scanner/Dockerfile | 35 ---- scanners/cmseek/scanner/wrapper.sh | 13 -- .../cmseek/templates/cascading-rules.yaml | 15 -- .../templates/cmseek-parse-definition.yaml | 32 ---- .../cmseek/templates/cmseek-scan-type.yaml | 59 ------- .../tests/__snapshot__/scanner_test.yaml.snap | 90 ---------- scanners/cmseek/tests/scanner_test.yaml | 30 ---- scanners/cmseek/values.yaml | 114 ------------- 41 files changed, 2 insertions(+), 1600 deletions(-) delete mode 100644 scanners/cmseek/.gitignore delete mode 100644 scanners/cmseek/.helm-docs.gotmpl delete mode 100644 scanners/cmseek/.helmignore delete mode 100644 scanners/cmseek/Chart.yaml delete mode 100644 scanners/cmseek/README.md delete mode 100644 scanners/cmseek/Taskfile.yaml delete mode 100644 scanners/cmseek/cascading-rules/scan-joomla.yaml delete mode 100644 scanners/cmseek/docs/.gitkeep delete mode 100644 scanners/cmseek/docs/README.ArtifactHub.md delete mode 100644 scanners/cmseek/docs/README.DockerHub-Parser.md delete mode 100644 scanners/cmseek/docs/README.DockerHub-Scanner.md delete mode 100644 scanners/cmseek/examples/demo-old-joomla/findings.yaml delete mode 100644 scanners/cmseek/examples/demo-old-joomla/scan.yaml delete mode 100644 scanners/cmseek/integration-tests/cmseek.test.js delete mode 100644 scanners/cmseek/parser/Dockerfile delete mode 100644 scanners/cmseek/parser/__snapshots__/parser.test.js.snap delete mode 100644 scanners/cmseek/parser/__snapshots__/parser.test.js.snap.license delete mode 100644 scanners/cmseek/parser/__testFiles__/joomla_with_core_vulns.json delete mode 100644 scanners/cmseek/parser/__testFiles__/joomla_with_core_vulns.json.license delete mode 100644 scanners/cmseek/parser/__testFiles__/joomla_without_core_vulns.json delete mode 100644 scanners/cmseek/parser/__testFiles__/joomla_without_core_vulns.json.license delete mode 100644 scanners/cmseek/parser/__testFiles__/not_joomla.json delete mode 100644 scanners/cmseek/parser/__testFiles__/not_joomla.json.license delete mode 100644 scanners/cmseek/parser/__testFiles__/test-empty-report.json delete mode 100644 scanners/cmseek/parser/__testFiles__/test-empty-report.json.license delete mode 100644 scanners/cmseek/parser/parser.js delete mode 100644 scanners/cmseek/parser/parser.test.js delete mode 100644 scanners/cmseek/scanner/Dockerfile delete mode 100644 scanners/cmseek/scanner/wrapper.sh delete mode 100644 scanners/cmseek/templates/cascading-rules.yaml delete mode 100644 scanners/cmseek/templates/cmseek-parse-definition.yaml delete mode 100644 scanners/cmseek/templates/cmseek-scan-type.yaml delete mode 100644 scanners/cmseek/tests/__snapshot__/scanner_test.yaml.snap delete mode 100644 scanners/cmseek/tests/scanner_test.yaml delete mode 100644 scanners/cmseek/values.yaml diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 23206c5f10..8382ea7680 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -419,7 +419,6 @@ jobs: matrix: unit: - amass - - cmseek - ffuf - git-repo-scanner - gitleaks diff --git a/.github/workflows/release-build.yaml b/.github/workflows/release-build.yaml index 6c201e600f..4a86fa3005 100644 --- a/.github/workflows/release-build.yaml +++ b/.github/workflows/release-build.yaml @@ -323,7 +323,6 @@ jobs: matrix: parser: - amass - - cmseek - ffuf - git-repo-scanner - gitleaks @@ -409,7 +408,6 @@ jobs: matrix: scanner: - amass - - cmseek - ffuf - kube-hunter - ncrack diff --git a/.github/workflows/scb-bot.yaml b/.github/workflows/scb-bot.yaml index 3b16f2b2d1..3a1c659b54 100644 --- a/.github/workflows/scb-bot.yaml +++ b/.github/workflows/scb-bot.yaml @@ -28,7 +28,6 @@ jobs: matrix: scanner: - amass - - cmseek - ffuf - gitleaks - kube-hunter diff --git a/documentation/docs/getting-started/upgrading.md b/documentation/docs/getting-started/upgrading.md index 5f77c14536..447847a95b 100644 --- a/documentation/docs/getting-started/upgrading.md +++ b/documentation/docs/getting-started/upgrading.md @@ -17,6 +17,7 @@ sidebar_position: 3 * `typo3scan` was removed as the scanner itself [isn't maintaned anymore](https://github.com/whoot/Typo3Scan?tab=readme-ov-file#unsupported). Most security aspects of typo3 are now hard to verify from the outside as it requires authentication (which is really good). Some typo3 security aspects (e.g. a incomplete installation) can be verified by [nuclei](https://www.securecodebox.io/docs/scanners/nuclei). * `kubeaudit` was removed as the scanner itself [isn't maintaned anymore](https://github.com/Shopify/kubeaudit?tab=readme-ov-file#-deprecation-notice-). As a replacement you can use the `trivy` with it's `k8s` scanning mode, see [trivy ScanType k8s example](https://www.securecodebox.io/docs/scanners/trivy#k8s). * `doggo` was removed. Doggo was added primarily as an experimentation to be used to deduplicate duplicate scan target from cascading rules based on DNS entries. That approach hasn't worked out unfortunately. The doggo integration has been non-functional for a while (see: https://github.com/secureCodeBox/secureCodeBox/issues/2853). As an alternative, nuclei already includes some DNS record based checks, if checks for specific records are required custom nuclei rules could be used to fulfil those requirements. +* `cmseek` was removed. cmseek has seen little updates in the last years. Our secureCodeBox integration with cmseek was always pretty basic, only supporting joomla (a specfifc CMS) results, which hasn't been a big focus for us. As a replacement we recommend using nuclei which has joomla rules which will likely receive more updates in the future. * `zap-baseline-scan` and `zap-advanced` in favor of the `zap-automation-framework`. The `zap-automation-framework` ScanTpye includes all functionalities of the removed ScanTypes and can be customized easily. The default ScanType for the AutoDiscovery has been changed to the `zap-automation-framework` as well. For migrating to the `zap-automation-framework` please refer to [migration to zap-automation framework](/docs/scanners/zap-automation-framework#migration-to-zap-automation-framework) guide. ➡️ [Reference: #2670](https://github.com/secureCodeBox/secureCodeBox/issues/2670) diff --git a/documentation/src/integrations.js b/documentation/src/integrations.js index 02dbd6c67f..1ca1a7dac8 100644 --- a/documentation/src/integrations.js +++ b/documentation/src/integrations.js @@ -83,14 +83,6 @@ export const Scanners = [ path: "docs/scanners/amass", imageUrl: "img/integrationIcons/Amass.svg", }, - { - title: "CMSeeK", - type: "CMS", - usecase: - "Automation of the process of detecting the Joomla CMS and its core vulnerabilities", - path: "docs/scanners/cmseek", - imageUrl: "img/integrationIcons/Default.svg", - }, { title: "ffuf", type: "Webserver", @@ -203,7 +195,6 @@ export const Scanners = [ path: "docs/scanners/wpscan", imageUrl: "img/integrationIcons/WPScan.svg", }, - { title: "ZAP Automation Framework", type: "WebApplication", diff --git a/operator/internal/telemetry/telemetry.go b/operator/internal/telemetry/telemetry.go index cceaa45320..aed85ccdf7 100644 --- a/operator/internal/telemetry/telemetry.go +++ b/operator/internal/telemetry/telemetry.go @@ -25,7 +25,7 @@ var telemetryInterval = 24 * time.Hour // Unofficial Scan Types should be reported as "other" to avoid leakage of confidential data via the scan-types name var officialScanTypes map[string]bool = map[string]bool{ "amass": true, - "cmseek": true, + "cmseek": true, // deprecated. we'll keep it in this list to still recieve telemetry data from older versions "doggo": true, // deprecated. we'll keep it in this list to still recieve telemetry data from older versions "ffuf": true, "git-repo-scanner": true, diff --git a/scanners/cmseek/.gitignore b/scanners/cmseek/.gitignore deleted file mode 100644 index a5be59dc8d..0000000000 --- a/scanners/cmseek/.gitignore +++ /dev/null @@ -1,5 +0,0 @@ -# SPDX-FileCopyrightText: the secureCodeBox authors -# -# SPDX-License-Identifier: Apache-2.0 - -*.tar diff --git a/scanners/cmseek/.helm-docs.gotmpl b/scanners/cmseek/.helm-docs.gotmpl deleted file mode 100644 index 98e6410b35..0000000000 --- a/scanners/cmseek/.helm-docs.gotmpl +++ /dev/null @@ -1,54 +0,0 @@ -{{- /* -SPDX-FileCopyrightText: the secureCodeBox authors - -SPDX-License-Identifier: Apache-2.0 -*/ -}} - -{{- define "extra.docsSection" -}} ---- -title: "CMSeeK" -category: "scanner" -type: "CMS" -state: "released" -appVersion: "{{ template "chart.appVersion" . }}" -usecase: "Automation of the process of detecting the Joomla CMS and its core vulnerabilities" ---- -{{- end }} - -{{- define "extra.dockerDeploymentSection" -}} -## Supported Tags -- `latest` (represents the latest stable release build) -- tagged releases, e.g. `{{ template "chart.appVersion" . }}` -{{- end }} - -{{- define "extra.chartAboutSection" -}} -## What is CMSeeK? -CMSeeK is an open source penetration testing tool to automate the process of detecting various types of CMS and its installed extensions. -Only the Joomla CMS is supported by secureCodeBox. CMSeeK has a database with known vulnerabilities. - -To learn more about the CMSeeK scanner itself, visit the CMSeeK GitHub repository [here](https://github.com/Tuhinshubhra/CMSeeK). -{{- end }} - -{{- define "extra.scannerConfigurationSection" -}} -## Scanner Configuration - -The CMSeeK targets are specified with the `-u` parameter. The target should be a URL. - -Additional CMSeeK scan features can be configured via the parameter attribute. - -Some useful example parameters listed below: - -- `-u URL, --url URL` : Target Url. -- `--follow-redirect` : Follows all/any redirect(s). -- `--no-redirect` : skips all redirects and tests the input target(s) -- `-r, --random-agent`: Use a random user agent. -- `--googlebot`: Use Google bot user agent. -- `--user-agent USER_AGENT`: Specify a custom user agent - -{{- end }} - -{{- define "extra.chartConfigurationSection" -}} -{{- end }} - -{{- define "extra.scannerLinksSection" -}} -{{- end }} \ No newline at end of file diff --git a/scanners/cmseek/.helmignore b/scanners/cmseek/.helmignore deleted file mode 100644 index 1b2144b9bb..0000000000 --- a/scanners/cmseek/.helmignore +++ /dev/null @@ -1,40 +0,0 @@ -# SPDX-FileCopyrightText: the secureCodeBox authors -# -# SPDX-License-Identifier: Apache-2.0 -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj -.vscode/ -# Node.js files -node_modules/* -package.json -package-lock.json -src/* -config/* -Dockerfile -.dockerignore -*.tar -parser/* -scanner/* -integration-tests/* -examples/* -docs/* -Makefile diff --git a/scanners/cmseek/Chart.yaml b/scanners/cmseek/Chart.yaml deleted file mode 100644 index 8199e3953d..0000000000 --- a/scanners/cmseek/Chart.yaml +++ /dev/null @@ -1,33 +0,0 @@ -# SPDX-FileCopyrightText: the secureCodeBox authors -# -# SPDX-License-Identifier: Apache-2.0 - -apiVersion: v2 -name: cmseek -description: A Helm chart for the Joomla security scanner that integrates with the secureCodeBox - -type: application -# version - gets automatically set to the secureCodeBox release version when the helm charts gets published -version: v3.1.0-alpha1 -appVersion: "v.1.1.3" - -kubeVersion: ">=v1.11.0-0" - -annotations: - versionApi: https://api.github.com/repos/Tuhinshubhra/CMSeeK/releases/latest - # supported cpu architectures for which docker images for the scanner should be build - supported-platforms: linux/amd64 - -keywords: - - security - - cmseek - - Joomla - - scanner - - secureCodeBox -home: https://www.securecodebox.io/docs/scanners/cmseek -icon: https://www.securecodebox.io/img/integrationIcons/Default.svg -sources: - - https://github.com/secureCodeBox/secureCodeBox -maintainers: - - name: iteratec GmbH - email: secureCodeBox@iteratec.com diff --git a/scanners/cmseek/README.md b/scanners/cmseek/README.md deleted file mode 100644 index f0734ccdc9..0000000000 --- a/scanners/cmseek/README.md +++ /dev/null @@ -1,121 +0,0 @@ ---- -title: "CMSeeK" -category: "scanner" -type: "CMS" -state: "released" -appVersion: "v.1.1.3" -usecase: "Automation of the process of detecting the Joomla CMS and its core vulnerabilities" ---- - - - - -

- License Apache-2.0 - GitHub release (latest SemVer) - OWASP Lab Project - Artifact HUB - GitHub Repo stars - Mastodon Follower -

- -## What is CMSeeK? -CMSeeK is an open source penetration testing tool to automate the process of detecting various types of CMS and its installed extensions. -Only the Joomla CMS is supported by secureCodeBox. CMSeeK has a database with known vulnerabilities. - -To learn more about the CMSeeK scanner itself, visit the CMSeeK GitHub repository [here](https://github.com/Tuhinshubhra/CMSeeK). - -## Deployment -The cmseek chart can be deployed via helm: - -```bash -# Install HelmChart (use -n to configure another namespace) -helm upgrade --install cmseek oci://ghcr.io/securecodebox/helm/cmseek -``` - -## Scanner Configuration - -The CMSeeK targets are specified with the `-u` parameter. The target should be a URL. - -Additional CMSeeK scan features can be configured via the parameter attribute. - -Some useful example parameters listed below: - -- `-u URL, --url URL` : Target Url. -- `--follow-redirect` : Follows all/any redirect(s). -- `--no-redirect` : skips all redirects and tests the input target(s) -- `-r, --random-agent`: Use a random user agent. -- `--googlebot`: Use Google bot user agent. -- `--user-agent USER_AGENT`: Specify a custom user agent - -## Requirements - -Kubernetes: `>=v1.11.0-0` - -## Values - -| Key | Type | Default | Description | -|-----|------|---------|-------------| -| cascadingRules.enabled | bool | `false` | Enables or disables the installation of the default cascading rules for this scanner | -| imagePullSecrets | list | `[]` | Define imagePullSecrets when a private registry is used (see: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/) | -| parser.affinity | object | `{}` | Optional affinity settings that control how the parser job is scheduled (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes-using-node-affinity/) | -| parser.env | list | `[]` | Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) | -| parser.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | -| parser.image.repository | string | `"docker.io/securecodebox/parser-cmseek"` | Parser image repository | -| parser.image.tag | string | defaults to the charts version | Parser image tag | -| parser.nodeSelector | object | `{}` | Optional nodeSelector settings that control how the scanner job is scheduled (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes/) | -| parser.resources | object | `{ requests: { cpu: "200m", memory: "100Mi" }, limits: { cpu: "400m", memory: "200Mi" } }` | Optional resources lets you control resource limits and requests for the parser container. See https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | -| parser.scopeLimiterAliases | object | `{}` | Optional finding aliases to be used in the scopeLimiter. | -| parser.tolerations | list | `[]` | Optional tolerations settings that control how the parser job is scheduled (see: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) | -| parser.ttlSecondsAfterFinished | string | `nil` | seconds after which the Kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | -| scanner.activeDeadlineSeconds | string | `nil` | There are situations where you want to fail a scan Job after some amount of time. To do so, set activeDeadlineSeconds to define an active deadline (in seconds) when considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#job-termination-and-cleanup) | -| scanner.affinity | object | `{}` | Optional affinity settings that control how the scanner job is scheduled (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes-using-node-affinity/) | -| scanner.backoffLimit | int | 3 | There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) | -| scanner.env | list | `[]` | Optional environment variables mapped into each scanJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) | -| scanner.extraContainers | list | `[]` | Optional additional Containers started with each scanJob (see: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) | -| scanner.extraVolumeMounts | list | `[]` | Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | -| scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | -| scanner.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | -| scanner.image.repository | string | `"docker.io/securecodebox/scanner-cmseek"` | Container Image to run the scan | -| scanner.image.tag | string | `nil` | defaults to the charts appVersion | -| scanner.nameAppend | string | `nil` | append a string to the default scantype name. | -| scanner.nodeSelector | object | `{}` | Optional nodeSelector settings that control how the scanner job is scheduled (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes/) | -| scanner.podSecurityContext | object | `{}` | Optional securityContext set on scanner pod (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | -| scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":false,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | -| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | -| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | -| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | -| scanner.securityContext.readOnlyRootFilesystem | bool | `false` | Prevents write access to the containers file system | -| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | -| scanner.suspend | bool | `false` | if set to true the scan job will be suspended after creation. You can then resume the job using `kubectl resume ` or using a job scheduler like kueue | -| scanner.tolerations | list | `[]` | Optional tolerations settings that control how the scanner job is scheduled (see: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) | -| scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the Kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | - -## License -[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0) - -Code of secureCodeBox is licensed under the [Apache License 2.0][scb-license]. - -[scb-owasp]: https://www.owasp.org/index.php/OWASP_secureCodeBox -[scb-docs]: https://www.securecodebox.io/ -[scb-site]: https://www.securecodebox.io/ -[scb-github]: https://github.com/secureCodeBox/ -[scb-mastodon]: https://infosec.exchange/@secureCodeBox -[scb-slack]: https://owasp.org/slack/invite -[scb-license]: https://github.com/secureCodeBox/secureCodeBox/blob/master/LICENSE - diff --git a/scanners/cmseek/Taskfile.yaml b/scanners/cmseek/Taskfile.yaml deleted file mode 100644 index eba6d685de..0000000000 --- a/scanners/cmseek/Taskfile.yaml +++ /dev/null @@ -1,20 +0,0 @@ -# SPDX-FileCopyrightText: the secureCodeBox authors -# -# SPDX-License-Identifier: Apache-2.0 - -version: "3.44.0" - -includes: - scanner: - taskfile: ../Taskfile.yaml - flatten: true - excludes: - - predeploy - vars: - scannerName: cmseek - -tasks: - predeploy: - deps: - - demo-targets:deploy:old-joomla - cmds: [] diff --git a/scanners/cmseek/cascading-rules/scan-joomla.yaml b/scanners/cmseek/cascading-rules/scan-joomla.yaml deleted file mode 100644 index 09756f2745..0000000000 --- a/scanners/cmseek/cascading-rules/scan-joomla.yaml +++ /dev/null @@ -1,22 +0,0 @@ -# SPDX-FileCopyrightText: the secureCodeBox authors -# -# SPDX-License-Identifier: Apache-2.0 - -apiVersion: "cascading.securecodebox.io/v1" -kind: CascadingRule -metadata: - name: "cmseek-cascade" - labels: - securecodebox.io/invasive: non-invasive - securecodebox.io/intensive: medium -spec: - matches: - anyOf: - - category: "WEB APPLICATION" - attributes: - MetaGenerator: "Joomla! - Open Source Content Management" - scanSpec: - scanType: "cmseek" - parameters: - - "-u" - - "{{{location}}}" # Runs a cmseek scan upon the 'location' parameter in whatweb findings diff --git a/scanners/cmseek/docs/.gitkeep b/scanners/cmseek/docs/.gitkeep deleted file mode 100644 index e69de29bb2..0000000000 diff --git a/scanners/cmseek/docs/README.ArtifactHub.md b/scanners/cmseek/docs/README.ArtifactHub.md deleted file mode 100644 index 404ef41c79..0000000000 --- a/scanners/cmseek/docs/README.ArtifactHub.md +++ /dev/null @@ -1,143 +0,0 @@ - - - -

- License Apache-2.0 - GitHub release (latest SemVer) - OWASP Lab Project - Artifact HUB - GitHub Repo stars - Mastodon Follower -

- -## What is OWASP secureCodeBox? - -

- secureCodeBox Logo -

- -_[OWASP secureCodeBox][scb-github]_ is an automated and scalable open source solution that can be used to integrate various *security vulnerability scanners* with a simple and lightweight interface. The _secureCodeBox_ mission is to support *DevSecOps* Teams to make it easy to automate security vulnerability testing in different scenarios. - -With the _secureCodeBox_ we provide a toolchain for continuous scanning of applications to find the low-hanging fruit issues early in the development process and free the resources of the penetration tester to concentrate on the major security issues. - -The secureCodeBox project is running on [Kubernetes](https://kubernetes.io/). To install it you need [Helm](https://helm.sh), a package manager for Kubernetes. It is also possible to start the different integrated security vulnerability scanners based on a docker infrastructure. - -### Quickstart with secureCodeBox on Kubernetes - -You can find resources to help you get started on our [documentation website](https://www.securecodebox.io) including instruction on how to [install the secureCodeBox project](https://www.securecodebox.io/docs/getting-started/installation) and guides to help you [run your first scans](https://www.securecodebox.io/docs/getting-started/first-scans) with it. - -## What is CMSeeK? -CMSeeK is an open source penetration testing tool to automate the process of detecting various types of CMS and its installed extensions. -Only the Joomla CMS is supported by secureCodeBox. CMSeeK has a database with known vulnerabilities. - -To learn more about the CMSeeK scanner itself, visit the CMSeeK GitHub repository [here](https://github.com/Tuhinshubhra/CMSeeK). - -## Deployment -The cmseek chart can be deployed via helm: - -```bash -# Install HelmChart (use -n to configure another namespace) -helm upgrade --install cmseek oci://ghcr.io/securecodebox/helm/cmseek -``` - -## Scanner Configuration - -The CMSeeK targets are specified with the `-u` parameter. The target should be a URL. - -Additional CMSeeK scan features can be configured via the parameter attribute. - -Some useful example parameters listed below: - -- `-u URL, --url URL` : Target Url. -- `--follow-redirect` : Follows all/any redirect(s). -- `--no-redirect` : skips all redirects and tests the input target(s) -- `-r, --random-agent`: Use a random user agent. -- `--googlebot`: Use Google bot user agent. -- `--user-agent USER_AGENT`: Specify a custom user agent - -## Requirements - -Kubernetes: `>=v1.11.0-0` - -## Values - -| Key | Type | Default | Description | -|-----|------|---------|-------------| -| cascadingRules.enabled | bool | `false` | Enables or disables the installation of the default cascading rules for this scanner | -| imagePullSecrets | list | `[]` | Define imagePullSecrets when a private registry is used (see: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/) | -| parser.affinity | object | `{}` | Optional affinity settings that control how the parser job is scheduled (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes-using-node-affinity/) | -| parser.env | list | `[]` | Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) | -| parser.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | -| parser.image.repository | string | `"docker.io/securecodebox/parser-cmseek"` | Parser image repository | -| parser.image.tag | string | defaults to the charts version | Parser image tag | -| parser.nodeSelector | object | `{}` | Optional nodeSelector settings that control how the scanner job is scheduled (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes/) | -| parser.resources | object | `{ requests: { cpu: "200m", memory: "100Mi" }, limits: { cpu: "400m", memory: "200Mi" } }` | Optional resources lets you control resource limits and requests for the parser container. See https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | -| parser.scopeLimiterAliases | object | `{}` | Optional finding aliases to be used in the scopeLimiter. | -| parser.tolerations | list | `[]` | Optional tolerations settings that control how the parser job is scheduled (see: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) | -| parser.ttlSecondsAfterFinished | string | `nil` | seconds after which the Kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | -| scanner.activeDeadlineSeconds | string | `nil` | There are situations where you want to fail a scan Job after some amount of time. To do so, set activeDeadlineSeconds to define an active deadline (in seconds) when considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#job-termination-and-cleanup) | -| scanner.affinity | object | `{}` | Optional affinity settings that control how the scanner job is scheduled (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes-using-node-affinity/) | -| scanner.backoffLimit | int | 3 | There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) | -| scanner.env | list | `[]` | Optional environment variables mapped into each scanJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) | -| scanner.extraContainers | list | `[]` | Optional additional Containers started with each scanJob (see: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) | -| scanner.extraVolumeMounts | list | `[]` | Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | -| scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | -| scanner.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | -| scanner.image.repository | string | `"docker.io/securecodebox/scanner-cmseek"` | Container Image to run the scan | -| scanner.image.tag | string | `nil` | defaults to the charts appVersion | -| scanner.nameAppend | string | `nil` | append a string to the default scantype name. | -| scanner.nodeSelector | object | `{}` | Optional nodeSelector settings that control how the scanner job is scheduled (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes/) | -| scanner.podSecurityContext | object | `{}` | Optional securityContext set on scanner pod (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | -| scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":false,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | -| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | -| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | -| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | -| scanner.securityContext.readOnlyRootFilesystem | bool | `false` | Prevents write access to the containers file system | -| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | -| scanner.suspend | bool | `false` | if set to true the scan job will be suspended after creation. You can then resume the job using `kubectl resume ` or using a job scheduler like kueue | -| scanner.tolerations | list | `[]` | Optional tolerations settings that control how the scanner job is scheduled (see: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) | -| scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the Kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | - -## Contributing - -Contributions are welcome and extremely helpful 🙌 -Please have a look at [Contributing](./CONTRIBUTING.md) - -## Community - -You are welcome, please join us on... 👋 - -- [GitHub][scb-github] -- [OWASP Slack (Channel #project-securecodebox)][scb-slack] -- [Mastodon][scb-mastodon] - -secureCodeBox is an official [OWASP][scb-owasp] project. - -## License -[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0) - -Code of secureCodeBox is licensed under the [Apache License 2.0][scb-license]. - -[scb-owasp]: https://www.owasp.org/index.php/OWASP_secureCodeBox -[scb-docs]: https://www.securecodebox.io/ -[scb-site]: https://www.securecodebox.io/ -[scb-github]: https://github.com/secureCodeBox/ -[scb-mastodon]: https://infosec.exchange/@secureCodeBox -[scb-slack]: https://owasp.org/slack/invite -[scb-license]: https://github.com/secureCodeBox/secureCodeBox/blob/master/LICENSE - diff --git a/scanners/cmseek/docs/README.DockerHub-Parser.md b/scanners/cmseek/docs/README.DockerHub-Parser.md deleted file mode 100644 index 954175668d..0000000000 --- a/scanners/cmseek/docs/README.DockerHub-Parser.md +++ /dev/null @@ -1,84 +0,0 @@ - - - -

- License Apache-2.0 - GitHub release (latest SemVer) - OWASP Lab Project - Artifact HUB - GitHub Repo stars - Mastodon Follower -

- -## What is OWASP secureCodeBox? - -

- secureCodeBox Logo -

- -_[OWASP secureCodeBox][scb-github]_ is an automated and scalable open source solution that can be used to integrate various *security vulnerability scanners* with a simple and lightweight interface. The _secureCodeBox_ mission is to support *DevSecOps* Teams to make it easy to automate security vulnerability testing in different scenarios. - -With the _secureCodeBox_ we provide a toolchain for continuous scanning of applications to find the low-hanging fruit issues early in the development process and free the resources of the penetration tester to concentrate on the major security issues. - -The secureCodeBox project is running on [Kubernetes](https://kubernetes.io/). To install it you need [Helm](https://helm.sh), a package manager for Kubernetes. It is also possible to start the different integrated security vulnerability scanners based on a docker infrastructure. - -### Quickstart with secureCodeBox on Kubernetes - -You can find resources to help you get started on our [documentation website](https://www.securecodebox.io) including instruction on how to [install the secureCodeBox project](https://www.securecodebox.io/docs/getting-started/installation) and guides to help you [run your first scans](https://www.securecodebox.io/docs/getting-started/first-scans) with it. - -## Supported Tags -- `latest` (represents the latest stable release build) -- tagged releases, e.g. `v.1.1.3` - -## How to use this image -This `parser` image is intended to work in combination with the corresponding security scanner docker image to parse the `findings` results. For more information details please take a look at the documentation page: https://www.securecodebox.io/docs/scanners/cmseek. - -```bash -docker pull securecodebox/parser-cmseek -``` - -## What is CMSeeK? -CMSeeK is an open source penetration testing tool to automate the process of detecting various types of CMS and its installed extensions. -Only the Joomla CMS is supported by secureCodeBox. CMSeeK has a database with known vulnerabilities. - -To learn more about the CMSeeK scanner itself, visit the CMSeeK GitHub repository [here](https://github.com/Tuhinshubhra/CMSeeK). - -## Community - -You are welcome, please join us on... 👋 - -- [GitHub][scb-github] -- [OWASP Slack (Channel #project-securecodebox)][scb-slack] -- [Mastodon][scb-mastodon] - -secureCodeBox is an official [OWASP][scb-owasp] project. - -## License -[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0) - -As with all Docker images, these likely also contain other software which may be under other licenses (such as Bash, etc from the base distribution, along with any direct or indirect dependencies of the primary software being contained). - -As for any pre-built image usage, it is the image user's responsibility to ensure that any use of this image complies with any relevant licenses for all software contained within. - -[scb-owasp]: https://www.owasp.org/index.php/OWASP_secureCodeBox -[scb-docs]: https://www.securecodebox.io/ -[scb-site]: https://www.securecodebox.io/ -[scb-github]: https://github.com/secureCodeBox/ -[scb-mastodon]: https://infosec.exchange/@secureCodeBox -[scb-slack]: https://owasp.org/slack/invite -[scb-license]: https://github.com/secureCodeBox/secureCodeBox/blob/master/LICENSE - diff --git a/scanners/cmseek/docs/README.DockerHub-Scanner.md b/scanners/cmseek/docs/README.DockerHub-Scanner.md deleted file mode 100644 index a9f9c71ab0..0000000000 --- a/scanners/cmseek/docs/README.DockerHub-Scanner.md +++ /dev/null @@ -1,99 +0,0 @@ - - - -

- License Apache-2.0 - GitHub release (latest SemVer) - OWASP Lab Project - Artifact HUB - GitHub Repo stars - Mastodon Follower -

- -## What is OWASP secureCodeBox? - -

- secureCodeBox Logo -

- -_[OWASP secureCodeBox][scb-github]_ is an automated and scalable open source solution that can be used to integrate various *security vulnerability scanners* with a simple and lightweight interface. The _secureCodeBox_ mission is to support *DevSecOps* Teams to make it easy to automate security vulnerability testing in different scenarios. - -With the _secureCodeBox_ we provide a toolchain for continuous scanning of applications to find the low-hanging fruit issues early in the development process and free the resources of the penetration tester to concentrate on the major security issues. - -The secureCodeBox project is running on [Kubernetes](https://kubernetes.io/). To install it you need [Helm](https://helm.sh), a package manager for Kubernetes. It is also possible to start the different integrated security vulnerability scanners based on a docker infrastructure. - -### Quickstart with secureCodeBox on Kubernetes - -You can find resources to help you get started on our [documentation website](https://www.securecodebox.io) including instruction on how to [install the secureCodeBox project](https://www.securecodebox.io/docs/getting-started/installation) and guides to help you [run your first scans](https://www.securecodebox.io/docs/getting-started/first-scans) with it. - -## Supported Tags -- `latest` (represents the latest stable release build) -- tagged releases, e.g. `v.1.1.3` - -## How to use this image -This `scanner` image is intended to work in combination with the corresponding `parser` image to parse the scanner `findings` to generic secureCodeBox results. For more information details please take a look at the [project page][scb-docs] or [documentation page][https://www.securecodebox.io/docs/scanners/cmseek]. - -```bash -docker pull securecodebox/scanner-cmseek -``` - -## What is CMSeeK? -CMSeeK is an open source penetration testing tool to automate the process of detecting various types of CMS and its installed extensions. -Only the Joomla CMS is supported by secureCodeBox. CMSeeK has a database with known vulnerabilities. - -To learn more about the CMSeeK scanner itself, visit the CMSeeK GitHub repository [here](https://github.com/Tuhinshubhra/CMSeeK). - -## Scanner Configuration - -The CMSeeK targets are specified with the `-u` parameter. The target should be a URL. - -Additional CMSeeK scan features can be configured via the parameter attribute. - -Some useful example parameters listed below: - -- `-u URL, --url URL` : Target Url. -- `--follow-redirect` : Follows all/any redirect(s). -- `--no-redirect` : skips all redirects and tests the input target(s) -- `-r, --random-agent`: Use a random user agent. -- `--googlebot`: Use Google bot user agent. -- `--user-agent USER_AGENT`: Specify a custom user agent - -## Community - -You are welcome, please join us on... 👋 - -- [GitHub][scb-github] -- [OWASP Slack (Channel #project-securecodebox)][scb-slack] -- [Mastodon][scb-mastodon] - -secureCodeBox is an official [OWASP][scb-owasp] project. - -## License -[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0) - -As with all Docker images, these likely also contain other software which may be under other licenses (such as Bash, etc from the base distribution, along with any direct or indirect dependencies of the primary software being contained). - -As for any pre-built image usage, it is the image user's responsibility to ensure that any use of this image complies with any relevant licenses for all software contained within. - -[scb-owasp]: https://www.owasp.org/index.php/OWASP_secureCodeBox -[scb-docs]: https://www.securecodebox.io/ -[scb-site]: https://www.securecodebox.io/ -[scb-github]: https://github.com/secureCodeBox/ -[scb-mastodon]: https://infosec.exchange/@secureCodeBox -[scb-slack]: https://owasp.org/slack/invite -[scb-license]: https://github.com/secureCodeBox/secureCodeBox/blob/master/LICENSE - diff --git a/scanners/cmseek/examples/demo-old-joomla/findings.yaml b/scanners/cmseek/examples/demo-old-joomla/findings.yaml deleted file mode 100644 index 012ac46eb9..0000000000 --- a/scanners/cmseek/examples/demo-old-joomla/findings.yaml +++ /dev/null @@ -1,61 +0,0 @@ -# SPDX-FileCopyrightText: the secureCodeBox authors -# -# SPDX-License-Identifier: Apache-2.0 - -[ - { - "name": "PHPMailer Remote Code Execution Vulnerability", - "description": "Vulnerability of type PHPMailer Remote Code Execution Vulnerability found", - "category": "Vulnerability", - "location": "http://old-joomla.demo-targets.svc.cluster.local", - "osi_layer": "APPLICATION", - "severity": "HIGH", - "attributes": - { - "joomla_version": "3.6.5", - "references": - [ - "CVE : CVE-2016-10033", - "https://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection", - "https://github.com/opsxcq/exploit-CVE-2016-10033", - "EDB : https://www.exploit-db.com/exploits/40969/", - ], - }, - "id": "f41eeb1c-142e-46f2-96ae-01c9f7ca1aa7", - "parsed_at": "2021-09-28T15:06:29.225Z", - }, - { - "name": "PPHPMailer Incomplete Fix Remote Code Execution Vulnerability", - "description": "Vulnerability of type PPHPMailer Incomplete Fix Remote Code Execution Vulnerability found", - "category": "Vulnerability", - "location": "http://old-joomla.demo-targets.svc.cluster.local", - "osi_layer": "APPLICATION", - "severity": "HIGH", - "attributes": - { - "joomla_version": "3.6.5", - "references": - [ - "CVE : CVE-2016-10045", - "https://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection", - "EDB : https://www.exploit-db.com/exploits/40969/", - ], - }, - "id": "ef8852d1-719b-4a4d-8cd6-d818fffb6fd2", - "parsed_at": "2021-09-28T15:06:29.225Z", - }, - { - "name": "Backup files", - "description": "Visible Backup files found", - "category": "Visible internal files", - "location": "http://old-joomla.demo-targets.svc.cluster.local", - "osi_layer": "APPLICATION", - "severity": "INFORMATIONAL", - "attributes": - { - "joomla_backup_files": "http://old-joomla.demo-targets.svc.cluster.local/administrator,", - }, - "id": "021b92a7-0c24-4f3c-b4b9-217e3a2e1ce9", - "parsed_at": "2021-09-28T15:06:29.225Z", - }, -] diff --git a/scanners/cmseek/examples/demo-old-joomla/scan.yaml b/scanners/cmseek/examples/demo-old-joomla/scan.yaml deleted file mode 100644 index e797910e78..0000000000 --- a/scanners/cmseek/examples/demo-old-joomla/scan.yaml +++ /dev/null @@ -1,14 +0,0 @@ -# SPDX-FileCopyrightText: the secureCodeBox authors -# -# SPDX-License-Identifier: Apache-2.0 - -apiVersion: "execution.securecodebox.io/v1" -kind: Scan -metadata: - name: cmseek-example -spec: - scanType: "cmseek" - parameters: - - "-u" - - "old-joomla.demo-targets.svc.cluster.local" # Change to the website you want to scan - - "--no-redirect" diff --git a/scanners/cmseek/integration-tests/cmseek.test.js b/scanners/cmseek/integration-tests/cmseek.test.js deleted file mode 100644 index e56b2dbf21..0000000000 --- a/scanners/cmseek/integration-tests/cmseek.test.js +++ /dev/null @@ -1,75 +0,0 @@ -// SPDX-FileCopyrightText: the secureCodeBox authors -// -// SPDX-License-Identifier: Apache-2.0 - -import { scan } from "../../../tests/integration/helpers.js"; - -test.skip( - "cmseek scans old-joomla for vulnerabilities without redirection", - async () => { - const { categories, severities, count } = await scan( - "cmseek-old-joomla", - "cmseek", - ["-u", "old-joomla.demo-targets.svc", "--no-redirect"], - 90, - ); - - expect(count).toBe(3); - expect(categories).toMatchInlineSnapshot(` - { - "Visible internal files": 1, - "Vulnerability": 2, - } - `); - expect(severities).toMatchInlineSnapshot(` - { - "high": 2, - "informational": 1, - } - `); - }, - { - timeout: 3 * 60 * 1000, - }, -); - -test.skip( - "cmseek scans old-joomla for vulnerabilities with redirection", - async () => { - const { categories, severities, count } = await scan( - "cmseek-old-joomla", - "cmseek", - ["-u", "old-joomla.demo-targets.svc", "--follow-redirect"], - 90, - ); - - expect(count).toBe(1); - expect(categories).toMatchInlineSnapshot(` - { - "Visible internal files": 1, - } - `); - expect(severities).toMatchInlineSnapshot(` - { - "informational": 1, - } - `); - }, - { - timeout: 3 * 60 * 1000, - }, -); - -test( - "Invalid argument should be marked as errored", - async () => { - await expect( - scan("cmseek-invalid-arg", "cmseek", ["--invalidArg", "example.com"], 90), - ).rejects.toThrow( - 'Scan failed with description "Failed to run the Scan Container, check k8s Job and its logs for more details"', - ); - }, - { - timeout: 3 * 60 * 1000, - }, -); diff --git a/scanners/cmseek/parser/Dockerfile b/scanners/cmseek/parser/Dockerfile deleted file mode 100644 index 6cd833a0ee..0000000000 --- a/scanners/cmseek/parser/Dockerfile +++ /dev/null @@ -1,9 +0,0 @@ -# SPDX-FileCopyrightText: the secureCodeBox authors -# -# SPDX-License-Identifier: Apache-2.0 - -ARG namespace -ARG baseImageTag -FROM ${namespace:-securecodebox}/parser-sdk-nodejs:${baseImageTag:-latest} -WORKDIR /home/app/parser-wrapper/parser/ -COPY --chown=root:root --chmod=755 ./parser.js ./parser.js \ No newline at end of file diff --git a/scanners/cmseek/parser/__snapshots__/parser.test.js.snap b/scanners/cmseek/parser/__snapshots__/parser.test.js.snap deleted file mode 100644 index 61f924ef20..0000000000 --- a/scanners/cmseek/parser/__snapshots__/parser.test.js.snap +++ /dev/null @@ -1,157 +0,0 @@ -// Jest Snapshot v1, https://goo.gl/fbAQLP - -exports[`parser parses result of Joomla scan with core vulnerabilities successfully 1`] = ` -[ - { - "attributes": { - "joomla_version": "3.6.5", - "references": [ - "CVE : CVE-2016-10033", - "https://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection", - "https://github.com/opsxcq/exploit-CVE-2016-10033", - "EDB : https://www.exploit-db.com/exploits/40969/", - ], - }, - "category": "Vulnerability", - "description": "Vulnerability of type PHPMailer Remote Code Execution Vulnerability found", - "identified_at": "2021-09-22T10:29:01.721Z", - "location": "http://172.26.0.3/", - "name": "PHPMailer Remote Code Execution Vulnerability", - "osi_layer": "APPLICATION", - "references": [ - { - "type": "URL", - "value": "https://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection", - }, - { - "type": "URL", - "value": "https://github.com/opsxcq/exploit-CVE-2016-10033", - }, - { - "type": "URL", - "value": "https://www.exploit-db.com/exploits/40969/", - }, - { - "type": "CVE", - "value": "CVE-2016-10033", - }, - { - "type": "URL", - "value": "https://www.cve.org/CVERecord?id=CVE-2016-10033", - }, - ], - "severity": "HIGH", - }, - { - "attributes": { - "joomla_version": "3.6.5", - "references": [ - "CVE : CVE-2016-10045", - "https://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection", - "EDB : https://www.exploit-db.com/exploits/40969/", - ], - }, - "category": "Vulnerability", - "description": "Vulnerability of type PPHPMailer Incomplete Fix Remote Code Execution Vulnerability found", - "identified_at": "2021-09-22T10:29:01.721Z", - "location": "http://172.26.0.3/", - "name": "PPHPMailer Incomplete Fix Remote Code Execution Vulnerability", - "osi_layer": "APPLICATION", - "references": [ - { - "type": "URL", - "value": "https://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection", - }, - { - "type": "URL", - "value": "https://www.exploit-db.com/exploits/40969/", - }, - { - "type": "CVE", - "value": "CVE-2016-10045", - }, - { - "type": "URL", - "value": "https://www.cve.org/CVERecord?id=CVE-2016-10045", - }, - ], - "severity": "HIGH", - }, - { - "attributes": { - "joomla_version": "3.6.5", - "references": [ - "https://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection", - "EDB : https://www.exploit-db.com/exploits/40969/", - ], - }, - "category": "Vulnerability", - "description": "Vulnerability of type PPHPMailer Incomplete Fix Remote Code Execution Vulnerability **without CVE** found", - "identified_at": "2021-09-22T10:29:01.721Z", - "location": "http://172.26.0.3/", - "name": "PPHPMailer Incomplete Fix Remote Code Execution Vulnerability **without CVE**", - "osi_layer": "APPLICATION", - "references": [ - { - "type": "URL", - "value": "https://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection", - }, - { - "type": "URL", - "value": "https://www.exploit-db.com/exploits/40969/", - }, - ], - "severity": "HIGH", - }, - { - "attributes": { - "joomla_version": "3.6.5", - "references": [], - }, - "category": "Vulnerability", - "description": "Vulnerability of type PPHPMailer Incomplete Fix Remote Code Execution Vulnerability **without references** found", - "identified_at": "2021-09-22T10:29:01.721Z", - "location": "http://172.26.0.3/", - "name": "PPHPMailer Incomplete Fix Remote Code Execution Vulnerability **without references**", - "osi_layer": "APPLICATION", - "references": null, - "severity": "HIGH", - }, - { - "attributes": { - "joomla_backup_files": [ - "http://172.26.0.3/1.save", - "http://172.26.0.3/1.tar.gz", - "http://172.26.0.3/1.rar", - "http://172.26.0.3/1.tar", - "http://172.26.0.3/1.zip", - "http://172.26.0.3/1.txt", - "http://172.26.0.3/1.tgz", - "http://172.26.0.3/1.tar.bz2", - "http://172.26.0.3/1.gz", - "http://172.26.0.3/1.tmp", - ], - }, - "category": "Visible internal files", - "description": "Visible Backup files found", - "identified_at": "2021-09-22T10:29:01.721Z", - "location": "http://172.26.0.3/", - "name": "Backup files", - "osi_layer": "APPLICATION", - "severity": "INFORMATIONAL", - }, - { - "category": "Security Misconfiguration", - "description": "Debug mode is enabled on the site", - "identified_at": "2021-09-22T10:29:01.721Z", - "location": "http://172.26.0.3/", - "name": "Debug mode", - "osi_layer": "APPLICATION", - "severity": "MEDIUM", - }, -] -`; - -exports[`parser parses result of Joomla scan without core vulnerabilities successfully 1`] = `[]`; - -exports[`parser parses result of non-Joomla scan successfully 1`] = `[]`; diff --git a/scanners/cmseek/parser/__snapshots__/parser.test.js.snap.license b/scanners/cmseek/parser/__snapshots__/parser.test.js.snap.license deleted file mode 100644 index 3034c0d74b..0000000000 --- a/scanners/cmseek/parser/__snapshots__/parser.test.js.snap.license +++ /dev/null @@ -1,3 +0,0 @@ -SPDX-FileCopyrightText: the secureCodeBox authors - -SPDX-License-Identifier: Apache-2.0 \ No newline at end of file diff --git a/scanners/cmseek/parser/__testFiles__/joomla_with_core_vulns.json b/scanners/cmseek/parser/__testFiles__/joomla_with_core_vulns.json deleted file mode 100644 index f0bf5c71b1..0000000000 --- a/scanners/cmseek/parser/__testFiles__/joomla_with_core_vulns.json +++ /dev/null @@ -1,56 +0,0 @@ -{ - "cms_id": "joom", - "cms_name": "joomla", - "cms_url": "https://joomla.org", - "detection_param": "header", - "joomla_backup_files": [ - "http://172.26.0.3/1.save", - "http://172.26.0.3/1.tar.gz", - "http://172.26.0.3/1.rar", - "http://172.26.0.3/1.tar", - "http://172.26.0.3/1.zip", - "http://172.26.0.3/1.txt", - "http://172.26.0.3/1.tgz", - "http://172.26.0.3/1.tar.bz2", - "http://172.26.0.3/1.gz", - "http://172.26.0.3/1.tmp" - ], - "joomla_debug_mode": "enabled", - "joomla_readme_file": "http://172.26.0.3/README.txt", - "joomla_version": "3.6.5", - "last_scanned": "2021-09-22 10:29:01.721009", - "url": "http://172.26.0.3/", - "vulnerabilities": [ - { - "name": "PHPMailer Remote Code Execution Vulnerability", - "references": [ - "CVE : CVE-2016-10033", - "https://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection", - "https://github.com/opsxcq/exploit-CVE-2016-10033", - "EDB : https://www.exploit-db.com/exploits/40969/" - ] - }, - { - "name": "PPHPMailer Incomplete Fix Remote Code Execution Vulnerability", - "references": [ - "CVE : CVE-2016-10045", - "https://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection", - "EDB : https://www.exploit-db.com/exploits/40969/" - ] - }, - { - "name": "PPHPMailer Incomplete Fix Remote Code Execution Vulnerability **without CVE**", - "references": [ - "https://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection", - "EDB : https://www.exploit-db.com/exploits/40969/" - ] - }, - { - "name": "PPHPMailer Incomplete Fix Remote Code Execution Vulnerability **without references**", - "references": [ - ] - } - - ], - "vulnerabilities_count": "4" -} \ No newline at end of file diff --git a/scanners/cmseek/parser/__testFiles__/joomla_with_core_vulns.json.license b/scanners/cmseek/parser/__testFiles__/joomla_with_core_vulns.json.license deleted file mode 100644 index 3034c0d74b..0000000000 --- a/scanners/cmseek/parser/__testFiles__/joomla_with_core_vulns.json.license +++ /dev/null @@ -1,3 +0,0 @@ -SPDX-FileCopyrightText: the secureCodeBox authors - -SPDX-License-Identifier: Apache-2.0 \ No newline at end of file diff --git a/scanners/cmseek/parser/__testFiles__/joomla_without_core_vulns.json b/scanners/cmseek/parser/__testFiles__/joomla_without_core_vulns.json deleted file mode 100644 index 045b098180..0000000000 --- a/scanners/cmseek/parser/__testFiles__/joomla_without_core_vulns.json +++ /dev/null @@ -1,10 +0,0 @@ -{ - "cms_id": "joom", - "cms_name": "joomla", - "cms_url": "https://joomla.org", - "detection_param": "header", - "joomla_debug_mode": "disabled", - "last_scanned": "2021-09-21 15:12:44.412355", - "url": "http://172.26.0.3/", - "vulnerabilities_count": "0" -} \ No newline at end of file diff --git a/scanners/cmseek/parser/__testFiles__/joomla_without_core_vulns.json.license b/scanners/cmseek/parser/__testFiles__/joomla_without_core_vulns.json.license deleted file mode 100644 index 3034c0d74b..0000000000 --- a/scanners/cmseek/parser/__testFiles__/joomla_without_core_vulns.json.license +++ /dev/null @@ -1,3 +0,0 @@ -SPDX-FileCopyrightText: the secureCodeBox authors - -SPDX-License-Identifier: Apache-2.0 \ No newline at end of file diff --git a/scanners/cmseek/parser/__testFiles__/not_joomla.json b/scanners/cmseek/parser/__testFiles__/not_joomla.json deleted file mode 100644 index 9ecbd39f2a..0000000000 --- a/scanners/cmseek/parser/__testFiles__/not_joomla.json +++ /dev/null @@ -1,8 +0,0 @@ -{ - "cms_id": "dru", - "cms_name": "Drupal", - "cms_url": "https://drupal.org", - "detection_param": "header", - "last_scanned": "2021-09-21 15:12:20.871380", - "url": "http://172.26.0.3/" -} \ No newline at end of file diff --git a/scanners/cmseek/parser/__testFiles__/not_joomla.json.license b/scanners/cmseek/parser/__testFiles__/not_joomla.json.license deleted file mode 100644 index 3034c0d74b..0000000000 --- a/scanners/cmseek/parser/__testFiles__/not_joomla.json.license +++ /dev/null @@ -1,3 +0,0 @@ -SPDX-FileCopyrightText: the secureCodeBox authors - -SPDX-License-Identifier: Apache-2.0 \ No newline at end of file diff --git a/scanners/cmseek/parser/__testFiles__/test-empty-report.json b/scanners/cmseek/parser/__testFiles__/test-empty-report.json deleted file mode 100644 index fe51488c70..0000000000 --- a/scanners/cmseek/parser/__testFiles__/test-empty-report.json +++ /dev/null @@ -1 +0,0 @@ -[] diff --git a/scanners/cmseek/parser/__testFiles__/test-empty-report.json.license b/scanners/cmseek/parser/__testFiles__/test-empty-report.json.license deleted file mode 100644 index c95bc37185..0000000000 --- a/scanners/cmseek/parser/__testFiles__/test-empty-report.json.license +++ /dev/null @@ -1,3 +0,0 @@ -SPDX-FileCopyrightText: the secureCodeBox authors - -SPDX-License-Identifier: Apache-2.0 diff --git a/scanners/cmseek/parser/parser.js b/scanners/cmseek/parser/parser.js deleted file mode 100644 index efc01ae239..0000000000 --- a/scanners/cmseek/parser/parser.js +++ /dev/null @@ -1,111 +0,0 @@ -// SPDX-FileCopyrightText: the secureCodeBox authors -// -// SPDX-License-Identifier: Apache-2.0 - -export async function parse(findings) { - let results = []; - // Making sure the CMS is Joomla - if (findings.cms_id != "joom") { - return results; - } - // Check if debug mode is enabled ; if yes add finding - let parsed_debug_mode_enabled = []; - - // I ran into an issue where the time coverted to ISO String was dependant from the timezone of the machine running the test. - // This means that if GitHub Actions CI time and local time are different the test will fail. - // To fix this we need to enforce the timezone in the date string. - // cmseek uses the timezone of the machine running the scan, so it will be different machine to machine (or cloud service). - // https://github.com/Tuhinshubhra/CMSeeK/blob/ce085fee1b5f48db7412911e399bb2c771e73a0f/cmseekdb/basic.py#L296 - // For simplicity UTC time is enforced, and that is by adding a Z to the end of the date string. - const last_scanned = new Date(findings.last_scanned + "Z").toISOString(); - if (findings.joomla_debug_mode == "enabled") { - parsed_debug_mode_enabled = { - name: "Debug mode", - identified_at: last_scanned, - description: `Debug mode is enabled on the site`, - category: "Security Misconfiguration", - location: findings.url, - osi_layer: "APPLICATION", - severity: "MEDIUM", - }; - } - - // Check if backup files are open; if yes add finding - let parsed_backupFiles = []; - if ("joomla_backup_files" in findings) { - parsed_backupFiles = { - name: "Backup files", - identified_at: last_scanned, - description: `Visible Backup files found`, - category: "Visible internal files", - location: findings.url, - osi_layer: "APPLICATION", - severity: "INFORMATIONAL", - attributes: { - joomla_backup_files: findings.joomla_backup_files, - }, - }; - } - // Check if any core vulnerabilities exist; if yes list findings - let parsed_vulnerabilities = []; - if (findings.vulnerabilities_count > 0) { - parsed_vulnerabilities = findings.vulnerabilities.map((vuln) => { - // Fetch CVE from vulnerability references - const cve = fetchCVE(vuln.references); - const separator = " : "; - - // Create CVE reference object if CVE exists - const cve_reference = cve - ? [ - { type: "CVE", value: cve }, - { type: "URL", value: `https://www.cve.org/CVERecord?id=${cve}` }, - ] - : []; // Empty array if no CVE exists - - // Create URL reference objects from the vulnerability references - const urls_references = vuln.references - .filter((ref) => ref.includes("http")) - .map((ref) => ({ - type: "URL", - // Extract the URL if the reference includes the separator, otherwise use the whole reference - value: ref.includes(separator) ? ref.split(separator)[1].trim() : ref, - })); - - // Combine URL and CVE references, and filter out any empty reference - const references = [...urls_references, ...cve_reference].filter( - (r) => r, - ); - - // Return the parsed vulnerability object - return { - name: vuln.name, - identified_at: last_scanned, - description: `Vulnerability of type ${vuln.name} found`, - category: "Vulnerability", - location: findings.url, - osi_layer: "APPLICATION", - severity: "HIGH", - references: references.length > 0 ? references : null, - attributes: { - joomla_version: findings.joomla_version, - references: vuln.references, - }, - }; - }); - } - // concat all parsed results - return parsed_vulnerabilities - .concat(parsed_backupFiles) - .concat(parsed_debug_mode_enabled); -} -// Helper function to fetch CVE from references -// it is assumed that the reference is in the format "CVE : CVE-XXXX-XXXX" -function fetchCVE(references) { - for (const reference of references) { - if (reference.includes("CVE :")) { - const cve = reference.split("CVE : ")[1].trim(); - return cve; - } - } - return null; -} diff --git a/scanners/cmseek/parser/parser.test.js b/scanners/cmseek/parser/parser.test.js deleted file mode 100644 index 0fdfb29448..0000000000 --- a/scanners/cmseek/parser/parser.test.js +++ /dev/null @@ -1,60 +0,0 @@ -// SPDX-FileCopyrightText: the secureCodeBox authors -// -// SPDX-License-Identifier: Apache-2.0 - -import { readFile } from "fs/promises"; - -import { parse } from "./parser"; - -import { validateParser } from "@securecodebox/parser-sdk-nodejs/parser-utils"; - -test("parser parses result of Joomla scan with core vulnerabilities successfully", async () => { - const fileContent = await readFile( - import.meta.dirname + "/__testFiles__/joomla_with_core_vulns.json", - { - encoding: "utf8", - }, - ); - - const findings = await parse(JSON.parse(fileContent)); - await expect(validateParser(findings)).resolves.toBeUndefined(); - expect(findings).toMatchSnapshot(); -}); - -test("parser parses result of Joomla scan without core vulnerabilities successfully", async () => { - const fileContent = await readFile( - import.meta.dirname + "/__testFiles__/joomla_without_core_vulns.json", - { - encoding: "utf8", - }, - ); - - const findings = await parse(JSON.parse(fileContent)); - await expect(validateParser(findings)).resolves.toBeUndefined(); - expect(findings).toMatchSnapshot(); -}); - -test("parser parses result of non-Joomla scan successfully", async () => { - const fileContent = await readFile( - import.meta.dirname + "/__testFiles__/not_joomla.json", - { - encoding: "utf8", - }, - ); - - const findings = await parse(JSON.parse(fileContent)); - await expect(validateParser(findings)).resolves.toBeUndefined(); - expect(findings).toMatchSnapshot(); -}); - -test("should properly parse empty cmseek json file", async () => { - const jsonContent = await readFile( - import.meta.dirname + "/__testFiles__/test-empty-report.json", - { - encoding: "utf8", - }, - ); - const findings = await parse(jsonContent); - await expect(validateParser(findings)).resolves.toBeUndefined(); - expect(findings).toMatchInlineSnapshot(`[]`); -}); diff --git a/scanners/cmseek/scanner/Dockerfile b/scanners/cmseek/scanner/Dockerfile deleted file mode 100644 index 9c7ed5b9ae..0000000000 --- a/scanners/cmseek/scanner/Dockerfile +++ /dev/null @@ -1,35 +0,0 @@ -# SPDX-FileCopyrightText: the secureCodeBox authors -# -# SPDX-License-Identifier: Apache-2.0 - -# Base Image -FROM python:3.9-alpine AS base -ARG scannerVersion -# Install git and Clone Repo -RUN apk add git \ - && git clone https://github.com/Tuhinshubhra/CMSeeK.git --depth 1 --branch $scannerVersion \ - && cd CMSeeK \ - && rm -r .git - -# Runtime Image -FROM python:3.9-alpine AS runtime - -# Create cmseek user/group and give access -RUN addgroup --system --gid 1001 cmseek && adduser cmseek --system --uid 1001 --ingroup cmseek -COPY --from=base --chown=1001:1001 /CMSeeK /home/cmseek/ -COPY --chown=1001:1001 wrapper.sh /home/cmseek/ - -# Create folder for scan output -RUN mkdir /home/securecodebox/ && chown -R cmseek:cmseek /home/securecodebox/ - -# Switch to cmseek user -USER 1001 -WORKDIR /home/cmseek/ - -# Create folder required by the scanner -RUN mkdir /home/cmseek/Result - -# Install cmseek python requirements -RUN python3 -m pip install -r requirements.txt - -ENTRYPOINT [ "sh", "/home/cmseek/wrapper.sh" ] diff --git a/scanners/cmseek/scanner/wrapper.sh b/scanners/cmseek/scanner/wrapper.sh deleted file mode 100644 index 9f6789b9a1..0000000000 --- a/scanners/cmseek/scanner/wrapper.sh +++ /dev/null @@ -1,13 +0,0 @@ -# SPDX-FileCopyrightText: the secureCodeBox authors -# -# SPDX-License-Identifier: Apache-2.0 - -python3 /home/cmseek/cmseek.py "$@" - -# Find how many files with the JSON extension in Result folder are. -lines=$(find /home/cmseek/Result/ -type f -name "*.json" | wc -l) - -#The cmseek scanner names the folder where the result is, the target url. That is why it's replaced with a wildcard here. -if [ $lines -eq 1 ]; then - mv /home/cmseek/Result/*/cms.json /home/securecodebox/cmseek.json -fi diff --git a/scanners/cmseek/templates/cascading-rules.yaml b/scanners/cmseek/templates/cascading-rules.yaml deleted file mode 100644 index fe0ac6b903..0000000000 --- a/scanners/cmseek/templates/cascading-rules.yaml +++ /dev/null @@ -1,15 +0,0 @@ -# SPDX-FileCopyrightText: the secureCodeBox authors -# -# SPDX-License-Identifier: Apache-2.0 - -# We only want to import the default cascading rules if they are enabled -{{ if .Values.cascadingRules.enabled }} -# The CascadingRules are not directly in the /templates directory as their curly bracket syntax clashes with helms templates ... :( -# We import them as raw files to avoid these clashes as escaping them is even more messy -{{ range $path, $_ := .Files.Glob "cascading-rules/*" }} -# Include File -{{ $.Files.Get $path }} -# Separate multiple files ---- -{{ end }} -{{ end }} diff --git a/scanners/cmseek/templates/cmseek-parse-definition.yaml b/scanners/cmseek/templates/cmseek-parse-definition.yaml deleted file mode 100644 index a551aed359..0000000000 --- a/scanners/cmseek/templates/cmseek-parse-definition.yaml +++ /dev/null @@ -1,32 +0,0 @@ -# SPDX-FileCopyrightText: the secureCodeBox authors -# -# SPDX-License-Identifier: Apache-2.0 - -apiVersion: "execution.securecodebox.io/v1" -kind: ParseDefinition -metadata: - name: "cmseek-json" -spec: - image: "{{ .Values.parser.image.repository }}:{{ .Values.parser.image.tag | default .Chart.Version }}" - imagePullPolicy: {{ .Values.parser.image.pullPolicy }} - ttlSecondsAfterFinished: {{ .Values.parser.ttlSecondsAfterFinished }} - env: - {{- toYaml .Values.parser.env | nindent 4 }} - scopeLimiterAliases: - {{- toYaml .Values.parser.scopeLimiterAliases | nindent 4 }} - affinity: - {{- toYaml .Values.parser.affinity | nindent 4 }} - tolerations: - {{- toYaml .Values.parser.tolerations | nindent 4 }} - {{- with .Values.imagePullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 4 }} - {{- end }} - {{- with .Values.parser.resources }} - resources: - {{- toYaml . | nindent 4 }} - {{- end }} - {{- with .Values.parser.nodeSelector }} - nodeSelector: - {{- toYaml . | nindent 4 }} - {{- end }} diff --git a/scanners/cmseek/templates/cmseek-scan-type.yaml b/scanners/cmseek/templates/cmseek-scan-type.yaml deleted file mode 100644 index f0b246ef2d..0000000000 --- a/scanners/cmseek/templates/cmseek-scan-type.yaml +++ /dev/null @@ -1,59 +0,0 @@ -# SPDX-FileCopyrightText: the secureCodeBox authors -# -# SPDX-License-Identifier: Apache-2.0 - -apiVersion: "execution.securecodebox.io/v1" -kind: ScanType -metadata: - name: "cmseek{{ .Values.scanner.nameAppend | default ""}}" -spec: - extractResults: - type: cmseek-json - location: "/home/securecodebox/cmseek.json" - jobTemplate: - spec: - suspend: {{ .Values.scanner.suspend | default false }} - {{- if .Values.scanner.ttlSecondsAfterFinished }} - ttlSecondsAfterFinished: {{ .Values.scanner.ttlSecondsAfterFinished }} - {{- end }} - backoffLimit: {{ .Values.scanner.backoffLimit }} - {{- if .Values.scanner.activeDeadlineSeconds }} - activeDeadlineSeconds: {{ .Values.scanner.activeDeadlineSeconds }} - {{- end }} - template: - spec: - restartPolicy: Never - affinity: - {{- toYaml .Values.scanner.affinity | nindent 12 }} - tolerations: - {{- toYaml .Values.scanner.tolerations | nindent 12 }} - {{- with .Values.imagePullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 12 }} - {{- end }} - securityContext: - {{- toYaml .Values.scanner.podSecurityContext | nindent 12 }} - containers: - - name: cmseek - image: "{{ .Values.scanner.image.repository }}:{{ .Values.scanner.image.tag | default .Chart.AppVersion }}" - imagePullPolicy: {{ .Values.scanner.image.pullPolicy }} - command: - - "sh" - - "/home/cmseek/wrapper.sh" - resources: - {{- toYaml .Values.scanner.resources | nindent 16 }} - securityContext: - {{- toYaml .Values.scanner.securityContext | nindent 16 }} - env: - {{- toYaml .Values.scanner.env | nindent 16 }} - volumeMounts: - {{- toYaml .Values.scanner.extraVolumeMounts | nindent 16 }} - {{- if .Values.scanner.extraContainers }} - {{- toYaml .Values.scanner.extraContainers | nindent 12 }} - {{- end }} - volumes: - {{- toYaml .Values.scanner.extraVolumes | nindent 12 }} - {{- with .Values.scanner.nodeSelector }} - nodeSelector: - {{- toYaml . | nindent 12 }} - {{- end }} diff --git a/scanners/cmseek/tests/__snapshot__/scanner_test.yaml.snap b/scanners/cmseek/tests/__snapshot__/scanner_test.yaml.snap deleted file mode 100644 index 758f959b59..0000000000 --- a/scanners/cmseek/tests/__snapshot__/scanner_test.yaml.snap +++ /dev/null @@ -1,90 +0,0 @@ -matches the snapshot: - 1: | - apiVersion: cascading.securecodebox.io/v1 - kind: CascadingRule - metadata: - labels: - securecodebox.io/intensive: medium - securecodebox.io/invasive: non-invasive - name: cmseek-cascade - spec: - matches: - anyOf: - - attributes: - MetaGenerator: Joomla! - Open Source Content Management - category: WEB APPLICATION - scanSpec: - parameters: - - -u - - '{{{location}}}' - scanType: cmseek - 2: | - apiVersion: execution.securecodebox.io/v1 - kind: ParseDefinition - metadata: - name: cmseek-json - spec: - affinity: - foo: bar - env: - - name: foo - value: bar - image: docker.io/securecodebox/parser-cmseek:0.0.0 - imagePullPolicy: IfNotPresent - imagePullSecrets: - - name: foo - resources: - foo: bar - scopeLimiterAliases: - foo: bar - tolerations: - - foo: bar - ttlSecondsAfterFinished: null - 3: | - apiVersion: execution.securecodebox.io/v1 - kind: ScanType - metadata: - name: cmseekfoo - spec: - extractResults: - location: /home/securecodebox/cmseek.json - type: cmseek-json - jobTemplate: - spec: - backoffLimit: 3 - suspend: false - template: - spec: - affinity: - foo: bar - containers: - - command: - - sh - - /home/cmseek/wrapper.sh - env: - - name: foo - value: bar - image: docker.io/securecodebox/scanner-cmseek:0.0.0 - imagePullPolicy: IfNotPresent - name: cmseek - resources: - foo: bar - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - all - privileged: false - readOnlyRootFilesystem: false - runAsNonRoot: true - volumeMounts: [] - - image: bar - name: foo - imagePullSecrets: - - name: foo - restartPolicy: Never - securityContext: - fsGroup: 1234 - tolerations: - - foo: bar - volumes: [] diff --git a/scanners/cmseek/tests/scanner_test.yaml b/scanners/cmseek/tests/scanner_test.yaml deleted file mode 100644 index c5b3b49c3a..0000000000 --- a/scanners/cmseek/tests/scanner_test.yaml +++ /dev/null @@ -1,30 +0,0 @@ -# SPDX-FileCopyrightText: the secureCodeBox authors -# -# SPDX-License-Identifier: Apache-2.0 - -suite: Full Snapshot - -tests: - - it: matches the snapshot - chart: - version: 0.0.0 - appVersion: 0.0.0 - set: - cascadingRules.enabled: true - imagePullSecrets: [{name: foo}] - parser: - env: [{name: foo, value: bar}] - scopeLimiterAliases: {foo: bar} - affinity: {foo: bar} - tolerations: [{foo: bar}] - resources: {foo: bar} - scanner: - nameAppend: foo - resources: {foo: bar} - env: [{name: foo, value: bar}] - extraContainers: [{name: foo, image: bar}] - podSecurityContext: {fsGroup: 1234} - affinity: {foo: bar} - tolerations: [{foo: bar}] - asserts: - - matchSnapshot: {} diff --git a/scanners/cmseek/values.yaml b/scanners/cmseek/values.yaml deleted file mode 100644 index 3d8d5ec19c..0000000000 --- a/scanners/cmseek/values.yaml +++ /dev/null @@ -1,114 +0,0 @@ -# SPDX-FileCopyrightText: the secureCodeBox authors -# -# SPDX-License-Identifier: Apache-2.0 -# -- Define imagePullSecrets when a private registry is used (see: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/) -imagePullSecrets: [] - -parser: - image: - # parser.image.repository -- Parser image repository - repository: docker.io/securecodebox/parser-cmseek - # parser.image.tag -- Parser image tag - # @default -- defaults to the charts version - tag: null - # -- Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images - pullPolicy: IfNotPresent - - # parser.ttlSecondsAfterFinished -- seconds after which the Kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ - ttlSecondsAfterFinished: null - # parser.env -- Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) - env: [] - - # parser.scopeLimiterAliases -- Optional finding aliases to be used in the scopeLimiter. - scopeLimiterAliases: {} - - # parser.nodeSelector -- Optional nodeSelector settings that control how the scanner job is scheduled (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes/) - nodeSelector: {} - - # parser.affinity -- Optional affinity settings that control how the parser job is scheduled (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes-using-node-affinity/) - affinity: {} - - # parser.tolerations -- Optional tolerations settings that control how the parser job is scheduled (see: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) - tolerations: [] - - # -- Optional resources lets you control resource limits and requests for the parser container. See https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - # @default -- `{ requests: { cpu: "200m", memory: "100Mi" }, limits: { cpu: "400m", memory: "200Mi" } }` - resources: {} - -scanner: - image: - # scanner.image.repository -- Container Image to run the scan - repository: docker.io/securecodebox/scanner-cmseek - # scanner.image.tag -- defaults to the charts appVersion - tag: null - # -- Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images - pullPolicy: IfNotPresent - - # scanner.nameAppend -- append a string to the default scantype name. - nameAppend: null - - # -- seconds after which the Kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ - ttlSecondsAfterFinished: null - # -- There are situations where you want to fail a scan Job after some amount of time. To do so, set activeDeadlineSeconds to define an active deadline (in seconds) when considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#job-termination-and-cleanup) - activeDeadlineSeconds: null - # -- There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) - # @default -- 3 - backoffLimit: 3 - - # scanner.resources -- CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) - resources: {} - # resources: - # requests: - # memory: "256Mi" - # cpu: "250m" - # limits: - # memory: "512Mi" - # cpu: "500m" - - # scanner.env -- Optional environment variables mapped into each scanJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) - env: [] - - # scanner.extraVolumes -- Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) - extraVolumes: [] - - # scanner.extraVolumeMounts -- Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) - extraVolumeMounts: [] - - # scanner.extraContainers -- Optional additional Containers started with each scanJob (see: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) - extraContainers: [] - - # scanner.podSecurityContext -- Optional securityContext set on scanner pod (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) - podSecurityContext: - {} - # fsGroup: 2000 - - # scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) - securityContext: - # scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user - runAsNonRoot: true - # scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system - readOnlyRootFilesystem: false - # scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated - allowPrivilegeEscalation: false - # scanner.securityContext.privileged -- Ensures that the scanner container is not run in privileged mode - privileged: false - capabilities: - drop: - # scanner.securityContext.capabilities.drop[0] -- This drops all linux privileges from the container. - - all - - # scanner.nodeSelector -- Optional nodeSelector settings that control how the scanner job is scheduled (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes/) - nodeSelector: {} - - # scanner.affinity -- Optional affinity settings that control how the scanner job is scheduled (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes-using-node-affinity/) - affinity: {} - - # scanner.tolerations -- Optional tolerations settings that control how the scanner job is scheduled (see: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) - tolerations: [] - - # -- if set to true the scan job will be suspended after creation. You can then resume the job using `kubectl resume ` or using a job scheduler like kueue - suspend: false - -cascadingRules: - # cascadingRules.enabled -- Enables or disables the installation of the default cascading rules for this scanner - enabled: false