Skip to content

Commit 08cedcb

Browse files
RTannRTann
authored
ROX-12350: Detect CVE-2022-22978 (#930)
1 parent 76885b8 commit 08cedcb

File tree

3 files changed

+152
-2
lines changed

3 files changed

+152
-2
lines changed

‎cpe/attributes/java/java.go

Lines changed: 41 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,36 @@ var (
3535
immutableIndicators = []string{
3636
"agent",
3737
}
38+
39+
knownSpringVendors = []string{"pivotal", "pivotal_software", "vmware"}
40+
knownSpringComponents = set.NewFrozenStringSet(
41+
"spring_advanced_message_queuing_protocol",
42+
"spring_aop",
43+
"spring_beans",
44+
"spring_boot",
45+
"spring_boot_autoconfigure",
46+
"spring_boot_jarmode_layertools",
47+
"spring_cloud_function",
48+
"spring_cloud_function_core",
49+
"spring_cloud_gateway",
50+
"spring_cloud_netflix",
51+
"spring_cloud_openfeign",
52+
"spring_context",
53+
"spring_core",
54+
"spring_data_mongodb",
55+
"spring_data_rest",
56+
"spring_expression",
57+
"spring_jcl",
58+
"spring_security",
59+
"spring_security_core",
60+
"spring_security_crypto",
61+
"spring_security_oath",
62+
"spring_security_web",
63+
"spring_web",
64+
"spring_web_flow",
65+
"spring_webflux",
66+
"spring_webmvc",
67+
)
3868
)
3969

4070
func isMutableName(name string) bool {
@@ -70,7 +100,7 @@ func ignored(c *component.Component) bool {
70100
return false
71101
}
72102

73-
func getPossibleVendors(origins []string) set.StringSet {
103+
func getPossibleVendors(origins []string, names set.StringSet) set.StringSet {
74104
// Try splitting on periods
75105
vendorSet := set.NewStringSet()
76106
for _, orig := range origins {
@@ -90,6 +120,15 @@ func getPossibleVendors(origins []string) set.StringSet {
90120
if vendorSet.Cardinality() == 0 {
91121
vendorSet.Add("apache")
92122
}
123+
124+
// Add Spring-specific vendors.
125+
for name := range names {
126+
if knownSpringComponents.Contains(name) {
127+
vendorSet.AddAll(knownSpringVendors...)
128+
break
129+
}
130+
}
131+
93132
return vendorSet
94133
}
95134

@@ -109,8 +148,8 @@ func GetJavaAttributes(c *component.Component) []*wfn.Attributes {
109148
return nil
110149
}
111150

112-
vendorSet := getPossibleVendors(java.Origins)
113151
nameSet := common.GenerateNameKeys(c)
152+
vendorSet := getPossibleVendors(java.Origins, nameSet)
114153
versionSet := common.GenerateVersionKeys(c)
115154
for k := range versionSet {
116155
versionSet.Add(extensionRegex.ReplaceAllString(k, ""))

‎e2etests/testcase_test.go

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3557,4 +3557,50 @@ Bug Fix(es) and Enhancement(s):
35573557
},
35583558
},
35593559
},
3560+
{
3561+
image: "quay.io/rhacs-eng/qa:spring-CVE-2022-22978",
3562+
registry: "https://quay.io",
3563+
username: os.Getenv("QUAY_RHACS_ENG_RO_USERNAME"),
3564+
password: os.Getenv("QUAY_RHACS_ENG_RO_PASSWORD"),
3565+
source: "NVD",
3566+
onlyCheckSpecifiedVulns: true,
3567+
namespace: "rhel:8",
3568+
expectedFeatures: []apiV1.Feature{
3569+
{
3570+
Name: "spring-security-web",
3571+
VersionFormat: component.JavaSourceType.String(),
3572+
Version: "5.5.5",
3573+
Location: "application/app.jar:BOOT-INF/lib/spring-security-web-5.5.5.jar",
3574+
Vulnerabilities: []apiV1.Vulnerability{
3575+
{
3576+
Name: "CVE-2022-22978",
3577+
Description: `In Spring Security versions 5.5.6 and 5.6.3 and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers.
3578+
3579+
Applications using RegexRequestMatcher with '.' in the regular expression are possibly vulnerable to an authorization bypass.`,
3580+
Link: "https://nvd.nist.gov/vuln/detail/CVE-2022-22978",
3581+
Severity: "Important",
3582+
Metadata: map[string]interface{}{
3583+
"NVD": map[string]interface{}{
3584+
"CVSSv2": map[string]interface{}{
3585+
"ExploitabilityScore": 0.0,
3586+
"ImpactScore": 0.0,
3587+
"Score": 0.0,
3588+
"Vectors": "",
3589+
},
3590+
"CVSSv3": map[string]interface{}{
3591+
"ExploitabilityScore": 3.9,
3592+
"ImpactScore": 4.2,
3593+
"Score": 8.2,
3594+
"Vectors": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
3595+
},
3596+
},
3597+
},
3598+
FixedBy: "5.5.7",
3599+
},
3600+
},
3601+
FixedBy: "5.5.7",
3602+
AddedBy: "sha256:5b6e3ce9721946e142ba43e488385ee4d323204a6052e0f20352d89ac00cafa2",
3603+
},
3604+
},
3605+
},
35603606
}

‎pkg/vulnloader/nvdloader/manual.go

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -454,6 +454,71 @@ var manuallyEnrichedVulns = map[string]*schema.NVDCVEFeedJSON10DefCVEItem{
454454
LastModifiedDate: "2022-03-31T00:00Z",
455455
PublishedDate: "2022-03-31T00:00Z",
456456
},
457+
"CVE-2022-22978": {
458+
CVE: &schema.CVEJSON40{
459+
CVEDataMeta: &schema.CVEJSON40CVEDataMeta{
460+
ID: "CVE-2022-22978",
461+
},
462+
DataFormat: "MITRE",
463+
DataType: "CVE",
464+
DataVersion: "4.0",
465+
Description: &schema.CVEJSON40Description{
466+
DescriptionData: []*schema.CVEJSON40LangString{
467+
{
468+
Lang: "en",
469+
Value: "In Spring Security versions 5.5.6 and 5.6.3 and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers.\n\nApplications using RegexRequestMatcher with '.' in the regular expression are possibly vulnerable to an authorization bypass.",
470+
},
471+
},
472+
},
473+
References: &schema.CVEJSON40References{
474+
ReferenceData: []*schema.CVEJSON40Reference{
475+
{
476+
Name: "https://tanzu.vmware.com/security/cve-2022-22978",
477+
},
478+
},
479+
},
480+
},
481+
Configurations: &schema.NVDCVEFeedJSON10DefConfigurations{
482+
CVEDataVersion: "4.0",
483+
Nodes: []*schema.NVDCVEFeedJSON10DefNode{
484+
{
485+
CPEMatch: []*schema.NVDCVEFeedJSON10DefCPEMatch{
486+
{
487+
Cpe23Uri: `cpe:2.3:a:vmware:spring\-security\-web:*:*:*:*:*:*:*:*`,
488+
VersionEndExcluding: "5.6.4",
489+
VersionStartIncluding: "5.6.0",
490+
},
491+
{
492+
Cpe23Uri: `cpe:2.3:a:vmware:spring\-security\-web:*:*:*:*:*:*:*:*`,
493+
VersionEndExcluding: "5.5.7",
494+
},
495+
},
496+
Operator: "OR",
497+
},
498+
},
499+
},
500+
Impact: &schema.NVDCVEFeedJSON10DefImpact{
501+
BaseMetricV3: &schema.NVDCVEFeedJSON10DefImpactBaseMetricV3{
502+
CVSSV3: &schema.CVSSV30{
503+
AttackComplexity: "LOW",
504+
AttackVector: "NETWORK",
505+
AvailabilityImpact: "NONE",
506+
BaseScore: 8.2,
507+
ConfidentialityImpact: "HIGH",
508+
IntegrityImpact: "LOW",
509+
PrivilegesRequired: "NONE",
510+
Scope: "UNCHANGED",
511+
UserInteraction: "NONE",
512+
VectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
513+
Version: "3.1",
514+
},
515+
ExploitabilityScore: 3.9,
516+
ImpactScore: 4.2,
517+
},
518+
},
519+
LastModifiedDate: "2022-05-16T00:00Z",
520+
PublishedDate: "2022-05-16T00:00Z",
521+
},
457522
"CVE-2017-5638": {
458523
CVE: &schema.CVEJSON40{
459524
CVEDataMeta: &schema.CVEJSON40CVEDataMeta{

0 commit comments

Comments
 (0)