forked from juice-shop/juice-shop
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'juice-shop:master' into master
- Loading branch information
Showing
668 changed files
with
2,643 additions
and
3,582 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,3 +1,3 @@ | ||
| /vagrant/ @wurstbrot | ||
| /test/cypress/ @ShubhamPalriwala | ||
| /frontend/src/app/score-board-preview @J12934 | ||
| /frontend/src/app/score-board @J12934 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
121 changes: 121 additions & 0 deletions
121
.well-known/csaf/2017/juice-shop-sa-20200513-express-jwt.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,121 @@ | ||
| { | ||
| "document": { | ||
| "acknowledgments": [ | ||
| { | ||
| "organization": "OWASP Juice Shop", | ||
| "summary": "Probably the most modern and sophisticated insecure web application" | ||
| } | ||
| ], | ||
| "aggregate_severity": { | ||
| "text": "Critical" | ||
| }, | ||
| "category": "csaf_security_advisory", | ||
| "csaf_version": "2.0", | ||
| "lang": "en", | ||
| "notes": [ | ||
| { | ||
| "category": "legal_disclaimer", | ||
| "text": "The Juice Shop contains vulnerabilities. Only use it in an isolated. ONLY run the Juice Shop in a training environment.", | ||
| "title": "Isolated Env." | ||
| } | ||
| ], | ||
| "publisher": { | ||
| "category": "vendor", | ||
| "contact_details": "timo.pagel@owasp.org", | ||
| "issuing_authority": "OWASP Juice Shop", | ||
| "name": "OWASP Juice Shop Core Team", | ||
| "namespace": "https://github.com/juice-shop/juice-shop" | ||
| }, | ||
| "title": "juice-shop-sa-20200513-express-jwt", | ||
| "tracking": { | ||
| "current_release_date": "2024-03-03T11:00:00.000Z", | ||
| "generator": { | ||
| "date": "2024-03-03T19:30:53.428Z", | ||
| "engine": { | ||
| "name": "Secvisogram", | ||
| "version": "2.5.0" | ||
| } | ||
| }, | ||
| "id": "juice-shop-sa-20200513-express-jwt", | ||
| "initial_release_date": "2024-03-03T11:00:00.000Z", | ||
| "revision_history": [ | ||
| { | ||
| "date": "2024-03-03T11:00:00.000Z", | ||
| "number": "1.0.0", | ||
| "summary": "Initial public release." | ||
| } | ||
| ], | ||
| "status": "final", | ||
| "version": "1.0.0" | ||
| } | ||
| }, | ||
| "product_tree": { | ||
| "branches": [ | ||
| { | ||
| "category": "product_version_range", | ||
| "name": ">=v6.0.0", | ||
| "product": { | ||
| "name": "OWASP Juice Shop", | ||
| "product_id": "juice-shop/juice-shop", | ||
| "product_identification_helper": { | ||
| "purl": "pkg:docker/bkimminich/juice-shop" | ||
| } | ||
| } | ||
| } | ||
| ] | ||
| }, | ||
| "vulnerabilities": [ | ||
| { | ||
| "cve": "CVE-2020-15084", | ||
| "notes": [ | ||
| { | ||
| "category": "details", | ||
| "text": "The Juice Shop is currently vulnerable to JWT null algorithm attacks . We will soon release a patch", | ||
| "title": "Vulnerable to Null JWT Algorithm" | ||
| } | ||
| ], | ||
| "product_status": { | ||
| "known_affected": [ | ||
| "juice-shop/juice-shop" | ||
| ] | ||
| }, | ||
| "remediations": [ | ||
| { | ||
| "category": "workaround", | ||
| "date": "2020-07-01T10:00:00.000Z", | ||
| "details": "Check for the expected JWT algorithm type in a WAF/Proxy/Loadbalancer in front of the Juice Shop.", | ||
| "product_ids": [ | ||
| "juice-shop/juice-shop" | ||
| ], | ||
| "url": "https://github.com/advisories/GHSA-6g6m-m6h5-w9gf" | ||
| } | ||
| ], | ||
| "scores": [ | ||
| { | ||
| "cvss_v3": { | ||
| "attackComplexity": "LOW", | ||
| "attackVector": "NETWORK", | ||
| "availabilityImpact": "NONE", | ||
| "baseScore": 9.1, | ||
| "baseSeverity": "CRITICAL", | ||
| "confidentialityImpact": "HIGH", | ||
| "environmentalScore": 9.1, | ||
| "environmentalSeverity": "CRITICAL", | ||
| "integrityImpact": "HIGH", | ||
| "privilegesRequired": "NONE", | ||
| "scope": "UNCHANGED", | ||
| "temporalScore": 9.1, | ||
| "temporalSeverity": "CRITICAL", | ||
| "userInteraction": "NONE", | ||
| "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", | ||
| "version": "3.1" | ||
| }, | ||
| "products": [ | ||
| "juice-shop/juice-shop" | ||
| ] | ||
| } | ||
| ], | ||
| "title": "CVE-2020-15084" | ||
| } | ||
| ] | ||
| } |
7 changes: 7 additions & 0 deletions
7
.well-known/csaf/2017/juice-shop-sa-20200513-express-jwt.json.asc
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| -----BEGIN PGP SIGNATURE----- | ||
|
|
||
| iHUEABYKAB0WIQQjcrKxKup64wAbs/vQj7FuICnYcAUCZid3ggAKCRDQj7FuICnY | ||
| cItlAP4tS43N//qIKXUZTLOMnd8cRMv25KfRF5WZ3OazSZxyLAEAkQluY3UwxO0m | ||
| Ybd/wfOOJ9DE7qjjZyFcf6le4Bl1pAI= | ||
| =n7jT | ||
| -----END PGP SIGNATURE----- |
1 change: 1 addition & 0 deletions
1
.well-known/csaf/2017/juice-shop-sa-20200513-express-jwt.json.sha512
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| 7e7ce7c65db3bf0625fcea4573d25cff41f2f7e3474f2c74334b14fc65bb4fd26af802ad17a3a03bf0eee6827a00fb8f7905f338c31b5e6ea9cb31620242e843 juice-shop-sa-20200513-express-jwt.json |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,85 @@ | ||
| { | ||
| "document": { | ||
| "acknowledgments": [ | ||
| { | ||
| "organization": "OWASP Juice Shop", | ||
| "summary": "Probably the most modern and sophisticated insecure web application" | ||
| } | ||
| ], | ||
| "aggregate_severity": { | ||
| "text": "High" | ||
| }, | ||
| "category": "csaf_security_advisory", | ||
| "csaf_version": "2.0", | ||
| "lang": "en", | ||
| "notes": [ | ||
| { | ||
| "category": "legal_disclaimer", | ||
| "text": "The Juice Shop contains vulnerabilities. Only use it in an isolated. ONLY run the Juice Shop in a training environment.", | ||
| "title": "Isolated Env." | ||
| } | ||
| ], | ||
| "publisher": { | ||
| "category": "vendor", | ||
| "contact_details": "timo.pagel@owasp.org", | ||
| "issuing_authority": "OWASP Juice Shop", | ||
| "name": "OWASP Juice Shop Core Team", | ||
| "namespace": "https://github.com/juice-shop/juice-shop" | ||
| }, | ||
| "title": "juice-shop-sa-20211014-proto", | ||
| "tracking": { | ||
| "current_release_date": "2021-10-14T10:00:00.000Z", | ||
| "generator": { | ||
| "date": "2024-03-09T14:24:03.158Z", | ||
| "engine": { | ||
| "name": "Secvisogram", | ||
| "version": "2.5.0" | ||
| } | ||
| }, | ||
| "id": "juice-shop-sa-20211014-proto", | ||
| "initial_release_date": "2024-03-03T11:00:00.000Z", | ||
| "revision_history": [ | ||
| { | ||
| "date": "2024-03-03T11:00:00.000Z", | ||
| "number": "1.0.0", | ||
| "summary": "Initial public release." | ||
| } | ||
| ], | ||
| "status": "final", | ||
| "version": "1.0.0" | ||
| } | ||
| }, | ||
| "product_tree": { | ||
| "branches": [ | ||
| { | ||
| "category": "product_version_range", | ||
| "name": ">=v12.10.2", | ||
| "product": { | ||
| "name": "OWASP Juice Shop", | ||
| "product_id": "juice-shop/juice-shop", | ||
| "product_identification_helper": { | ||
| "purl": "pkg:docker/bkimminich/juice-shop" | ||
| } | ||
| } | ||
| } | ||
| ] | ||
| }, | ||
| "vulnerabilities": [ | ||
| { | ||
| "cve": "CVE-2020-36604", | ||
| "notes": [ | ||
| { | ||
| "category": "details", | ||
| "text": "A proof of an exploit does not exists, but it might be possible to exploit the Juice Shop through the vulnerability.", | ||
| "title": "Notes" | ||
| } | ||
| ], | ||
| "product_status": { | ||
| "known_affected": [ | ||
| "juice-shop/juice-shop" | ||
| ] | ||
| }, | ||
| "title": "The Juice Shop uses the library hoek which might be subject to prototype pollution via the clone function." | ||
| } | ||
| ] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| -----BEGIN PGP SIGNATURE----- | ||
|
|
||
| iHUEABYKAB0WIQQjcrKxKup64wAbs/vQj7FuICnYcAUCZid3yAAKCRDQj7FuICnY | ||
| cJo1AP0ZdiEeoFAUcCm6j6lrGIbrPjElYFcgeX1yRbx1plzaCwEA4BH2nvY/VuLH | ||
| cZI6JuYTsPoeAkzwDsWWTCJGM7u12QU= | ||
| =UeTn | ||
| -----END PGP SIGNATURE----- |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| c4eedb2d5ac0b0c11666d87247e1011de4fa5db7e741a4c090374a039e1ce31210d08e63b27d5fabb307705ebbfa1bbbcfe56e5ba0c3528deb00af273f670778 juice-shop-sa-20211014-proto.json |
Oops, something went wrong.