results.json

[
  {
    "module": {
      "key": "contents",
      "name": "File Contents",
      "description": "Scans files for dangerous content",
      "enabled": true
    },
    "results": {
      "high": [],
      "medium": [],
      "low": [],
      "critical": [
        {
          "name": "some_file_with_private_key_in.md",
          "description": "Private key in file",
          "extra": "Line number: 1",
          "data": {
            "extension": [
              "js",
              "json",
              "xml",
              "text",
              "rb",
              "py",
              "sh",
              "md"
            ],
            "content": {},
            "caption": "Private key in file",
            "level": "critical"
          }
        }
      ]
    }
  },
  {
    "module": {
      "key": "files",
      "name": "Secret Files",
      "description": "Scans for known secret files",
      "enabled": true
    },
    "results": {
      "high": [
        {
          "name": "keyring",
          "description": "GNOME Keyring database file",
          "extra": null,
          "data": {
            "part": "extension",
            "type": "regex",
            "pattern": {},
            "caption": "GNOME Keyring database file",
            "level": "high",
            "description": null
          }
        }
      ],
      "medium": [
        {
          "name": "gem/credentials",
          "description": "Rubygems credentials file",
          "extra": "Might contain API key for a rubygems.org account.",
          "data": {
            "part": "path",
            "type": "regex",
            "pattern": {},
            "caption": "Rubygems credentials file",
            "level": "medium",
            "description": "Might contain API key for a rubygems.org account."
          }
        }
      ],
      "low": [
        {
          "name": "some_file_with_private_key_in.md",
          "description": "Contains words: private, key",
          "extra": null,
          "data": {
            "part": "filename",
            "type": "regex",
            "pattern": {},
            "caption": "Contains words: private, key",
            "level": "low",
            "description": null
          }
        }
      ],
      "critical": [
        {
          "name": "cert.pem",
          "description": "Potential cryptographic private key",
          "extra": null,
          "data": {
            "part": "extension",
            "type": "match",
            "pattern": "pem",
            "caption": "Potential cryptographic private key",
            "level": "critical",
            "description": null
          }
        },
        {
          "name": "id_rsa",
          "description": "Private SSH key",
          "extra": null,
          "data": {
            "part": "filename",
            "type": "regex",
            "pattern": {},
            "caption": "Private SSH key",
            "level": "critical",
            "description": null
          }
        },
        {
          "name": "regex_rsa",
          "description": "Private SSH key",
          "extra": null,
          "data": {
            "part": "filename",
            "type": "regex",
            "pattern": {},
            "caption": "Private SSH key",
            "level": "critical",
            "description": null
          }
        }
      ]
    }
  },
  {
    "module": {
      "key": "ncu",
      "name": "Node Check Updates",
      "description": "Scans a package.json for out of date packages",
      "enabled": true
    },
    "results": {
      "high": [
        {
          "name": "nodemailer",
          "description": "Module is one or more major versions out of date",
          "extra": "Installed: 2.6.4, Available: 3.1.8",
          "data": {}
        }
      ],
      "medium": [
        {
          "name": "body-parser",
          "description": "Module is one or more minor versions out of date",
          "extra": "Installed: 1.15.1, Available: 1.17.1",
          "data": {}
        },
        {
          "name": "debug",
          "description": "Module is one or more minor versions out of date",
          "extra": "Installed: 2.2.0, Available: 2.6.3",
          "data": {}
        },
        {
          "name": "express",
          "description": "Module is one or more minor versions out of date",
          "extra": "Installed: 4.13.4, Available: 4.15.2",
          "data": {}
        },
        {
          "name": "morgan",
          "description": "Module is one or more minor versions out of date",
          "extra": "Installed: 1.7.0, Available: 1.8.1",
          "data": {}
        },
        {
          "name": "serve-favicon",
          "description": "Module is one or more minor versions out of date",
          "extra": "Installed: 2.3.0, Available: 2.4.1",
          "data": {}
        }
      ],
      "low": [],
      "critical": []
    }
  },
  {
    "module": {
      "key": "nsp",
      "name": "Node Security Project",
      "description": "Scans a package.json for known vulnerabilities from NSP",
      "enabled": true
    },
    "results": {
      "high": [
        {
          "name": "negotiator",
          "description": "https://nodesecurity.io/advisories/106",
          "extra": "vulnerable-app@0.0.0 > express@4.13.4 > accepts@1.2.13 > negotiator@0.5.3",
          "data": {
            "id": 106,
            "updated_at": "2016-06-16T20:37:24.000Z",
            "created_at": "2016-05-04T16:34:12.000Z",
            "publish_date": "2016-06-16T17:36:06.000Z",
            "overview": "negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa.\n\nThe header for \"Accept-Language\", when parsed by negotiator is vulnerable to Regular Expression Denial of Service via a specially crafted string. \n\nTimeline\n\n- April 29th 2016 - Initial report to maintainers\n- April 29th 2016 - Confirm receipt from maintainers\n- May 1st 2016 - Fix confirmed\n- May 5th 2016 - 0.6.1 published with fix\n- June 16th 2016 - Advisory published (delay was to coordinate fixes in upstream frameworks, Koa and Express)",
            "recommendation": "Upgrade to at least version 0.6.1\n\nExpress users should update to Express 4.14.0 or greater. If you want to see if you are using a vulnerable call,  a quick grep for the `acceptsLanguages` function call in your application will tell you if you are using this functionality.",
            "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "cvss_score": 7.5,
            "module": "negotiator",
            "version": "0.5.3",
            "vulnerable_versions": "<= 0.6.0",
            "patched_versions": ">= 0.6.1",
            "title": "Regular Expression Denial of Service",
            "path": [
              "vulnerable-app@0.0.0",
              "express@4.13.4",
              "accepts@1.2.13",
              "negotiator@0.5.3"
            ],
            "advisory": "https://nodesecurity.io/advisories/106"
          }
        }
      ],
      "medium": [
        {
          "name": "uglify-js",
          "description": "https://nodesecurity.io/advisories/48",
          "extra": "vulnerable-app@0.0.0 > jade@1.11.0 > transformers@2.1.0 > uglify-js@2.2.5",
          "data": {
            "id": 48,
            "updated_at": "2016-04-21T00:15:04.000Z",
            "created_at": "2015-10-24T17:58:34.232Z",
            "publish_date": "2015-10-24T21:01:32.155Z",
            "overview": "uglify-js is vulnerable to regular expression denial of service (ReDoS) when certain types of input is passed into .parse().\n\n\"The Regular expression Denial of Service (ReDoS) is a Denial of Service attack, that exploits the fact that most Regular Expression implementations may reach extreme situations that cause them to work very slowly (exponentially related to input size). An attacker can then cause a program using a Regular Expression to enter these extreme situations and then hang for a very long time.\" [1]\n\n### Proof of Concept\n\n```\nvar u = require('uglify-js');\nvar genstr = function (len, chr) {\n    var result = \"\";\n    for (i=0; i<=len; i++) {\n        result = result + chr;\n    }\n\n    return result;\n}\n\nu.parse(\"var a = \" + genstr(process.argv[2], \"1\") + \".1ee7;\");\n```\n\n### Results\n```\n$ time node test.js 10000\nreal\t0m1.091s\nuser\t0m1.047s\nsys\t0m0.039s\n\n$ time node test.js 80000\nreal\t0m6.486s\nuser\t0m6.229s\nsys\t0m0.094s\n```",
            "recommendation": "Update to version 2.6.0 or later",
            "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "cvss_score": 5.3,
            "module": "uglify-js",
            "version": "2.2.5",
            "vulnerable_versions": "<2.6.0",
            "patched_versions": ">=2.6.0",
            "title": "Regular Expression Denial of Service",
            "path": [
              "vulnerable-app@0.0.0",
              "jade@1.11.0",
              "transformers@2.1.0",
              "uglify-js@2.2.5"
            ],
            "advisory": "https://nodesecurity.io/advisories/48"
          }
        }
      ],
      "low": [],
      "critical": [
        {
          "name": "uglify-js",
          "description": "https://nodesecurity.io/advisories/39",
          "extra": "vulnerable-app@0.0.0 > jade@1.11.0 > transformers@2.1.0 > uglify-js@2.2.5",
          "data": {
            "id": 39,
            "updated_at": "2016-04-28T17:22:23.000Z",
            "created_at": "2015-10-17T19:41:46.382Z",
            "publish_date": "2015-08-24T19:29:10.000Z",
            "overview": "[Tom MacWright](https://github.com/mishoo/UglifyJS2/issues/751) discovered that UglifyJS versions 2.4.23 and earlier are affected by a vulnerability which allows a specially crafted Javascript file to have altered functionality after minification. This bug was [demonstrated](https://zyan.scripts.mit.edu/blog/backdooring-js/) by [Yan](https://twitter.com/bcrypt) to allow potentially malicious code to be hidden within secure code, activated by minification.\n\n\n### Details:\n\nIn Boolean algebra, DeMorgan's laws describe the relationships between conjunctions ( && ), disjunctions ( || ) and negations ( ! ).\nIn Javascript form, they state that:\n !(a && b) === (!a) || (!b)\n !(a || b) === (!a) && (!b)\n\nThe law does not hold true when one of the values is not a boolean however.\n\nVulnerable versions of UglifyJS do not account for this restriction, and erroneously apply the laws to a statement if it can be reduced in length by it.\n\nConsider this authentication function:\n\n```\nfunction isTokenValid(user) {\n    var timeLeft =\n        !!config && // config object exists\n        !!user.token && // user object has a token\n        !user.token.invalidated && // token is not explicitly invalidated\n        !config.uninitialized && // config is initialized\n        !config.ignoreTimestamps && // don't ignore timestamps\n        getTimeLeft(user.token.expiry); // > 0 if expiration is in the future\n\n    // The token must not be expired\n    return timeLeft > 0;\n}\n\nfunction getTimeLeft(expiry) {\n  return expiry - getSystemTime();\n}\n```\nWhen minified with a vulnerable version of UglifyJS, it will produce the following insecure output, where a token will never expire:\n\n( Formatted for readability )\n\n```\nfunction isTokenValid(user) {\n    var timeLeft = !(                       // negation\n        !config                             // config object does not exist\n        || !user.token                      // user object does not have a token\n        || user.token.invalidated           // token is explicitly invalidated\n        || config.uninitialized             // config isn't initialized\n        || config.ignoreTimestamps          // ignore timestamps\n        || !getTimeLeft(user.token.expiry)  // > 0 if expiration is in the future\n    );\n    return timeLeft > 0\n}\n\nfunction getTimeLeft(expiry) {\n    return expiry - getSystemTime()\n}\n```",
            "recommendation": "Upgrade UglifyJS to version >= 2.4.24.",
            "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
            "cvss_score": 8.3,
            "module": "uglify-js",
            "version": "2.2.5",
            "vulnerable_versions": "<= 2.4.23",
            "patched_versions": ">= 2.4.24",
            "title": "Incorrect Handling of Non-Boolean Comparisons During Minification",
            "path": [
              "vulnerable-app@0.0.0",
              "jade@1.11.0",
              "transformers@2.1.0",
              "uglify-js@2.2.5"
            ],
            "advisory": "https://nodesecurity.io/advisories/39"
          }
        }
      ]
    }
  }
]