Skip to content

Commit 93486b9

Browse files
felickzfelickz
committed
Add vulnerable dependencies demo project with multiple projects and examples of security vulnerabilities
1 parent 24f9124 commit 93486b9

16 files changed

+468
-2
lines changed

‎Directory.Build.props‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
<Project>
2+
<PropertyGroup>
3+
<TargetFramework>net9.0</TargetFramework>
4+
<ImplicitUsings>enable</ImplicitUsings>
5+
<Nullable>enable</Nullable>
6+
<LangVersion>latest</LangVersion>
7+
</PropertyGroup>
8+
</Project>

‎Directory.Build.targets‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
<Project>
2+
<Target Name="OverridePackageVersions" BeforeTargets="CollectPackageReferences">
3+
<Message Text="Using centrally defined package versions for this solution" Importance="High" />
4+
</Target>
5+
</Project>

‎Directory.Packages.props‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
<Project>
2+
<PropertyGroup>
3+
<ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
4+
<CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
5+
</PropertyGroup>
6+
7+
<ItemGroup>
8+
<!-- Common packages -->
9+
<PackageVersion Include="Microsoft.Extensions.Logging" Version="9.0.0" />
10+
<PackageVersion Include="Microsoft.Extensions.Logging.Console" Version="9.0.0" />
11+
<PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="9.0.0" />
12+
13+
<!-- Vulnerable direct dependencies (examples) -->
14+
<PackageVersion Include="Newtonsoft.Json" Version="12.0.3" /> <!-- Has known vulnerabilities -->
15+
<PackageVersion Include="System.Text.RegularExpressions" Version="4.3.0" /> <!-- Known regex vulnerability -->
16+
<PackageVersion Include="System.Net.Http" Version="4.3.0" /> <!-- Contains security vulnerabilities -->
17+
18+
<!-- API dependencies -->
19+
<PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="8.0.0" /> <!-- Intentionally older version -->
20+
<PackageVersion Include="Microsoft.AspNetCore.Mvc.NewtonsoftJson" Version="7.0.0" /> <!-- Older version -->
21+
<PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="9.0.8" />
22+
<PackageVersion Include="Swashbuckle.AspNetCore" Version="6.2.3" /> <!-- Outdated version -->
23+
24+
<!-- Library dependencies with transitive vulnerabilities -->
25+
<PackageVersion Include="Microsoft.AspNet.WebApi.Client" Version="5.2.7" /> <!-- Has vulnerable dependencies -->
26+
<PackageVersion Include="Microsoft.Data.OData" Version="5.8.4" /> <!-- Contains vulnerable dependency chain -->
27+
28+
<!-- Utility dependencies -->
29+
<PackageVersion Include="log4net" Version="2.0.12" /> <!-- Has known vulnerabilities -->
30+
<PackageVersion Include="SharpZipLib" Version="1.3.1" /> <!-- Contains security issues -->
31+
</ItemGroup>
32+
</Project>

‎README.md‎

Lines changed: 61 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,61 @@
1-
# vulnerable-dependencies
2-
Simulates a repository with multiple projects, CPM, and vulnerable direct and transitive dependencies
1+
# Vulnerable Dependencies Demo
2+
3+
This repository demonstrates a .NET 9 solution with multiple projects that contain vulnerable direct and transitive dependencies. It uses Central Package Management (CPM) to manage these dependencies.
4+
5+
## Project Structure
6+
7+
- **VulnerableApi**: A .NET 9 Web API project with vulnerable dependencies
8+
- Uses vulnerable Newtonsoft.Json settings
9+
- Contains SSRF vulnerability through user-controlled HTTP requests
10+
- Uses vulnerable JWT authentication configuration
11+
12+
- **VulnerableLibrary**: A class library with vulnerable dependencies
13+
- Uses vulnerable regex patterns (potential ReDoS)
14+
- Contains outdated SharpZipLib reference
15+
- Uses vulnerable versions of System.Net.Http
16+
17+
- **VulnerableConsole**: A console application that uses both direct and transitive dependencies
18+
- Uses vulnerable log4net version
19+
- Demonstrates vulnerable JSON serialization
20+
- References the VulnerableLibrary with its transitive dependencies
21+
22+
## Vulnerability Examples
23+
24+
This repository contains examples of:
25+
26+
1. **Direct dependencies with known vulnerabilities**:
27+
- Newtonsoft.Json 12.0.3 (CVE-2020-0605)
28+
- System.Text.RegularExpressions 4.3.0 (CVE-2019-0820)
29+
- System.Net.Http 4.3.0 (CVE-2018-8292)
30+
31+
2. **Transitive dependencies with vulnerabilities**:
32+
- Dependencies coming through Microsoft.AspNet.WebApi.Client
33+
- Dependencies coming through Microsoft.Data.OData
34+
35+
3. **Vulnerable code patterns**:
36+
- TypeNameHandling.All in Newtonsoft.Json (CVE-2017-9785)
37+
- Regex patterns vulnerable to ReDoS
38+
- SSRF through unvalidated user input
39+
40+
## Central Package Management
41+
42+
The project uses Central Package Management (CPM) via the Directory.Packages.props file to define all package versions in a central location.
43+
44+
## Running the Sample
45+
46+
```powershell
47+
dotnet restore
48+
dotnet build
49+
```
50+
51+
## Security Analysis
52+
53+
You can use various tools to detect the vulnerabilities in this sample:
54+
55+
- NuGet Package Vulnerability Detection
56+
- Static Code Analysis tools
57+
- Dependency scanning tools
58+
59+
## Note
60+
61+
This is a demonstration repository used to illustrate vulnerable dependencies. Do not use any of this code in a production environment.

‎VulnerableApi/Controllers/VulnerableController.cs‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
using Microsoft.AspNetCore.Mvc;
2+
using Newtonsoft.Json;
3+
using System.Net.Http;
4+
using VulnerableLibrary;
5+
6+
namespace VulnerableApi.Controllers
7+
{
8+
[ApiController]
9+
[Route("api/[controller]")]
10+
public class VulnerableController : ControllerBase
11+
{
12+
private readonly HttpClient _httpClient;
13+
private readonly DataProcessor _dataProcessor;
14+
15+
public VulnerableController(DataProcessor dataProcessor)
16+
{
17+
_httpClient = new HttpClient();
18+
_dataProcessor = dataProcessor;
19+
}
20+
21+
[HttpGet("unsafe-json")]
22+
public ActionResult GetUnsafeJson(string input)
23+
{
24+
// Using vulnerable JSON deserialization
25+
var settings = new JsonSerializerSettings
26+
{
27+
TypeNameHandling = TypeNameHandling.All // CVE-2017-9785 - Known security vulnerability
28+
};
29+
30+
var result = JsonConvert.DeserializeObject(input, settings);
31+
return Ok(result);
32+
}
33+
34+
[HttpPost("process-data")]
35+
public async Task<ActionResult> ProcessData([FromBody] DataRequest request)
36+
{
37+
try
38+
{
39+
var result = await _dataProcessor.ProcessData(request.Data);
40+
return Ok(new { Success = true, Result = result });
41+
}
42+
catch (Exception ex)
43+
{
44+
return BadRequest(new { Error = ex.Message });
45+
}
46+
}
47+
48+
[HttpGet("unsafe-request")]
49+
public async Task<ActionResult> UnsafeRequest(string url)
50+
{
51+
// Using vulnerable System.Net.Http version
52+
// SSRF vulnerability - allowing the client to specify any URL
53+
var response = await _httpClient.GetAsync(url);
54+
var content = await response.Content.ReadAsStringAsync();
55+
return Ok(content);
56+
}
57+
}
58+
59+
public class DataRequest
60+
{
61+
public string Data { get; set; } = string.Empty;
62+
}
63+
}

‎VulnerableApi/Program.cs‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
var builder = WebApplication.CreateBuilder(args);
2+
3+
// Add services to the container.
4+
builder.Services.AddEndpointsApiExplorer();
5+
builder.Services.AddSwaggerGen();
6+
builder.Services.AddControllers()
7+
.AddNewtonsoftJson(); // Using vulnerable Newtonsoft.Json
8+
9+
// Add JWT authentication with vulnerable version
10+
builder.Services.AddAuthentication()
11+
.AddJwtBearer(options =>
12+
{
13+
options.Authority = "https://example.auth.server";
14+
options.Audience = "api";
15+
// Vulnerable: DisableTokenValidation = true would be insecure
16+
});
17+
18+
// Register the vulnerable library components
19+
builder.Services.AddTransient<VulnerableLibrary.DataProcessor>();
20+
21+
var app = builder.Build();
22+
23+
// Configure the HTTP request pipeline.
24+
if (app.Environment.IsDevelopment())
25+
{
26+
app.UseSwagger();
27+
app.UseSwaggerUI();
28+
}
29+
30+
var summaries = new[]
31+
{
32+
"Freezing", "Bracing", "Chilly", "Cool", "Mild", "Warm", "Balmy", "Hot", "Sweltering", "Scorching"
33+
};
34+
35+
app.MapControllers();
36+
37+
app.MapGet("/weatherforecast", () =>
38+
{
39+
var forecast = Enumerable.Range(1, 5).Select(index =>
40+
new WeatherForecast
41+
(
42+
DateOnly.FromDateTime(DateTime.Now.AddDays(index)),
43+
Random.Shared.Next(-20, 55),
44+
summaries[Random.Shared.Next(summaries.Length)]
45+
))
46+
.ToArray();
47+
return forecast;
48+
})
49+
.WithName("GetWeatherForecast");
50+
51+
app.Run();
52+
53+
record WeatherForecast(DateOnly Date, int TemperatureC, string? Summary)
54+
{
55+
public int TemperatureF => 32 + (int)(TemperatureC / 0.5556);
56+
}

‎VulnerableApi/Properties/launchSettings.json‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
{
2+
"$schema": "https://json.schemastore.org/launchsettings.json",
3+
"profiles": {
4+
"http": {
5+
"commandName": "Project",
6+
"dotnetRunMessages": true,
7+
"launchBrowser": false,
8+
"applicationUrl": "http://localhost:5184",
9+
"environmentVariables": {
10+
"ASPNETCORE_ENVIRONMENT": "Development"
11+
}
12+
}
13+
}
14+
}

‎VulnerableApi/VulnerableApi.csproj‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
<Project Sdk="Microsoft.NET.Sdk.Web">
2+
3+
<PropertyGroup>
4+
<TargetFramework>net9.0</TargetFramework>
5+
<Nullable>enable</Nullable>
6+
<ImplicitUsings>enable</ImplicitUsings>
7+
</PropertyGroup>
8+
9+
<ItemGroup>
10+
<PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" />
11+
<PackageReference Include="Microsoft.AspNetCore.Mvc.NewtonsoftJson" />
12+
<PackageReference Include="Microsoft.AspNetCore.OpenApi" />
13+
<PackageReference Include="Newtonsoft.Json" />
14+
<PackageReference Include="Swashbuckle.AspNetCore" />
15+
<PackageReference Include="System.Net.Http" />
16+
</ItemGroup>
17+
18+
<ItemGroup>
19+
<ProjectReference Include="..\VulnerableLibrary\VulnerableLibrary.csproj" />
20+
</ItemGroup>
21+
22+
</Project>

‎VulnerableApi/VulnerableApi.http‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
@VulnerableApi_HostAddress = http://localhost:5184
2+
3+
GET {{VulnerableApi_HostAddress}}/weatherforecast/
4+
Accept: application/json
5+
6+
###

‎VulnerableApi/appsettings.Development.json‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{
2+
"Logging": {
3+
"LogLevel": {
4+
"Default": "Information",
5+
"Microsoft.AspNetCore": "Warning"
6+
}
7+
}
8+
}

0 commit comments

Comments
 (0)