# Dependency Security Detection Module

> Third-party dependency security detection module
> For known CVE vulnerabilities, version security, and dependency configuration risks

## Risk Pattern Library

### Risk Pattern 1: Known CVE Vulnerability Dependencies (High Risk)

#### Vulnerable Code Example
```xml
<!-- High Risk: Dependency version with known CVE vulnerabilities -->
<dependency>
    <groupId>org.apache.logging.log4j</groupId>
    <artifactId>log4j-core</artifactId>
    <version>2.14.1</version>  <!-- CVE-2021-44228 -->
</dependency>

<dependency>
    <groupId>com.alibaba</groupId>
    <artifactId>fastjson</artifactId>
    <version>1.2.24</version>  <!-- Multiple RCE vulnerabilities -->
</dependency>

<dependency>
    <groupId>org.springframework</groupId>
    <artifactId>spring-core</artifactId>
    <version>4.3.0.RELEASE</version>  <!-- Known security vulnerabilities -->
</dependency>
```

### Risk Pattern 2: Outdated Dependency Versions (Medium Risk)

#### Vulnerable Code Example
```xml
<!-- Medium Risk: Using outdated dependency versions -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-web</artifactId>
    <version>2.0.5.RELEASE</version>  <!-- Multiple known vulnerabilities -->
</dependency>

<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-core</artifactId>
    <version>1.4.0</version>  <!-- Security vulnerabilities exist -->
</dependency>
```

### Risk Pattern 3: Multi-Language Dependency Security Detection

#### Node.js Dependency Vulnerability Example
```json
// High Risk: Node.js known vulnerability dependencies
{
  "dependencies": {
    "lodash": "4.17.15",  // Multiple prototype pollution vulnerabilities
    "hoek": "4.0.0",      // Known security vulnerabilities
    "minimist": "0.0.8"   // Prototype pollution vulnerability
  }
}
```

#### Python Dependency Vulnerability Example
```txt
# High Risk: Python known vulnerability dependencies
Django==2.0.0              # Multiple security vulnerabilities
requests==2.18.0           # Known security vulnerabilities
urllib3==1.21.0            # Security vulnerabilities
```

#### Go Dependency Vulnerability Example
```go
// High Risk: Go known vulnerability dependencies
require (
    github.com/gin-gonic/gin v1.4.0  // Security vulnerabilities exist
    golang.org/x/text v0.3.0         // CVE-2022-32149
)
```

#### Vulnerable Code Example
```xml
<!-- Medium Risk: Insecure dependency configuration -->
<dependency>
    <groupId>com.fasterxml.jackson.core</groupId>
    <artifactId>jackson-databind</artifactId>
    <version>2.13.0</version>
    <!-- Missing security configuration: enableDefaultTyping may lead to deserialization vulnerability -->
</dependency>
```

---

## Detection Command Set

### Dependency Configuration File Detection
```bash
# 1. Detect Java project dependency configuration
find . -name "pom.xml" -o -name "build.gradle" -o -name "build.gradle.kts" | head -10

# 2. Detect Node.js project dependency configuration
find . -name "package.json" | head -10

# 3. Detect Python project dependency configuration
find . -name "requirements.txt" -o -name "pyproject.toml" -o -name "setup.py" | head -10

# 4. Detect Go project dependency configuration
find . -name "go.mod" -o -name "go.sum" | head -10
```

### Known CVE Vulnerability Detection
```bash
# 1. Detect Log4j2 vulnerable versions
grep -rn "log4j-core" --include="pom.xml" --include="build.gradle" | grep -E "2\.(0|1[0-6])\."

# 2. Detect Fastjson vulnerable versions
grep -rn "fastjson" --include="pom.xml" --include="build.gradle" | grep -E "1\.2\.([0-9]|[1-6][0-9]|7[0-9]|8[0-2])"

# 3. Detect Spring known vulnerability versions
grep -rn "spring-core" --include="pom.xml" --include="build.gradle" | grep -E "4\.([0-2]\.[0-9]|3\.[0-9]\.[0-9]*[^1][0-9]*)"

# 4. Detect Shiro known vulnerability versions
grep -rn "shiro-core" --include="pom.xml" --include="build.gradle" | grep -E "1\.([0-3]\.[0-9]|4\.[0-2])"
```

### Dependency Version Security Analysis
```bash
# 1. Extract all dependency version information
grep -E "<version>|<implementation|api" pom.xml build.gradle 2>/dev/null | head -20

# 2. Detect outdated Spring Boot versions
grep -rn "spring-boot" --include="pom.xml" --include="build.gradle" | grep -E "2\.([0-4]\.[0-9])"

# 3. Detect insecure Jackson configuration
grep -rn "enableDefaultTyping" --include="*.java" --include="*.yml" --include="*.properties"

# 4. Detect XML parser security configuration
grep -rn "disallow-doctype-decl\|external-general-entities" --include="*.java" --include="*.xml"
```

### Dependency Tree Analysis
```bash
# 1. Analyze Maven dependency tree (if Maven is available)
if command -v mvn &> /dev/null; then
    mvn dependency:tree 2>/dev/null | grep -E "(log4j|fastjson|shiro|spring)" | head -10
fi

# 2. Analyze Gradle dependencies (if Gradle is available)
if command -v gradle &> /dev/null; then
    gradle dependencies 2>/dev/null | grep -E "(log4j|fastjson|shiro|spring)" | head -10
fi
```

---

## Security Fix Solutions

### Fix 1: Upgrade Vulnerable Dependency Versions
```xml
<!-- Secure: Upgrade to safe versions -->
<dependency>
    <groupId>org.apache.logging.log4j</groupId>
    <artifactId>log4j-core</artifactId>
    <version>2.17.1</version>  <!-- Safe version -->
</dependency>

<dependency>
    <groupId>com.alibaba</groupId>
    <artifactId>fastjson</artifactId>
    <version>1.2.83</version>  <!-- Safe version -->
</dependency>
```

### Fix 2: Add Security Configuration
```java
// Secure: Jackson security configuration
ObjectMapper mapper = new ObjectMapper();
mapper.enableDefaultTyping();  // Avoid using, or use safe whitelist mode

// Use whitelist mode
mapper.activateDefaultTyping(LaissezFaireSubTypeValidator.instance,
    ObjectMapper.DefaultTyping.NON_FINAL, JsonTypeInfo.As.WRAPPER_ARRAY);
```

### Fix 3: Dependency Vulnerability Scanning Integration
```bash
# Integrate OWASP Dependency Check
mvn org.owasp:dependency-check-maven:check

# Or use snyk for detection
snyk test

# Or use trivy for detection
trivy fs .
```

---

## Risk Rating Matrix

| Risk Type | Severity | Exploit Difficulty | Detection Difficulty | Fix Priority |
|-----------|----------|-------------------|---------------------|-------------|
| Known CVE Vulnerability | High | Low | Low | Fix Immediately |
| Outdated Dependency Version | Medium | Medium | Low | Plan Fix |
| Insecure Configuration | Medium | Medium | Medium | Plan Fix |

---

## High-Risk Dependency Quick Reference

### Java High-Risk Dependencies
| Dependency | Vulnerable Versions | CVE Numbers | Risk Description |
|-----------|-------------------|-------------|-----------------|
| log4j-core | < 2.17.0 | CVE-2021-44228 | JNDI injection RCE |
| fastjson | < 1.2.83 | Multiple CVEs | Deserialization RCE |
| shiro | < 1.9.0 | CVE-2020-1957 | Permission bypass |
| spring-core | < 5.3.0 | Multiple CVEs | Multiple security vulnerabilities |
| jackson-databind | Specific versions | Multiple CVEs | Deserialization vulnerability |

### Configuration Security Key Points
1. **Disable Dangerous Features**: Avoid dangerous configurations like enableDefaultTyping
2. **Timely Updates**: Regularly update dependencies to the latest secure versions
3. **Security Scanning**: Integrate automated dependency security scanning tools

---

## Detection Priority

### High-Risk Detection Items (Execute Immediately)
- [ ] Log4j2 vulnerability version detection
- [ ] Fastjson vulnerability version detection
- [ ] Spring known vulnerability detection
- [ ] Shiro security version detection

### Medium-Risk Detection Items (Plan Execution)
- [ ] Outdated dependency version detection
- [ ] Insecure configuration detection
- [ ] Dependency tree security analysis

---

## Minimal PoC / Quick Check
```bash
# Log4j2 vulnerability version
rg -n "log4j-core" --glob "pom.xml" | rg "2\\.(0|1[0-6])\\."

# Fastjson vulnerability version
rg -n "fastjson" --glob "pom.xml" | rg "1\\.2\\.([0-9]|[1-6][0-9]|7[0-9]|8[0-2])"

# Node postinstall
rg -n "postinstall" package.json

# Python unpinned versions
rg -n "==" requirements.txt || echo "Check if unpinned versions exist"
```

---

## Real-World Case Study: RuoYi Management System Dependency Vulnerabilities

### Project Background
**Project**: RuoYi v3.1
**Tech Stack**: Spring Boot + MyBatis + Shiro + Druid
**Audit Date**: 2025-12-28

### Discovered Outdated Dependencies

```xml
<!-- pom.xml -->
<properties>
    <ruoyi.version>3.1</ruoyi.version>
    <java.version>1.8</java.version>
    <shiro.version>1.4.0</shiro.version>  <!-- 2017 version -->
    <mybatis.boot.version>1.3.2</mybatis.boot.version>
    <druid.version>1.1.10</druid.version>  <!-- 2018 version -->
</properties>

<dependencyManagement>
    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-dependencies</artifactId>
            <version>2.0.5.RELEASE</version>  <!-- October 2018 -->
            <type>pom</type>
            <scope>import</scope>
        </dependency>
    </dependencies>
</dependencyManagement>
```

### Known CVE List

| Dependency | Current Version | Known CVE | Severity | Impact |
|-----------|----------------|-----------|----------|--------|
| Spring Boot | 2.0.5 | CVE-2018-15758 | High | Session fixation attack |
| Spring Boot | 2.0.5 | CVE-2018-11040 | Medium | Cross-origin vulnerability |
| Shiro | 1.4.0 | CVE-2020-1957 | High | Authentication bypass |
| Shiro | 1.4.0 | CVE-2020-11989 | Critical | Permission bypass |
| Shiro | 1.4.0 | CVE-2020-13933 | High | Authentication bypass |
| Druid | 1.1.10 | SQL Wall bypass | Medium | SQL injection protection bypass |
| MyBatis | 1.3.2 | Performance and security issues | Low | Stability issues |

### Detection Process

```bash
# 1. Find dependency configuration files
find /path/to/project -name "pom.xml"

# 2. Extract dependency versions
grep -A 2 "<dependency>" pom.xml | grep -E "version|artifactId"

# 3. Check Spring Boot version
grep "spring-boot" pom.xml | grep "version"
# Found: 2.0.5.RELEASE (released October 2018)

# 4. Check Shiro version
grep "shiro.version" pom.xml
# Found: 1.4.0 (multiple CVEs exist)

# 5. Use Maven dependency check tool
mvn dependency-check:check
```

### Shiro Authentication Bypass Detailed Analysis

#### CVE-2020-1957 (CVSS 9.8)

```java
// Vulnerability: Path traversal in Spring Boot + Shiro combination
// Shiro 1.4.0 and below have path matching bypass

// Configuration
@Bean
public ShiroFilterFactoryBean shiroFilterFactoryBean() {
    ShiroFilterFactoryBean factoryBean = new ShiroFilterFactoryBean();
    Map<String, String> filterChainDefinitionMap = new LinkedHashMap<>();
    filterChainDefinitionMap.put("/admin/**", "authc");  // Requires authentication
    filterChainDefinitionMap.put("/**", "anon");  // Anonymous access
    return factoryBean;
}

// Attack vector
// Bypass authentication to access /admin/users
GET /admin/users;.css  // Bypasses authentication
GET /admin/users;.js   // Bypasses authentication
GET /xxx/..;/admin/users  // Bypasses authentication
```

#### CVE-2020-11989 (CVSS 9.8)

```java
// Vulnerability: Shiro permission bypass
// Using URL encoding to bypass permission checks

// Attack vector
GET /admin%2Fusers  // %2F = /
GET /admin%3Busers  // %3B = ;
```

### Fix Recommendations

```xml
<!-- Upgrade to safe versions -->
<properties>
    <spring-boot.version>2.7.18</spring-boot.version>  <!-- November 2023 -->
    <shiro.version>1.13.0</shiro.version>  <!-- August 2023 -->
    <druid.version>1.2.20</druid.version>  <!-- October 2023 -->
    <mybatis.boot.version>2.3.2</mybatis.boot.version>
</properties>

<dependencyManagement>
    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-dependencies</artifactId>
            <version>2.7.18</version>
            <type>pom</type>
            <scope>import</scope>
        </dependency>
    </dependencies>
</dependencyManagement>
```

### Automated Detection Integration

```xml
<!-- Maven dependency check plugin -->
<plugin>
    <groupId>org.owasp</groupId>
    <artifactId>dependency-check-maven</artifactId>
    <version>9.0.0</version>
    <configuration>
        <failBuildOnCVSS>7</failBuildOnCVSS>
        <suppressionFiles>
            <suppressionFile>dependency-check-suppressions.xml</suppressionFile>
        </suppressionFiles>
    </configuration>
    <executions>
        <execution>
            <goals>
                <goal>check</goal>
            </goals>
        </execution>
    </executions>
</plugin>
```

### Running Detection

```bash
# Maven dependency security check
mvn dependency-check:check

# Generate HTML report
mvn dependency-check:aggregate

# CI/CD integration
mvn clean verify -P dependency-check
```

### Fix Baseline Example
```json
// package.json: pin versions and remove postinstall
"dependencies": {
  "lodash": "4.17.21"
},
"scripts": {
  "postinstall": ""  // Remove dangerous scripts
}
```

```xml
<!-- Maven: pin secure versions -->
<dependency>
  <groupId>org.apache.logging.log4j</groupId>
  <artifactId>log4j-core</artifactId>
  <version>2.17.1</version>
</dependency>
```

### Audit Summary

1. **Severely Outdated Dependencies**: All core dependencies are from 2018 or earlier
2. **High Security Risk**: Multiple Critical and High severity CVEs exist
3. **Upgrade Recommendation**: Immediately upgrade all dependencies to the latest stable versions
4. **Automated Detection**: Integrate dependency-check into CI/CD pipeline

---

Through the detection rules and RuoYi case study in this module, security risks in third-party dependencies can be effectively identified, especially known CVE vulnerabilities and version security issues.
