https://github.com/jlleitschuh/bulk-security-pr-generator
Generate thousands of pull requests to fix widespread security vulnerabilities across GitHub.
https://github.com/jlleitschuh/bulk-security-pr-generator
Last synced: 11 months ago
JSON representation
Generate thousands of pull requests to fix widespread security vulnerabilities across GitHub.
- Host: GitHub
- URL: https://github.com/jlleitschuh/bulk-security-pr-generator
- Owner: JLLeitschuh
- License: mit
- Created: 2020-02-06T15:28:00.000Z (over 6 years ago)
- Default Branch: master
- Last Pushed: 2025-02-07T03:28:27.000Z (over 1 year ago)
- Last Synced: 2025-03-16T01:23:38.365Z (about 1 year ago)
- Language: Python
- Homepage:
- Size: 2.96 MB
- Stars: 34
- Watchers: 3
- Forks: 14
- Open Issues: 4
-
Metadata Files:
- Readme: README.md
- License: LICENSE.txt
Awesome Lists containing this project
README
# Bulk Security Pull Request Generator
Used to generate bulk pull requests (PRs) against projects to fix security vulnerabilities.
These 'bulk fixes' are done as a part of the new [GitHub Security Lab](https://securitylab.github.com/) Bug Bounty Program.
Data is sourced from queries on [lgtm.com](https://lgtm.com) and used to create bulk pull-requests to fix these security
vulnerabilities.
### Features
- Built-in crash recovery -- Saves state during execution to allow recovering from a crash
- Records metrics -- Files fixed, Number of Fixes, PR URLs
- Fast -- Asynchronous IO using python async API
### To Implement
- Commit messages follow the [SECOM](https://tqrg.github.io/sec-commits/) standard.
## Project 1: HTTPS Everywhere to Resolve Dependencies in Maven POM Files Everywhere!
[](https://medium.com/@jonathan.leitschuh/want-to-take-over-the-java-ecosystem-all-you-need-is-a-mitm-1fc329d898fb?source=friends_link&sk=3c99970c55a899ad9ef41f126efcde0e)
[Want to take over the Java ecosystem? All you need is a MITM!](https://medium.com/@jonathan.leitschuh/want-to-take-over-the-java-ecosystem-all-you-need-is-a-mitm-1fc329d898fb?source=friends_link&sk=3c99970c55a899ad9ef41f126efcde0e)
This project has been used to generate PRs that automatically fix a security vulnerability in Maven POM files that
are using HTTP instead of HTTPS to resolve dependencies.
**Pull Requests Generated: 1,596**
## Project 1.5: Prevent `rhostname` array overflow
GitHub Security Lab's [pwntester](https://github.com/pwntester) leveraged this project to generate pull requests to fix an array overflow. This is a variant of [CVE-2020-8597](https://nvd.nist.gov/vuln/detail/CVE-2020-8597).
You can read in more detail about this vulnerability in [CERT Advisory VU#782301](https://kb.cert.org/vuls/id/782301/).
The vulnerability occurs because, given that `vallen` was checked to be less than len, it can never be the case that `vallen >= len + sizeof(rhostname)`. Therefore, `rhostname` never gets trimmed and the `rhostname` array may overflow.
**Pull Requests Generated: [1,885](https://github.com/search?o=desc&q=author%3Aghsecuritylab+&s=comments&type=Issues)**
## Project 2: CVE-2019-16303 - JHipster Vulnerability Fix - Use CSPRNG in RandomUtil
In 2019, I discovered a vulnerability in the [JHipster](https://www.jhipster.tech/) code generator where it was
generating vulnerable implementations of a class called `RandomUtil.java`.
Using one password reset token from these apps combined with the POC below, an attacker can determine all future password
reset tokens to be generated by these vulnerable servers.
This would allow an attacker to pick and choose what account they would like to takeover by sending account password reset requests for targeted accounts.
[POC code](http://web.archive.org/web/20191126104359/https://medium.com/@alex91ar/the-java-soothsayer-a-practical-application-for-insecure-randomness-c67b0cd148cd) has existed since March 3rd, 2018 for taking one RNG value generated by `RandomStringUtils` and reversing it to generate all of the past/future RNG values.
The fix was generated for each vulnerable file, preserving the original style of the file, by the [Rewrite project](https://github.com/openrewrite/rewrite).
See the specific code for this fix [here](https://github.com/moderneinc/jhipster-cwe-338).
**Pull Requests Generated: 3,880**