[Package Issue]: ZAP.ZAP detected by Microsoft Defender Antivirus as PUA about winget-pkgs

[psiinon]

ZAP project lead here.
We do think this is very likely to be a false positive, but we are doing due diligence

[psiinon]

New ZAP FAQ: https://www.zaproxy.org/faq/why-does-my-antivirus-tool-flag-zap/

[vikingnope]

I've had a response from the Microsoft Security Response Center.
They have confirmed it is a False Positive and that they have rolled out a fix.
I think this issue can be closed now?

@psiinon , thank you for your cooperation and swift reply. We will be closing this ticket.🙂

@stephengillie or @ksast can you kindly close this ticket, please.

[vikingnope]

I do not think this would be an issue form Winget's end since it is only a package manager which downloasd ready made files from the internet. If you were to download the same file from the website would the same issue happen?

[ksast]

I do not think this would be an issue form Winget's end since it is only a package manager which downloasd ready made files from the internet. If you were to download the same file from the website would the same issue happen?

I agree it's not related to the winget software directly, however its related to a specific package distributed via the package manager's repository. Is there a better channel to address this concern?

To answer the question, yes the same issue happens when downloading the file from https://www.zaproxy.org/download.

[vikingnope]

I mean the file downloaded through winget is from Github itself

https://github.com/microsoft/winget-pkgs/blob/master/manifests/z/ZAP/ZAP/2.15.0/ZAP.ZAP.installer.yaml

I would recommend trying to check for system updates, maybe this was solved with some security update releases were it becomes excluded since it is a fake detection

Let me see if I can somewhere where to report this

[vikingnope]

Maybe look at this: https://www.microsoft.com/en-us/wdsi/filesubmission

[ksast]

I mean the file downloaded through winget is from Github itself

https://github.com/microsoft/winget-pkgs/blob/master/manifests/z/ZAP/ZAP/2.15.0/ZAP.ZAP.installer.yaml

I would recommend trying to check for system updates, maybe this was solved with some security update releases were it becomes excluded since it is a fake detection

Let me see if I can somewhere where to report this

I have confirmed that detection signatures are up to date and the file is also detected by a few other security vendors on virustotal: https://www.virustotal.com/gui/file/28b348dd65116ddabbbbd98b7f84864a0bb0f98d656266f2f08bfd010ae51c57

How do you conclude that this is a fake detection or false positive?

If not confirmed as a false positive, I would see this as a potential supply chain attack, where a malicious file is distributed via a public package manager's repository. So correct me if I'm wrong, but such packages should not be further distributed until the case has been properly investigated.

[vikingnope]

Files are scanned thoroughly usually before being allowed to be approved and posted on winget, but it may be that it is a malware (which I highly doubt).

See here: https://github.com/microsoft/winget-pkgs/blob/master/SECURITY.md

[vikingnope]

Also see: zaproxy/zaproxy#8488

[vikingnope]

I would recommend creating an issue on the zap proxy github and link this Issue so that we can keep track of this: https://github.com/zaproxy/zaproxy/issues

[ksast]

I would recommend creating an issue on the zap proxy github and link this Issue so that we can keep track of this: https://github.com/zaproxy/zaproxy/issues

I will, thank you.

Also see: zaproxy/zaproxy#8488

I'm not quite happy how this was handled. One guy just recommended to report it as false positive without any justification. But maybe that's just me. Thx.

[psiinon]

We are sure it is a false positive, as per zaproxy/zaproxy#8491 (comment)
But if anyone has any other evidence we can look at, or any contacts the the Microsoft Defender team then please let me know.

[vikingnope]

@psiinon, maybe you can send an email on the email found in the docs below:

https://github.com/microsoft/winget-pkgs/blob/master/SECURITY.md

[psiinon]

@vikingnope I've just done that 😁 I'll also be writing a ZAP FAQ which will explain this situation in more detail...

[mdanish-kh]

[Policy] Area-External

[psiinon]

I've had a response from the Microsoft Security Response Center.
They have confirmed it is a False Positive and that they have rolled out a fix.
I think this issue can be closed now?