veracode / verademo

A deliberately insecure Java web application

VeraDemo - Blab-a-Gag

ℹ️ Notice

This project is intentionally vulnerable! It contains known vulnerabilities and security errors in its code and is meant as an example project for software security scanning tools such as Veracode. Please do not report vulnerabilities in this project; the odds are they’re there on purpose :) .

About

Blab-a-Gag is a fairly simple forum type application which allows:

• Users can post a one-liner joke.
• Users can follow the jokes of other users or not (listen or ignore).
• Users can comment on other users messages (heckle).

URLs

• /feed shows the jokes/heckles that are relevant to the current user.
• /blabbers shows a list of all other users and allows the current user to listen or ignore.
• /profile allows the current user to modify their profile.
• /login allows you to log in to your account
• /register allows you to create a new user account
• /tools shows a tools page that shows a fortune or lets you ping a host.

Run

If you don't already have Docker this is a prerequisite.

docker run --rm -it -p 127.0.0.1:8080:8080 antfie/verademo

Navigate to: http://127.0.0.1:8080.

Exploitation Demos

See the /docs folder. Pipeline Scan results of this application are in /docs/scan_results/results.json.

Technologies Used

• Spring boot
• MariaDB

Development

To build the container run this:

docker pull mariadb:10.6.2
docker build --no-cache -t verademo .

To run the container for local development run this:

docker run --rm -it -p 127.0.0.1:8080:8080 --entrypoint bash -v "$(pwd)/app:/app" verademo

You will then need to manually run the two commands within /entrypoint.sh. The first starts the DB in the background whereas the second compiles and runs the application. Typically a container shouldn't have multiple services but this was done for convenience.

verademo's Issues

pom.xml miss configured and at the wrong directory in v2.1.1.zip

The file was in the app directory, should be placed in the main directory.

Also in the pom itself the maven-compiler-plugin seems miss configured, as far as I can tell.
I had to comment the plugins (line 140 -155) in order to make the project build in the pipeline.

Even refactoring it like this didn't help
```

org.springframework.boot
spring-boot-maven-plugin
${spring-boot.version}


org.apache.maven.plugins
maven-compiler-plugin

true
lines,vars,source

-g:source,lines,vars

Does not work with Veracode Greenlight

Are additional steps required to have this repository compatible with Veracode Greenlight?

I cloned the project locally and attempted to scan the "app" directory, which resulted in the following error:

"Problem Occurred. Unable to locate the server configuration. Configure the local server and deploy the application."

Version Information

• Veracode Greenlight (1.8.2.202112220533-RELEASE)
• IntelliJ IDEA (2021.3)

Rename 'master' to 'main'

In keeping with new standards, rename the master branch to main.

Clarify that VeraDemo is intentionally vulnerable

The description of this project talks about an intentionally vulnerable web app, but the README file just talks about the "Blab-A-Gag" app. Because we sometimes get actual vulnerability reports about this app, we should consider doing the following:

• Update the README file to clearly state that this is an intentionally vulnerable project
• Update the parts of the source code that comment something as /* BAD CODE / to say something like / EXAMPLE VULNERABILITY */ or something along these lines