Vulnerability notification for live applications
Methods, systems, and computer-readable media for monitoring states of application packages deployed on a cloud-based application deployment platform. A notification service retrieves a copy of a deployed application package from the cloud-based deployment platform, and determines libraries of the application package. The notification service can then determine security vulnerabilities in the libraries, and provide notifications on the vulnerabilities of the application package to a user or developer.
1. A method, comprising:
receiving, by a report server from a user device, a command-line request to identify applications running on a cloud application platform that are installed with application packages having one or more vulnerabilities;
in response to receiving the command-line request to identify applications running on the cloud application platform that are installed with application packages having one or more vulnerabilities, querying, by the report server, a plurality of nodes of the cloud application platform that are running instances of the application specified by the request;
generating, by each of one or more nodes in the cloud application platform that is hosting an instance of the application specified by the request, application metadata for a respective application executing on the node;
providing, by each of the one or more nodes in the cloud application platform, the generated metadata to the report server;
receiving, by the report server from a distributed computing platform, a copy of an application package deployed on a distributed computing platform, the application package including an application that is dependent on one or more libraries;
extracting library identifiers from the application package, each library identifier corresponding to a respective library that the application is dependent on;
determining, based on the library identifiers and from a library index database, a respective library version of each library;
determining for each library, based on each library identifier, the corresponding library version, and from a software vulnerability database, any vulnerabilities for the library, each vulnerability being represented by a respective vulnerability identifier and a respective vulnerability severity score, each vulnerability severity score indicating a likelihood that a respective library will cause a security breach of the distributed computing platform; and
providing a notification to the user device indicating that the application package is vulnerable to one or more security breaches upon determining that a vulnerability severity score of at least one of the libraries satisfies a vulnerability threshold,
wherein the method is performed by a plurality of computers.
2. The method of claim 1 , wherein extracting the library identifiers is triggered by at least one of:
a scheduled inspection time having been satisfied;
a signature of the application package having changed value; or
the software vulnerability database having been updated.
3. The method of claim 1 , wherein extracting the library identifiers comprises performing a multipass scan of the application package and environment in which the application package is stored, wherein performing the multipass scan comprises:
in a first pass, extracting text strings from at least one of: an environment variable of an operating system of the application, metainformation of an operating system of the application package, a directory structure storing the application, or an inclusion path of the application;
in a second pass, determining a respect signature for each library of the application package; and
designating the text strings and the signatures as the library identifiers.
4. The method of claim 3 , wherein determining the respective library version of each of the libraries comprises:
querying a library index database using the respective signatures; and
obtaining each respective library version according to a match between the respective signature in the library identifiers and a signature associated with the library version in the library index database.
5. The method of claim 1 , wherein determining the respective vulnerability severity score comprises:
querying the software vulnerability database using the each library identifier and the corresponding library version; and
obtaining a list of vulnerability identifiers and the respective vulnerability severity scores from the software vulnerability database.
6. The method of claim 1 , comprising determining that the vulnerability satisfies the vulnerability threshold due to obsolescence of the corresponding library or a newly-discovered form of attack.
7. The method of claim 1 , wherein the vulnerability is represented by a Common Vulnerability and Exposure (CVE) identifier, the vulnerability severity score is a Common Vulnerability Scoring System (CVSS) score, and the software vulnerability database is a National Vulnerability Database (NVD).
8. The method of claim 7 , wherein providing the notification to the user device indicating that the application package is vulnerable comprises:
generating a tabulated report that includes the CVE identifier, the vulnerability severity score, a representation of a Common Weakness Enumeration (CWE) value, a name of the library, the library version corresponding to the library, and a reference to additional information explaining the vulnerability; and
providing the tabulated report to a device in response to a command-line input from the device requesting vulnerability analysis on the application.
9. A system comprising:
one or more computers and one or more storage devices on which are stored instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising:
receiving, by a report server from a user device, a command-line request to identify applications running on a cloud application platform that are installed with application packages having one or more vulnerabilities;
in response to receiving the command-line request to identify applications running on the cloud application platform that are installed with application packages having one or more vulnerabilities, querying, by the report server, a plurality of nodes of the cloud application platform that are running instances of the application specified by the request;
generating, by each of one or more nodes in the cloud application platform that is hosting an instance of the application specified by the request, application metadata for a respective application executing on the node;
providing, by each of the one or more nodes in the cloud application platform, the generated metadata to the report server;
receiving, by the report server from a distributed computing platform, a copy of an application package deployed on a distributed computing platform, the application package including an application that is dependent on one or more libraries;
extracting library identifiers from the application package, each library identifier corresponding to a respective library that the application is dependent on;
determining, based on the library identifiers and from a library index database, a respective library version of each library;
determining for each library, based on each library identifier, the corresponding library version, and from a software vulnerability database, any vulnerabilities for the library, each vulnerability being represented by a respective vulnerability identifier and a respective vulnerability severity score, each vulnerability severity score indicating a likelihood that a respective library will cause a security breach of the distributed computing platform; and
providing a notification to the user device indicating that the application package is vulnerable to one or more security breaches upon determining that a vulnerability severity score of at least one of the libraries satisfies a vulnerability threshold.
10. The system of claim 9 , wherein extracting the library identifiers is triggered by at least one of:
a scheduled inspection time having been satisfied;
a signature of the application package having changed value; or
the software vulnerability database having been updated.
11. The system of claim 9 , wherein extracting the library identifiers comprises performing a multipass scan of the application package and environment in which the application package is stored, wherein performing the multipass scan comprises:
in a first pass, extracting text strings from at least one of: an environment variable of an operating system of the application, metainformation of an operating system of the application package, a directory structure storing the application, or an inclusion path of the application;
in a second pass, determining a respect signature for each library of the application package; and
designating the text strings and the signatures as the library identifiers.
12. The system of claim 11 , wherein determining the respective library version of each of the libraries comprises:
querying a library index database using the respective signatures; and
obtaining each respective library version according to a match between the respective signature in the library identifiers and a signature associated with the library version in the library index database.
13. The system of claim 9 , wherein determining the respective vulnerability severity score comprises:
querying the software vulnerability database using the each library identifier and the corresponding library version; and
obtaining a list of vulnerability identifiers and the respective vulnerability severity scores from the software vulnerability database.
14. The system of claim 9 , the operations comprising determining that the vulnerability satisfies the vulnerability threshold due to obsolescence of the corresponding library or a newly-discovered form of attack.
15. The system of claim 9 , wherein the vulnerability is represented by a Common Vulnerability and Exposure (CVE) identifier, the vulnerability severity score is a Common Vulnerability Scoring System (CVSS) score, and the software vulnerability database is a National Vulnerability Database (NVD).
16. The system of claim 15 , wherein providing the notification to the user device indicating that the application package is vulnerable comprises:
generating a tabulated report that includes the CVE identifier, the vulnerability severity score, a representation of a Common Weakness Enumeration (CWE) value, a name of the library, the library version corresponding to the library, and a reference to additional information explaining the vulnerability; and
providing the tabulated report to a device in response to a command-line input from the device requesting vulnerability analysis on the application.
17. One or more non-transitory computer storage media storing instructions that are operable, when executed by one or more computers, to cause the one or more computers to perform operations comprising:
receiving, by a report server from a user device, a command-line request to identify applications running on a cloud application platform that are installed with application packages having one or more vulnerabilities;
in response to receiving the command-line request to identify applications running on the cloud application platform that are installed with application packages having one or more vulnerabilities, querying, by the report server, a plurality of nodes of the cloud application platform that are running instances of the application specified by the request;
generating, by each of one or more nodes in the cloud application platform that is hosting an instance of the application specified by the request, application metadata for a respective application executing on the node;
providing, by each of the one or more nodes in the cloud application platform, the generated metadata to the report server;
receiving, by the report server from a distributed computing platform, a copy of an application package deployed on a distributed computing platform, the application package including an application that is dependent on one or more libraries;
extracting library identifiers from the application package, each library identifier corresponding to a respective library that the application is dependent on;
determining, based on the library identifiers and from a library index database, a respective library version of each library;
determining for each library, based on each library identifier, the corresponding library version, and from a software vulnerability database, any vulnerabilities for the library, each vulnerability being represented by a respective vulnerability identifier and a respective vulnerability severity score, each vulnerability severity score indicating a likelihood that a respective library will cause a security breach of the distributed computing platform; and
providing a notification to the user device indicating that the application package is vulnerable to one or more security breaches upon determining that a vulnerability severity score of at least one of the libraries satisfies a vulnerability threshold.
18. The one or more computer storage media of claim 17 , wherein extracting the library identifiers is triggered by at least one of:
a scheduled inspection time having been satisfied;
a signature of the application package having changed value; or
the software vulnerability database having been updated.
19. The one or more computer storage media of claim 17 , wherein extracting the library identifiers comprises performing a multipass scan of the application package and environment in which the application package is stored, wherein performing the multipass scan comprises:
in a first pass, extracting text strings from at least one of: an environment variable of an operating system of the application, metainformation of an operating system of the application package, a directory structure storing the application, or an inclusion path of the application;
in a second pass, determining a respect signature for each library of the application package; and
designating the text strings and the signatures as the library identifiers.
20. The one or more computer storage media of claim 19 , wherein determining the respective library version of each of the libraries comprises:
querying a library index database using the respective signatures; and
obtaining each respective library version according to a match between the respective signature in the library identifiers and a signature associated with the library version in the library index database.