malwarebytes/ghas-cli

CLI utility to deploy at scale and interact with GitHub Advanced Security

ghas-cli

CLI utility to interact with GitHub Advanced Security ("GHAS").

It allows to deploy GHAS features individually or at scale, while taking into account each repository configuration.

More specifically, it automates the following:

• Ensure GitHub Actions are properly enabled for the repository (required for CodeQL),
• Enable Secret Scanner, and create an informative issue
• Enable Push Protection, and create an informative issue
• Enable Dependabot and create an informative issue
• Enable the Dependency Reviewer and create an informative issue
• Open a PR to deploy Code Scanning with a custom configuration tuned for each repository's languages and non-main default branch (e.g main or master are not hardcoded, it determines the proper default branch automatically),
• Cleanup legacy Mend issues on each repository

Each of these actions can also open an issue explaining each feature, how to use them, and what to eventually do before they are fully enabled. See ./templates to get an overview of these issues!

To follow your deployment, ghas-cli outputs results in a csv file indicating the deployment status of each feature for each repository.

You can work on a single repository or on thousands of them. In that case, ghas-cli does its best to overcome GitHub's rate limits...

Installation

Builds are available in the Releases tab.

• Pypi:

pip install ghas-cli

• Manually:

python -m pip install /full/path/to/ghas-cli-xxx.whl

# e.g: python3 -m pip install Downloads/ghas-cli-0.5.0-none-any.whl

Usage

ghas-cli -h or see the wiki.

Development

Build

Install Poetry first, then:

make dev

Bump the version number

• Bump the version number: poetry version x.x.x
• Update the __version__ field in src/cli.py accordingly.

Publish a new version

Requires syft to be installed to generate the sbom.

1. Bump the version number as described above
2. make deps to update the dependencies
3. make release to build the packages
4. git commit -a -S Bump to version 1.1.2 and git tag -s v1.1.2 -m "1.1.2"
5. Upload dist/*, checksums.sha512 and checksums.sha512.asc to a new release in GitHub.
6. Upload to PyPi: poetry publish.

Why not use ghas-enablement?

GitHub suggests using ghas-enablement to deploy GHAS at scale. Unfortunately, it has many limitations that make it a non viable tool as you understood if you read the beginning of this README, including:

• Only support for one default branch name: If you repositories are mixing master, main, dev, test... as the repository default branch, you will end up creating the CodeQL config to another branch than the default's.
  • ghas-cli uses the correct default branch for each repo.
• Non per-language CodeQL workflow configuration: You can only automate the PR creation for a single CodeQL workflow config file. Your repositories are likely a mix of many languages combinations, so pushing a single workflow configuration accross an organization is not efficient.
  • ghas-cli adjusts the CodeQL configuration to each repository languages.
• Doesn't check if Actions are properly enabled on your organization repositories: Running ghas-enablement when Actions are disabled will fail.
  • ghas-cli makes sure Actions are enabled before doing anything else. If they're not, it enables them.
• More broadly, ghas-cli creates more educative issues on each repositories. It also provides more flexibility with an extensive CLI to pipe in/out data.

Miscellaneous

This repository is provided as-is and isn't bound to Malwarebytes' SLA.

ghas-cli's Issues

About Security code scanning

CodeQL Pull Request Created 👋

Hey there!

As you may have seen, I've created a pull request for you.

This pull request enables GitHub Advanced Security, but most importantly, enables CodeQL on your repository.

The purpose of this issue is:

1. Give you some context as to why this pull request was created.
2. Provide you with some links to help you understand what CodeQL and GitHub Advanced Security are.

As a company, we are moving towards CodeQL for our static analysis tool. We didn't want to go and raise a pull request for every repository manually, and we didn't expect you to have to go and manually create a pull request for every single repositor either. So here is a pull request for you to review and hopefully approve!
We are rolling out CodeQL per language/user, so if you have only got a pull request for a few of your repositories, not to worry, more will come soon.

Hopefully, you should see a nice green status tick next to CodeQL within the status section of the pull request. However, if you haven't, that's understandable. We have taken the best guess approach at configuring CodeQL for you, but 1) we are still maturing, and 2) codeql can differ repository by repository.

If you have a red X next to CodeQL, that means that CodeQL is not configured for your repository. You may need to go ahead and edit the codeql-config-*.yml file to get it working with your build process/codebase. Some information on that can be found below:

1. Internal CodeQL resources
2. Compiled Languages with CodeQL
3. Configuring Code Scanning.

If you need any more assistance, please don't hesitate to contact a member of Application Security team (tag @Malwarebytes/security-appsec in this issue, or #github-appsec-security on Slack). We are here to help.

Thanks!

• Application Security Team :)

About Dependabot

Dependabot Enabled 👋

Hey there!

As you may have seen, I've enabled Dependabot and Dependency Graph for you.

The purpose of this issue is:

1. Give you some context as to why Dependabot and Dependency Graph are now enabled.
2. Provide you with some links to help you understand what Dependabot and Dependency Graph are.

As a company, we have been progressively deploying Dependabot and Dependency Graph on all of our repositories in order to provide you 1) with an easy way to stay informed when your dependencies are vulnerable and 2) A one-click semi-automated update process with contextual information.

We didn't expect you to have to go and manually turn these features on for every single repository, so this is simply a notice saying that we've done it for you.
We are rolling out Dependabot and Dependency Graph per teams, so if you have only got a informative notice for a few of your repositories, not to worry, more will come soon.

We want to make sure you are empowered to maintain the security of your repositories. Thus we count on you to properly react when a vulnerability alert is triggered, following the documentation below:

1. What to do when a dependency vulnerability alert is triggered?

If you need any more assistance, please don't hesitate to contact a member of Application Security team (tag @Malwarebytes/security-appsec in this issue, or #github-appsec-security on Slack). We are here to help.

Thanks!

• Application Security Team :)

Change the archivable? logic to use `updated_at` for the entire repository, and not for the default branch only

ghas-cli/src/cli.py

Line 435 in c7dc45f

branch_last_commit_date = repositories.get_default_branch_last_updated(

CVE-2019-11324 (High) detected in urllib3-1.22-py2.py3-none-any.whl

CVE-2019-11324 - High Severity Vulnerability

Vulnerable Library - urllib3-1.22-py2.py3-none-any.whl

HTTP library with thread-safe connection pooling, file post, and more.

Library home page: https://files.pythonhosted.org/packages/63/cb/6965947c13a94236f6d4b8223e21beb4d576dc72e8130bd7880f600839b8/urllib3-1.22-py2.py3-none-any.whl

Dependency Hierarchy:

• requests-2.27.1-py2.py3-none-any.whl (Root Library)
  • ❌ urllib3-1.22-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 0a629133d0d823623458d59e1589980cde6422fd

Found in base branch: main

Vulnerability Details

The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument.

Publish Date: 2019-04-18

URL: CVE-2019-11324

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11324

Release Date: 2019-04-18

Fix Resolution: 1.24.2

CVE-2019-11236 (Medium) detected in urllib3-1.22-py2.py3-none-any.whl

CVE-2019-11236 - Medium Severity Vulnerability

Vulnerable Library - urllib3-1.22-py2.py3-none-any.whl

HTTP library with thread-safe connection pooling, file post, and more.

Library home page: https://files.pythonhosted.org/packages/63/cb/6965947c13a94236f6d4b8223e21beb4d576dc72e8130bd7880f600839b8/urllib3-1.22-py2.py3-none-any.whl

Dependency Hierarchy:

• requests-2.27.1-py2.py3-none-any.whl (Root Library)
  • ❌ urllib3-1.22-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 0a629133d0d823623458d59e1589980cde6422fd

Found in base branch: main

Vulnerability Details

In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.

Publish Date: 2019-04-15

URL: CVE-2019-11236

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-r64q-w8jr-g9qp

Release Date: 2019-04-15

Fix Resolution: urllib3 - 1.24.3

Export list of dependencies for an entire organization

Is your feature request related to a problem? Please describe.
It is a bit cumbersome to export all dependencies in a csv format for all repositories of an organization. Currently, GitHub doesn't allow to export dependencies from https://github.com/orgs/ORG/insights/dependencies . GitHub support team asks to export the list of repositories, and then export all dependencies for each repository from that list. It takes a lot of time to format it properly.

Describe the solution you'd like

Ideally, ghas-cli would have a single command to export dependencies for an organization that would hide the internal complexities:

1. Export the list of repositories,
2. For each repository, export the list of dependencies (sbom?),
3. Format the list as a CSV, with the following fields:

TODO

Describe alternatives you've considered
Do each step manually.

Additional context
This feature can be requested for compliance reasons by legal teams, and currently there is no way to easily and quickly export an up-to-date list of dependencies for a whole organization in GitHub.

Export secrets by type

Is your feature request related to a problem? Please describe.
It's only possible to export all open or resolved secrets, but it's not possible to export only certain secret types.

Describe the solution you'd like
The ability to export a specific secret type only.

Describe alternatives you've considered
Export the entire list of secrets, and then filter in the csv directly.

Additional context
/

CVE-2022-23491 (Medium) detected in certifi-2022.9.24-py3-none-any.whl - autoclosed

CVE-2022-23491 - Medium Severity Vulnerability

Vulnerable Library - certifi-2022.9.24-py3-none-any.whl

Python package for providing Mozilla's CA Bundle.

Library home page: https://files.pythonhosted.org/packages/1d/38/fa96a426e0c0e68aabc68e896584b83ad1eec779265a028e156ce509630e/certifi-2022.9.24-py3-none-any.whl

Dependency Hierarchy:

• requests-2.28.1-py3-none-any.whl (Root Library)
  • ❌ certifi-2022.9.24-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion.

Publish Date: 2022-12-07

URL: CVE-2022-23491

CVSS 3 Score Details (6.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-23491

Release Date: 2022-12-07

Fix Resolution: certifi - 2022.12.07

CVE-2021-33503 (High) detected in urllib3-1.22-py2.py3-none-any.whl

CVE-2021-33503 - High Severity Vulnerability

Vulnerable Library - urllib3-1.22-py2.py3-none-any.whl

HTTP library with thread-safe connection pooling, file post, and more.

Library home page: https://files.pythonhosted.org/packages/63/cb/6965947c13a94236f6d4b8223e21beb4d576dc72e8130bd7880f600839b8/urllib3-1.22-py2.py3-none-any.whl

Dependency Hierarchy:

• requests-2.27.1-py2.py3-none-any.whl (Root Library)
  • ❌ urllib3-1.22-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 0a629133d0d823623458d59e1589980cde6422fd

Found in base branch: main

Vulnerability Details

An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.

Publish Date: 2021-06-29

URL: CVE-2021-33503

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-q2q7-5pp4-w6pg

Release Date: 2021-06-29

Fix Resolution: urllib3 - 1.26.5

Move API calls to the new calendar-based approach

Describe the solution you'd like
Port the REST-API calls to the new calendar approach: https://github.blog/changelog/2022-11-28-calendar-based-versioning-for-the-rest-api/

Additional context

https://docs.github.com/en/rest/overview/api-versions?apiVersion=2022-11-28

CVE-2018-20060 (High) detected in urllib3-1.22-py2.py3-none-any.whl

CVE-2018-20060 - High Severity Vulnerability

Vulnerable Library - urllib3-1.22-py2.py3-none-any.whl

HTTP library with thread-safe connection pooling, file post, and more.

Library home page: https://files.pythonhosted.org/packages/63/cb/6965947c13a94236f6d4b8223e21beb4d576dc72e8130bd7880f600839b8/urllib3-1.22-py2.py3-none-any.whl

Dependency Hierarchy:

• requests-2.27.1-py2.py3-none-any.whl (Root Library)
  • ❌ urllib3-1.22-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 0a629133d0d823623458d59e1589980cde6422fd

Found in base branch: main

Vulnerability Details

urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.

Publish Date: 2018-12-11

URL: CVE-2018-20060

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20060

Release Date: 2018-12-11

Fix Resolution: 1.23

CVE-2020-26137 (Medium) detected in urllib3-1.22-py2.py3-none-any.whl

CVE-2020-26137 - Medium Severity Vulnerability

Vulnerable Library - urllib3-1.22-py2.py3-none-any.whl

HTTP library with thread-safe connection pooling, file post, and more.

Library home page: https://files.pythonhosted.org/packages/63/cb/6965947c13a94236f6d4b8223e21beb4d576dc72e8130bd7880f600839b8/urllib3-1.22-py2.py3-none-any.whl

Dependency Hierarchy:

• requests-2.27.1-py2.py3-none-any.whl (Root Library)
  • ❌ urllib3-1.22-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 0a629133d0d823623458d59e1589980cde6422fd

Found in base branch: main

Vulnerability Details

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.

Publish Date: 2020-09-30

URL: CVE-2020-26137

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26137

Release Date: 2020-09-30

Fix Resolution: 1.25.9

CVE-2019-9740 (Medium) detected in urllib3-1.22-py2.py3-none-any.whl

CVE-2019-9740 - Medium Severity Vulnerability

Vulnerable Library - urllib3-1.22-py2.py3-none-any.whl

HTTP library with thread-safe connection pooling, file post, and more.

Library home page: https://files.pythonhosted.org/packages/63/cb/6965947c13a94236f6d4b8223e21beb4d576dc72e8130bd7880f600839b8/urllib3-1.22-py2.py3-none-any.whl

Dependency Hierarchy:

• requests-2.27.1-py2.py3-none-any.whl (Root Library)
  • ❌ urllib3-1.22-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 0a629133d0d823623458d59e1589980cde6422fd

Found in base branch: main

Vulnerability Details

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

Publish Date: 2019-03-13

URL: CVE-2019-9740

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9740

Release Date: 2019-03-13

Fix Resolution: v2.7.17,v3.5.8,v3.6.9,3.7.4,3.7.5