### Blogpost There is a plethora of JavaScript libraries for use on the web and in node.js apps out there. They greatly simplify the development process, but also require us to stay updated on new library versions and security fixes. "Using Components with Known Vulnerabilities" is now a part of the [OWASP Top 10](https://www.owasp.org/index.php/Top_10_2013-A9-Using_Components_with_Known_Vulnerabilities) and insecure libraries can pose a huge risk for your webapp. The goal of Retire.js is to help you detect use of libraries with known vulnerabilities. Retire.js has three parts: 1. [A command line scanner](https://github.com/RetireJS/retire.js/tree/master/node) 2. [A Chrome extension](https://github.com/RetireJS/retire.js/tree/master/chrome) 3. [A grunt plugin](https://github.com/bekk/grunt-retire) Command line scanner -------------------- Scan a web app or node app for use of vulnerable JavaScript libraries and/or node modules. ``` Usage: retire [options] Options: -h, --help output usage information -V, --version output the version number -p, --package limit node scan to packages where parent is mentioned in package.json (ignore node_modules) -n, --node Run node dependency scan only -j, --js Run scan of JavaScript files only -v, --verbose Show identified files (by default only vulnerable files are shown) --jspath Folder to scan for javascript files --nodepath Folder to scan for node files --path Folder to scan for both --jsrepo Local version of repo --noderepo Local version of repo ``` Chrome extension ------------- Scans visited sites for references to insecure libraries, and puts warnings in the developer console. An icon on the address bar displays will also indicated if vulnerable libraries were loaded. This extension is not meant to be enabled all the time, but rather something you enable when you want to assess your site. Grunt plugin ------------- Scans the given grunt enabled project for JavaScript files with known vulnerabilities, and breaks if it finds any. See examples on the [repo page](https://github.com/bekk/grunt-retire). The source ---------------- The source of vulnerabilities is a manually maintained [JSON file](https://github.com/RetireJS/retire.js/tree/master/repository) in the GitHub repository. It was created by looking through release notes and issue trackers for the most common frameworks. If you see a framework or vulnerability missing, feel free to create a pull request (or register as an issue). Detection --------------- To detect a given version of a given component, Retire.js uses filename or URL. If that fails, it will download/open the file and look for specific comments within the file. If that also fails, there is the possibility to use hashes for minified files. And if that fails as well, the Chrome plugin will run code in a sandbox to try to detect the component and version. This last detection mechanisms is not available in the command line scanner, as running arbitrary JavaScript-files in the node-process could have unwanted consequences. If anybody knows of a good way to sandbox the code on node, feel free to register an issue or contribute. It's important to note that even though your site is using a vulnerable library, that does not necessarily mean your site is vulnerable. It depends on whether and how your site exercises the vulnerable code. That said, it's better to be safe than sorry. Want to help out? --------------------- We need help in both improving the scanner and plugin, and keeping the repository of known vulnerabilities up to date. You can contribute at [https://github.com/RetireJS/retire.js](https://github.com/RetireJS/retire.js) --- ### README # Retire.js **What you require you must also retire** There is a vast ecosystem of JavaScript libraries available for both web and Node.js applications. While these libraries significantly accelerate development, they also require ongoing maintenance to ensure security vulnerabilities are addressed promptly. In 2013, “Using Components with Known Vulnerabilities” was added to the OWASP Top 10 list of critical security risks, highlighting the serious threat that outdated or insecure dependencies can pose to web applications. Retire.js was created to help developers identify JavaScript library versions with known vulnerabilities, especially those that are not in package manifests, but simply downloaded and put in source control. Retire.js can be used in many ways: 1. [As command line scanner](https://github.com/RetireJS/retire.js/tree/master/node) 2. [As a Chrome extension](https://github.com/RetireJS/retire.js/tree/master/chrome) - **Not** officially available in the Chrome web store 3. [As a Burp Extension](https://github.com/h3xstream/burp-retire-js) or [OWASP ZAP Add-on](https://www.zaproxy.org/docs/desktop/addons/retire.js/) 4. [As a Firefox extension](https://github.com/RetireJS/retire.js/tree/master/firefox) - **Deprecated** Let us know if you want to maintain and undeprecate it. 5. [A headless web site scanner](https://github.com/RetireJS/retire-site-scanner) 6. [As a grunt plugin (deprecated)](https://github.com/bekk/grunt-retire) 7. [As a gulp task (deprecated)](#user-content-gulp-task) ## Command line scanner Scan a web app or node app for use of vulnerable JavaScript libraries and/or Node.JS modules. If you haven't already, you need to [install node/npm](https://docs.npmjs.com/downloading-and-installing-node-js-and-npm) first. In the source code folder of the application folder run: ``` $ npm install retire $ retire ``` ## SBOM generation retire.js can generate SBOMs in the CycloneDX-format: ``` $ retire --outputformat cyclonedx ``` By default retire.js will exit with code 13 if it finds vulnerabilities. This can be overridden with `--exitwith 0`. ## Chrome and firefox extensions Scans visited sites for references to insecure libraries, and puts warnings in the developer console. An icon on the address bar displays will also indicate if vulnerable libraries were loaded. ## Burp Extension and OWASP ZAP Add-on [@h3xstream](https://github.com/h3xstream) has adapted Retire.js as a [plugin](https://github.com/h3xstream/burp-retire-js) for the penetration testing tools [Burp](https://portswigger.net/burp/) and [OWASP ZAP](https://www.zaproxy.org). The [OWASP ZAP](https://www.zaproxy.org) team officially supports a Retire.js add-on which is available via the ZAP Marketplace and is included by default in the ZAP weekly releases: https://www.zaproxy.org/docs/desktop/addons/retire.js/ ## Headless site scanner The retire-site-scanner https://github.com/RetireJS/retire-site-scanner can be used to scan a web site in headless mode (as opposed to using the chrome/firefox extensions) ## Grunt plugin (deprecated) A [Grunt task for running Retire.js](https://github.com/bekk/grunt-retire) as part of your application's build routine, or some other automated workflow. ## Gulp task (deprecated) An example of a Gulp task which can be used in your gulpfile to watch and scan your project files automatically. You can modify the watch patterns and (optional) Retire.js options as you like. ```javascript const c = require("ansi-colors"); var gulp = require("gulp"); var beeper = require("beeper"); var log = require("fancy-log"); var spawn = require("child_process").spawn; gulp.task("retire:watch", ["retire"], function (done) { // Watch all javascript files and package.json gulp.watch(["js/**/*.js", "package.json"], ["retire"]); }); gulp.task("retire", function () { // Spawn Retire.js as a child process // You can optionally add option parameters to the second argument (array) var child = spawn("retire", [], { cwd: process.cwd() }); child.stdout.setEncoding("utf8"); child.stdout.on("data", function (data) { log(data); }); child.stderr.setEncoding("utf8"); child.stderr.on("data", function (data) { log(c.red(data)); beeper(); }); }); ``` ## Donate Donations will be used to fund the maintainance of the tool and vulnerability repo. ---