Blogpost
There is a plethora of JavaScript libraries for use on the web and in node.js apps out there. They greatly simplify the development process, but also require us to stay updated on new library versions and security fixes. "Using Components with Known Vulnerabilities" is now a part of the
OWASP Top 10 and insecure libraries can pose a huge risk for your webapp. The goal of Retire.js is to help you detect use of libraries with
known vulnerabilities.
Retire.js has three parts:
1. A command line scanner
2. A Chrome extension
3. A grunt plugin
Command line scanner
--------------------
Scan a web app or node app for use of vulnerable JavaScript libraries and/or node modules.
Usage: retire [options]Options:
-h, --help output usage information
-V, --version output the version number
-p, --package limit node scan to packages where parent is mentioned in package.json (ignore node_modules)
-n, --node Run node dependency scan only
-j, --js Run scan of JavaScript files only
-v, --verbose Show identified files (by default only vulnerable files are shown)
--jspath <path> Folder to scan for javascript files
--nodepath <path> Folder to scan for node files
--path <path> Folder to scan for both
--jsrepo <path> Local version of repo
--noderepo <path> Local version of repo
Chrome extension
-------------
Scans visited sites for references to insecure libraries, and puts warnings in the developer console. An icon on the address bar displays will also indicated if vulnerable libraries were loaded. This extension is not meant to be enabled all the time, but rather something you enable when you want to assess your site.
Grunt plugin
-------------
Scans the given grunt enabled project for JavaScript files with known vulnerabilities, and breaks if it finds any. See examples on the repo page.
The source
----------------
The source of vulnerabilities is a manually maintained JSON file in the GitHub repository. It was created by looking through release notes and issue trackers for the most common frameworks. If you see a framework or vulnerability missing, feel free to create a pull request (or register as an issue).
Detection
---------------
To detect a given version of a given component, Retire.js uses filename or URL. If that fails, it will download/open the file and look for specific comments within the file. If that also fails, there is the possibility to use hashes for minified files. And if that fails as well, the Chrome plugin will run code in a sandbox to try to detect the component and version. This last detection mechanisms is not available in the command line scanner, as running arbitrary JavaScript-files in the node-process could have unwanted consequences. If anybody knows of a good way to sandbox the code on node, feel free to register an issue or contribute.
It's important to note that even though your site is using a vulnerable library, that does not necessarily mean your site is vulnerable. It depends on whether and how your site exercises the vulnerable code. That said, it's better to be safe than sorry.
Want to help out?
---------------------
We need help in both improving the scanner and plugin, and keeping the repository of known vulnerabilities up to date. You can contribute at https://github.com/RetireJS/retire.js
---
README
Retire.js
What you require you must also retire
There is a vast ecosystem of JavaScript libraries available for both web and Node.js applications. While these libraries significantly accelerate development, they also require ongoing maintenance to ensure security vulnerabilities are addressed promptly. In 2013, βUsing Components with Known Vulnerabilitiesβ was added to the OWASP Top 10οΏΌ list of critical security risks, highlighting the serious threat that outdated or insecure dependencies can pose to web applications. Retire.js was created to help developers identify JavaScript library versions with known vulnerabilities, especially those that are not in package manifests, but simply downloaded and put in source control.
Retire.js can be used in many ways:
1. As command line scanner
2. As a Chrome extension - Not officially available in the Chrome web store
3. As a Burp Extension or OWASP ZAP Add-on
4. As a Firefox extension - Deprecated Let us know if you want to maintain and undeprecate it.
5. A headless web site scanner
6. As a grunt plugin (deprecated)
7. As a gulp task (deprecated)
Command line scanner
Scan a web app or node app for use of vulnerable JavaScript libraries and/or Node.JS modules. If you haven't already, you need to install node/npm first. In the source code folder of the application folder run:
$ npm install retire
$ retireSBOM generation
retire.js can generate SBOMs in the CycloneDX-format:
$ retire --outputformat cyclonedxBy default retire.js will exit with code 13 if it finds vulnerabilities. This can be overridden with --exitwith 0.
Chrome and firefox extensions
Scans visited sites for references to insecure libraries, and puts warnings in the developer console. An icon on the address bar displays will also indicate if vulnerable libraries were loaded.
Burp Extension and OWASP ZAP Add-on
@h3xstream has adapted Retire.js as a plugin for the penetration testing tools Burp and OWASP ZAP.
The OWASP ZAP team officially supports a Retire.js add-on which is available via the ZAP Marketplace and is included by default in the ZAP weekly releases: https://www.zaproxy.org/docs/desktop/addons/retire.js/
Headless site scanner
The retire-site-scanner https://github.com/RetireJS/retire-site-scanner can be used to scan a web site in headless mode (as opposed to using the chrome/firefox extensions)
Grunt plugin (deprecated)
A Grunt task for running Retire.js as part of your application's build routine, or some other automated workflow.
Gulp task (deprecated)
An example of a Gulp task which can be used in your gulpfile to watch and scan your project files automatically. You can modify the watch patterns and (optional) Retire.js options as you like.
const c = require("ansi-colors");var gulp = require("gulp");
var beeper = require("beeper");
var log = require("fancy-log");
var spawn = require("child_process").spawn;
gulp.task("retire:watch", ["retire"], function (done) {
// Watch all javascript files and package.json
gulp.watch(["js//*.js", "package.json"], ["retire"]);
});
gulp.task("retire", function () {
// Spawn Retire.js as a child process
// You can optionally add option parameters to the second argument (array)
var child = spawn("retire", [], { cwd: process.cwd() });
child.stdout.setEncoding("utf8");
child.stdout.on("data", function (data) {
log(data);
});
child.stderr.setEncoding("utf8");
child.stderr.on("data", function (data) {
log(c.red(data));
beeper();
});
});
Donate
<a href="https://www.paypal.me/eoftedal"><img src="https://www.paypalobjects.com/en_US/i/btn/btn_donate_SM.gif"></a>
Donations will be used to fund the maintainance of the tool and vulnerability repo.
---