The goal of this project is to support uptake of open source software by providing support to identify which of all disclosed vulnerabilities are a real concern for them and how to prioritize their vulnerability management efforts. This will be done by developing APIs, algorithms, and tools for detecting the use of vulnerable functionality in software and prioritizing what vulnerabilities to mitigate.
Vulnerabilities in third-party or open-source software is not a new problem, but as organizations, society, and even our critical infrastructure become increasingly dependent on software-based systems, handling vulnerabilities becomes more important. At the same time, the number of vulnerabilities reported by the US National Vulnerability Database (NVD) is, since 2017, in the order of 15k-18k each year, an increase from 4k-8k between 2005-2016.
To tackle these challenges, the ARVOS project will first extract vulnerable symbols by correlating Git commit history with the CVE database. Then, eBPF probes used at runtime, either in testing or in production, to measure if these symbols are actually used. This helps contextualize vulnerabilities, identify which are related to real threats, which in turn helps prioritize security patching.
The ARVOS project started by conducting user interview and is now moving into the technical validation phase. The focus is on answering the following high-level questions:
We first focus on containerized CI/CD environments, specifically the Docker container engine. In a next iteration, we will focus on containerized production environments, specifically Kubernetes using Docker as container engine.
We first focus on the Java programming language for two reasons:
In a next iteration, we will focus on Python, which cannot be easily addressed with static approaches.
Later, we will also tackle JavaScript / NodeJS, for the same reasons as Python.
ARVOS needs to be easy to install.
The exact CLI and output (e.g., human-readable, colored terminal, CSV, JSON) are left as hypothesis to be answered during the technical validation.
Requirements:
Steps :
Install arvos cli
pip install arvos
Make sure the port 8080 is not used, and run arvos
arvos --demo
In a separate terminal, run the following command to generate some workload :
while true; do curl -Ikq http://localhost:8080/sanitize; curl -Ikq http://localhost:8080/xstream; sleep 2; done
Once done, you can check the arvos logs in the console by running docker logs -f tracer
.
To scan your own Java application, you need to:
Build a jar
file for your application. Your application should be able to run in JVM 17 or 18.
Install arvos cli
pip install arvos
Run arvos against your application
arvos scan --java 17 --jar target/application.jar --pom pom.xml --trace-period 2 --save-report pdf
You can run the arvos scanner indefinitely by not specifying the --trace-period argument
Call a few endpoints of your application multiple times (either using curl .. or a browser)
You can either wait for the arvos scan to finish or stop it manually by running :
arvos --stop
and check the generated report either on the console by running docker logs -f tracer
, or as a .pdf file under your home directory.