cerberauth / vulnapi

API Security Vulnerability Scanner designed to help you secure your APIs.
https://vulnapi.cerberauth.com
MIT License
89 stars 10 forks source link

Scanning with curl and openapi doesn't work with last version #173

Closed guerricm closed 2 months ago

guerricm commented 2 months ago

Using last version of vulnapi to check VAmPI or other uri, doesn't work.

guerricmerle@MacBook-Air-de-Guerric VAmPI % docker run --rm cerberauth/vulnapi scan openapi http://host.docker.internal:5050/openapi.json 
WARNING: The requested image's platform (linux/amd64) does not match the detected host platform (linux/arm64/v8) and no specific platform was requested

| WELL-KNOWN PATHS | URL |
|------------------|-----|
| OpenAPI          | N/A |
| GraphQL          | N/A |

Congratulations! No issues were found.

| OPERATION | RISK LEVEL | CVSS 4.0 SCORE | OWASP | VULNERABILITY |
|-----------|------------|----------------|-------|---------------|

We have same problem with curl http://testphp.vulnweb.com/

guerricmerle@MacBook-Air-de-Guerric VAmPI % docker run --rm cerberauth/vulnapi scan curl http://testphp.vulnweb.com/                     
WARNING: The requested image's platform (linux/amd64) does not match the detected host platform (linux/arm64/v8) and no specific platform was requested

| WELL-KNOWN PATHS | URL |
|------------------|-----|
| OpenAPI          | N/A |
| GraphQL          | N/A |

Congratulations! No issues were found.

| OPERATION | RISK LEVEL | CVSS 4.0 SCORE | OWASP | VULNERABILITY |
|-----------|------------|----------------|-------|---------------|

But with previous version, all is good (curl and openapi)

image
TorH2k3 commented 2 months ago

Same problem for me, it yields N/A for all.

emmanuelgautier commented 2 months ago

Thanks for your report. The issue was with the new scans argument which disable scans when leave empty. Sorry about the issue.

This has been fixed in the new version released today if you want to give a try.

guerricm commented 2 months ago

@emmanuelgautier sorry for the delay. I confirm that version 0.8.0 corrects the problem. thanks for the quick resolution.