cveUser and cvePass for dependency-check.sh CLI

[rjpearce]

Hello,

I'm working on a mirror of NVD database in a JFrog/Artifactory artifactory repo which requires authorisation.

I have set the --cveUrlBase and --cveUrlModified correctly but there seems to be no way to set the username and password when using the CLI client.

In the Maven dependency check there is and setting.
Is there any way of setting these for the CLI client?

Thank you and Merry Christmas.

[jeremylong]

Sorry about the missing arguments. You can create a properties file with:

cve.user=user
cve.password=pass

Then include the properties using the --propertyfile custom.properties in the CLI.

[jeremylong]

While the CLI argument is being added in the next release - I would recommend continuing to use the properties file to avoid storing credentials in the history...

[rjpearce]

Awesome thank you @jeremylong do you have a link I can use to buy you a coffee/beer?

[jeremylong]

@rjpearce only thing I have setup is GH sponsors: https://github.com/sponsors/jeremylong

[rjpearce]

Thanks. @jeremylong I haven't been able to get it working using the properties file.
When I run the dependency check it gets a 401 response (un-authorised).

I can see from the log output that cve.username and cve.password is being correctly picked up:

cve.password='********'
cve.user='foo'

However it looks like when the request is made to the server no basic auth is added to request.
I setup a simple Python http server and I get the following output when running dependency-check.sh

User-Agent: Java/14.0.1
Host: 192.168.1.38:8000
Accept: text/html, image/gif, image/jpeg, *; q=.2, /; q=.2
Connection: keep-alive

if I use curl the basic auth is present:
curl -u user:pw http://192.168.1.38:8000/artifactory/third-party/nist-nvd-mirror/nvdcve-1.1-modified.meta

Authorization: Basic dXNlcjpwdw==
User-Agent: curl/7.64.1
Accept: /

I have tried to follow the NvdCve updates through the code by I'm getting rather lost and confused.
Do you know where the logic exists to check for the cve.username and cve.password and call addBasicAuthentication in the UrlConnectionFactory before making the request?

Let me know if there is more debugging I can do additional things to try.

[jeremylong]

The CVE creds are used in two places:

DependencyCheck/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/DownloadTask.java

Line 128 in 41ae5d5

downloader.fetchFile(url1, file, Settings.KEYS.CVE_USER, Settings.KEYS.CVE_PASSWORD);

DependencyCheck/core/src/main/java/org/owasp/dependencycheck/data/update/NvdCveUpdater.java

Line 340 in 52c689c

final String content = d.fetchContent(u, true, Settings.KEYS.CVE_USER, Settings.KEYS.CVE_PASSWORD);

From there you can trace into the Downloader and eventually end up at:

DependencyCheck/utils/src/main/java/org/owasp/dependencycheck/utils/HttpResourceConnection.java

Lines 202 to 204 in 52c689c

	if (userKey != null && passwordKey != null) {
	connFactory.addBasicAuthentication(conn, userKey, passwordKey);
	}

Which then calls:

DependencyCheck/utils/src/main/java/org/owasp/dependencycheck/utils/URLConnectionFactory.java

Lines 161 to 173 in 52c689c

	public void addBasicAuthentication(HttpURLConnection conn, String userKey, String passwordKey) {
	if (StringUtils.isNotEmpty(settings.getString(userKey))
	&& StringUtils.isNotEmpty(settings.getString(passwordKey))) {
	final String user = settings.getString(userKey);
	final String password = settings.getString(passwordKey);
	final String userColonPassword = user + ":" + password;
	final String basicAuth = "Basic " + Base64.getEncoder().encodeToString(userColonPassword.getBytes(UTF_8));
	if (LOGGER.isDebugEnabled()) {
	LOGGER.debug("Adding user/pw from settings.xml as basic authorization");
	}
	conn.addRequestProperty("Authorization", basicAuth);
	}
	}

[jeremylong]

@rjpearce with the recent release - are you still having issues with the basic auth?

[rjpearce]

Hi Jeremy,

Thank you, Sorry for the slow response.
I have run a quick re-test with 6.0.5 using the new command line args for cveUser/cvePass and everything is working as expected.

We ended up not using Artifactory for our solution. We switched to a very simple solution by building a Docker container based on owasp/dependency-check that has runs dependency-check with --updateonly.

This leverages depedency-checks existing ability to cache NVD data to build a daily docker image. We then tag the docker image and consume it in other CI/CD jobs.

Below is the code I used to ascertain auth sanity:

Source info: https://hub.docker.com/r/owasp/dependency-check

docker pull owasp/dependency-check:$DC_VERSION
docker run --rm \
    -e user=$USER \
    -u $(id -u ${USER}):$(id -g ${USER}) \
    --volume $(pwd):/src:z \
    --volume "$DATA_DIRECTORY":/usr/share/dependency-check/data:z \
    --volume $(pwd)/odc-reports:/report:z \
    owasp/dependency-check:$DC_VERSION \
    --scan /src \
    --format "ALL" \
    --project "$DC_PROJECT" \
    --cveUser 'foo' \
    --cvePassword 'secret' \
    --cveUrlBase http://host.docker.internal:8000/nvdcve-1.1-%d.json.gz \
    --cveUrlModified http://host.docker.internal:8000/nvdcve-1.1-modified.json.gz \
    --out /report

A simple web server

import http.server
import socketserver
import base64

class GetHandler(http.server.SimpleHTTPRequestHandler):
    def do_GET(self):
        expected_auth = b'Basic ' + base64.b64encode('{}:{}'.format('foo', 'secret').encode('ascii'))
        actual_auth = self.headers.get('Authorization', '').encode('ascii')
        if expected_auth == actual_auth:
          print('Credentials valid')
        else:
          print('Credentials invalid')
        print('Headers -------')
        print(self.headers)
        print('--------')
        http.server.SimpleHTTPRequestHandler.do_GET(self)

PORT = 8000
Handler = GetHandler

with socketserver.TCPServer(("", PORT), Handler) as httpd:
    print("Listening on port", PORT)
    httpd.serve_forever()

Output

Listening on port 8000
**Credentials valid**
Headers -------
Authorization: Basic Zm9vOnNlY3JldA==
Accept-Encoding: gzip, deflate
User-Agent: Java/14.0.2
Host: host.docker.internal:8000
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Connection: keep-alive