Merge branch 'main' into add-outbound-blocking

Author: bitterpanda63

.github/workflows/release.yml

@@ -28,13 +28,15 @@ jobs:
       - name: Download binaries & Build with Gradle
         working-directory: ./
         run: chmod +x gradlew && make binaries && make build
-      - name: Create a zip file of the build
-        run:
-          mv dist/ zen/ && zip -r zen.zip zen/*
-      - name: Generate SHA checksum
+      - name: Create zip and tar.gz files of the build
+        run: |
+          mv dist/ zen/
+          zip -r zen.zip zen/*
+          tar -czf zen.tar.gz zen/*
+      - name: Generate SHA checksums
         run: |
           shasum -a 256 zen.zip > zen.zip.sha256sum
-
+          shasum -a 256 zen.tar.gz > zen.tar.gz.sha256sum
       - name: Upload Release Asset
         uses: actions/upload-release-asset@v1
         env:
@@ -53,3 +55,21 @@ jobs:
           asset_path: ./zen.zip.sha256sum
           asset_name: zen.zip.sha256sum
           asset_content_type: text/plain
+      - name: Upload Release Asset (tar.gz)
+        uses: actions/upload-release-asset@v1
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        with:
+          upload_url: ${{ github.event.release.upload_url }}
+          asset_path: ./zen.tar.gz
+          asset_name: zen.tar.gz
+          asset_content_type: application/gzip
+      - name: Upload Release Asset (tar.gz SHA)
+        uses: actions/upload-release-asset@v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          upload_url: ${{ github.event.release.upload_url }}
+          asset_path: ./zen.tar.gz.sha256sum
+          asset_name: zen.tar.gz.sha256sum
+          asset_content_type: text/plain

Makefile

@@ -32,7 +32,7 @@ cov: check_binaries
 
 # Binaries :
 
-BASE_URL = https://github.com/AikidoSec/zen-internals/releases/download/v0.1.43
+BASE_URL = https://github.com/AikidoSec/zen-internals/releases/download/v0.1.60
 FILES = \
     libzen_internals_aarch64-apple-darwin.dylib \
     libzen_internals_aarch64-apple-darwin.dylib.sha256sum \

README.md

@@ -68,9 +68,10 @@ Zen operates autonomously on the same server as your Java app to:
 You can install Zen by downloading the zip file [here](https://github.com/AikidoSec/firewall-java/releases/latest) and unzipping it to your directory of choice,
 we picked `/opt/zen` here for our Linux system as an example. We also have support for Windows and Mac OS X.
 Please ensure you do not alter the structure of this folder and that the process can read & write to it.
-To activate Zen you then just have to add the following argument to your Java command :
+
+To activate Zen you then just have to add the following `-javaagent` to your Java command **before** the `-jar` argument
 ```
--javaagent:/opt/zen/agent.jar
+java -javaagent:/opt/zen/agent.jar -jar build/myapp.jar
 ```
 Replace `/opt/zen` with your directory of choice.
 

agent_api/src/main/java/dev/aikido/agent_api/background/cloud/api/events/DetectedAttackWave.java

@@ -1,14 +1,17 @@
 package dev.aikido.agent_api.background.cloud.api.events;
 
+import com.google.gson.Gson;
 import dev.aikido.agent_api.background.cloud.GetManagerInfo;
 import dev.aikido.agent_api.context.ContextObject;
 import dev.aikido.agent_api.context.User;
+import dev.aikido.agent_api.storage.attack_wave_detector.AttackWaveDetector;
+import dev.aikido.agent_api.storage.attack_wave_detector.AttackWaveDetectorStore;
 
+import java.util.List;
 import java.util.Map;
 
 import static dev.aikido.agent_api.background.cloud.GetManagerInfo.getManagerInfo;
 import static dev.aikido.agent_api.helpers.UnixTimeMS.getUnixTimeMS;
-import static dev.aikido.agent_api.storage.ServiceConfigStore.getConfig;
 
 public final class DetectedAttackWave {
     private DetectedAttackWave() {
@@ -42,9 +45,15 @@ public static DetectedAttackWaveEvent createAPIEvent(ContextObject context) {
             context.getHeader("user-agent"), // userAgent
             context.getSource() // source
         );
+
+        String ip = context.getRemoteAddress();
+        List<AttackWaveDetector.Sample> samples = AttackWaveDetectorStore.getSamplesForIp(ip);
+        Map<String, String> metadata = Map.of(
+            "samples", new Gson().toJson(samples)
+        );
+
         AttackWaveData attackData = new AttackWaveData(
-            Map.of(),
-            context.getUser()
+            metadata, context.getUser()
         );
 
         return new DetectedAttackWaveEvent(

agent_api/src/main/java/dev/aikido/agent_api/storage/attack_wave_detector/AttackWaveDetector.java

@@ -3,19 +3,26 @@
 import dev.aikido.agent_api.context.ContextObject;
 import dev.aikido.agent_api.ratelimiting.LRUCache;
 
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Objects;
+
 import static dev.aikido.agent_api.vulnerabilities.attack_wave_detection.WebScanDetector.isWebScanner;
 
 public class AttackWaveDetector {
-    private final LRUCache<String, Integer> suspiciousRequestsMap;
+    private final LRUCache<String, Integer> suspiciousRequestsCounts;
+    private final LRUCache<String, List<Sample>> suspiciousRequestsSamples;
     private final LRUCache<String, Long> sentEventsMap;
     private final int attackWaveThreshold;
+    private final int maxSamplesPerIP;
 
     public AttackWaveDetector() {
         this(
             /* attackWaveThreshold, default: 15 requests */ 15,
             /* attackWaveTimeFrame, default: 1 min */       60_000L,
             /* minTimeBetweenEvents, default: 20 min */     20 * 60_000L,
-            /* maxLRUEntries, default: 10,000 entries */    10_000
+            /* maxLRUEntries, default: 10,000 entries */    10_000,
+            /* maxSamplesPerIP, default: 15 samples */ 15
         );
     }
 
@@ -26,9 +33,11 @@ public AttackWaveDetector() {
      * @param maxLRUEntries        Maximum number of entries in the LRU cache
      */
     public AttackWaveDetector(int attackWaveThreshold, long attackWaveTimeFrame,
-                              long minTimeBetweenEvents, int maxLRUEntries) {
+                              long minTimeBetweenEvents, int maxLRUEntries, int maxSamplesPerIP) {
         this.attackWaveThreshold = attackWaveThreshold;
-        this.suspiciousRequestsMap = new LRUCache<>(maxLRUEntries, attackWaveTimeFrame);
+        this.maxSamplesPerIP = maxSamplesPerIP;
+        this.suspiciousRequestsCounts = new LRUCache<>(maxLRUEntries, attackWaveTimeFrame);
+        this.suspiciousRequestsSamples = new LRUCache<>(maxLRUEntries, attackWaveTimeFrame);
         this.sentEventsMap = new LRUCache<>(maxLRUEntries, minTimeBetweenEvents);
     }
 
@@ -56,16 +65,42 @@ public boolean check(ContextObject ctx) {
 
         // Add 1 to the suspiciousRequests counter.
         int suspiciousRequests = 1;
-        Integer existingSuspiciousRequests = this.suspiciousRequestsMap.get(ip);
+        Integer existingSuspiciousRequests = this.suspiciousRequestsCounts.get(ip);
         if (existingSuspiciousRequests != null) {
             suspiciousRequests = existingSuspiciousRequests + 1;
         }
-        this.suspiciousRequestsMap.set(ip, suspiciousRequests);
+        this.suspiciousRequestsCounts.set(ip, suspiciousRequests);
+
+        this.trackSample(ip, ctx.getMethod(), ctx.getUrl());
 
         if (suspiciousRequests < this.attackWaveThreshold) {
             return false;
         }
         this.sentEventsMap.set(ip, System.currentTimeMillis());
         return true;
     }
+
+    public List<Sample> getSamplesForIp(String ip) {
+        List<Sample> samples = this.suspiciousRequestsSamples.get(ip);
+        if (samples == null) {
+            samples = new ArrayList<>();
+        }
+        return samples;
+    }
+
+    public record Sample(String method, String url) {}
+    private void trackSample(String ip, String method, String url) {
+        List<Sample> samples = getSamplesForIp(ip);
+        if (samples.size() >= this.maxSamplesPerIP) {
+            return;
+        }
+
+        for (Sample sample : samples) {
+            if (Objects.equals(sample.method, method) && Objects.equals(sample.url, url)) {
+                return; // an equivalent entry already exists, skipping
+            }
+        }
+        samples.add(new Sample(method, url));
+        this.suspiciousRequestsSamples.set(ip, samples);
+    }
 }

agent_api/src/main/java/dev/aikido/agent_api/storage/attack_wave_detector/AttackWaveDetectorStore.java

@@ -4,6 +4,7 @@
 import dev.aikido.agent_api.helpers.logging.LogManager;
 import dev.aikido.agent_api.helpers.logging.Logger;
 
+import java.util.List;
 import java.util.concurrent.locks.ReentrantLock;
 
 public final class AttackWaveDetectorStore {
@@ -25,4 +26,13 @@ public static boolean check(ContextObject ctx) {
             mutex.unlock();
         }
     }
+
+    public static List<AttackWaveDetector.Sample> getSamplesForIp(String ip) {
+        mutex.lock();
+        try {
+            return detector.getSamplesForIp(ip);
+        } finally {
+            mutex.unlock();
+        }
+    }
 }

agent_api/src/main/java/dev/aikido/agent_api/vulnerabilities/path_traversal/UnsafePathChecker.java

@@ -3,9 +3,13 @@
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
+import java.util.regex.Pattern;
 
 public final class UnsafePathChecker {
     private UnsafePathChecker() {}
+
+    private static final Pattern CURRENT_DIR_PATTERN = Pattern.compile("/(\\./)+");
+
     private static final List<String> LINUX_ROOT_FOLDERS = Arrays.asList(
             "/bin/",
             "/boot/",
@@ -25,15 +29,17 @@ private UnsafePathChecker() {}
             "/sys/",
             "/tmp/",
             "/usr/",
-            "/var/"
+            "/var/",
+            "/app/",
+            "/code/"
     );
     private static final List<String> DANGEROUS_PATH_STARTS = Arrays.asList(
             "c:/",
             "c:\\"
     );
 
     public static boolean startsWithUnsafePath(String filePathRaw) {
-        String filePath = ensureOneLeadingSlash(filePathRaw.toLowerCase());
+        String filePath = normalizePath(filePathRaw.toLowerCase());
 
         List<String> dangerousStartsList = new ArrayList<>(DANGEROUS_PATH_STARTS);
         dangerousStartsList.addAll(LINUX_ROOT_FOLDERS);
@@ -47,15 +53,24 @@ public static boolean startsWithUnsafePath(String filePathRaw) {
     }
 
     public static boolean startsWithUnsafePath(String filePathRaw, String userInputRaw) {
-        String filePath = ensureOneLeadingSlash(filePathRaw.toLowerCase());
-        String userInput = ensureOneLeadingSlash(userInputRaw.toLowerCase());
+        String filePath = normalizePath(filePathRaw.toLowerCase());
+        String userInput = normalizePath(userInputRaw.toLowerCase());
         return startsWithUnsafePath(filePath) && filePath.startsWith(userInput);
     }
 
-    private static String ensureOneLeadingSlash(String path) {
-        if (path.startsWith("/")) {
-            return "/" + path.replaceAll("^/+", "");
+    /**
+     * Normalizes a path by removing /./ and removing consecutive slashes
+     */
+    private static String normalizePath(String path) {
+        if (path == null || path.isEmpty()) {
+            return path;
         }
-        return path;
+
+        // Matches /./ or /././ or /./././ etc. (one or more ./ sequences after a /)
+        String normalized = CURRENT_DIR_PATTERN.matcher(path).replaceAll("/");
+
+        // Merge consecutive slashes since these don't change where you are in the path.
+        normalized = normalized.replaceAll("/+", "/");
+        return normalized;
     }
 }

agent_api/src/main/java/dev/aikido/agent_api/vulnerabilities/shell_injection/DangerousShellChars.java

@@ -7,7 +7,7 @@ public final class DangerousShellChars {
     private DangerousShellChars() {}
     private static final List<String> DANGEROUS_CHARS = Arrays.asList(
             "#", "!", "\"", "$", "&", "'", "(", ")", "*", ";", "<", "=", ">", "?",
-            "[", "\\", "]", "^", "`", "{", "|", "}", " ", "\n", "\t", "~"
+            "[", "\\", "]", "^", "`", "{", "|", "}", " ", "\n", "\t", "~", "\r", "\f"
     );
 
     public static boolean containDangerousCharacter(String userInput) {

agent_api/src/main/java/dev/aikido/agent_api/vulnerabilities/shell_injection/ShellSyntaxChecker.java

@@ -10,7 +10,7 @@
 public final class ShellSyntaxChecker {
     private ShellSyntaxChecker() {}
     private static final List<String> SEPARATORS = Arrays.asList(
-            " ", "\t", "\n", ";", "&", "|", "(", ")", "<", ">"
+            " ", "\t", "\n", ";", "&", "|", "(", ")", "<", ">", "\r", "\f"
     );
 
     public static boolean containsShellSyntax(String command, String userInput) {

agent_api/src/test/java/attack_wave_detection/AttackWaveDetectorTest.java

@@ -4,14 +4,15 @@
 import org.junit.jupiter.api.Test;
 import utils.EmptySampleContextObject;
 
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.util.List;
+
+import static org.junit.jupiter.api.Assertions.*;
 
 class AttackWaveDetectorTest {
 
     private AttackWaveDetector newAttackWaveDetector() {
         // Use much smaller time frames for testing (e.g., 100ms instead of 60s)
-        return new AttackWaveDetector(6, 100L, 200L, 10_000);
+        return new AttackWaveDetector(6, 100L, 200L, 10_000, 3);
     }
 
     private static boolean checkDetector(AttackWaveDetector detector, String ip, boolean isWebScanner) {
@@ -59,6 +60,12 @@ void testWebScannerWithDelays() throws InterruptedException {
         assertFalse(checkDetector(detector, "::1", true));
         assertFalse(checkDetector(detector, "::1", true));
         assertFalse(checkDetector(detector, "::1", true));
+        assertArrayEquals(
+            List.of(
+                new AttackWaveDetector.Sample("BADMETHOD", "https://example.com/wp-config.php")
+            ).toArray(),
+            detector.getSamplesForIp("::1").toArray()
+        );
 
         // Small delay (50ms)
         Thread.sleep(50);
@@ -118,4 +125,24 @@ void testSlowWebScannerThirdInterval() throws InterruptedException {
         assertFalse(checkDetector(detector, "::1", true));
         assertTrue(checkDetector(detector, "::1", true));
     }
+
+    @Test
+    void testItRespectsSamplesLimit() {
+        AttackWaveDetector detector = newAttackWaveDetector();
+        detector.check(new EmptySampleContextObject("", "/../etc/passwd", "GET"));
+        detector.check(new EmptySampleContextObject("", "/../etc/passwd", "GET"));
+        detector.check(new EmptySampleContextObject("", "/test2", "GET"));
+        detector.check(new EmptySampleContextObject("", "/../etc/passwd", "POST"));
+        detector.check(new EmptySampleContextObject("", "/test3", "PUT"));
+        detector.check(new EmptySampleContextObject("", "/.env", "GET"));
+        detector.check(new EmptySampleContextObject("", "/test4", "BADMETHOD"));
+        assertArrayEquals(
+            List.of(
+                new AttackWaveDetector.Sample("GET", "https://example.com/../etc/passwd"),
+                new AttackWaveDetector.Sample("POST", "https://example.com/../etc/passwd"),
+                new AttackWaveDetector.Sample("GET", "https://example.com/.env")
+            ).toArray(),
+            detector.getSamplesForIp("192.168.1.1").toArray()
+        );
+    }
 }