SCAGoat : Damn Vulnerable SCA Application
SCAGoat
SCAGoat is an application for Software Composition Analysis (SCA) that focuses on vulnerable and compromised JAR dependencies used in development code, providing users with hands-on learning opportunities to understand potential attack scenarios. It is designed to identify vulnerabilities that may arise from using vulnerable JAR files.
What All CVE Covered?
The CVEs covered under SCAGoat are primarily critical and high severity, which have a CVSS score of 9. This aid in understanding the vulnerable package being used and its potential for exploitation.
In addition, there is one compromised package, that lacks a CVE, but is malicious by nature and cannot be detected with traditional SCA scanners.
| CVE | Package Name | Link |
|---|---|---|
| CVE-2023-42282 | IP | https://nvd.nist.gov/vuln/detail/CVE-2023-42282 |
| CVE-2017-1000427 | Marked | https://nvd.nist.gov/vuln/detail/CVE-2017-1000427 |
| CVE-2017-16114 | Marked | markedjs/marked#926 |
| CVE-2021-44228 | log4j | https://nvd.nist.gov/vuln/detail/CVE-2021-44228 |
| CVE-2020-9547 | jackson-databind | https://nvd.nist.gov/vuln/detail/CVE-2020-9547 |
| CVE-2021-33623 | trim-newlines | https://nvd.nist.gov/vuln/detail/CVE-2021-33623 |
| CVE-2020-13935 | spring-websocket | https://nvd.nist.gov/vuln/detail/CVE-2020-13935 |
| Malicious Package (No CVE) | xz-java | https://central.sonatype.com/artifact/io.github.xz-java/xz-java |
Steps to run SCAGoat
Step 1. Clone the application
git clone https://github.com/harekrishnarai/Damn-vulnerable-sca.git
cd Damn-vulnerable-sca
docker compose up
