Nexus IQ nupkg scan capabilities - Sonatype Lifecycle & Repository Firewall - Sonatype Community
Nexus IQ nupkg scan capabilities
post by ericth on Jan 17, 2023
Hello
I read this documentation about Nuget package scan powered by Nexus IQ :
Lifecycle ABF scans identify both NuGet packages (.nupkg) and the following Pecoff extensions: .acm, .ax, .cpl, .dll, .drv, .efi, .exe, .mui, .ocx, .scr, .sys, .tsp
I tried to see on a “lab project”, vulnerable on purpose, capabilities of Nexus IQ.
I have a simple choco script that creates a nupkg that embeds a very old version of putty tool :
- version 0.52 (Jan 14, 2002)
- download : Download Old Versions of PuTTY for Windows - OldVersion.com
- vulnerable to many critical vulnerabilities : Putty Putty : Security vulnerabilities, CVEs
I scan it with Nexus IQ:
Scan target: /testpackage.1.0.0.nupkg
Starting scanning target: /testpackage.1.0.0.nupkg
Could not open /putty-0.52.exe as an archive. Will scan it as regular file.
Loaded 0 module information files
Completed IQ analysis
No vulnerabilities found.
Is Nexus able to detect such can of vulnerabilities in executable files ?
Do you have an example of a vulnerable nupkg I can produce to test Nexus IQ ?
Eric
1.0k views
3 links