Kali Linux 2021.4a support was added.
Rocky Linux 8 support was added.
RedHat 9 support was added.
Windows Server 2022 support was added.
Windows 11 support was added.
SUSE Linux Enterprise Server 15 support was added.
Oracle Linux 8 support was added.
RedHat 8 support was added.
Oracle RAC support was added.
JavaScript memory-leaks detection was added.
New DOM checks, from 40 to 54
Major Version. JavaScript fuzzy engine was added
New DOM checks, from 27 to 39
CWE updated to 4.4
OWASP fully updated to Top Ten 2017
New DOM checks, from 21 to 27
Major Version. New Python-based engine was added
New DOM checks, from 13 to 20
Generates report even the scan was aborted
By default, terminates the scan after 1 hour
New DOM checks, from 1 to 12
Major Version. This is the first version with indipendent fixes.
Centos 8 support was added
Updated to ruby 3.0.0
This is the last version following original Arachni Web UI fixes.
Plugins
metrics -- Fixed type error due to race condition.
proxy -- bind_address default switched to 127.0.0.1, 0.0.0.0 breaks SSL interception on MS Windows.
metrics
Fixed division by 0 error when no requests have been performed.
Added:
HTTP
Request time-outs
Responses per second
Browser cluster
Timed-out jobs
Seconds per job
Total job time
Job count
email_notify
Retry on error.
Default to afr as a report format.
Native MS Windows compatibility.
RedHat 7 and Centos 7 full support
BUG fix
Management background
Fix the error of default value of request.param_encoding reported by a Customer
Java/Scala/Kotlin/Clojure version
Fix the issue that the attack reported cannot be intercepted
Optimization and improvement
Management background
Fix regular default configuration of sensitive files in Web root directory, remove extra double quotes
Add host interface, optimize manual installation tips
Java/Scala/Kotlin/Clojure version
Fix the problem that SpringBoot may cause all Hook points to be invalid after enabling the whitelist
PHP version
Added fastcgi SAPI support (previous versions only supported php-fpm / apache)
.NET Detection plugin
Sensitive information leak detection algorithm to correct the problem that mobile phone number identification will be falsely reported in some cases
When the request JSON parsing error, truncate the exception log to avoid the hard disk full
Intercept command execution based on CVE-2020-9547, CVE-2020-8840
Major changes
IAST scanning tool
The IAST console is integrated into the existing management background to reduce operation and maintenance costs (iast no longer monitors port 18664)
IAST scanner changed to connect to panel server (previously connected to agent server)
The IAST scanner uses websocket to connect to the management background, which is not compatible with the background before v1.3.0
Old version background users can use the pip3 command to install the old version
PHP version
For file-related detection points, if the read file starts with a streaming protocol, SSRF detection will be triggered, and file read-write detection will not be triggered
The affected protocol is: https / http / ftp
The affected functions are: file / readfile / file_get_content / fopen / copy / include
When plugin.filterclosed, the files related to the detection point will be ignored open_basedir configuration, continue to the plug-in detection
new features
General improvements
Add file deletion test point
Added detection point after SSRF jump to detect rebinding attacks
Add HTML response detection point, default sampling 5 times per minute
Add dependent library information collection, the default collection once every 6 hours
Java POM information
PHP composer.json
Completion of SQL anomaly detection points
PHP adds PostgreSQL, SQLite exception monitoring
Java adds PostgreSQL, SQLite, Oracle, SQLServer, HSQLDB, DB2 monitoring
Weak password list supports remote delivery
Strengthen the stand-alone version configuration verification
When the outermost key value of yaml cannot be recognized, print the log
Java/Scala/Kotlin/Clojure version
Increase Hibernate SQL checkpoint
Increase nio detection point
Added SpringBoot partial annotation parameter support
PHP version
SSRF supports IPv6 address resolution
Baseline check: detect whether there are compressed files, SQL and other sensitive files in the web root directory
Increase mysql_db_query, mysql_unbuffered_db_query detection points
Increase print checkpoint
Management background
New -s restart / -s stop / -s statusinstructions, you can restart the spooler, turn off background and access to state
Support host to set notes and search by notes
Whitelist support notes
Support log write kafka
Change alarm sending interval to front-end configuration
Increase alarm log deduplication, calculated according to request number, stack MD5, attack type
Background log increase in size, file number limit, configurable
.NET /Java/Scala/Kotlin/Clojure Detection plugin
Add any file deletion vulnerability detection
Add header injection detection (such as SQL injection, command injection)
Added command execution syntax error monitoring and suspicious injection detection
Increase DNS Rebind SSRF attack
Add leak detection of HTTP response sensitive information, such as bank card, ID card, mobile phone number
BUG fix
Java/Scala/Kotlin/Clojure version
When RaspInstall installs rasp.jar, rename it before writing to a new file
Avoid modifying the loaded jar, mmap problems may occur
Old files are randomly named after uuid, support multiple installations, and will be deleted uniformly at startup
PHP version
When the configuration delivered in the background does not meet expectations, actively report the exception log
Fix the problem that only one entry will be uploaded in the following log of Kali
Repair some cases, there will be multiple rasp-logprocesses of problem
Management background
Client version aggregation interface, without filtering host online status
Add duplicate whitelist check
new features
General improvements
Java/Scala/Kotlin/Clojure, .NET, PHP add crash monitoring (only supports Linux / Mac system)
Monitoring signals such as segfault / abort, etc.
The monitoring scope is Java main process, PHP worker / heartbeat / logging process / daemon
After the crash, an alarm is automatically sent to the management background, and the stack log is uploaded; the background will send an email alarm synchronously
To test monitoring results, the executable kill -11 PIDcommand triggers a segmentation fault
Management background
Support client version enumeration
Support one key to close all alarms
When the agent cannot obtain the version number of the application such as dubbo, allow the agent to register
BUG fix
Java/Scala/Kotlin/Clojure version
Fix the problem that the syslog address will still send logs to the old address after modification
Upgrade Instructions
Management background
After the upgrade is complete backstage, still need to be performed manually ./rasp-cloud -upgrade 121to122update the MongoDB
Increased X-Protected-By: OpenRASPconfiguration
Request body size limit changed to 12KB
Support online upgrade, but please do not modify the configuration in the background during execution
new features
General improvements
Completely solve the v8::Abort()crash problem
Upgrade v8 to the latest version: 7.8.279.19
Support hide X-Protected-By: OpenRASPresponse header
Automatic installer
Support custom heartbeat interval through -heartbeat /-heartbeat parameter
Java/Scala/Kotlin/Clojure version
Added WebSphere 7.X support. Due to IBM JDK restrictions, file-related detection points cannot take effect
When the plug-in does not register the request / requestEnd detection point, relevant parameters are no longer constructed to improve performance
.NET/PHP/Java/Scala/Kotlin/Clojure Detection plugin
Intercept command execution based on bsh.servlet.BshServlet, eg CNVD-2019-32204
Intercept command execution based on jdk.scripting.nashorn
BUG fix
Java/Scala/Kotlin/Clojure version
Fix the problem that Java cannot get the character stream request body in some cases
PHP version
When the repair is closed plugin.filter, the included .php/.incfile will not plug into the issue
For multipart requests, extract the parameters separately to solve the problem of not requesting the body when generating an alarm
Detection plugin
Fix user reported that the memory usage of replaceAll function is too high
Fix the xss_userinput bypass issue reported by @Looke
Upgrade Instructions
Management background
Solved migration issues to ElasticSearch 6.8.8
Due to early ElasticSearch mapping problems, for existing applications, alarm messages, baseline messages, and exception messages do not support case search
After the background upgrade is complete, the user needs to manually perform ./rasp-cloud -upgrade 120to121to update the mapping
The program will first modify the alias, point the index to the new alias, and delete the previous index after completing the data copy
New alarm data can be written during the copy process and will not be lost
new features
General improvements
First Scala version
Support custom RASP ID
When using the installation --rasp-id (PHP)or -raspid (Java)setting
If not specified, according to the previous logic, based on the network card, RASP path and other information to calculate a
Management background
Increase the deduplication of the alarm log, according to request_id + stack_md5
In the System Settings -> Background settings interface, add a key clean-up alarm data support
Host management interface, automatically remember Host statuscheck case
Alarm view interface, support searching by alarm message and stack MD5; Referer and URL support click
Java/Scala/Kotlin/Clojure version
Added partial support for TongWeb 6.X server, from @superbaimo
Simplify the installation process of JBoss 7 and higher, from @Lorisy
Added HSQL database hook point to detect WebGoat SQL injection vulnerabilities
Increased fuse support
Collect the single-core CPU occupancy rate every once in a while, if it exceeds the threshold and 3 consecutive times, start the fuse mechanism
When the occupancy rate collected next time is lower than the threshold, the protection is automatically restored
This function is off by default, and the collection interval and CPU usage can be configured
Fix the problem that plugin.filter does not take effect at include hook point
Plug-in system
First .NET and Kotlin/Clojure version
Command execution checkpoint, add environment variable information
SQL anomaly detection is changed to plug-in detection, and the error code to be monitored can be customized in the management background
Fix the command_reflect algorithm, which may cause false alarms in some cases
Bug fix
Universal fix
Added support for re-registration, which can be automatically restored when the host is accidentally deleted after offline
Java version
Fix the problem of false alarm when middleware supports multipart protocol, but users do not use files
Fix the problem that when the server is connected to the management background after a period of startup, the Java Agent will not obtain the registered IP again
Fixed an issue where WebSphere. Deserialization command execution would not be blocked due to empty context.language
Fix the problem that when the heartbeat fails, sleep is invalid and the log will be printed infinitely
Fix the problem that the log4j cache will not be cleared after the log is pushed
Fix the problem that when there are multiple files uploaded, only the first file will be processed
Fix the problem of missing details when configuration update fails
Fix the problem that the request hook cannot be intercepted (thanks @Looke for feedback)
Fix the issue that cloud.X and other configurations can be delivered remotely
Fix the problem that the SQL prepared statements will not enter the detection plug-in and will not record SQL exceptions when an exception occurs
PHP version
Fixed an issue where PDO exception monitoring did not filter error codes and recorded redundant exception logs
Major changes
General changes
Remove enforce_policy configuration, baseline detection no longer supports interception
Remove MySQL duplicated key error monitoring
Delete the stack_trace string field in the alarm log and uniformly use attack_params.stack to get the stack
If the Java / PHP agent is upgraded to v1.2.0, the management background must also be upgraded, otherwise the front-end stack will be displayed as an empty value and the vulnerability aggregation list will be empty
new features
General improvements
When the host name changes, sync to the management background
Add host_type field to identify whether it is a docker container
Management background
Fix the problem that the original URL cannot be jumped back after login
Plug-in system
Added requestEnd hook point, called once at the end of the request
Add RASP.request () interface, can send HTTP request in plugin
Add RASP.get_version () interface to get agent version information
Add multiple fields such as context.requestId
Add two parameters dest_path / dest_realpath to file upload (PHP version only)
Added loadLibrary_unc algorithm to intercept when the library to be loaded comes from the UNC path
PHP version
Add eval / assert hook points
Increase debuglevel configuration to avoid printing redundant logs
Java version
Added cluster support to JBoss and WebLogic
Fix the problem that fetching Thread Local data will crash when v8 is running in multi-thread environment
Added key hook check: requestEnd, request.parameterMap refuses to start when it does not exist
Heartbeat interval lower limit changed to 10s
Optimized memory usage, reduced by about 50%
Print RASP ID at startup for easy troubleshooting
Solve the problem that XSS will not detect when Tomcat actively flush ()
At the same time optimize the XSS detection efficiency
XSS interception no longer throws an exception (other attack types will still throw)
Automatic installer
Add SpringBoot semi-automatic installation, that is, only release the file and modify the configuration, the parameter name is -nodetect
Added support for tomcat installed by yum, that is, the separation of bin directory and tomcat_home
Increase -prependparameter, if it will open -javaagentparameters on the front
Appended by default
Solve jacoco compatibility issues
Gray box scanning tool
Released the first version of the gray box scanner , combined with the RASP vulnerabilities scanner
Bug fix
Java version
Solve JRockit compatibility problem, change to jni to get network card information
Solve org.elasticsearch.client.RestClient compatibility issues
Solve the problem of incompatibility between XXE code safety switch and taglib
Disable V8 execstack warning
PHP version
Fix the problem of incorrect PHP version number in the alarm log
Plug-in system
Repair 001-dir-1.jspeven if you close the plugin all_logwill not intercept problem
General improvements
Management background
Support to decide whether to alarm according to attack type
Host management page, support export agent list
Add host page, fix SpringBoot + Docker installation command
Optimize multiple table experience
Java version
syslog tcp increase connection, send timeout
Support agent version information through rasp.jar
Detection plugin
readFile hook point ignores war package related operations
Bug fix
Java version
When the host name is not bound in the / etc / hosts, the floodgate hostnamecommand called BUG
Passed to the stack of the plugin to fix the problem of incorrect filtering
Fixed the problem of null pointer exception when Undertow parses parameters
Fix an XSS hook point null pointer exception
General improvements
Management background
Turn on gzip compression support to reduce network traffic
Alarm and baseline log retention time support custom, default 365 days
Optimize multiple front-end experiences
Agent exception log adds stack details display
Enhanced alarm search function
Support advanced configuration options for detection algorithms
Java version
Fix incomplete stack filtering
Solve possible encoding problems caused by emoji packages
openrasp-v8 all exceptions are synchronized to rasp.log
Detection algorithm
Fix the false alarm of command_reflect
Algorithm for deleting xss tag when there are more than 10 alarms
Major changes
General changes
Upgrade Google v8 to version 7.2
The syntax interpreter was replaced by antlr4 to flex to reduce memory usage
PHP version
Replace libstdc ++ with libc ++
Remove pcre dependency
Binary package adds Thread Safety version
Java version
Replace rhino with openrasp-v8
SQL, SSRF detection logic changed to JS implementation
Temporarily removing JRockit JDKsupport, WebLogic 10.3.6 needs to be set JAVA_VENDOR=Sunto switch to Oracle JDK
Plug-in system
Streamline the console.log function and delete color-related codes
Pass to the stack of the detection plug-in to filter out com.baidu.openrasp related content
new features
General changes
new DAST lightweight penTest tool coming from IronWASP project
SQL exception increases password error monitoring
Implement weak password detection for database connection
Java version
Add XXE code safety switch, which can directly prohibit loading of external entities
Bug fix
Universal fix
After the plug-in is updated successfully, a heartbeat is sent immediately to solve the problem of lagging behind the version information of the management background
The alarm stack filters out openrasp related content
Java version
Fix the problem of false alarms in file upload detection points, instead check after the user has used the file
Fix the problem of incorrect encoding of openrasp.yml file under Windows
Fix the problem that JBoss 12 and above cannot be installed automatically
Solve the problem that JSP can not get the stack
Fix the problem that Tomcat will not jump after xss interception
Fix the bug that the heartbeat will never be beat again after a failed heartbeat
Solve the problem of abnormal HTML injection function under Tomcat 5
Fix the problem of heartbeat thread remaining after uninstalling without restarting the installation
Unified log.maxbackup logic with PHP version, when configured as 1, keep today and yesterday's logs
Management Backgroung
Porting to ElasticSearch v5.6.8
Fix the problem of detecting duplicate uploads of plugins
Added cache invalidation setting on front page
Fix the problem that the debug_level field is not a number
When there is an online host under the application, it is forbidden to delete the application
Fix the problem of nosniff misspelling in the application reinforcement, the user can save the configuration once to repair
Major changes
General changes
APM features from Apache SkyWalking and Elastic APM
The header field is added to the alarm log, and the outermost user_agent and referer duplicate fields are removed
Standalone version configuration file changed to yaml
Only when the response code set to intercept 302jump if power Location header, allows the user to print custom block content
Management background
Delete the two items AgentServerURL and PanelServerURL in the configuration file, and modify it on the management background interface instead
The first two options will be set automatically when accessing the background for the first time. To enable the load balancing mode, please correct the Agent server list manually
PHP version
The stand-alone version disables fswatch by default. If need, please use --enable-fswatchthe compiler parameters to open
Replace rapidjsonthe interface more flexiblenlohmann/json
cli mode turns off baseline checking to avoid redundant logs. If need, please use --enable-cli-supportthe compiler parameters to open
Rasp-install adds SELinux and open_basedir checks to avoid unusable problems after installation
Java version
Remove rasp-log4j.xmlrelated startup parameters. Change to dynamically generate log4j configuration, users no longer need to configure
new features
General functions
Added JSON parameter parsing, namely context.json
Added application hardening function, which can prevent click hijacking, MIME sniffing, automatic operation of downloaded files, and reflection XSS
Support decompilation function, user code can be obtained at the same time when an alarm is generated (only JDK 6-8, PHP support)
PHP version
New PHP 7.3Support
Java version
New SpringBoot + UndertowSupport
New WebLogicSupport
New JBoss 6-8support (does not support automatic installation)
New JDK 11Support
Increase application environment variable collection
Add experimental non-restart installation and non-restart uninstall functions, temporarily do not support non-restart upgrade
Management background
Improve multiple user experiences and provide a more complete alarm search experience
Added vulnerability aggregation display to avoid the problem of attacking the screen during the vulnerability exploitation phase
Improve audit log display, add type field and display
Added client exception log display
Algorithm improvements
General improvements
Increase the development mode switch, after loading it will load some performance-consuming detection algorithms
The observation mode is turned on by default
Security baseline
Tomcat background weak password increase empty password check
Path traversal
Fixed an issue where the is_path_endswith_userinput function was incorrectly reported when downloading files using absolute paths
The following use Windows interception ..\..\list directories attack
File Inclusion
Fix the false alarm caused by the phar: // file when using Baidu Cloud BOS service
Added common penetration command detection support, only print logs by default
SQLi
Added SQL anomaly detection, such as syntax error and error injection
Fix char / chr () false alarm problem, only give an alarm when there are 5 occurrences
SSRF
Add port information when calling the detection plugin
Intercept access to Alibaba Cloud metadata
File Upload
The alarm log adds a multipart parameter name field to facilitate the construction of requests
XSS
Added xss_userinput detection algorithm to intercept reflection XSS
The xss_echo algorithm adds content filtering to avoid alarms caused by non-attack events (this algorithm has no false alarms)
WebShell
Intercept backdoor based on LD_PRELOAD
Deserialization
Intercept attacks based on JNDI reflection execution commands
Bug fix
Management background
Fix the problem that ElasticSearch pulled by docker cannot connect
PHP version
Fix the problem that the SSRF detection point cannot get the hostname when the URL has no protocol
new features
Java version
Add okhttp / okhttp3 hook point for SSRF detection
Other general functions
The first version of the release management background
Add remote management functions, including log upload, plugin delivery, remote configuration management, etc.
syslog log adds tag field support, can be customized
LRU is changed from plug-in to agent, covering several detection points of sql, ssrf, readFile, writeFile
Major changes
Management Background
Porting to ElasticSearch v6.1.0
Rewrite of entire Dashboard in GO language
PHP version
Officially remove Windows support
Algorithm improvements
Command execution
Increase the detection of JBoss EL reflection command execution
Added bash command interpreter to detect command injection attacks
Bug fix
Fix dubboRPC below, when log4j prints logs, there is no requestMethod resulting in a null pointer bug
Fix a crash in PHP session + mysql handler
Fix the issue that SpringBoot 1.5.9 + Embedded Tomcat Server cannot obtain the server version number
new features
Java version
Officially supports WebSphere, and currently only tested 8.5, 9.0 two versions
other
Alarm log increase algorithmfield identifies a specific algorithm name
Algorithm improvements
Any file download
Fix an absolute path false positive caused by ThinkPHP rewrite
Major changes
General
Remove SQL slow query hooks, but temporarily keep the code
Java version
Plug-in to get the Dubbo RPCparameter name from the openrasp-dubbo-XXXchangedubbo-XXX
new features
Alarm log increase in request_methodfield, i.e., request method
Bug fix
Fixed an issue where No modifications are allowed to a locked ParameterMap error when obtaining parameters under certain tomcat versions
Algorithm improvements
Rename
Fix a potential false positive issue of rename_webshell
Deserialization
Stack algorithm adds commons.collections4 check
Major changes
Management Backgroung
Porting to ElasticSearch v5.0.0
Java version
block.urlThe configuration option is renamed block.redirect_urland supports templated configuration
Automatically replace the template of %request_id%keywords for the current request ID
PHP version
openrasp.block_url Configuration option renamed openrasp.block_redirect_url
And support templated configuration, same as Java version
All log times are changed to system time, and the time in PHP time zone is no longer used
Solve the problem that the IAST-RASP alarm log and the nginx / apache access log cannot correspond one to one
Remove the webshell_include detection point and use JS plug-in detection
JS API interface
For the Java server, appBasePath no longer points to the webapps directory, but the application deployment path, such as /tomcat/webapps/vulns
RASP.sql_tokenize array elements are changed to a dictionary, and two parameters of the token start coordinate and token end coordinate are added
After improvement, the sqli_userinputalgorithm only needs to execute tokenize again
In the event of an attack, greatly improve performance
new features
Java version
Add baseline check for JBoss
When the request is intercepted and the expected response type is xml / json, the user can customize the response content
Through configuration block.content_xmland block.content_jsontemplate
Add plugin.filter configuration
Applicable to hooks such as include / rename / readFile
If enabled, when the file does not exist, it will not enter the detection logic (default open)
Increase the ability to obtain the client's real IP
Users can openrasp.clientip_headerget real client IP from which the header in the specified
The default is to clientiprequest header
The fields in the alarm log are client_ip
Added Dubbo RPC basic data type support
JS plugin can get RPC parameters, the name is openrasp-dubbo-X
PHP version
Supported by openrasp.hooks_ignore=alldisabling all hook point
Increase the ability to obtain the client's real IP, same as Java version
When the request is intercepted and the expected response type is xml / json, the user can customize the response content, the same as the Java version
Add openrasp.plugin_filter configuration, same as Java version
Algorithm improvements
SSRF
Fix XXE, SSRF bypass problem reported by @piggy ", default interception netloc://, jar://and more unsafe protocols
OGNL
Changed the hook point to Ognl.topLevelExpressionfix the problem of incorrect detection of OGNL report by @Shi Wei
SQLi
Add lazy loading and pre-filtering mechanism, only execute when tokenize is needed to improve performance
Use linked lists to replace arrays, optimize JS LRU implementation, and improve performance
Twentieth
Fix @Ling Xiao Feedback's xxe_file algorithm, resulting in a large number of alarm log issues
Solved by ignoring entities with extension dtd / xml
File directory traversal, arbitrary file inclusion
Add a new detection algorithm, when the user input contains traversal features, and the user input is located at the end of the directory, it is determined that the file directory traversal
Fix the confluence 5.8 AFD alarm message reported by @ Tavern Ranger is incorrect
When the user passes in file: /// etc / passwd, but the actual read is / etc / passwd, it will cause a bypass, which has been fixed
File writing
writeFile_script is changed to ignore by default to avoid a lot of useless logs
Rename monitor
Add filtering, only enter the detection logic when the source file contains the extension, to fix the false alarm problem under the larvael framework of @ 蠓 Report
Add filtering, only enter the detection logic when the source and target are files
Slow query
Since the corresponding SQL statement cannot be obtained, slow query detection is disabled by default; disabling this hook point can also improve the performance of the Java version.
Bug fix
PHP version
Fix incorrect processing of array_filter parameters
Fix the problem of missing domain name in URL field in alarm log
Major changes
Java version
Command execution hook point, command parameters are uniformly changed to string form
All alarm messages are changed to English, and translation support is added in the next version
PHP version
All alarm messages are changed to English, and translation support is added in the next version
new features
PHP version
Officially support PHP 7.0-7.2
Added support for SQL prepared statement
Use v8 default platform to replace custom platform to provide more general background task capability and error tracing
Java version
Increase rename hook points
Algorithm changes
Command execution
Increase the recognition of commands executed by FreeMarker templates
Fix cacti false positives reported by @Garfield
By default, all command execution is no longer blocked
If there is no demand manually modify the command execution command_otheralgorithm for the switchblock
This switch does not affect the interception of deserialization command execution or the detection of other algorithms
SSRF
Increase the detection of special protocols, and the corresponding detection switch. Including php://, file://etc.
A user input matching algorithm, increased 127.X.X.Xrecognition
Add a dnslog address feedback from @dos_man *.tu4.org
File directory traversal
Repair a @Leesec report /../../detected problems to bypass
PHP stack detection algorithm
Repair @Ezreal report of a call\_user\_funcfalse alarm problem
Backdoor upload detection
Increase the monitoring of rename to prevent writing to webshell through renaming
SQL injection
Increase the global LRU cache, when the detection result is ignore, do not repeat the detection, to improve performance
User input matching algorithm, the shortest parameter length can be configured
Increase into outfiledetection and increase the detection switch corresponding
Bug fix
PHP version
Added more than 60 unit tests and fixed 2 parameter parsing errors
Optimize the processing logic of different protocols. If the protocol does not support write operations, it will no longer enter the detection plug-in
Fix a problem that the path reduction fails due to the mixed use of left and right slashes
Other changes
Add new block page
Algorithm improvements
Add switches for all detection algorithms
Users can control whether an algorithm is enabled by editing the configuration of the JS plug-in header
ssrf_common algorithm, increase ceye.io, transfer.shdetection and interception
Bug fix
Solve a classloader compatibility problem in Resin 3.1.8
Fix a parsing error in SQLParser
Solve the loading conflict problem of mozilla rhino by modifying the package name
Other changes
Use the snapshot feature of the v8 engine to speed up the v8 instance startup speed
Major changes
Java version
Java package name changed to com.baidu.rasp
Before the upgrade, users need to manually delete rasp/conf/rasp-log4j.xmlfiles
After the application starts, OpenRASP will automatically generate a new log configuration file
Solve the compatibility issue of high version JDK, ISSUE: rhino jdk8u162 compatibility issue # 98
In order to reduce Hook point development costs, the Hook framework was changed to JavaAssist
RaspInstall-OpenRASP automatic installer
To support automatic uninstallation, we adjusted the command line parameters of RaspInstall.jar
java -jar RaspInstall.jar -install /home/tomcat
java -jar RaspInstall.jar -uninstall /home/tomcat
Algorithm changes
SQLi detection algorithm # 2, the constant comparison algorithm is turned off by default
In real business, there are often situations where coding is not standardized, which can cause false positives, eg AND ((0='' OR 0='0')
Command execution detection logic adjustment
In order to detect unconventional deserialization and command execution vulnerabilities, when command execution comes from non-HTTP requests, it will also enter the detection point
Suitable for detecting CVE-2016-8735 , CVE-2018-1270 and other vulnerabilities
new features
Java version adds ascii banner, print at startup
Add JDBC Prepared SQL Hook point
Support Resin 3.X, 4.X server
Add custom coding configuration, allows users to set context.parameterencoding
Increase jnotify exception acquisition
Bug fix
Feedback from @ KindergardenMM
ProcessBuilder is bypassed, we changed the Hook point to the lower level UNIXProcess, ProcessImpl class
PHP version
When the file does not exist, file_put_contents will not call the detection plugin, which has been fixed
Solve a memory leak in the log module
Major changes
Java version
Debugging configuration options, the debug_levelchangeddebug.level
new features
Added support for PHP 5.X
Linux 5.3 ~ 5.6
Windows 5.6 (thread-safe version only)
Mac homebrew PHP 5.6
PHP security baseline check
INI configuration audit
allow_url_include
expose_php
display_errors
yaml.decode
Database connection account audit
Features supported by other PHP versions
SQL slow query audit
Test case enhancement
Add PHP test cases
Add a simple navigation page
Uniform increase of clickable links, reduce dependence on command line
Add PHP version performance test report
discuz / wordpress performance loss, all around 2%
Open docker-based automated vulnerability testing environment- app-env-docker
API changes
directory hook point, add stack parameter
ssrf hook point, add ip parameter
Algorithm improvements
SQLi detection algorithm enhancement
Increase the detection of UNION NULL statement
Statement specification checking algorithm, intercepting common blind injection functions, eg ord,chr
Add control switch separately for database manager detection algorithm
SSRF detection algorithm enhancement
When the requested URL comes from the user and the address is an intranet address, it will be intercepted
Java-deserialization detection
Intercept attack codes that execute commands through ysoserial
PHP-Increased detection of Chinese kitchen knives
Identify exceptions based on stacks, intercept file managers, and execute commands
Based on user input recognition, some samples can be intercepted directly, eg <?php eval($_POST[0]); ?>
PHP-Interception callback operation, eg array_map("system", $whatever)
What specific callback interception, please refer to openrasp.callable_blackliststhe default configuration
BUG fix
Feedback by @Count Ji
SQLi Algorithm # 1-When the user input is a pure number, and appears in the SQL statement multiple times, it will generate a false alarm and has been resolved
BUG fix
Automatic installer
Solve the problem that JBoss 4.0.3 cannot be recognized
Other changes
Grab the RASP.sql_tokenize error message and print to plugin.log
Major changes
Delete reflectionhook
Some frameworks will call reflection a lot, affecting performance
We tested a number of financial services, the new performance by the loss 10%down to5%
Reflex-based inspection, move to commandhook point, the detection ability remains unchanged
Algorithm improvements
SSRF detection algorithm is enhanced to add more common domain name detection
Major changes
For the Java version, the SQLi/SSRFdetection algorithm is changed to Java native implementation to further improve performance
By modifying the widget algorithm.configto detect the control logic is configured
Open source license by the BSD-3switch to Apache License 2.0facilitate commercial
Modify context.parameteracquisition logic
When the JSP script reads the parameters, the JS plugin can read them. This can reduce false positives and also improve the performance of SQLi algorithm # 1
Supports the automatic deletion of expired logs
By patching log4j 1.X
Before the upgrade, the user needs to manually delete rasp/conf/rasp-log4j.xml, the program will automatically generate a new
new features
Support JBoss 7.X
Support to insert HTML code in the response, which can be used for detection CSRF/Backstage, this feature is turned off by default
rasp.properties in configuration options, in addition to hooks.ignoreoutside, began to support dynamic updates take effect immediately after that is modified
Supports custom response status codes when intercepting attacks
default 400
Security baseline
Support Tomcat Directory Indexinspection
JS precompiled code from the original start time 8sdropped to 3saround
Increase the debugging switch, used to collect the number of hook entry times, time consumption, etc.
Algorithm improvements
Officially support SSRF vulnerability detection, including the following three scenarios
URL.openConnection
commons-httpclient
httpclient
API changes
RASP.config()Renamed the interface RASP.config_set()and added relevant debug logs
Increase RASP.get_jsengine()interface for acquiring JS engine name
Bug fix
# 84: request.setCharacterEncoding encoding problem
Solve because there is no write permission, resulting in rasp-log4j.xmlthe issue of release failure
In the new version, RaspInstall will take the initiative to modify raspdirectory permissions
Baseline check log, add call stack information
When the application uses a high authority database account, it is convenient to locate the specific code
Rewrite the catalina.shscript modification logic to support repeat the installation
Around the modified configuration, similar increases ### BEGIN OPENRASP ###indicia
Major changes
The security baseline log is split into separate files
Convenient to collect different types of logs
Before you upgrade, users need to manually delete rasp/conf/rasp-log4j.xmlfiles
new features
Detection of JSTL file contains vulnerabilities, or SSRF exploit
Support DB2database, we only tested the free version, 9.7and10.5
Server security baseline
New database connection account audit function , eg using a rootconnection mysql, using the saconnection mssql etc.
Add slow query audit function
Use SELECTstatement reads data of more than 500 lines, can be arranged
Support Syslog TCPway transmission of alarm log
Algorithm improvements
Public SQL injection detection algorithm # 2-Based on statement specification, plug-in configuration can be modified
Prohibit multi-statement execution, eg select 123; select 456
Forbid hexadecimal string, eg load_file(0x41424344)
Disable MySQL version number comments, eg /*!12345
Forbid numeric constant comparison operation, eg SELECT 1 FROM dual WHERE 8778 <> 8778
Prohibit the use of blacklist function, EG load_file, benchmark, pg_sleep, ...
API changes
Added context.appBasePath interface to get the root directory of the web application
New session operation interface , context.session.setSession, context.session.getSession
Other changes
Plug-in splitting, some unused detection logic, such as scanner recognition function, moved to addons directory
RaspInstall source code is open
CVE Vulnerability Coverage List Open
Major changes
Performance optimization
Due to poor jni performance, we decided to replace j2v8 with the latest version of Mozilla Rhino
In the worst case, the impact on the server in 2%the left and right, you can view specific performance test report
Drop support for WebLogic
API changes
Add SQL tokenize interface: RASP.sql_tokenize
Add SESSION to modify the interface: context.session.getSession / context.session.setSession
readFile Interface, when the file does not exist, the plugin will no longer be called
Hook point change
Add webdav hook point, can check MOVEand COPYoperate
Block log changes
Add HTTP Referer field
Increase request_idparameter is used to identify an attacker
Increase the event_typefield for signs log types
attack_time Field renamed event_time
attack_params Change the field to JSON format (previously it was a string, you need to reconfigure ES mapping)
new features
Support custom interception page
By block.urlConfiguration
The default is the little dinosaur page
Add server security baseline check function, currently only supports tomcat, can detect the following non-security configuration
Manager / html has a weak password
JSESSION does not open httpOnly
tomcat starts as root
The default webapps are not deleted
In the event of attack, the output plug extra confidencefield for identifying the reliability of the detection result
All in response to increased X-Protected-By: OpenRASPresponse headers
Support HTTP alarm push
Added support for Jetty and JBoss 5 ~ 6 servers
Added log.maxstack configuration option to configure the maximum stack in the alarm log
Algorithm improvements
Increase scanner identification, according to UA, Header (default closed, please manually modify the plug-in)
SQL injection detection algorithm # 1 open
Sensitive file download vulnerability detection
Other changes
JBoss XXE Hook points are optimized to improve performance
Bug fix
When a runtime error occurs in the JS plugin, the alarm log should not be printed
When the JS plugin fails, print detailed stack and error information in plugin.log
new features
Add an exception flow identification, when certain classes are called through reflection, it will trigger the plug-in detection logic
Bug fix
Added doFilter hook point to fix the problem that the vulnerability cannot be detected under the struts series framework
new features
Support multiple Java servers and database servers
Support multiple SIEM applications
Complete the first version of the official detection plugin
Support multiple hook points
First version for JAVA/ElasticSearch 1.2.0, result of OASES (Open AI System Security Alliance) Project.
PHP Versio, Credits to PIOF Project
COPYRIGHT (C) 2014-2022 SECURITY REVIEWER SRL. ALL RIGHTS RESERVED.