cyberchef/scripts/vulnerability-triage.js

#!/usr/bin/env node

/**
 * Vulnerability Triage Script
 *
 * This script analyzes npm audit results and provides:
 * - Priority ranking of vulnerabilities
 * - Detection of actively exploited vulnerabilities
 * - Recommendations for fixes
 * - Risk assessment
 */

const { execSync } = require('child_process');
const fs = require('fs');
const path = require('path');

// ANSI color codes
const colors = {
    reset: '\x1b[0m',
    bright: '\x1b[1m',
    red: '\x1b[31m',
    green: '\x1b[32m',
    yellow: '\x1b[33m',
    blue: '\x1b[34m',
    magenta: '\x1b[35m',
    cyan: '\x1b[36m',
};

// Known actively exploited CVEs (update regularly from CISA KEV catalog)
const ACTIVELY_EXPLOITED = new Set([
    'GHSA-4hjh-wcwx-xvwj',  // axios DoS
    'GHSA-jr5f-v2jv-69x6',  // axios SSRF
    // Add more from https://www.cisa.gov/known-exploited-vulnerabilities-catalog
]);

// CWE categories that indicate high exploitability
const HIGH_RISK_CWES = new Set([
    'CWE-78',   // OS Command Injection
    'CWE-79',   // XSS
    'CWE-89',   // SQL Injection
    'CWE-94',   // Code Injection
    'CWE-798',  // Hard-coded Credentials
    'CWE-918',  // SSRF
    'CWE-502',  // Deserialization
]);

class VulnerabilityTriager {
    constructor() {
        this.auditData = null;
        this.vulnerabilities = [];
        this.prioritized = {
            critical: [],
            high: [],
            moderate: [],
            low: []
        };
    }

    runAudit() {
        console.log(`${colors.blue}🔍 Running npm audit...${colors.reset}\n`);

        try {
            const result = execSync('npm audit --json', {
                encoding: 'utf-8',
                stdio: ['pipe', 'pipe', 'ignore']
            });
            this.auditData = JSON.parse(result);
        } catch (error) {
            // npm audit exits with non-zero if vulnerabilities found
            if (error.stdout) {
                this.auditData = JSON.parse(error.stdout);
            } else {
                console.error(`${colors.red}❌ Failed to run npm audit${colors.reset}`);
                process.exit(1);
            }
        }
    }

    analyzeVulnerabilities() {
        console.log(`${colors.cyan}📊 Analyzing vulnerabilities...${colors.reset}\n`);

        if (!this.auditData || !this.auditData.vulnerabilities) {
            console.log(`${colors.green}✅ No vulnerabilities found!${colors.reset}`);
            return;
        }

        for (const [packageName, vuln] of Object.entries(this.auditData.vulnerabilities)) {
            const analysis = this.analyzeVulnerability(packageName, vuln);
            this.vulnerabilities.push(analysis);
            this.prioritized[vuln.severity].push(analysis);
        }
    }

    analyzeVulnerability(packageName, vuln) {
        const analysis = {
            package: packageName,
            severity: vuln.severity,
            range: vuln.range,
            fixAvailable: vuln.fixAvailable,
            via: vuln.via,
            isDirect: vuln.isDirect,
            riskScore: 0,
            exploitable: false,
            highRiskCWE: false,
            recommendations: []
        };

        // Calculate risk score
        if (vuln.severity === 'critical') analysis.riskScore += 40;
        else if (vuln.severity === 'high') analysis.riskScore += 30;
        else if (vuln.severity === 'moderate') analysis.riskScore += 20;
        else if (vuln.severity === 'low') analysis.riskScore += 10;

        // Check for actively exploited vulnerabilities
        for (const issue of vuln.via) {
            if (typeof issue === 'object') {
                const ghsaId = issue.url ? issue.url.split('/').pop() : null;

                if (ghsaId && ACTIVELY_EXPLOITED.has(ghsaId)) {
                    analysis.exploitable = true;
                    analysis.riskScore += 50; // Massive boost for active exploitation
                }

                // Check for high-risk CWEs
                if (issue.cwe) {
                    for (const cwe of issue.cwe) {
                        if (HIGH_RISK_CWES.has(cwe)) {
                            analysis.highRiskCWE = true;
                            analysis.riskScore += 20;
                        }
                    }
                }

                // Check CVSS score
                if (issue.cvss && issue.cvss.score >= 9.0) {
                    analysis.riskScore += 15;
                }
            }
        }

        // Direct dependencies are more concerning
        if (vuln.isDirect) {
            analysis.riskScore += 10;
        }

        // Generate recommendations
        this.generateRecommendations(analysis);

        return analysis;
    }

    generateRecommendations(analysis) {
        if (analysis.exploitable) {
            analysis.recommendations.push({
                priority: 'URGENT',
                action: 'This vulnerability is being actively exploited in the wild. Apply fix immediately.',
                icon: '🚨'
            });
        }

        if (analysis.fixAvailable) {
            if (analysis.severity === 'critical' || analysis.severity === 'high') {
                analysis.recommendations.push({
                    priority: 'HIGH',
                    action: 'Run: npm audit fix --force',
                    icon: '🔧'
                });
            } else {
                analysis.recommendations.push({
                    priority: 'MEDIUM',
                    action: 'Run: npm audit fix',
                    icon: '🔧'
                });
            }
        } else {
            if (analysis.severity === 'critical' || analysis.severity === 'high') {
                analysis.recommendations.push({
                    priority: 'HIGH',
                    action: 'No automatic fix available. Consider: 1) Finding alternative package, 2) Waiting for upstream fix, 3) Patching manually',
                    icon: '⚠️'
                });
            } else {
                analysis.recommendations.push({
                    priority: 'LOW',
                    action: 'Monitor for updates. Consider alternative packages if available.',
                    icon: 'ℹ️'
                });
            }
        }

        if (analysis.isDirect) {
            analysis.recommendations.push({
                priority: 'MEDIUM',
                action: 'Direct dependency - can be updated directly in package.json',
                icon: '📦'
            });
        } else {
            analysis.recommendations.push({
                priority: 'LOW',
                action: 'Transitive dependency - requires updating parent package',
                icon: '🔗'
            });
        }

        if (analysis.highRiskCWE) {
            analysis.recommendations.push({
                priority: 'HIGH',
                action: 'High-risk vulnerability type detected. Review code for potential impact.',
                icon: '⚡'
            });
        }
    }

    printReport() {
        console.log(`${colors.bright}═══════════════════════════════════════════════════════════${colors.reset}`);
        console.log(`${colors.bright}${colors.cyan}           VULNERABILITY TRIAGE REPORT${colors.reset}`);
        console.log(`${colors.bright}═══════════════════════════════════════════════════════════${colors.reset}\n`);

        // Summary
        const summary = this.auditData.metadata.vulnerabilities;
        console.log(`${colors.bright}📊 Summary:${colors.reset}`);
        console.log(`   🔴 Critical: ${colors.red}${summary.critical || 0}${colors.reset}`);
        console.log(`   🟠 High:     ${colors.yellow}${summary.high || 0}${colors.reset}`);
        console.log(`   🟡 Moderate: ${summary.moderate || 0}`);
        console.log(`   ⚪ Low:      ${summary.low || 0}`);
        console.log(`   ━━━━━━━━━━━━━━━━━━━━`);
        console.log(`   📦 Total:    ${colors.bright}${summary.total || 0}${colors.reset}\n`);

        // Actively exploited
        const exploitable = this.vulnerabilities.filter(v => v.exploitable);
        if (exploitable.length > 0) {
            console.log(`${colors.red}${colors.bright}🚨 ACTIVELY EXPLOITED VULNERABILITIES: ${exploitable.length}${colors.reset}\n`);
            exploitable.forEach(vuln => this.printVulnerability(vuln, true));
        }

        // Print by severity
        const severities = ['critical', 'high', 'moderate', 'low'];
        for (const severity of severities) {
            const vulns = this.prioritized[severity];
            if (vulns.length > 0 && severity !== 'low') {  // Skip low for brevity
                this.printSeveritySection(severity, vulns);
            }
        }

        // Action items
        this.printActionItems();

        console.log(`\n${colors.bright}═══════════════════════════════════════════════════════════${colors.reset}\n`);
    }

    printSeveritySection(severity, vulnerabilities) {
        const color = severity === 'critical' ? colors.red :
                     severity === 'high' ? colors.yellow :
                     severity === 'moderate' ? colors.blue : colors.reset;

        const icon = severity === 'critical' ? '🔴' :
                    severity === 'high' ? '🟠' :
                    severity === 'moderate' ? '🟡' : '⚪';

        console.log(`\n${color}${colors.bright}${icon} ${severity.toUpperCase()} PRIORITY (${vulnerabilities.length})${colors.reset}`);
        console.log(`${'─'.repeat(59)}\n`);

        // Sort by risk score
        const sorted = vulnerabilities.sort((a, b) => b.riskScore - a.riskScore);

        sorted.forEach((vuln, idx) => {
            if (idx < 5 || severity === 'critical') {  // Show top 5 or all critical
                this.printVulnerability(vuln);
            }
        });

        if (sorted.length > 5 && severity !== 'critical') {
            console.log(`   ... and ${sorted.length - 5} more\n`);
        }
    }

    printVulnerability(vuln, detailed = false) {
        const color = vuln.severity === 'critical' ? colors.red :
                     vuln.severity === 'high' ? colors.yellow : colors.reset;

        console.log(`${color}📦 ${colors.bright}${vuln.package}${colors.reset} ${color}(Risk: ${vuln.riskScore})${colors.reset}`);
        console.log(`   Version: ${vuln.range}`);
        console.log(`   ${vuln.fixAvailable ? '✅ Fix available' : '❌ No automatic fix'}`);

        if (vuln.exploitable) {
            console.log(`   ${colors.red}🚨 ACTIVELY EXPLOITED${colors.reset}`);
        }

        if (vuln.highRiskCWE) {
            console.log(`   ⚡ High-risk vulnerability type`);
        }

        if (detailed || vuln.severity === 'critical') {
            console.log(`\n   ${colors.bright}Issues:${colors.reset}`);
            for (const issue of vuln.via) {
                if (typeof issue === 'object') {
                    console.log(`   - ${issue.title}`);
                    console.log(`     ${colors.cyan}${issue.url}${colors.reset}`);
                    if (issue.cvss && issue.cvss.score) {
                        console.log(`     CVSS: ${issue.cvss.score}`);
                    }
                }
            }
        }

        console.log(`\n   ${colors.bright}Recommendations:${colors.reset}`);
        vuln.recommendations.forEach(rec => {
            const recColor = rec.priority === 'URGENT' ? colors.red :
                           rec.priority === 'HIGH' ? colors.yellow : colors.reset;
            console.log(`   ${rec.icon} ${recColor}[${rec.priority}]${colors.reset} ${rec.action}`);
        });

        console.log('');
    }

    printActionItems() {
        console.log(`\n${colors.bright}${colors.green}🎯 RECOMMENDED ACTIONS${colors.reset}`);
        console.log(`${'─'.repeat(59)}\n`);

        const actions = [];

        // Urgent: Actively exploited
        const exploitable = this.vulnerabilities.filter(v => v.exploitable);
        if (exploitable.length > 0) {
            actions.push({
                priority: 1,
                icon: '🚨',
                text: `IMMEDIATE: Fix ${exploitable.length} actively exploited vulnerability(ies)`,
                command: 'npm audit fix --force'
            });
        }

        // High priority: Critical vulnerabilities with fixes
        const criticalFixable = this.prioritized.critical.filter(v => v.fixAvailable);
        if (criticalFixable.length > 0) {
            actions.push({
                priority: 2,
                icon: '🔴',
                text: `Fix ${criticalFixable.length} critical vulnerability(ies)`,
                command: 'npm audit fix --force'
            });
        }

        // Medium priority: High vulnerabilities with fixes
        const highFixable = this.prioritized.high.filter(v => v.fixAvailable);
        if (highFixable.length > 0) {
            actions.push({
                priority: 3,
                icon: '🟠',
                text: `Fix ${highFixable.length} high severity vulnerability(ies)`,
                command: 'npm audit fix'
            });
        }

        // Review unfixable critical/high
        const unfixable = this.vulnerabilities.filter(v =>
            !v.fixAvailable && (v.severity === 'critical' || v.severity === 'high')
        );
        if (unfixable.length > 0) {
            actions.push({
                priority: 2,
                icon: '⚠️',
                text: `Manual review required for ${unfixable.length} unfixable critical/high vulnerability(ies)`,
                command: 'See recommendations above for each package'
            });
        }

        actions.sort((a, b) => a.priority - b.priority);

        actions.forEach((action, idx) => {
            console.log(`${idx + 1}. ${action.icon} ${colors.bright}${action.text}${colors.reset}`);
            console.log(`   ${colors.cyan}$ ${action.command}${colors.reset}\n`);
        });

        if (actions.length === 0) {
            console.log(`${colors.green}✅ No urgent actions required!${colors.reset}\n`);
        }
    }

    exportJSON(filename = 'vulnerability-report.json') {
        const report = {
            timestamp: new Date().toISOString(),
            summary: this.auditData.metadata.vulnerabilities,
            vulnerabilities: this.vulnerabilities,
            prioritized: this.prioritized
        };

        fs.writeFileSync(filename, JSON.stringify(report, null, 2));
        console.log(`${colors.green}✅ Report exported to ${filename}${colors.reset}\n`);
    }

    run() {
        this.runAudit();
        this.analyzeVulnerabilities();
        this.printReport();

        // Exit with error code if critical/high vulnerabilities exist
        const criticalCount = this.prioritized.critical.length;
        const highCount = this.prioritized.high.length;
        const exploitableCount = this.vulnerabilities.filter(v => v.exploitable).length;

        if (exploitableCount > 0) {
            console.log(`${colors.red}⚠️  Exiting with error code due to actively exploited vulnerabilities${colors.reset}\n`);
            process.exit(3);
        } else if (criticalCount > 0) {
            console.log(`${colors.red}⚠️  Exiting with error code due to critical vulnerabilities${colors.reset}\n`);
            process.exit(2);
        } else if (highCount > 0) {
            console.log(`${colors.yellow}⚠️  Exiting with error code due to high severity vulnerabilities${colors.reset}\n`);
            process.exit(1);
        }

        console.log(`${colors.green}✅ No critical or high severity vulnerabilities!${colors.reset}\n`);
        process.exit(0);
    }
}

// CLI execution
if (require.main === module) {
    const triager = new VulnerabilityTriager();
    triager.run();

    // Export JSON if --json flag is provided
    if (process.argv.includes('--json')) {
        triager.exportJSON();
    }
}

module.exports = VulnerabilityTriager;