SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillsjava-vuln-scanner

java-vuln-scanner

Security & auditing

View repository

Updated 10-16 04:57

About this skill

Java Component Vulnerability Scanner

Scans Java project dependencies for known vulnerabilities, supports 130+ CVE rules, outputs grouped by module, and generates vulnerability trigger point inspection results via AI.

Workflow

1. Determine the scan target

Supported input types:

  • pom.xml - Maven project
  • build.gradle - Gradle project
  • .jar file - extract dependency information from the file name or META-INF
  • directory - recursively scan all the above files, automatically grouped by module

2. Handle jar/class files (when decompilation is needed)

When the target is a .jar or .class file and dependency information cannot be extracted directly, use the CFR decompiler (see java-shared/DECOMPILE_STRATEGY.md）：

# 反编译单个文件
java -jar {CFR_JAR} /path/to/file.jar --outputdir {output_path}/decompiled

# 反编译目录
find /path/to/classes -name "*.class" | xargs java -jar {CFR_JAR} --outputdir {output_path}/decompiled

3. Execute vulnerability scan

Run the scan script; the report is automatically saved to the {项目名}_audit/vuln_report/ directory:

python3 scripts/scan_dependencies.py <目标路径> \
  --rules references/java-vulnerability.yaml \
  --no-deps

Parameter description:

  • <目标路径>: pom.xml, build.gradle, jar file, or directory
  • --rules/-r: vulnerability rule file path (uses built-in rules)
  • --format/-f: output format (markdown/json)
  • --output/-o: specify the output path (auto-generated if not specified)
  • --depth/-d: module grouping depth (default: 2)
  • --no-deps: do not display the dependency list (simplified output)
  • --no-save: output to terminal only, do not save to file

4. Check the scan results

The report is grouped by module, and each module is classified by severity level:

  • 🔴 Critical: fix immediately (Log4Shell, Fastjson RCE, Shiro deserialization, etc.)
  • 🟠 High: fix as soon as possible (Spring Boot Actuator, XStream, etc.)
  • 🟡 Medium: plan to fix (JDBC driver vulnerabilities, Guava, etc.)
  • 🔵 Low: recommend upgrading (outdated components)

5. AI vulnerability trigger point analysis (important)

After the scan is complete,you mustbased on the scan results, follow the references/OUTPUT_TEMPLATE.md template to fill in the complete report (single file）。

Analysis steps

  1. Read the scan results generated by the Python script
  2. Identify the project runtime environment：
    • Check the frameworks used by the project: Spring MVC / Spring Boot / Struts2 / Servlet / JAX-RS, etc.
    • Check the container type: Tomcat / Jetty / Undertow / WebLogic / WildFly, etc.
    • Find configuration files:web.xml、struts.xml、application.yml、applicationContext.xml , etc.
  3. Extract routes and entry points：
    • Scan Controller / Action / Servlet classes and extract HTTP route mappings
    • Identify key entry points such as file upload, JSON/XML parsing, and user input handling
    • Combine with the java-route-mapper skill (if loaded) to obtain complete route information
  4. Extract the detectedunique vulnerable componentslist (deduplicated)
  5. Fill in the report according to the template, and the detail block for each vulnerability must include:
    • Trigger conditions
    • Dangerous code patterns (java code block)
    • Attack vectors
    • Affected routes/interfaces
    • Code search commands (bash code block)
    • Remediation Recommendations
  6. Use the Write tool to write the complete report to a single file

Environment Identification Method

Identify the project environment based on the following characteristics (refer to the identification strategy of the java-route-mapper skill):

Web Framework Identification:

Framework Identification Characteristics Configuration File Key Dependencies
Spring MVC @Controller、@RequestMapping、@RestController dispatcher-servlet.xml、spring-mvc.xml spring-webmvc.jar
Spring Boot @SpringBootApplication、Spring Boot starter application.properties、application.yml spring-boot-starter-*.jar
Struts 2 ActionSupport、\<action\> configuration struts.xml、struts-plugin.xml struts2-core.jar
Servlet HttpServlet、@WebServlet、\<servlet\> configuration web.xml javax.servlet-api.jar
JAX-RS @Path、@GET、@POST、@PathParam web.xml(REST servlet mapping) jersey-*.jar、cxf-rt-*.jar
CXF Web Services @WebService、\<jaxws:endpoint\> applicationContext.xml、cxf-servlet.xml cxf-*.jar

Container Identification:

Container Identification Characteristics Configuration File
Tomcat catalina.jar、org.apache.catalina server.xml、context.xml
Jetty jetty-*.jar、org.eclipse.jetty jetty.xml、webdefault.xml
Undertow undertow-*.jar、io.undertow undertow-handlers.conf
WebLogic weblogic.jar、weblogic.xml weblogic.xml、weblogic-application.xml
WildFly/JBoss jboss-*.jar、org.jboss jboss-web.xml、standalone.xml

Framework Combination Identification:

Multi-framework hybrid projects need to be identified and checked separately:

  • Struts2 + Spring: check struts-spring-plugin.jar and Spring configuration
  • Spring MVC + CXF: check \<jaxws:endpoint\> and @Controller coexistence
  • Servlet + Filter chain: check the filter-mapping order in web.xml filter-mapping order in

Vulnerability Rule Coverage

Rule file references/java-vulnerability.yaml contains 130+ rules, covering:

Component Category Main Vulnerabilities
Log4j CVE-2021-44228 (Log4Shell), CVE-2021-45046
Fastjson CVE-2022-25845, CVE-2017-18349
Spring CVE-2022-22965 (Spring4Shell), CVE-2022-22963
Struts2 S2-045, S2-046, S2-057, S2-061
Shiro CVE-2016-4437, CVE-2020-11989, CVE-2020-17510
Jackson CVE-2020-36518, CVE-2019-12384
XStream 15 CVEs including CVE-2021-39144
ActiveMQ CVE-2023-46604
JDBC Driver MySQL, PostgreSQL, H2, Derby, etc.

Example

Complete Scanning Process

# 1. 执行扫描
python3 scripts/scan_dependencies.py /path/to/webapp \
  --rules references/java-vulnerability.yaml \
  --no-deps

# 2. 输出示例:
# [INFO] 创建输出目录: webapp_audit/vuln_report
# [INFO] 报告已保存到: webapp_audit/vuln_report/webapp_vuln_report_20260204_101747.md
# 📊 扫描摘要:
#    模块数量: 4
#    依赖总数: 262
#    漏洞总数: 80
#    🔴 严重: 24

# 3. AI 自动读取报告并追加触发点检查结果

Output Report Structure

Output Constraints (non-violable):

  1. Output as a single file — must not be split into multiple files
  2. File naming format: {project_name}_vuln_report_{YYYYMMDD_HHMMSS}.md
  3. Must strictly fill the output according to the references/OUTPUT_TEMPLATE.md template
  4. Must not add or remove sections, and must not adjust the order of sections

Output Template: references/OUTPUT_TEMPLATE.md

{project_name}_audit/vuln_report/
└── {project_name}_vuln_report_{YYYYMMDD_HHMMSS}.md   ← 仅此 1 个文件
    ├── 1. 扫描概述
    ├── 2. 风险统计
    ├── 3. 组件漏洞映射表
    ├── 4. 漏洞详情（含触发条件、危险代码、攻击向量、搜索命令）
    └── 5. 审计结论

General output specification reference: java-shared/OUTPUT_STANDARD.md