Simon -> Emil

Hi Emil,

Thanks for contacting us, we'd be more than happy to organize a trial.
 
Our goal is to make sure you’ll get the most out of the trial and our engineers will work closely with you to achieve this. To get the right engineer from our side on the call, would you be able to answer the questions below?

    Can you explain your goals or pains you're dealing with that we can address in the trial? 

    What programming languages/platforms (Java, Kotlin, Android etc.) are you using in your team and across your company and what build tools are you using (Gradle, Maven, Bazel, etc.)? 

    How many developers on your team/org contribute to these projects?


What does your availability look like this week or the following to get things started?
 
Let me know and I will send over the calendar invite. Looking forward to connecting. Talk soon!

Cheers,

 Simon

Senior Sales Development Representative

Emil -> Simon

Hi Simon.

I am an independent security contractor who does penetration testing and bug bounty hunting for clients.

https://app.intigriti.com/researcher/profile/0xlime

I am interested in a Enterbuild test license that can allow me to spin up an Standaloneped version of the software to do security assessment of the software. I am in full compliance with your guidelines at {...} and will naturally confidentially disclose any findings I may have.

So to answer your questions:

    Can you explain your goals or pains you're dealing with that we can address in the trial?

Security research of the Enterbuild platform when self hosted in Standaloneped systems.

    What programming languages/platforms (Java, Kotlin, Android etc.) are you using in your team and across your company and what build tools are you using (Gradle, Maven, Bazel, etc.)?

I use any programming language needed for my security assessments.

    How many developers on your team/org contribute to these projects?

Just me :-)

Simon -> Emil
Hi Emil,

Thanks again for the insight on what you are looking to accomplish. I have looped in our VP of Information Security - Timothy  and he will go ahead and assist you with this process. Looking forward to connecting. Talk soon!

Cheers,

Timothy -> Emil

Hi Emil

Thanks for getting in touch and finding our Vulnerability Disclosure Policy! 

Could you provide any background as to your interest or how you found us? It's rare we get these requests from security researchers outside of the usual missing HTTP headers and DNS problems on our websites we get daily. 

The Standalone license will be time limited - how much time would you like? I'd need to check with Sales but i think 2-3 weeks would usually be the most we can do. 

We do pen test Enterbuild around 4 times a year but no test can cover everything. 

There may be some interesting information in the Key Features section here; {...}

Thanks,
Timothy

Emil -> Timothy

Hi Timothy.

{..} My interest then came to me again when doing some reconnaissance for a bug bounty program where I found some Enterbuild servers.

I have previously been working on security in DevOps tools, Gitlab mostly but also Jenkins {...}

That is to say, if I find anything again of course I will report it through the responsible disclosure policy.

2-3 weeks is perfect for me I think :-)

Thanks again Timothy

Timothy -> Emil

Thanks for the explanation! I'll get that license sent over to you
Feel free to send any questions etc our way. All our documentation is at docs.enterbuild.com

# Create containers from both versions without running them
docker create --name vulnerable registry.enterbuild.com/enterbuild/enterprise-app:3.2.6
docker create --name patched registry.enterbuild.com/enterbuild/enterprise-app:3.2.7

# Extract the filesystems
mkdir -p extracted/vulnerable
mkdir -p extracted/patched
docker cp vulnerable:/ ./extracted/vulnerable/
docker cp patched:/ ./extracted/patched/

#!/usr/bin/env python3

import os
import subprocess
import shutil
import re
import tempfile
import hashlib

# Create a temp directory for extraction
temp_dir = tempfile.mkdtemp()
print(f"Using temporary directory: {temp_dir}")

# Create output directories
os.makedirs("jar-diff/vulnerable", exist_ok=True)
os.makedirs("jar-diff/patched", exist_ok=True)

# Extract both JARs to temporary locations
print("Extracting vulnerable JAR...")
vuln_extract_dir = os.path.join(temp_dir, "vulnerable")
os.makedirs(vuln_extract_dir)
subprocess.run(
    f"unzip -q ./extracted/vulnerable/opt/app/lib/enterprise-app-all.jar -d {vuln_extract_dir}",
    shell=True
)

print("Extracting patched JAR...")
patched_extract_dir = os.path.join(temp_dir, "patched")
os.makedirs(patched_extract_dir)
subprocess.run(
    f"unzip -q ./extracted/patched/opt/app/lib/enterprise-app-all.jar -d {patched_extract_dir}",
    shell=True
)

# Get file lists with paths preserved
print("Generating file lists...")
vulnerable_files = {}
patched_files = {}

for root, _, files in os.walk(vuln_extract_dir):
    for file in files:
        full_path = os.path.join(root, file)
        rel_path = os.path.relpath(full_path, vuln_extract_dir)
        vulnerable_files[rel_path] = os.path.getsize(full_path)

for root, _, files in os.walk(patched_extract_dir):
    for file in files:
        full_path = os.path.join(root, file)
        rel_path = os.path.relpath(full_path, patched_extract_dir)
        patched_files[rel_path] = os.path.getsize(full_path)

# Find files with different sizes
print("Finding files with different sizes...")
diff_files = []
for filename, vuln_size in vulnerable_files.items():
    if filename in patched_files and vulnerable_files[filename] != patched_files[filename]:
        diff_files.append((filename, vuln_size, patched_files[filename]))

# Sort by size difference (largest first)
diff_files.sort(key=lambda x: abs(x[1] - x[2]), reverse=True)

with open("diff_sizes.txt", "w") as f:
    f.write("Files with different sizes:\n")
    for filename, vuln_size, patch_size in diff_files:
        f.write(f"{filename} ({vuln_size} → {patch_size})\n")

# Find files only in patched version
new_files = []
for filename in patched_files:
    if filename not in vulnerable_files:
        new_files.append(filename)

with open("new_files.txt", "w") as f:
    f.write("\nFiles only in patched version:\n")
    for filename in new_files:
        f.write(f"{filename}\n")

# Find files only in vulnerable version
removed_files = []
for filename in vulnerable_files:
    if filename not in patched_files:
        removed_files.append(filename)

with open("removed_files.txt", "w") as f:
    f.write("\nFiles only in vulnerable version:\n")
    for filename in removed_files:
        f.write(f"{filename}\n")

# Create a summary
with open("summary.txt", "w") as f:
    f.write("=== JAR Comparison Summary ===\n")
    f.write(f"Total files in vulnerable JAR: {len(vulnerable_files)}\n")
    f.write(f"Total files in patched JAR: {len(patched_files)}\n")
    f.write(f"Files with different sizes: {len(diff_files)}\n")
    f.write(f"New files in patched version: {len(new_files)}\n")
    f.write(f"Removed files in vulnerable version: {len(removed_files)}\n")

# Display the summary
with open("summary.txt", "r") as f:
    print(f.read())

#!/usr/bin/env python3

import os
import subprocess
import difflib
import sys
from concurrent.futures import ThreadPoolExecutor

# Directories containing the class files
vuln_dir = "jar-diff/vulnerable"
patched_dir = "jar-diff/patched"

# Create directories for decompiled files
decompiled_vuln_dir = "decompiled/vulnerable"
decompiled_patched_dir = "decompiled/patched"
diff_dir = "decompiled/diffs"

os.makedirs(decompiled_vuln_dir, exist_ok=True)
os.makedirs(decompiled_patched_dir, exist_ok=True)
os.makedirs(diff_dir, exist_ok=True)

# Get the mapping of safe filenames to original paths
file_mapping = {}
if os.path.exists("jar-diff/file_mapping.txt"):
    with open("jar-diff/file_mapping.txt", "r") as f:
        next(f)  # Skip header
        for line in f:
            if " -> " in line:
                safe_name, original_path = line.strip().split(" -> ", 1)
                file_mapping[safe_name] = original_path

# Function to decompile a class file
def decompile_file(input_file, output_dir):
    base_name = os.path.basename(input_file)
    if not base_name.endswith(".class"):
        return None

    output_file = os.path.join(output_dir, base_name.replace(".class", ".java"))

    # Use jadx to decompile
    try:
        subprocess.run(
            ["jadx", "-d", output_dir, input_file],
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE,
            check=True
        )

        # JADX creates a different output structure, find the decompiled file
        java_name = base_name.replace(".class", ".java")
        for root, _, files in os.walk(output_dir):
            for file in files:
                if file == java_name:
                    src_path = os.path.join(root, file)
                    if src_path != output_file:
                        os.makedirs(os.path.dirname(output_file), exist_ok=True)
                        os.rename(src_path, output_file)
                    return output_file

        # If we couldn't find the file, try CFR as a fallback
        subprocess.run(
            ["java", "-jar", "cfr.jar", input_file, "--outputdir", output_dir],
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE
        )
        return output_file
    except Exception as e:
        print(f"Error decompiling {input_file}: {e}")
        return None

# Decompile all class files in parallel
print("Decompiling vulnerable class files...")
vuln_files = [os.path.join(vuln_dir, f) for f in os.listdir(vuln_dir) if f.endswith(".class")]
patched_files = [os.path.join(patched_dir, f) for f in os.listdir(patched_dir) if f.endswith(".class")]

with ThreadPoolExecutor(max_workers=os.cpu_count()) as executor:
    vuln_results = list(executor.map(lambda f: decompile_file(f, decompiled_vuln_dir), vuln_files))
    patched_results = list(executor.map(lambda f: decompile_file(f, decompiled_patched_dir), patched_files))

# Generate diffs for each pair of files
print("Generating diffs...")
all_diffs = []

for filename in os.listdir(decompiled_vuln_dir):
    if not filename.endswith(".java"):
        continue

    vuln_file = os.path.join(decompiled_vuln_dir, filename)
    patched_file = os.path.join(decompiled_patched_dir, filename)

    if not os.path.exists(patched_file):
        continue

    # Read the files
    with open(vuln_file, 'r', encoding='utf-8', errors='ignore') as f:
        vuln_content = f.readlines()

    with open(patched_file, 'r', encoding='utf-8', errors='ignore') as f:
        patched_content = f.readlines()

    # Generate diff
    diff = list(difflib.unified_diff(
        vuln_content, patched_content,
        fromfile=f"vulnerable/{filename}",
        tofile=f"patched/{filename}",
        n=3
    ))

    if diff:
        # Write diff to file
        diff_file = os.path.join(diff_dir, filename.replace(".java", ".diff"))
        with open(diff_file, 'w', encoding='utf-8') as f:
            f.writelines(diff)

        # Calculate diff size (number of changed lines)
        diff_size = sum(1 for line in diff if line.startswith('+') or line.startswith('-'))

        # Get original path if available
        original_path = file_mapping.get(filename.replace(".java", ".class"), "Unknown")

        all_diffs.append((diff_file, diff_size, original_path))

# Sort diffs by size (largest changes first)
all_diffs.sort(key=lambda x: x[1], reverse=True)

# Write summary of all diffs
with open("decompiled/diff_summary.txt", "w") as f:
    f.write("=== All Diffs (Sorted by Size) ===\n\n")
    for diff_file, diff_size, original_path in all_diffs:
        f.write(f"File: {diff_file}\n")
        f.write(f"Original path: {original_path}\n")
        f.write(f"Changed lines: {diff_size}\n")
        f.write("\n")

print(f"\nDecompilation and diff generation complete. Generated {len(all_diffs)} diffs.")
print("Check decompiled/diff_summary.txt for a summary of all changes, sorted by size.")
print("All diffs are available in the decompiled/diffs directory.")

# Create a simple HTML report for easier browsing
with open("decompiled/diff_report.html", "w") as f:
    f.write("""<!DOCTYPE html>
<html>
<head>
    <title>Class File Diff Report</title>
    <style>
        body { font-family: Arial, sans-serif; margin: 20px; }
        table { border-collapse: collapse; width: 100%; }
        th, td { border: 1px solid #ddd; padding: 8px; text-align: left; }
        th { background-color: #f2f2f2; }
        tr:nth-child(even) { background-color: #f9f9f9; }
        tr:hover { background-color: #f2f2f2; }
    </style>
</head>
<body>
    <h1>Class File Diff Report</h1>
    <table>
        <tr>
            <th>Diff File</th>
            <th>Original Path</th>
            <th>Changed Lines</th>
        </tr>
""")

    for diff_file, diff_size, original_path in all_diffs:
        rel_path = os.path.relpath(diff_file, "decompiled")
        f.write(f"""
        <tr>
            <td><a href="{rel_path}">{os.path.basename(diff_file)}</a></td>
            <td>{original_path}</td>
            <td>{diff_size}</td>
        </tr>
""")

    f.write("""
    </table>
</body>
</html>
""")

print("An HTML report is available at decompiled/diff_report.html")

@@ -22,10 +22,11 @@
     /* renamed from: a, reason: merged with bridge method [inline-methods] */
     public void execute(Chain chain) throws Exception {
-        chain.prefix("operator-hash", chain2 -> {
-            chain2.post("reset", this::a).path(context -> {
+        chain.prefix("operator-hash-safe", chain2 -> {
+            chain2.post("reset", ctx -> validateRequest(ctx, this::a)).path(context -> {
                 context.byMethod(byMethodSpec -> {
-                    byMethodSpec.get(this::b).post(this::c);
+                    byMethodSpec.get(ctx -> validateRequest(ctx, this::b))
+                               .post(ctx -> validateRequest(ctx, this::c));
                 });
             });
         });
@@ -43,6 +44,19 @@
         }
     }

+    private void validateRequest(Context ctx, Handler handler) {
+        if (!isAuthorizedRequest(ctx)) {
+            ctx.getResponse().status(HttpResponseStatus.UNAUTHORIZED.code()).send();
+            return;
+        }
+        handler.handle(ctx);
+    }
+    
+    private boolean isAuthorizedRequest(Context ctx) {
+        // Check for valid authentication token
+        return ctx.getRequest().getHeaders().contains("Authorization") && 
+               verifyToken(ctx.getRequest().getHeaders().get("Authorization"));
+    }