OWASP VulnerableApp 2.2.0

🚀 OWASP VulnerableApp 2.2.0

🎉 OWASP VulnerableApp 2.2.0 is here! This release brings expanded hands-on security challenges, new vulnerability scenarios, additional secure implementations, and broader DAST/SAST scanner benchmarking. It also includes 🔒 security fixes, 🐛 bug fixes, and improvements across the developer experience.

🚀 Highlights

🎯 Expanded Challenge Mode

Challenge Mode now covers more vulnerability categories, helping users explore security weaknesses through hands-on exercises.

🆕 Added Challenge Mode support for:

• 💉 Injection: LDAP Injection, Error-Based SQL Injection, Union-Based SQL Injection, and Command Injection.
• 🌐 Web vulnerabilities: File Upload, SSRF, XSS, and Path Traversal.
• 🔍 Other vulnerability categories: XXE, JWT, Cache Poisoning, and Cryptographic Failures.
• 🔐 Access control: Improved IDOR challenge-card annotations and hints.

🛡️ New Vulnerabilities and Secure Implementations

• 🆕 Added Session Management, OTP, and Insecure Deserialization vulnerability scenarios.
• 💥 Added Billion Laughs attack levels for XXE.
• 📧 Added password reset functionality with rate limiting and email integration.
• ✅ Added secure File Upload, Path Traversal, Persistent XSS, and Open Redirect implementations.
• 🧪 Improved Cryptographic Failures challenges and added further SQL Injection test coverage.

📊 Expanded Security Scanner Benchmarking

New benchmark integrations:

• 🕷️ OWASP ZAP by Checkmarx
• 🔎 Semgrep
• 🌐 Wapiti

📈 Benchmark improvements include additional ZAP findings, corrected SAST ground truth, and fixes to scanner and sitemap URL handling when applications use a custom server.servlet.context-path.

🐛 Bug Fixes and 🔒 Security Improvements

• 🚫 Closed case-sensitivity bypasses in Open Redirect and SSRF protocol validation.
• 📂 Added Path Traversal checks before reading files and moved JWT PEM files out of served static templates.
• 🔑 Fixed JWT levels affected by debug logging, authentication seed hashes, and IDOR demo account credentials.
• 🐳 Improved unrestricted file upload compatibility when running from a JAR or as a non-root user.
• 📧 Fixed Mailpit integration and 🖥️ UI navigation flickering.
• 🌍 Fixed internationalization issues, translation problems, and broken documentation links.
• 📊 Corrected benchmark ground-truth mappings and fixed the sample vulnerability generation task.
• 🔧 Standardized API deprecation and sunset headers.

🧰 Developer Experience and 📚 Documentation

• ✉️ Added SMTP support and Mailpit-backed email functionality.
• ⚡ Added a server startup action to simplify pull request reviews.
• 🎬 Added a project overview video and Challenge Mode / Scanner Mode demonstration GIFs.
• 🌏 Added Korean and Brazilian Portuguese README translations.
• 🖼️ Improved language selection and language-specific documentation assets.

⚠️ API Deprecation: The bare GET /scanner endpoint is deprecated. Use GET /scanner/sast or GET /scanner/dast instead.

🙌 🎉 Contributors

💙 A huge thank you to everyone who contributed code, security improvements, benchmark integrations, documentation, translations, and testing to this release!

❤️ @wipheg · @ArjavTripathi · @CHI7440 · @InCaelus · @antriksh-9 · @logeshkumar11-dev · @mmlzq · @nirupam-06 · @Mubashir78 · @MixhizoR · @vianbas · @pereiravp · @rusetiq · @sharankumar-k · @VKspyder2003 · @AzazelSensei · @krev-jinn · @TianHengZhuang · @sara-zou · @Eyablg-ops · @Akhil-1527 · @palSayan1000 · @souravC01 · @JadAlTounsi · @agenticsymphony-tech · @preetkaran20

🌟 Your contributions help make OWASP VulnerableApp a better platform for security education, vulnerability research, and reproducible security scanner evaluation. Thank you for being part of the community! 🤝

📋 Full Changelog

🔗 [View the full changelog from 2.1.0 to 2.2.0](2.1.0...2.2.0)

⭐ If you find OWASP VulnerableApp useful, please star the [GitHub repository](https://github.com/SasanLabs/VulnerableApp) and consider contributing! 🚀