Using AI to analyse vulnerabilities

This project analyzes vulnerabilities identified by their CVE id. It tries to find out how a vulnerability can be exploited. The web application can be accessed at https://torstenwerner.github.io/vulnerability-analysis/. The prompt can optionally be specified as a parameter e.g.: https://torstenwerner.github.io/vulnerability-analysis/?prompt=CVE-2021-44228.

Architecture

The following technologies are used in the project.

• The OpenAI API with the websearch tool.
• Node to implement the AI service.
• An AWS lambda function to run the AI service without a permanently running server.
• The AWS gateway provides a secure REST API accessible from the internet.
• Svelte and Vite to implement a web UI.
• GitHub actions to build the web application and deploy it to GitHub pages.
• GitHub pages to deliver the web application to the user.

Status of the current implementation

• The file server.js implements a REST service using node to implement most of the business requirements.
• The file ai-chat.js implements the function askAi which is chatting with the AI.
• The file lambda/lambda.js implements an AWS Lambda function that provides the same functionality as the REST service.
• The file lambda/update-lambda.js updates the lambda function in AWS.
• The file client-slim.js tests the REST service or the lambda function.
• The file client-fat.js tests the business logic directly without using server.js.
• The directory webapp implements a Svelte based web application that can be deployed to any web server. It is currently deployed to GitHub pages.

AWS Lambda Deployment

The Lambda function code and configuration is located in the lambda directory.

To deploy the Lambda function:

1. Navigate to the lambda directory:

   cd lambda

2. Build and package the Lambda function:

   npm run package

3. Deploy to AWS Lambda:

   npm run update

Alternatively, you can manually deploy:

• Create a new Lambda function in the AWS Console
• Select "Author from scratch"
• Runtime: Node.js 20.x
• Architecture: x86_64 or arm64
• Upload the generated function.zip
• Set the handler to "lambda.handler"
• Configure environment variables:
  • OPENAI_API_KEY: Your OpenAI API key

4. Configure API Gateway:
   • Create a new REST API
   • Create a POST method for the /cve-analysis endpoint
   • Integrate with your Lambda function
   • Deploy the API

The Lambda function will now be accessible through the API Gateway endpoint.

Ideas

• improved UI
• https://upstash.com/ for caching responses to reduce AI costs (Redis)
• or https://supabase.com/database (PostgreSQL)
• Use https://brave.com/search/api/ for a less expensive web search.
• improved AI developer prompt
• fetch data from the NVD API and include it in the AI developer prompt
• Allow uploading a JSON report from the OWASP Dependency-Check and render a select menu for all included CVE ids. Parse the JSON in the browser for data protection reasons.
• Render a full AI report for the uploaded OWASP JSON report adding AI answers to the NVD data for each CVE.
• Allow uploading two JSON OWASP reports from different generation dates and render an AI report that visualizes all new and fixed vulnerabilities.
• Add more research areas beyond vulnerability analysis.