CLI to Check For PHP Security Vulnerabilities

 

Enlightn Security Checker (from the folks behind Enlightn) is a command-line tool that checks if your application uses dependencies with known security vulnerabilities.

You can install it globally via composer to start checking projects:

composer global require enlightn/security-checker

Using the security-checker CLI, you provide a path to your project’s composer.lock file to get a report of any vulnerabilities:

⇒ security-checker security:check /path/to/composer.lock

{

    "laravel\/framework": {

        "version": "5.7.29",

        "time": "2020-04-14T14:16:19+00:00",

        "advisories": [

            {

                "title": "RCE vulnerability in \"cookie\" session driver",

                "link": "https:\/\/blog.laravel.com\/laravel-cookie-security-releases",

                "cve": null

            }

        ]

    },

    "robrichards\/xmlseclibs": {

        "version": "2.1.1",

        "time": "2019-11-05T11:51:00+00:00",

        "advisories": [

            {

                "title": "Filter input to avoid XPath injection",

                "link": "https:\/\/github.com\/robrichards\/xmlseclibs\/commit\/649032643f7aac493e91ca318da0339aec72aa4a",

                "cve": null

            }

        ]

    }

}

You can programmatically get a report with the following PHP code:

use Enlightn\SecurityChecker\SecurityChecker;

$result = (new SecurityChecker)->check('/path/to/composer.lock');

/*

{

  "laravel/framework": {

    "version": "8.22.0",

    "time": "2021-01-13T13:37:56+00:00",

    "advisories": [{

      "title": "Unexpected bindings in QueryBuilder",

      "link": "https://blog.laravel.com/security-laravel-62011-7302-8221-released",

      "cve": null

    }]

  }

}

*/

The Enlightn Security Checker uses the security advisories database to reference known security vulnerabilities in PHP projects and libraries. You can learn more about this package and view the source code on GitHub.