A minimal Maven WAR application with intentionally outdated dependencies for demonstrating:
- Syft SBOM generation from a WAR file
- GitHub Advanced Security (GHAS) — Dependabot alerts, CodeQL code scanning
- Dependency vulnerability discovery for enterprise Java apps
⚠️ This repository contains known-vulnerable dependencies. Do not deploy to production.
| Library | Version | CVE | Severity | Common Name |
|---|---|---|---|---|
log4j-core |
2.14.1 | CVE-2021-44228 | Critical | Log4Shell |
log4j-core |
2.14.1 | CVE-2021-45046 | Critical | Log4Shell variant |
spring-webmvc |
5.3.17 | CVE-2022-22965 | Critical | Spring4Shell |
commons-text |
1.9 | CVE-2022-42889 | Critical | Text4Shell |
jackson-databind |
2.13.0 | CVE-2022-42003 | High | — |
snakeyaml |
1.29 | CVE-2022-25857 | High | — |
- Java 11+
- Maven 3.8+
- Syft (
brew install syfton macOS)
mvn package -DskipTests
# Output: target/demo-java-war.warsyft scan target/demo-java-war.war -o tablesyft scan target/demo-java-war.war -o cyclonedx-json=sbom.cdx.jsonsyft scan target/demo-java-war.war -o spdx-json=sbom.spdx.jsonsyft scan target/demo-java-war.war -o cyclonedx-json | grypeOn every push to main, the workflows:
| Workflow | What it does |
|---|---|
build-and-sbom.yml |
Builds WAR, runs Syft, uploads CycloneDX + SPDX SBOMs as artifacts |
codeql.yml |
Runs CodeQL Java analysis, uploads results to GitHub Security tab |
SBOM artifacts are downloadable from the Actions tab → latest run → Artifacts.
Navigate to Security → Dependabot alerts to see all CVEs detected in pom.xml.
Navigate to Security → Code scanning alerts to see any findings from CodeQL's Java analysis.
Enabled by default for public repositories — any accidentally committed credentials will appear under Security → Secret scanning alerts.