Feat: add bentoml insecure deserlization plugin

[secureness]

The issue of this PR: #482
The testbed: google/security-testbeds#73

[secureness]

@tooryx could you help me on this issue too? In case your colleague was busy.

[lokiuox]

Hey @secureness, thanks for your contribution!

First of all, about your issues with Tsunami, the two CLI switches you're referencing were added pretty recently. Just make sure you're not using the Tsunami JAR from the release section, but rather compile everything from source. I'd suggest just purging everything and running the quick_start_advanced.sh script from scratch.

Also, I've found that I needed to append this to my yaml config, otherwise I'd get a Nullptr Exception:

common:
  net:
    http:
      trust_all_certificates: true
      connect_timeout_seconds: 30

About the plugin, I confirm it's working after fixing the small bugs I've highlighted in the review.

Please after addressing the review comments, also make sure to do the following:

• Try to fix the indentation, some lines seem extra-indented and a few multiline strings start and end at different indentation levels
• Add a file with the test cases. You can take inspiration from the other Python plugins in the repo

[secureness]

I'll add the test cases soon, sorry I didn't notice that Python plugins have test cases too :)

[secureness]

@lokiuox I added the tests.

[lokiuox]

Hi @secureness, I added a few more comments

[lokiuox]

Hey @secureness, I've left two comments on a a few minor things, besides those the plugin looks good.

[lokiuox]

Hi @secureness, I just noticed that the plugin lacks a check to ensure that the service is indeed BentoML before calling _IsServiceVulnerable(). If you could add a simple check in _IsSupportedService or Detect (e.g. calling an API or requesting a page that is specific to BentoML) that would be great. I'm otherwise ready to mark this plugin as approved.

[lokiuox]

LGTM - Approved
@maoning we can merge this and google/security-testbeds#73

Reviewer: Savio, Doyensec
Plugin: BentoML Insecure Deserialization RCE - CVE-2024-2912

[tooryx]

Hi @secureness,

This is being reviewed internally and should be merged in a few days.

~tooryx