VulnerableCode Ubuntu 24.04

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is the recommended size for evaluation and the web app. If you plan to run large import pipelines, choose a size with more memory and disk.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the web interface. VulnerableCode serves plain HTTP on port 80. For production or shared access, terminate TLS in front of it with your own domain (see Step 8).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for VulnerableCode by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:vulnerablecode-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name vulnerablecode \
  --image sac1647283583153:vulnerablecode-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
# Open the HTTP port so you can reach the web interface
az vm open-port --resource-group <your-rg> --name vulnerablecode --port 80 --priority 900

Step 3 - Retrieve the per-VM admin credentials

Nothing secret is baked into the image. On first boot, a one-shot service (vulnerablecode-firstboot.service) generates a fresh Django secret key, application HMAC key, database password, administrator account and REST API token, all unique to your instance. It writes them to /root/vulnerablecode-credentials.txt, readable only by root.

SSH in as azureuser and read the file:

$
sudo cat /root/vulnerablecode-credentials.txt
# VulnerableCode - generated on first boot by vulnerablecode-firstboot.service.
# These credentials are unique to THIS VM. Store them somewhere safe. vulnerablecode.url=http://<vm-ip>/ vulnerablecode.admin.user=admin vulnerablecode.admin.pass=<VULNERABLECODE_ADMIN_PASSWORD> vulnerablecode.api.email=api@sac.local vulnerablecode.api.token=<VULNERABLECODE_API_TOKEN> VULNERABLECODE_ADMIN_PASSWORD=<VULNERABLECODE_ADMIN_PASSWORD> VULNERABLECODE_API_TOKEN=<VULNERABLECODE_API_TOKEN>

The first-boot service that rotates these per-VM secrets is installed and enabled.

Step 4 - Browse the web UI

Open http://<vm-ip>/ in your browser. The home page is a search interface over packages and advisories.

On a freshly deployed instance the database is empty, so searches return no results until you run the import pipelines (Step 6). The search page is protected by a lightweight proof-of-work challenge (ALTCHA) that your browser solves automatically to deter scraping. Once you have imported data, a search returns the matching packages with their vulnerability status and risk score.

Select a package to open its detail page. It lists the advisories that affect the package and the ones it fixes, each linked to its CVE aliases.

The public web UI, the interactive API docs and the staff sign-in page all answer through nginx.

Staff sign-in is at http://<vm-ip>/admin/login/. Sign in as admin with the password from the credentials file to reach the Django admin (/admin/) and the pipeline dashboard. The login form is captcha-protected.

Step 5 - Call the REST API

The REST API is served under /api/v3/. By default, two things are required:

• The VCIO_API_AGENT User-Agent header. The API rejects generic clients, but the interactive docs at /api/docs/ are exempt.
• A per-VM API token, because this image ships with API authentication enabled.

Use the token from the credentials file:

# List the package ecosystems the instance supports (a GET endpoint)
curl -s -A "VCIO_API_AGENT" \
  -H "Authorization: Token <VULNERABLECODE_API_TOKEN>" \
  http://<vm-ip>/api/v3/package-types/ | head -c 400; echo

The expected output is a JSON list of supported package types, such as pypi, npm, deb and maven:

{"package_types":["alpine","apache","cargo","composer","conan","deb","gem","generic","github","golang","hex","maven","npm","nuget","pypi","rpm", ...]}

The interactive API documentation at http://<vm-ip>/api/docs/ documents every endpoint, the required User-Agent, and the request bodies for the POST bulk-lookup endpoints (packages, advisories).

Because API authentication is enabled by default, a request with the correct User-Agent but no token is rejected. The same request with the per-VM token succeeds.

To make the API fully open and read-only instead, set VULNERABLECODEIO_REQUIRE_AUTHENTICATION=False in /opt/vulnerablecode/.env and restart the service:

sudo systemctl restart vulnerablecode

Step 6 - Populate the database with the import pipelines

The image ships with an empty, migrated database. Populate it with the importers you need.

These pipelines download large volumes of data and can run for a long time. Run them in a tmux or screen session, or as a scheduled job, rather than interactively over a fragile connection.

First, list the available import and enrichment pipelines:

sudo vc-manage import --list sudo vc-manage improve --list

Then run a specific pipeline by name. For example, to import the nginx advisories and compute risk scores, run sudo vc-manage import nginx_importer_v2, followed by sudo vc-manage improve unfurl_version_range_v2 and sudo vc-manage improve compute_package_risk_v2.

After an import completes, the packages and advisories are searchable in the web UI (Step 4) and queryable through the REST API (Step 5).

Step 7 - Administer the instance

vc-manage is a thin wrapper around Django's manage.py. It runs as the vulnerablecode service user with the instance environment.

# Create an additional administrator
sudo vc-manage createsuperuser
# Create an additional API user + key
sudo vc-manage create_api_user --email <your-email>
# Open a Django shell
sudo vc-manage shell

Configuration lives in /opt/vulnerablecode/.env. Restart vulnerablecode after you edit it.

Step 8 - Enable HTTPS with your own domain

For production, put your own domain in front and terminate TLS. Point a DNS A record at the VM. Then add your host to ALLOWED_HOSTS and CSRF_TRUSTED_ORIGINS in /opt/vulnerablecode/.env, and obtain a certificate with certbot for the nginx site:

sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.com
sudo systemctl restart vulnerablecode

Support

Every SecureAnyCloud image is backed by 24/7 support. Contact us for help with deployment, upgrades, TLS termination, scheduling the import pipelines, API integration and scaling.

Deploy on Azure

Launch VulnerableCode on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com