Empty Risky Service Principals leads to JSON parsing error

[schrolla]

Prerequisites

• This issue has an informative and human-readable title.

ScubaGear Version

v1.5.0

Operating System

Windows 11

PowerShell Version

5.1

M365 Environment and License(s)

M365 Environment: GCC high
License Types:

🐛 Summary

When running ScubaGear, receive the following error running against a particular GCC high tenant environment.

Fatal Error involving the Report Creation.
Ending ScubaGear execution. Error: Invalid JSON primitive: .

at New-Report,
C:\Users\Administrator\Documents\WindowsPowerShell\Modules\ScubaGear\1.5.0\Modules\CreateReport\CreateReport.psm1:
line 66
at Invoke-ReportCreation,
C:\Users\Administrator\Documents\WindowsPowerShell\Modules\ScubaGear\1.5.0\Modules\Orchestrator.psm1: line 1277
at Invoke-SCuBA,
C:\Users\Administrator\Documents\WindowsPowerShell\Modules\ScubaGear\1.5.0\Modules\Orchestrator.psm1: line 440
at , C:\Users\Administrator\Documents\gcc1test.ps1: line 6
at , : line 1
At C:\Users\Administrator\Documents\WindowsPowerShell\Modules\ScubaGear\1.5.0\Modules\Orchestrator.psm1:1371 char:13

•         throw $InvokeReportErrorMessage
  

•         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : OperationStopped: (Fatal Error inv...o file>: line 1:String) [], RuntimeException
  • FullyQualifiedErrorId : Fatal Error involving the Report Creation.
    Ending ScubaGear execution. Error: Invalid JSON primitive: .

  at New-Report, C:\Users\Administrator\Documents\WindowsPowerShell\Modules\ScubaGear\1.5.0\Modules\CreateReport\Cre
  ateReport.psm1: line 66
  at Invoke-ReportCreation, C:\Users\Administrator\Documents\WindowsPowerShell\Modules\ScubaGear\1.5.0\Modu
  les\Orchestrator.psm1: line 1277
  at Invoke-SCuBA, C:\Users\Administrator\Documents\WindowsPowerShell\Modules\ScubaGear\1.5.0\Modules\Orche
  strator.psm1: line 440
  at , C:\Users\Administrator\Documents\gcc1test.ps1: line 6
  at , : line 1

When reviewing the associated ScubaResults JSON file, it appears the risky_third_party_service_principals key has no value, resulting in the parsing error.

Steps to reproduce

1. Setup tenant environment where there may be one or more risky apps, but no risky SPs (if possible).
2. Run ScubaGear in GCC high environment

   Invoke-Scuba -ProductNames @("defender", "teams", "exo", "sharepoint", "aad") `
   -M365Environment gcchigh `
   -AppID <rREDACTED> `
   -CertificateThumbprint <REDACTED> `
   -Organization <REDACTED> `
   -OutPath <REDACTED> `
   -Quiet
   

3. Watch for fatal error during CreateReport stage of processing.

Expected behavior

ScubaGear should generate a complete report without errors.

Output from Initialize-SCuBA (optional)

No response

[schrolla]

A very quick look at the code starting in ExportAADProvider.psm1:192 shows where the key value is set. It looks like it only considers when both SP and Apps values are null, and not if one or the other may be null.
Recommend looking at how the conditional handles one or the other being null as a possible code path that isn't covered and might result in null JSON values.