From fbfb5b036b510a2df86260a3300c7756d5b60ac0 Mon Sep 17 00:00:00 2001 From: PLRoman Date: Fri, 10 Jan 2020 13:17:18 -0600 Subject: [PATCH 01/54] Revise Sensitive Data Exposure > Critically Sensitive Data (#271) --- CHANGELOG.md | 9 +++++ deprecated-node-mapping.json | 9 +++++ mappings/cvss_v3/cvss_v3.json | 24 ++++++++++-- mappings/cwe/cwe.json | 13 +------ .../remediation_advice.json | 9 +---- vulnerability-rating-taxonomy.json | 38 +++++++++++++++---- 6 files changed, 73 insertions(+), 29 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1d680fe5..5932712d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,8 +5,17 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/) and this p ## [Unreleased] ### Added +- sensitive_data_exposure.disclosure_of_secrets.for_publicly_accessible_asset +- sensitive_data_exposure.disclosure_of_secrets.for_internal_asset +- sensitive_data_exposure.disclosure_of_secrets.pay_per_use_abuse +- sensitive_data_exposure.disclosure_of_secrets.intentionally_public_sample_or_invalid +- sensitive_data_exposure.disclosure_of_secrets.data_traffic_spam +- sensitive_data_exposure.disclosure_of_secrets.non_corporate_user ### Removed +- sensitive_data_exposure.critically_sensitive_data.password_disclosure +- sensitive_data_exposure.critically_sensitive_data.private_api_keys +- sensitive_data_exposure.critically_sensitive_data ### Changed diff --git a/deprecated-node-mapping.json b/deprecated-node-mapping.json index 73d7fdc0..3040d3e5 100644 --- a/deprecated-node-mapping.json +++ b/deprecated-node-mapping.json @@ -145,5 +145,14 @@ }, "cross_site_scripting_xss.ie_only.older_version_ie11": { "1.7": "cross_site_scripting_xss.ie_only.older_version_ie_eleven" + }, + "sensitive_data_exposure.critically_sensitive_data.password_disclosure": { + "1.9": "sensitive_data_exposure.disclosure_of_secrets" + }, + "sensitive_data_exposure.critically_sensitive_data.private_api_keys": { + "1.9": "sensitive_data_exposure.disclosure_of_secrets" + }, + "sensitive_data_exposure.critically_sensitive_data": { + "1.9": "sensitive_data_exposure" } } diff --git a/mappings/cvss_v3/cvss_v3.json b/mappings/cvss_v3/cvss_v3.json index 51165445..32d6c3ff 100644 --- a/mappings/cvss_v3/cvss_v3.json +++ b/mappings/cvss_v3/cvss_v3.json @@ -397,15 +397,31 @@ "id": "sensitive_data_exposure", "children": [ { - "id": "critically_sensitive_data", + "id": "disclosure_of_secrets", "children": [ { - "id": "password_disclosure", + "id": "for_publicly_accessible_asset", "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L" }, { - "id": "private_api_keys", - "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L" + "id": "for_internal_asset", + "cvss_v3": "AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L" + }, + { + "id": "pay_per_use_abuse", + "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + }, + { + "id": "intentionally_public_sample_or_invalid", + "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N" + }, + { + "id": "data_traffic_spam", + "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N" + }, + { + "id": "non_corporate_user", + "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N" } ] }, diff --git a/mappings/cwe/cwe.json b/mappings/cwe/cwe.json index 8da3c098..def4770c 100644 --- a/mappings/cwe/cwe.json +++ b/mappings/cwe/cwe.json @@ -227,17 +227,8 @@ "cwe": ["CWE-934"], "children": [ { - "id": "critically_sensitive_data", - "children": [ - { - "id": "password_disclosure", - "cwe": ["CWE-522"] - }, - { - "id": "private_api_keys", - "cwe": ["CWE-522"] - } - ] + "id": "disclosure_of_secrets", + "cwe": ["CWE-522"] }, { "id": "exif_geolocation_data_not_stripped_from_uploaded_images", diff --git a/mappings/remediation_advice/remediation_advice.json b/mappings/remediation_advice/remediation_advice.json index b6e25de2..e4fbbf71 100644 --- a/mappings/remediation_advice/remediation_advice.json +++ b/mappings/remediation_advice/remediation_advice.json @@ -737,13 +737,8 @@ ], "children": [ { - "id": "critically_sensitive_data", - "children": [ - { - "id": "private_api_keys", - "remediation_advice": "1. Do not store private API keys in source code that is publicly accessible such as in a public GitHub repository.\n2. Critically sensitive data should not be sent over cleartext. Make sure to only use `HTTPS` whenever transmitting private API keys.\n3. Browser headers are set to not cache when the sensitive data is presented to end-user." - } - ] + "id": "disclosure_of_secrets", + "remediation_advice": "1. Do not store secrets in source code that is publicly accessible such as in a public GitHub repository.\n2. Critically sensitive data should not be transmitted in cleartext. Make sure to only use `HTTPS` whenever transmitting passwords and private API keys.\n3. Set appropriate headers to prevent caching of sensitive data when served to end-user." }, { "id": "exif_geolocation_data_not_stripped_from_uploaded_images", diff --git a/vulnerability-rating-taxonomy.json b/vulnerability-rating-taxonomy.json index d9d73fe6..b5ef585a 100644 --- a/vulnerability-rating-taxonomy.json +++ b/vulnerability-rating-taxonomy.json @@ -799,21 +799,45 @@ "type": "category", "children": [ { - "id": "critically_sensitive_data", - "name": "Critically Sensitive Data", + "id": "disclosure_of_secrets", + "name": "Disclosure of Secrets", "type": "subcategory", "children": [ { - "id": "password_disclosure", - "name": "Password Disclosure", + "id": "for_publicly_accessible_asset", + "name": "For Publicly Accessible Asset", "type": "variant", "priority": 1 }, { - "id": "private_api_keys", - "name": "Private API Keys", + "id": "for_internal_asset", + "name": "For Internal Asset", "type": "variant", - "priority": 1 + "priority": 3 + }, + { + "id": "pay_per_use_abuse", + "name": "Pay-Per-Use Abuse", + "type": "variant", + "priority": 4 + }, + { + "id": "intentionally_public_sample_or_invalid", + "name": "Intentionally Public, Sample or Invalid", + "type": "variant", + "priority": 5 + }, + { + "id": "data_traffic_spam", + "name": "Data/Traffic Spam", + "type": "variant", + "priority": 5 + }, + { + "id": "non_corporate_user", + "name": "Non-Corporate User", + "type": "variant", + "priority": 5 } ] }, From b8d11e29f484e62f8d3b42e9afafbecf5a31ae45 Mon Sep 17 00:00:00 2001 From: PLRoman Date: Tue, 18 Feb 2020 14:42:28 -0600 Subject: [PATCH 02/54] Add Server-Side Template Injection (SSTI) (#275) --- CHANGELOG.md | 2 ++ mappings/cvss_v3/cvss_v3.json | 13 +++++++++++++ mappings/cwe/cwe.json | 4 ++++ .../remediation_advice.json | 7 +++++++ vulnerability-rating-taxonomy.json | 19 +++++++++++++++++++ 5 files changed, 45 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5932712d..ddfd5796 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,8 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/) and this p - sensitive_data_exposure.disclosure_of_secrets.intentionally_public_sample_or_invalid - sensitive_data_exposure.disclosure_of_secrets.data_traffic_spam - sensitive_data_exposure.disclosure_of_secrets.non_corporate_user +- server_side_injection.ssti.basic +- server_side_injection.ssti.custom ### Removed - sensitive_data_exposure.critically_sensitive_data.password_disclosure diff --git a/mappings/cvss_v3/cvss_v3.json b/mappings/cvss_v3/cvss_v3.json index 32d6c3ff..b86763e0 100644 --- a/mappings/cvss_v3/cvss_v3.json +++ b/mappings/cvss_v3/cvss_v3.json @@ -290,6 +290,19 @@ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N" } ] + }, + { + "id": "ssti", + "children": [ + { + "id": "basic", + "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" + }, + { + "id": "custom", + "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + } + ] } ] }, diff --git a/mappings/cwe/cwe.json b/mappings/cwe/cwe.json index def4770c..8aa0707d 100644 --- a/mappings/cwe/cwe.json +++ b/mappings/cwe/cwe.json @@ -172,6 +172,10 @@ "cwe": ["CWE-1007"] } ] + }, + { + "id": "ssti", + "cwe": ["CWE-94"] } ] }, diff --git a/mappings/remediation_advice/remediation_advice.json b/mappings/remediation_advice/remediation_advice.json index e4fbbf71..2ef7f5de 100644 --- a/mappings/remediation_advice/remediation_advice.json +++ b/mappings/remediation_advice/remediation_advice.json @@ -636,6 +636,13 @@ ] } ] + }, + { + "id": "ssti", + "remediation_advice": "1. Wherever possible, avoid creating templates from user input. Passing user input into templates as parameters is normally a safe alternative.\n2.If supporting user-submitted templates is a business requirement, consider using a simple logic-less template engine such as Mustache or one provided by the native language like Python's Template. If this is not an option, review the chosen template engine's documentation for hardening advice, and consider rendering the template within a sandboxed execution environment.", + "references": [ + "https://portswigger.net/kb/issues/00101080_server-side-template-injection" + ] } ] }, diff --git a/vulnerability-rating-taxonomy.json b/vulnerability-rating-taxonomy.json index b5ef585a..196fa599 100644 --- a/vulnerability-rating-taxonomy.json +++ b/vulnerability-rating-taxonomy.json @@ -635,6 +635,25 @@ "priority": 5 } ] + }, + { + "id": "ssti", + "name": "Server-Side Template Injection (SSTI)", + "type": "subcategory", + "children": [ + { + "id": "basic", + "name": "Basic", + "type": "variant", + "priority": 4 + }, + { + "id": "custom", + "name": "Custom", + "type": "variant", + "priority": null + } + ] } ] }, From fab61847d96748c26441b48257a977c59cf60197 Mon Sep 17 00:00:00 2001 From: PLRoman Date: Mon, 2 Mar 2020 20:52:35 -0600 Subject: [PATCH 03/54] Add Sensitive Data Exposure in local/sessionStorage (#276) --- CHANGELOG.md | 2 ++ mappings/cvss_v3/cvss_v3.json | 13 +++++++++++++ mappings/cwe/cwe.json | 4 ++++ .../remediation_advice.json | 7 +++++++ vulnerability-rating-taxonomy.json | 19 +++++++++++++++++++ 5 files changed, 45 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index ddfd5796..ab3f052b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -13,6 +13,8 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/) and this p - sensitive_data_exposure.disclosure_of_secrets.non_corporate_user - server_side_injection.ssti.basic - server_side_injection.ssti.custom +- sensitive_data_exposure.via_localstorage_sessionstorage.sensitive_token +- sensitive_data_exposure.via_localstorage_sessionstorage.non_sensitive_token ### Removed - sensitive_data_exposure.critically_sensitive_data.password_disclosure diff --git a/mappings/cvss_v3/cvss_v3.json b/mappings/cvss_v3/cvss_v3.json index b86763e0..db821733 100644 --- a/mappings/cvss_v3/cvss_v3.json +++ b/mappings/cvss_v3/cvss_v3.json @@ -519,6 +519,19 @@ { "id": "json_hijacking", "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N" + }, + { + "id": "via_localstorage_sessionstorage", + "children": [ + { + "id": "sensitive_token", + "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" + }, + { + "id": "non_sensitive_token", + "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N" + } + ] } ] }, diff --git a/mappings/cwe/cwe.json b/mappings/cwe/cwe.json index 8aa0707d..2ecb4ab1 100644 --- a/mappings/cwe/cwe.json +++ b/mappings/cwe/cwe.json @@ -261,6 +261,10 @@ { "id": "weak_password_reset_implementation", "cwe": ["CWE-640"] + }, + { + "id": "via_localstorage_sessionstorage", + "cwe": ["CWE-922"] } ] }, diff --git a/mappings/remediation_advice/remediation_advice.json b/mappings/remediation_advice/remediation_advice.json index 2ef7f5de..22a07c54 100644 --- a/mappings/remediation_advice/remediation_advice.json +++ b/mappings/remediation_advice/remediation_advice.json @@ -830,6 +830,13 @@ "references": [ "http://www.thespanner.co.uk/2011/05/30/json-hijacking/" ] + }, + { + "id": "via_localstorage_sessionstorage", + "remediation_advice": "Do not store anything sensitive in localStorage and any critical data in sessionStorage. Stick with properly secured cookies utilizing HTTPOnly and Secure flags", + "references": [ + "http://michael-coates.blogspot.com/2010/07/html5-local-storage-and-xss.html" + ] } ] }, diff --git a/vulnerability-rating-taxonomy.json b/vulnerability-rating-taxonomy.json index 196fa599..f36caa89 100644 --- a/vulnerability-rating-taxonomy.json +++ b/vulnerability-rating-taxonomy.json @@ -1027,6 +1027,25 @@ "name": "JSON Hijacking", "type": "subcategory", "priority": 5 + }, + { + "id": "via_localstorage_sessionstorage", + "name": "Via localStorage/sessionStorage", + "type": "subcategory", + "children": [ + { + "id": "sensitive_token", + "name": "Sensitive Token", + "type": "variant", + "priority": 4 + }, + { + "id": "non_sensitive_token", + "name": "Non-Sensitive Token", + "type": "variant", + "priority": 5 + } + ] } ] }, From 897fbb008ba029c8221fb851d3000d00e3bd7f3a Mon Sep 17 00:00:00 2001 From: PLRoman Date: Thu, 23 Apr 2020 14:51:51 -0500 Subject: [PATCH 04/54] Add Broken Link Hijacking (#277) Co-authored-by: Barnett Klane --- CHANGELOG.md | 1 + mappings/cvss_v3/cvss_v3.json | 4 ++++ mappings/cwe/cwe.json | 1 + mappings/remediation_advice/remediation_advice.json | 4 ++++ vulnerability-rating-taxonomy.json | 6 ++++++ 5 files changed, 16 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index ab3f052b..ebe95872 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -15,6 +15,7 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/) and this p - server_side_injection.ssti.custom - sensitive_data_exposure.via_localstorage_sessionstorage.sensitive_token - sensitive_data_exposure.via_localstorage_sessionstorage.non_sensitive_token +- server_side_injection.content_spoofing.impersonation_via_broken_link_hijacking ### Removed - sensitive_data_exposure.critically_sensitive_data.password_disclosure diff --git a/mappings/cvss_v3/cvss_v3.json b/mappings/cvss_v3/cvss_v3.json index db821733..d5bc63b2 100644 --- a/mappings/cvss_v3/cvss_v3.json +++ b/mappings/cvss_v3/cvss_v3.json @@ -277,6 +277,10 @@ "id": "iframe_injection", "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N" }, + { + "id": "impersonation_via_broken_link_hijacking", + "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + }, { "id": "external_authentication_injection", "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N" diff --git a/mappings/cwe/cwe.json b/mappings/cwe/cwe.json index 2ecb4ab1..8450d1ec 100644 --- a/mappings/cwe/cwe.json +++ b/mappings/cwe/cwe.json @@ -166,6 +166,7 @@ }, { "id": "content_spoofing", + "cwe": ["CWE-451"], "children": [ { "id": "homograph_idn_based", diff --git a/mappings/remediation_advice/remediation_advice.json b/mappings/remediation_advice/remediation_advice.json index 22a07c54..93c68d3f 100644 --- a/mappings/remediation_advice/remediation_advice.json +++ b/mappings/remediation_advice/remediation_advice.json @@ -590,6 +590,10 @@ "http://resources.infosecinstitute.com/iframe-security-risk/" ] }, + { + "id": "impersonation_via_broken_link_hijacking", + "remediation_advice": "In order to prevent this type of injection consider the following solutions:\n\n1. Keep track of company's public 3rd party accounts, that includes social media. Whenever one is deleted, make sure it is not referenced in the application\n2. Monitor all hyperlinks pointing to 3rd party resources, as well as any other external references for that matter, and make sure that they do not become invalid, e.g. check for change in HTTP response code. In many cases it may be possible for anyone to claim such URL's and share new content.\n3. Always treat all user input as untrusted data." + }, { "id": "external_authentication_injection", "remediation_advice": "Even if unsafe HTML tags like `