-
Notifications
You must be signed in to change notification settings - Fork 1.7k
style: normalize csv files (LF + trim) #12661
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: dev
Are you sure you want to change the base?
Conversation
This pull request contains multiple information disclosure risks, including a hardcoded password in App.config, sensitive infrastructure details in a Twistlock scan report, and exposed AWS account information with specific user details, which could potentially be exploited for unauthorized access or social engineering attacks.
Hardcoded Password in
|
Vulnerability | Hardcoded Password |
---|---|
Description | A credential scan record indicates a potential hardcoded password in 'App.config'. The presence of a 'General Password' finding with a high matching score (95.9%) suggests a significant risk of exposed credentials that could lead to unauthorized system access. |
TimeofDiscovery,Source,Searcher,Description,Line,IsSuppressed,HashKey,SuppressJustification,MatchingScore | |
2021-04-10T21:43:46.792Z,E:sample/dir/first/App.config,CSCAN-GENERAL0060 General Password,[Use Triage Mode (-t) to output matching details.],10,NO,4BszeHDdqD3qPgsQ66sOA//MHECABy0rIRG6mEhwe9s=,"",95.9 |
Information Disclosure in unittests/scans/twistlock/scan_report_many_vuln.csv
Vulnerability | Information Disclosure |
---|---|
Description | The CSV contains extensive details about internal infrastructure, including registry names, repository details, internal hostnames, CVE IDs, and vulnerability descriptions. This comprehensive exposure could provide an attacker with valuable reconnaissance information about the organization's systems and potential vulnerabilities. |
Registry,Repository,Tag,Id,Scan Time,Pass,Type,Distro,Hostname,Layer,CVE ID,Compliance ID,Type,Severity,Packages,Source Package,Package Version,Package License,CVSS,Fix Status,Description,Cause,Published,Custom Labels | |
provisioner-docker.cloud.thdm.local,acme/acme-image-root,1.1.2,sha256:09951c12314543758569898475787989070600790978987567dcd68248372aac,14:24.3,TRUE,cli,FancyOS,docker-dev-1234567a-1234-1234-abcd-12345567890a,,CVE-2023-12334,98,java,critical,io.class_class,,1.1.1.Release,,1.2,fixed in 1.2.11,"HttpObjectDecoder.java in a complex class before 1.2.11 allows an intruder to do horrible things that will end in \""Bad thing.\""",,12:00.0, | |
provisioner-docker.cloud.thdm.local,acme/acme-image-ultimate,1.1.2,sha256:09951r3412f122121dcbº341212341bc111231233123121231dcd68248372aac,10:11.2,TRUE,somecli,GoodOS,docker-image-som-987777b-4312-12ty-2133-42343423542f,,CVE-2035-1000,0º,langua,high,cool framework_cool-core,,1.1.1,,1.1,"fixed in the future 1.0., 2.3.45","Cool Framework, versions 0.5.0 prior to 0.1.0. and older unsupported versions, provide client-side support for multi requests. When fractals are represented, the hyper speed fails",,29:00.0, | |
provisioner-docker.,acme/acme-image-beta,1.1.2,sha256:c7012312354352356542634455425435524523452352345345555520a899c91e,98:76.5,TRUE,cli,SantaCruzOS,build-123-123-123,,CVE-2030-12345,21,old-language,high,load,,1.13.4,,5.6,fixed in >=0.0.1,"A prototype tjat will expose a black hole was found ",,49:00.0, | |
Information Disclosure in unittests/scans/aws_prowler/issue4450.csv
Vulnerability | Information Disclosure |
---|---|
Description | The CSV reveals sensitive AWS account information, including specific IAM user names and security configuration details. Specific users like 'ansible-test-user', 'John', and 'Michael' are named, with details about MFA status and account access, which could be leveraged for targeted social engineering or account compromise attempts. |
django-DefectDojo/unittests/scans/aws_prowler/issue4450.csv
Lines 1 to 5 in 4135688
PROFILE,ACCOUNT_NUM,REGION,TITLE_ID,CHECK_RESULT,ITEM_SCORED,ITEM_LEVEL,TITLE_TEXT,CHECK_RESULT_EXTENDED,CHECK_ASFF_COMPLIANCE_TYPE,CHECK_SEVERITY,CHECK_SERVICENAME,CHECK_ASFF_RESOURCE_TYPE,CHECK_ASFF_TYPE,CHECK_RISK,CHECK_REMEDIATION,CHECK_DOC,CHECK_CAF_EPIC | |
V2devTest,612801422404,us-west-2,1.1,PASS,Scored,Level 1,[check11] Avoid the use of the root account (Scored),Root user in the account wasn't accessed in the last 1 days,Software and Configuration Checks,High,iam,AwsAccount,Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark,"The ""root"" account has unrestricted access to all resources in the AWS account. It is highly recommended that the use of this account be avoided.",Follow the remediation instructions of the Ensure IAM policies are attached only to groups or roles recommendation.,http://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html,IAM, | |
V2devTest,612801422404,us-west-2,1.2,FAIL,Scored,Level 1,[check12] Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password (Scored),User ansible-test-user has Password enabled but MFA disabled,ens-op.acc.5.aws.iam.1,High,iam,AwsIamUser,Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark,Unauthorized access to this critical account if password is not secure or it is disclosed in any way.,Enable MFA for root account. is a simple best practice that adds an extra layer of protection on top of your user name and password. Recommended to use hardware keys over virtual MFA.,https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_virtual.html,IAM, | |
V2devTest,612801422404,us-west-2,1.2,FAIL,Scored,Level 1,[check12] Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password (Scored),User John has Password enabled but MFA disabled,ens-op.acc.5.aws.iam.1,High,iam,AwsIamUser,Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark,Unauthorized access to this critical account if password is not secure or it is disclosed in any way.,Enable MFA for root account. is a simple best practice that adds an extra layer of protection on top of your user name and password. Recommended to use hardware keys over virtual MFA.,https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_virtual.html,IAM, | |
V2devTest,612801422404,us-west-2,1.2,FAIL,Scored,Level 1,[check12] Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password (Scored),User Michael has Password enabled but MFA disabled,ens-op.acc.5.aws.iam.1,High,iam,AwsIamUser,Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark,Unauthorized access to this critical account if password is not secure or it is disclosed in any way.,Enable MFA for root account. is a simple best practice that adds an extra layer of protection on top of your user name and password. Recommended to use hardware keys over virtual MFA.,https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_virtual.html,IAM, |
All finding details can be found in the DryRun Security Dashboard.
I've split the formatting changes into separate commits (or PRs) by file type for safer review:
git diff -w
shows empty).csv
togetherThis commit only touches 23
csv files