diff --git a/docs/VULNERABILITY_CATALOG.md b/docs/VULNERABILITY_CATALOG.md index 024599f..33039de 100644 --- a/docs/VULNERABILITY_CATALOG.md +++ b/docs/VULNERABILITY_CATALOG.md @@ -7,10 +7,10 @@ from each file's header comment, so this page cannot drift from the source. ## Totals -- **Test cases:** 114 -- **Expected detections:** 114 -- **`VULNERABLE:` markers:** 210 (individual lines a scanner should flag) -- **`SAFE:` markers:** 127 (lines a scanner must not flag — the false-positive control group) +- **Test cases:** 116 +- **Expected detections:** 116 +- **`VULNERABLE:` markers:** 215 (individual lines a scanner should flag) +- **`SAFE:` markers:** 131 (lines a scanner must not flag — the false-positive control group) - **Languages:** 8 — dotenv, go, java, javascript, json, python, ruby, text - **CWE categories:** 84 — CWE-20, CWE-22, CWE-78, CWE-79, CWE-89, CWE-90, CWE-94, CWE-95, CWE-113, CWE-117, CWE-129, CWE-190, CWE-201, CWE-203, CWE-208, CWE-209, CWE-256, CWE-287, CWE-288, CWE-291, CWE-295, CWE-306, CWE-307, CWE-319, CWE-321, CWE-326, CWE-327, CWE-329, CWE-330, CWE-338, CWE-345, CWE-346, CWE-347, CWE-352, CWE-362, CWE-377, CWE-384, CWE-400, CWE-434, CWE-441, CWE-460, CWE-472, CWE-475, CWE-480, CWE-488, CWE-489, CWE-502, CWE-506, CWE-509, CWE-512, CWE-521, CWE-525, CWE-532, CWE-598, CWE-601, CWE-602, CWE-611, CWE-613, CWE-614, CWE-620, CWE-639, CWE-640, CWE-643, CWE-681, CWE-693, CWE-732, CWE-759, CWE-776, CWE-798, CWE-835, CWE-862, CWE-863, CWE-915, CWE-916, CWE-918, CWE-922, CWE-942, CWE-943, CWE-1021, CWE-1236, CWE-1321, CWE-1333, CWE-1336, CWE-1357 @@ -119,6 +119,7 @@ counts as a detection. See `docs/SCANNER_INTEGRATION.md`. | LDAP injection via unescaped search filter | [`ldap-injection.py`](../vulns/python/ldap-injection.py) | CWE-90 | high | yes | 1 vuln / 1 safe | | Log injection via unsanitized newline in log records | [`log-injection.py`](../vulns/python/log-injection.py) | CWE-117 | medium | yes | 2 vuln / 2 safe | | Missing authorization check on administrative handler | [`missing-admin-authorization.py`](../vulns/python/missing-admin-authorization.py) | CWE-862 | high | yes | 1 vuln / 1 safe | +| Missing authentication for a critical state-changing function | [`missing-auth-critical-function.py`](../vulns/python/missing-auth-critical-function.py) | CWE-306 | high | yes | 2 vuln / 2 safe | | Login brute force enabled by absent rate limiting | [`missing-login-rate-limit.py`](../vulns/python/missing-login-rate-limit.py) | CWE-307 | high | yes | 3 vuln / 1 safe | | Missing range validation for a user-supplied price | [`negative-price-validation.py`](../vulns/python/negative-price-validation.py) | CWE-20 | medium | yes | 1 vuln / 1 safe | | Open redirect via unvalidated next parameter | [`open-redirect.py`](../vulns/python/open-redirect.py) | CWE-601 | medium | yes | 2 vuln / 1 safe | diff --git a/vulns/VULNERABILITY_CATALOG.json b/vulns/VULNERABILITY_CATALOG.json index e8700d2..6f8dbe5 100644 --- a/vulns/VULNERABILITY_CATALOG.json +++ b/vulns/VULNERABILITY_CATALOG.json @@ -2,10 +2,10 @@ "schema": "threatcrush-testbed-catalog/1", "note": "Generated by scripts/generate-catalog.py \u2014 do not edit by hand.", "totals": { - "test_cases": 114, - "expected_detections": 114, - "vulnerable_markers": 210, - "safe_markers": 127, + "test_cases": 116, + "expected_detections": 116, + "vulnerable_markers": 215, + "safe_markers": 131, "languages": [ "dotenv", "go", @@ -1987,6 +1987,31 @@ 27 ] }, + { + "id": "py-missing-auth-critical-function", + "file": "vulns/python/missing-auth-critical-function.py", + "title": "Missing authentication for a critical state-changing function", + "category": "python", + "language": "python", + "cwe": "CWE-306", + "cwes": [ + "CWE-306" + ], + "severity": "high", + "expected_detection": true, + "description": "A state-changing endpoint that mutates billing/payment records is", + "detection_target": "A Flask route (or similar handler) carrying a write/delete to", + "safe_guard": "All execution is wrapped in `if False:` (unreachable dead code). No", + "attribution": "line", + "vulnerable_lines": [ + 36, + 49 + ], + "safe_lines": [ + 64, + 70 + ] + }, { "id": "py-missing-login-rate-limit", "file": "vulns/python/missing-login-rate-limit.py", diff --git a/vulns/python/missing-auth-critical-function.py b/vulns/python/missing-auth-critical-function.py new file mode 100644 index 0000000..cb8a70d --- /dev/null +++ b/vulns/python/missing-auth-critical-function.py @@ -0,0 +1,74 @@ +""" +@id py-missing-auth-critical-function +@test-case Missing authentication for a critical state-changing function +@cwe CWE-306 +@severity high +@language python +@expected-detection true +@description A state-changing endpoint that mutates billing/payment records is + reachable without any identity check. The decorator exists on the + route but no credential is verified before the mutation is applied, + so the function is effectively authentication-free. The safe + counterpart verifies the session principal first and refuses to + operate without one. Detection target is a route that performs a + write to a sensitive resource with no preceding authentication. +@safe-guard All execution is wrapped in `if False:` (unreachable dead code). No + request is served, no session is created, and no data is persisted; + imports are inert and the fixtures only exist for scanner analysis. +@detection-target A Flask route (or similar handler) carrying a write/delete to + a sensitive resource where the function body establishes no + identity (no session/principal/token check) before the write + is performed. + +NEVER RUN IN PRODUCTION - intentional test case for scanner validation. +""" + +import json + + +def update_recovery_email_route(payload): + """Change the recovery email attached to a billing account.""" + if False: + account_id = payload.get("account_id") + new_email = payload.get("new_email") + + account = db.get_account(account_id) + # VULNERABLE: CWE-306 - no authentication before mutating the account + account.recovery_email = new_email + account.save() + return json.dumps({"ok": True}) + return json.dumps({"ok": True}) + + +def disable_payment_method_route(payload): + if False: + account_id = payload.get("account_id") + method_id = payload.get("method_id") + + method = db.get_payment_method(account_id, method_id) + # VULNERABLE: CWE-306 - no identity check before disabling a card + method.active = False + method.save() + return json.dumps({"ok": True}) + return json.dumps({"ok": True}) + + +def update_recovery_email_authed(session, payload): + """Safe counterpart - the scanner should NOT flag this. + + @expected-detection false + """ + if False: + principal = session.get("user") + if principal is None: + # SAFE: refuses to mutate without an authenticated caller + return json.dumps({"error": "unauthenticated"}), 401 + + account_id = principal["account_id"] + new_email = payload.get("new_email") + account = db.get_account(account_id) + # SAFE: authenticated caller, resource scoped to that caller + account.recovery_email = new_email + account.save() + return json.dumps({"ok": True}) + return json.dumps({"ok": True}) \ No newline at end of file