Semgrep

💎Vulnerabiltiies to be discovered

The next vulnerabilities should be discovered in this sections:

• VULN-FLASK-DEBUG
• VULN-TAR-SLIP
• VULN-LOGGING-PERMS
• VULN-SECRET-LOG
• VULN-UID-IDOR
• VULN-ARCHIVE-WRITE
• VULN-HASH-LEN
• VULN-XSS
• VULN-SSRF
• VULN-CSRF

⚙️Semgrep setup

If you didn't set up the static-analysis profile's infrastructure, please do so by running the command docker-compose --profile static-analysis up.

Use docker exec --interactive --tty static-analysers bash to enter the container where the CLI application is contained.

⚙️Coder setup

If you didn't set up the static-analysis profile's infrastructure, please do so by running the command docker-compose --profile static-analysis up.

Access this link to interact with the application's web user interface. Use the ossfortress password for login.

📚Semgrep documentation

The Semgrep documentation is available here.

Steps

Scanning

1. Create a Semgrep command that scans the entire codebase with the default configuration (auto) and creates a SARIF output file, /root/analysis/semgrep.sarif.
2. Validate each warning produced by Semgrep by manually inspecting the code. Use the Coder instance in the Docker infrastructure to review the results.

🚧Solution

To display the solution of this task, enter the text i-surrender-to-the-code-security-gods in the field below.

Writing rules

info

For live testing of your rules, you can also use the Playground.

1. The vulnerabilities listed below were not detected by any technique that we've seen so far. Inspect the Semgrep documentation and write rules to catch them in the /root/analysis/semgrep-rules folder. The rules should have as many metadata fields filled as possible.

Vulnerability ID	Vulnerable code to be found with the Semgrep rules
VULN-SECRET-LOG	Calls to functions from logging where the parameters have sensitive names
VULN-UID-IDOR	execute_string_command calls with dynamic arguments
VULN-ARCHIVE-WRITE	os.path.join calls where the arguments came from the parameters of the function
VULN-HASH-LEN	sha256_update calls where the parameter is created by concatenation

2. Modify the command from the first section to use them and to save the resulting SARIF file in /root/analysis/semgrep.custom.sarif.

🚧Solution

To display the solution of this task, enter the text i-surrender-to-the-code-security-gods in the field below.