@runsec/mcp 1.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.js +578 -0
- package/package.json +43 -0
- package/src/rules/data/rule-compliance-map.json +43563 -0
- package/src/rules/data/semgrep-rules/README-taint-overlays.md +21 -0
- package/src/rules/data/semgrep-rules/advanced-agent-cloud.yaml +802 -0
- package/src/rules/data/semgrep-rules/app-logic.yaml +445 -0
- package/src/rules/data/semgrep-rules/auth-keycloak.yaml +831 -0
- package/src/rules/data/semgrep-rules/browser-agent.yaml +260 -0
- package/src/rules/data/semgrep-rules/cloud-secrets.yaml +316 -0
- package/src/rules/data/semgrep-rules/csharp-dotnet.yaml +4864 -0
- package/src/rules/data/semgrep-rules/desktop-electron-pro.yaml +30 -0
- package/src/rules/data/semgrep-rules/desktop-vsto-suite.yaml +2759 -0
- package/src/rules/data/semgrep-rules/devops-security.yaml +393 -0
- package/src/rules/data/semgrep-rules/domain-access-management.yaml +1023 -0
- package/src/rules/data/semgrep-rules/domain-data-privacy.yaml +852 -0
- package/src/rules/data/semgrep-rules/domain-input-validation.yaml +2894 -0
- package/src/rules/data/semgrep-rules/domain-platform-hardening.yaml +1715 -0
- package/src/rules/data/semgrep-rules/ds-ml-security.yaml +2431 -0
- package/src/rules/data/semgrep-rules/fastapi-async.yaml +5953 -0
- package/src/rules/data/semgrep-rules/frontend-react.yaml +4035 -0
- package/src/rules/data/semgrep-rules/frontend-security.yaml +200 -0
- package/src/rules/data/semgrep-rules/go-core.yaml +4959 -0
- package/src/rules/data/semgrep-rules/hft-cpp-security.yaml +631 -0
- package/src/rules/data/semgrep-rules/infra-k8s-helm.yaml +4968 -0
- package/src/rules/data/semgrep-rules/integration-security.yaml +2362 -0
- package/src/rules/data/semgrep-rules/java-enterprise.yaml +14756 -0
- package/src/rules/data/semgrep-rules/java-spring.yaml +397 -0
- package/src/rules/data/semgrep-rules/license-compliance.yaml +186 -0
- package/src/rules/data/semgrep-rules/mobile-flutter.yaml +37 -0
- package/src/rules/data/semgrep-rules/mobile-security.yaml +721 -0
- package/src/rules/data/semgrep-rules/nodejs-nestjs.yaml +5164 -0
- package/src/rules/data/semgrep-rules/nodejs-security.yaml +326 -0
- package/src/rules/data/semgrep-rules/observability.yaml +381 -0
- package/src/rules/data/semgrep-rules/php-security.yaml +3601 -0
- package/src/rules/data/semgrep-rules/python-backend-pro.yaml +30 -0
- package/src/rules/data/semgrep-rules/python-django.yaml +181 -0
- package/src/rules/data/semgrep-rules/python-security.yaml +284 -0
- package/src/rules/data/semgrep-rules/ru-regulatory.yaml +496 -0
- package/src/rules/data/semgrep-rules/ruby-rails.yaml +3078 -0
- package/src/rules/data/semgrep-rules/rust-security.yaml +2701 -0
|
@@ -0,0 +1,4864 @@
|
|
|
1
|
+
rules:
|
|
2
|
+
- id: runsec.csharp-dotnet.csh-001
|
|
3
|
+
metadata:
|
|
4
|
+
runsec_version: v1.0
|
|
5
|
+
confidence: |-
|
|
6
|
+
0.9
|
|
7
|
+
exploit_scenario: |-
|
|
8
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
9
|
+
fix_template: |-
|
|
10
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
11
|
+
pattern-either:
|
|
12
|
+
- pattern: |-
|
|
13
|
+
var expr = request.Query["expr"];
|
|
14
|
+
...
|
|
15
|
+
var result = await CSharpScript.EvaluateAsync(expr);
|
|
16
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-001\\b'
|
|
17
|
+
message: |-
|
|
18
|
+
RunSec Detection [CSH-001]: CWE-94
|
|
19
|
+
languages:
|
|
20
|
+
- csharp
|
|
21
|
+
severity: WARNING
|
|
22
|
+
- id: runsec.csharp-dotnet.csh-002
|
|
23
|
+
metadata:
|
|
24
|
+
runsec_version: v1.0
|
|
25
|
+
confidence: |-
|
|
26
|
+
0.9
|
|
27
|
+
exploit_scenario: |-
|
|
28
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
29
|
+
fix_template: |-
|
|
30
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
31
|
+
pattern-either:
|
|
32
|
+
- pattern: |-
|
|
33
|
+
var host = request.Query["host"];
|
|
34
|
+
...
|
|
35
|
+
Process.Start("cmd.exe", "/c ping " + host);
|
|
36
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-002\\b'
|
|
37
|
+
message: |-
|
|
38
|
+
RunSec Detection [CSH-002]: CWE-78
|
|
39
|
+
languages:
|
|
40
|
+
- csharp
|
|
41
|
+
severity: WARNING
|
|
42
|
+
- id: runsec.csharp-dotnet.csh-003
|
|
43
|
+
metadata:
|
|
44
|
+
runsec_version: v1.0
|
|
45
|
+
confidence: |-
|
|
46
|
+
0.9
|
|
47
|
+
exploit_scenario: |-
|
|
48
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
49
|
+
fix_template: |-
|
|
50
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
51
|
+
pattern-either:
|
|
52
|
+
- pattern: |-
|
|
53
|
+
var cmd = request.Query["cmd"];
|
|
54
|
+
...
|
|
55
|
+
Process.Start(new ProcessStartInfo("bash", "-c " + cmd) { UseShellExecute = true });
|
|
56
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-003\\b'
|
|
57
|
+
message: |-
|
|
58
|
+
RunSec Detection [CSH-003]: CWE-77
|
|
59
|
+
languages:
|
|
60
|
+
- csharp
|
|
61
|
+
severity: WARNING
|
|
62
|
+
- id: runsec.csharp-dotnet.csh-004
|
|
63
|
+
metadata:
|
|
64
|
+
runsec_version: v1.0
|
|
65
|
+
confidence: |-
|
|
66
|
+
0.9
|
|
67
|
+
exploit_scenario: |-
|
|
68
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
69
|
+
fix_template: |-
|
|
70
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
71
|
+
pattern-either:
|
|
72
|
+
- pattern: |-
|
|
73
|
+
var typeName = request.Query["type"];
|
|
74
|
+
...
|
|
75
|
+
var t = Type.GetType(typeName);
|
|
76
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-004\\b'
|
|
77
|
+
message: |-
|
|
78
|
+
RunSec Detection [CSH-004]: CWE-470
|
|
79
|
+
languages:
|
|
80
|
+
- csharp
|
|
81
|
+
severity: WARNING
|
|
82
|
+
- id: runsec.csharp-dotnet.csh-005
|
|
83
|
+
metadata:
|
|
84
|
+
runsec_version: v1.0
|
|
85
|
+
confidence: |-
|
|
86
|
+
0.9
|
|
87
|
+
exploit_scenario: |-
|
|
88
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
89
|
+
fix_template: |-
|
|
90
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
91
|
+
pattern-either:
|
|
92
|
+
- pattern: |-
|
|
93
|
+
var method = request.Query["method"];
|
|
94
|
+
...
|
|
95
|
+
target.GetType().GetMethod(method).Invoke(target, null);
|
|
96
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-005\\b'
|
|
97
|
+
message: |-
|
|
98
|
+
RunSec Detection [CSH-005]: CWE-74
|
|
99
|
+
languages:
|
|
100
|
+
- csharp
|
|
101
|
+
severity: WARNING
|
|
102
|
+
- id: runsec.csharp-dotnet.csh-006
|
|
103
|
+
metadata:
|
|
104
|
+
runsec_version: v1.0
|
|
105
|
+
confidence: |-
|
|
106
|
+
0.9
|
|
107
|
+
exploit_scenario: |-
|
|
108
|
+
Атакующий контролирует ORDER BY через query string; подставляет выражение, ведущее к утечке данных или обходу логики (CWE-89).
|
|
109
|
+
fix_template: |-
|
|
110
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
111
|
+
pattern-either:
|
|
112
|
+
- pattern: |-
|
|
113
|
+
var order = request.Query["order"];
|
|
114
|
+
...
|
|
115
|
+
var sql = $"SELECT * FROM users ORDER BY {order}";
|
|
116
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-006\\b'
|
|
117
|
+
message: |-
|
|
118
|
+
RunSec Detection [CSH-006]: CWE-74
|
|
119
|
+
languages:
|
|
120
|
+
- csharp
|
|
121
|
+
severity: WARNING
|
|
122
|
+
- id: runsec.csharp-dotnet.csh-007
|
|
123
|
+
metadata:
|
|
124
|
+
runsec_version: v1.0
|
|
125
|
+
confidence: |-
|
|
126
|
+
0.9
|
|
127
|
+
exploit_scenario: |-
|
|
128
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
129
|
+
fix_template: |-
|
|
130
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
131
|
+
pattern-either:
|
|
132
|
+
- pattern: |-
|
|
133
|
+
var code = request.Form["code"];
|
|
134
|
+
...
|
|
135
|
+
CompileAndRun(code);
|
|
136
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-007\\b'
|
|
137
|
+
message: |-
|
|
138
|
+
RunSec Detection [CSH-007]: CWE-94
|
|
139
|
+
languages:
|
|
140
|
+
- csharp
|
|
141
|
+
severity: WARNING
|
|
142
|
+
- id: runsec.csharp-dotnet.csh-008
|
|
143
|
+
metadata:
|
|
144
|
+
runsec_version: v1.0
|
|
145
|
+
confidence: |-
|
|
146
|
+
0.9
|
|
147
|
+
exploit_scenario: |-
|
|
148
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
149
|
+
fix_template: |-
|
|
150
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
151
|
+
pattern-either:
|
|
152
|
+
- pattern: |-
|
|
153
|
+
var js = request.Form["script"];
|
|
154
|
+
...
|
|
155
|
+
engine.Execute(js);
|
|
156
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-008\\b'
|
|
157
|
+
message: |-
|
|
158
|
+
RunSec Detection [CSH-008]: CWE-95
|
|
159
|
+
languages:
|
|
160
|
+
- csharp
|
|
161
|
+
severity: WARNING
|
|
162
|
+
- id: runsec.csharp-dotnet.csh-009
|
|
163
|
+
metadata:
|
|
164
|
+
runsec_version: v1.0
|
|
165
|
+
confidence: |-
|
|
166
|
+
0.9
|
|
167
|
+
exploit_scenario: |-
|
|
168
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
169
|
+
fix_template: |-
|
|
170
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
171
|
+
pattern-either:
|
|
172
|
+
- pattern: |-
|
|
173
|
+
...
|
|
174
|
+
var obj = formatter.Deserialize(stream);
|
|
175
|
+
...
|
|
176
|
+
JsonConvert.DeserializeObject(json, new JsonSerializerSettings { TypeNameHandling = TypeNameHandling.All })
|
|
177
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-009\\b'
|
|
178
|
+
message: |-
|
|
179
|
+
RunSec Detection [CSH-009]: CWE-502
|
|
180
|
+
languages:
|
|
181
|
+
- csharp
|
|
182
|
+
severity: WARNING
|
|
183
|
+
- id: runsec.csharp-dotnet.csh-010
|
|
184
|
+
metadata:
|
|
185
|
+
runsec_version: v1.0
|
|
186
|
+
confidence: |-
|
|
187
|
+
0.9
|
|
188
|
+
exploit_scenario: |-
|
|
189
|
+
Атакующий подсовывает XML с внешней сущностью/DTD; при включённом XmlResolver читает файлы или достаёт секреты (CWE-611 XXE).
|
|
190
|
+
fix_template: |-
|
|
191
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
192
|
+
pattern-either:
|
|
193
|
+
- pattern: |-
|
|
194
|
+
var doc = new XmlDocument();
|
|
195
|
+
...
|
|
196
|
+
doc.XmlResolver = new XmlUrlResolver();
|
|
197
|
+
doc.Load(reader);
|
|
198
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-010\\b'
|
|
199
|
+
message: |-
|
|
200
|
+
RunSec Detection [CSH-010]: CWE-611
|
|
201
|
+
languages:
|
|
202
|
+
- csharp
|
|
203
|
+
severity: WARNING
|
|
204
|
+
- id: runsec.csharp-dotnet.csh-011
|
|
205
|
+
metadata:
|
|
206
|
+
runsec_version: v1.0
|
|
207
|
+
confidence: |-
|
|
208
|
+
0.9
|
|
209
|
+
exploit_scenario: |-
|
|
210
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
211
|
+
fix_template: |-
|
|
212
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
213
|
+
pattern-either:
|
|
214
|
+
- pattern: |-
|
|
215
|
+
var opts = new CookieOptions { Path = "/" };
|
|
216
|
+
...
|
|
217
|
+
Response.Cookies.Append("session", token, opts);
|
|
218
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-011\\b'
|
|
219
|
+
message: |-
|
|
220
|
+
RunSec Detection [CSH-011]: CWE-614
|
|
221
|
+
languages:
|
|
222
|
+
- csharp
|
|
223
|
+
severity: WARNING
|
|
224
|
+
- id: runsec.csharp-dotnet.csh-012
|
|
225
|
+
metadata:
|
|
226
|
+
runsec_version: v1.0
|
|
227
|
+
confidence: |-
|
|
228
|
+
0.9
|
|
229
|
+
exploit_scenario: |-
|
|
230
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
231
|
+
fix_template: |-
|
|
232
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
233
|
+
pattern-either:
|
|
234
|
+
- pattern: |-
|
|
235
|
+
var defaultConnection = "Server=db;User=sa;Password=SuperSecret123";
|
|
236
|
+
...
|
|
237
|
+
var apiKey = "prod-api-key-12345";
|
|
238
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-012\\b'
|
|
239
|
+
message: |-
|
|
240
|
+
RunSec Detection [CSH-012]: CWE-798
|
|
241
|
+
languages:
|
|
242
|
+
- csharp
|
|
243
|
+
severity: WARNING
|
|
244
|
+
- id: runsec.csharp-dotnet.csh-013
|
|
245
|
+
metadata:
|
|
246
|
+
runsec_version: v1.0
|
|
247
|
+
confidence: |-
|
|
248
|
+
0.9
|
|
249
|
+
exploit_scenario: |-
|
|
250
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
251
|
+
fix_template: |-
|
|
252
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
253
|
+
pattern-either:
|
|
254
|
+
- pattern: |-
|
|
255
|
+
...
|
|
256
|
+
using (var md5 = MD5.Create())
|
|
257
|
+
...
|
|
258
|
+
using (var sha1 = SHA1.Create())
|
|
259
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-013\\b'
|
|
260
|
+
message: |-
|
|
261
|
+
RunSec Detection [CSH-013]: CWE-327
|
|
262
|
+
languages:
|
|
263
|
+
- csharp
|
|
264
|
+
severity: WARNING
|
|
265
|
+
- id: runsec.csharp-dotnet.csh-014
|
|
266
|
+
metadata:
|
|
267
|
+
runsec_version: v1.0
|
|
268
|
+
confidence: |-
|
|
269
|
+
0.9
|
|
270
|
+
exploit_scenario: |-
|
|
271
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
272
|
+
fix_template: |-
|
|
273
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
274
|
+
pattern-either:
|
|
275
|
+
- pattern: |-
|
|
276
|
+
var url = Request.Query["redirect"];
|
|
277
|
+
...
|
|
278
|
+
return Redirect(url);
|
|
279
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-014\\b'
|
|
280
|
+
message: |-
|
|
281
|
+
RunSec Detection [CSH-014]: CWE-601
|
|
282
|
+
languages:
|
|
283
|
+
- csharp
|
|
284
|
+
severity: WARNING
|
|
285
|
+
- id: runsec.csharp-dotnet.csh-015
|
|
286
|
+
metadata:
|
|
287
|
+
runsec_version: v1.0
|
|
288
|
+
confidence: |-
|
|
289
|
+
0.9
|
|
290
|
+
exploit_scenario: |-
|
|
291
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
292
|
+
fix_template: |-
|
|
293
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
294
|
+
pattern-either:
|
|
295
|
+
- pattern: |-
|
|
296
|
+
var handler = new HttpClientHandler();
|
|
297
|
+
...
|
|
298
|
+
handler.ServerCertificateCustomValidationCallback = (sender, cert, chain, sslPolicyErrors) => true;
|
|
299
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-015\\b'
|
|
300
|
+
message: |-
|
|
301
|
+
RunSec Detection [CSH-015]: CWE-295
|
|
302
|
+
languages:
|
|
303
|
+
- csharp
|
|
304
|
+
severity: WARNING
|
|
305
|
+
- id: runsec.csharp-dotnet.csh-016
|
|
306
|
+
metadata:
|
|
307
|
+
runsec_version: v1.0
|
|
308
|
+
confidence: |-
|
|
309
|
+
0.9
|
|
310
|
+
exploit_scenario: |-
|
|
311
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
312
|
+
fix_template: |-
|
|
313
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
314
|
+
pattern-either:
|
|
315
|
+
- pattern: |-
|
|
316
|
+
...
|
|
317
|
+
var bytes = Encoding.UTF8.GetBytes(password);
|
|
318
|
+
...
|
|
319
|
+
SHA256.Create().ComputeHash(bytes)
|
|
320
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-016\\b'
|
|
321
|
+
message: |-
|
|
322
|
+
RunSec Detection [CSH-016]: CWE-916
|
|
323
|
+
languages:
|
|
324
|
+
- csharp
|
|
325
|
+
severity: WARNING
|
|
326
|
+
- id: runsec.csharp-dotnet.csh-017
|
|
327
|
+
metadata:
|
|
328
|
+
runsec_version: v1.0
|
|
329
|
+
confidence: |-
|
|
330
|
+
0.9
|
|
331
|
+
exploit_scenario: |-
|
|
332
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
333
|
+
fix_template: |-
|
|
334
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
335
|
+
pattern-either:
|
|
336
|
+
- pattern: |-
|
|
337
|
+
mailItem.HTMLBody = userHtml;
|
|
338
|
+
worksheet.Cells[row, col].Formula = "=" + userInput;
|
|
339
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-017\\b'
|
|
340
|
+
message: |-
|
|
341
|
+
RunSec Detection [CSH-017]: Office Add-in Security
|
|
342
|
+
languages:
|
|
343
|
+
- csharp
|
|
344
|
+
severity: WARNING
|
|
345
|
+
- id: runsec.csharp-dotnet.csh-018
|
|
346
|
+
metadata:
|
|
347
|
+
runsec_version: v1.0
|
|
348
|
+
confidence: |-
|
|
349
|
+
0.9
|
|
350
|
+
exploit_scenario: |-
|
|
351
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
352
|
+
fix_template: |-
|
|
353
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
354
|
+
pattern-either:
|
|
355
|
+
- pattern: |-
|
|
356
|
+
Globals.ThisAddIn.Application.Run(userMacro)
|
|
357
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-018\\b'
|
|
358
|
+
message: |-
|
|
359
|
+
RunSec Detection [CSH-018]: VSTO hardening
|
|
360
|
+
languages:
|
|
361
|
+
- csharp
|
|
362
|
+
severity: WARNING
|
|
363
|
+
- id: runsec.csharp-dotnet.csh-019
|
|
364
|
+
metadata:
|
|
365
|
+
runsec_version: v1.0
|
|
366
|
+
confidence: |-
|
|
367
|
+
0.9
|
|
368
|
+
exploit_scenario: |-
|
|
369
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
370
|
+
fix_template: |-
|
|
371
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
372
|
+
pattern-either:
|
|
373
|
+
- pattern: |-
|
|
374
|
+
new BinaryFormatter().Deserialize(stream)
|
|
375
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-019\\b'
|
|
376
|
+
message: |-
|
|
377
|
+
RunSec Detection [CSH-019]: .NET BinaryFormatter ban
|
|
378
|
+
languages:
|
|
379
|
+
- csharp
|
|
380
|
+
severity: WARNING
|
|
381
|
+
- id: runsec.csharp-dotnet.csh-020
|
|
382
|
+
metadata:
|
|
383
|
+
runsec_version: v1.0
|
|
384
|
+
confidence: |-
|
|
385
|
+
0.9
|
|
386
|
+
exploit_scenario: |-
|
|
387
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
388
|
+
fix_template: |-
|
|
389
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
390
|
+
pattern-either:
|
|
391
|
+
- pattern: |-
|
|
392
|
+
dataSet.ReadXml(userStream)
|
|
393
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-020\\b'
|
|
394
|
+
message: |-
|
|
395
|
+
RunSec Detection [CSH-020]: CWE-611 / XML hardening
|
|
396
|
+
languages:
|
|
397
|
+
- csharp
|
|
398
|
+
severity: WARNING
|
|
399
|
+
- id: runsec.csharp-dotnet.csh-021
|
|
400
|
+
metadata:
|
|
401
|
+
runsec_version: v1.0
|
|
402
|
+
confidence: |-
|
|
403
|
+
0.9
|
|
404
|
+
exploit_scenario: |-
|
|
405
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
406
|
+
fix_template: |-
|
|
407
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
408
|
+
pattern-either:
|
|
409
|
+
- pattern: |-
|
|
410
|
+
[DllImport("user32.dll")] static extern int MessageBox(string text);
|
|
411
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-021\\b'
|
|
412
|
+
message: |-
|
|
413
|
+
RunSec Detection [CSH-021]: Interop security
|
|
414
|
+
languages:
|
|
415
|
+
- csharp
|
|
416
|
+
severity: WARNING
|
|
417
|
+
- id: runsec.csharp-dotnet.csh-022
|
|
418
|
+
metadata:
|
|
419
|
+
runsec_version: v1.0
|
|
420
|
+
confidence: |-
|
|
421
|
+
0.9
|
|
422
|
+
exploit_scenario: |-
|
|
423
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
424
|
+
fix_template: |-
|
|
425
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
426
|
+
pattern-either:
|
|
427
|
+
- pattern: |-
|
|
428
|
+
Assembly.LoadFrom(pathFromRequest)
|
|
429
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-022\\b'
|
|
430
|
+
message: |-
|
|
431
|
+
RunSec Detection [CSH-022]: CWE-114
|
|
432
|
+
languages:
|
|
433
|
+
- csharp
|
|
434
|
+
severity: WARNING
|
|
435
|
+
- id: runsec.csharp-dotnet.csh-023
|
|
436
|
+
metadata:
|
|
437
|
+
runsec_version: v1.0
|
|
438
|
+
confidence: |-
|
|
439
|
+
0.9
|
|
440
|
+
exploit_scenario: |-
|
|
441
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
442
|
+
fix_template: |-
|
|
443
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
444
|
+
pattern-either:
|
|
445
|
+
- pattern: |-
|
|
446
|
+
public IActionResult Update(UserEntity entity)
|
|
447
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-023\\b'
|
|
448
|
+
message: |-
|
|
449
|
+
RunSec Detection [CSH-023]: OWASP Mass Assignment
|
|
450
|
+
languages:
|
|
451
|
+
- csharp
|
|
452
|
+
severity: WARNING
|
|
453
|
+
- id: runsec.csharp-dotnet.csh-024
|
|
454
|
+
metadata:
|
|
455
|
+
runsec_version: v1.0
|
|
456
|
+
confidence: |-
|
|
457
|
+
0.9
|
|
458
|
+
exploit_scenario: |-
|
|
459
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
460
|
+
fix_template: |-
|
|
461
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
462
|
+
pattern-either:
|
|
463
|
+
- pattern: |-
|
|
464
|
+
CreateMap<UserDto, UserEntity>();
|
|
465
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-024\\b'
|
|
466
|
+
message: |-
|
|
467
|
+
RunSec Detection [CSH-024]: Object mapping security
|
|
468
|
+
languages:
|
|
469
|
+
- csharp
|
|
470
|
+
severity: WARNING
|
|
471
|
+
- id: runsec.csharp-dotnet.csh-025
|
|
472
|
+
metadata:
|
|
473
|
+
runsec_version: v1.0
|
|
474
|
+
confidence: |-
|
|
475
|
+
0.9
|
|
476
|
+
exploit_scenario: |-
|
|
477
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
478
|
+
fix_template: |-
|
|
479
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
480
|
+
pattern-either:
|
|
481
|
+
- pattern: |-
|
|
482
|
+
ValidateIssuer = false; ValidateAudience = false;
|
|
483
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-025\\b'
|
|
484
|
+
message: |-
|
|
485
|
+
RunSec Detection [CSH-025]: JWT BCP / ASP.NET Auth
|
|
486
|
+
languages:
|
|
487
|
+
- csharp
|
|
488
|
+
severity: WARNING
|
|
489
|
+
- id: runsec.csharp-dotnet.csh-026
|
|
490
|
+
metadata:
|
|
491
|
+
runsec_version: v1.0
|
|
492
|
+
confidence: |-
|
|
493
|
+
0.9
|
|
494
|
+
exploit_scenario: |-
|
|
495
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
496
|
+
fix_template: |-
|
|
497
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
498
|
+
pattern-either:
|
|
499
|
+
- pattern: |-
|
|
500
|
+
context.Response.Redirect(returnUrl)
|
|
501
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-026\\b'
|
|
502
|
+
message: |-
|
|
503
|
+
RunSec Detection [CSH-026]: OAuth redirect security
|
|
504
|
+
languages:
|
|
505
|
+
- csharp
|
|
506
|
+
severity: WARNING
|
|
507
|
+
- id: runsec.csharp-dotnet.csh-027
|
|
508
|
+
metadata:
|
|
509
|
+
runsec_version: v1.0
|
|
510
|
+
confidence: |-
|
|
511
|
+
0.9
|
|
512
|
+
exploit_scenario: |-
|
|
513
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
514
|
+
fix_template: |-
|
|
515
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
516
|
+
pattern-either:
|
|
517
|
+
- pattern: |-
|
|
518
|
+
var path = Path.Combine(uploadDir, file.FileName);
|
|
519
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-027\\b'
|
|
520
|
+
message: |-
|
|
521
|
+
RunSec Detection [CSH-027]: OWASP File Upload
|
|
522
|
+
languages:
|
|
523
|
+
- csharp
|
|
524
|
+
severity: WARNING
|
|
525
|
+
- id: runsec.csharp-dotnet.csh-028
|
|
526
|
+
metadata:
|
|
527
|
+
runsec_version: v1.0
|
|
528
|
+
confidence: |-
|
|
529
|
+
0.9
|
|
530
|
+
exploit_scenario: |-
|
|
531
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
532
|
+
fix_template: |-
|
|
533
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
534
|
+
pattern-either:
|
|
535
|
+
- pattern: |-
|
|
536
|
+
return PhysicalFile(basePath + name, ...)
|
|
537
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-028\\b'
|
|
538
|
+
message: |-
|
|
539
|
+
RunSec Detection [CSH-028]: CWE-22
|
|
540
|
+
languages:
|
|
541
|
+
- csharp
|
|
542
|
+
severity: WARNING
|
|
543
|
+
- id: runsec.csharp-dotnet.csh-029
|
|
544
|
+
metadata:
|
|
545
|
+
runsec_version: v1.0
|
|
546
|
+
confidence: |-
|
|
547
|
+
0.9
|
|
548
|
+
exploit_scenario: |-
|
|
549
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
550
|
+
fix_template: |-
|
|
551
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
552
|
+
pattern-either:
|
|
553
|
+
- pattern: |-
|
|
554
|
+
[HttpPost]
|
|
555
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-029\\b'
|
|
556
|
+
message: |-
|
|
557
|
+
RunSec Detection [CSH-029]: OWASP CSRF
|
|
558
|
+
languages:
|
|
559
|
+
- csharp
|
|
560
|
+
severity: WARNING
|
|
561
|
+
- id: runsec.csharp-dotnet.csh-030
|
|
562
|
+
metadata:
|
|
563
|
+
runsec_version: v1.0
|
|
564
|
+
confidence: |-
|
|
565
|
+
0.9
|
|
566
|
+
exploit_scenario: |-
|
|
567
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
568
|
+
fix_template: |-
|
|
569
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
570
|
+
pattern-either:
|
|
571
|
+
- pattern: |-
|
|
572
|
+
var opts = new CookieOptions { Secure = false, HttpOnly = false };
|
|
573
|
+
...
|
|
574
|
+
Response.Cookies.Append("session", token, opts);
|
|
575
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-030\\b'
|
|
576
|
+
message: |-
|
|
577
|
+
RunSec Detection [CSH-030]: Session management
|
|
578
|
+
languages:
|
|
579
|
+
- csharp
|
|
580
|
+
severity: WARNING
|
|
581
|
+
- id: runsec.csharp-dotnet.csh-031
|
|
582
|
+
metadata:
|
|
583
|
+
runsec_version: v1.0
|
|
584
|
+
confidence: |-
|
|
585
|
+
0.9
|
|
586
|
+
exploit_scenario: |-
|
|
587
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
588
|
+
fix_template: |-
|
|
589
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
590
|
+
pattern-either:
|
|
591
|
+
- pattern: |-
|
|
592
|
+
TypeNameHandling.Auto/All
|
|
593
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-031\\b'
|
|
594
|
+
message: |-
|
|
595
|
+
RunSec Detection [CSH-031]: Json.NET hardening
|
|
596
|
+
languages:
|
|
597
|
+
- csharp
|
|
598
|
+
severity: WARNING
|
|
599
|
+
- id: runsec.csharp-dotnet.csh-032
|
|
600
|
+
metadata:
|
|
601
|
+
runsec_version: v1.0
|
|
602
|
+
confidence: |-
|
|
603
|
+
0.9
|
|
604
|
+
exploit_scenario: |-
|
|
605
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
606
|
+
fix_template: |-
|
|
607
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
608
|
+
pattern-either:
|
|
609
|
+
- pattern: |-
|
|
610
|
+
validateRequest="false"
|
|
611
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-032\\b'
|
|
612
|
+
message: |-
|
|
613
|
+
RunSec Detection [CSH-032]: ASP.NET config security
|
|
614
|
+
languages:
|
|
615
|
+
- csharp
|
|
616
|
+
severity: WARNING
|
|
617
|
+
- id: runsec.csharp-dotnet.csh-033
|
|
618
|
+
metadata:
|
|
619
|
+
runsec_version: v1.0
|
|
620
|
+
confidence: |-
|
|
621
|
+
0.9
|
|
622
|
+
exploit_scenario: |-
|
|
623
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
624
|
+
fix_template: |-
|
|
625
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
626
|
+
pattern-either:
|
|
627
|
+
- pattern: |-
|
|
628
|
+
SecurityProtocol = SecurityProtocolType.Ssl3
|
|
629
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-033\\b'
|
|
630
|
+
message: |-
|
|
631
|
+
RunSec Detection [CSH-033]: TLS hardening
|
|
632
|
+
languages:
|
|
633
|
+
- csharp
|
|
634
|
+
severity: WARNING
|
|
635
|
+
- id: runsec.csharp-dotnet.csh-034
|
|
636
|
+
metadata:
|
|
637
|
+
runsec_version: v1.0
|
|
638
|
+
confidence: |-
|
|
639
|
+
0.9
|
|
640
|
+
exploit_scenario: |-
|
|
641
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
642
|
+
fix_template: |-
|
|
643
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
644
|
+
pattern-either:
|
|
645
|
+
- pattern: |-
|
|
646
|
+
var token = new Random().Next();
|
|
647
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-034\\b'
|
|
648
|
+
message: |-
|
|
649
|
+
RunSec Detection [CSH-034]: CWE-338
|
|
650
|
+
languages:
|
|
651
|
+
- csharp
|
|
652
|
+
severity: WARNING
|
|
653
|
+
- id: runsec.csharp-dotnet.csh-035
|
|
654
|
+
metadata:
|
|
655
|
+
runsec_version: v1.0
|
|
656
|
+
confidence: |-
|
|
657
|
+
0.9
|
|
658
|
+
exploit_scenario: |-
|
|
659
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
660
|
+
fix_template: |-
|
|
661
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
662
|
+
pattern-either:
|
|
663
|
+
- pattern: |-
|
|
664
|
+
logger.LogInformation("pwd={pwd}", pwd)
|
|
665
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-035\\b'
|
|
666
|
+
message: |-
|
|
667
|
+
RunSec Detection [CSH-035]: OWASP Logging
|
|
668
|
+
languages:
|
|
669
|
+
- csharp
|
|
670
|
+
severity: WARNING
|
|
671
|
+
- id: runsec.csharp-dotnet.csh-036
|
|
672
|
+
metadata:
|
|
673
|
+
runsec_version: v1.0
|
|
674
|
+
confidence: |-
|
|
675
|
+
0.9
|
|
676
|
+
exploit_scenario: |-
|
|
677
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
678
|
+
fix_template: |-
|
|
679
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
680
|
+
pattern-either:
|
|
681
|
+
- pattern: |-
|
|
682
|
+
"(uid=" + user + ")"
|
|
683
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-036\\b'
|
|
684
|
+
message: |-
|
|
685
|
+
RunSec Detection [CSH-036]: CWE-90
|
|
686
|
+
languages:
|
|
687
|
+
- csharp
|
|
688
|
+
severity: WARNING
|
|
689
|
+
- id: runsec.csharp-dotnet.csh-037
|
|
690
|
+
metadata:
|
|
691
|
+
runsec_version: v1.0
|
|
692
|
+
confidence: |-
|
|
693
|
+
0.9
|
|
694
|
+
exploit_scenario: |-
|
|
695
|
+
Атакующий подаёт вход, провоцирующий катастрофический backtracking regex; возможен ReDoS (обычно не прямой RCE).
|
|
696
|
+
fix_template: |-
|
|
697
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
698
|
+
pattern-either:
|
|
699
|
+
- pattern: |-
|
|
700
|
+
new Regex("(a+)+$")
|
|
701
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-037\\b'
|
|
702
|
+
message: |-
|
|
703
|
+
RunSec Detection [CSH-037]: ReDoS defense
|
|
704
|
+
languages:
|
|
705
|
+
- csharp
|
|
706
|
+
severity: WARNING
|
|
707
|
+
- id: runsec.csharp-dotnet.csh-038
|
|
708
|
+
metadata:
|
|
709
|
+
runsec_version: v1.0
|
|
710
|
+
confidence: |-
|
|
711
|
+
0.9
|
|
712
|
+
exploit_scenario: |-
|
|
713
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
714
|
+
fix_template: |-
|
|
715
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
716
|
+
pattern-either:
|
|
717
|
+
- pattern: |-
|
|
718
|
+
signedXml.CheckSignature()
|
|
719
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-038\\b'
|
|
720
|
+
message: |-
|
|
721
|
+
RunSec Detection [CSH-038]: XMLDSIG security
|
|
722
|
+
languages:
|
|
723
|
+
- csharp
|
|
724
|
+
severity: WARNING
|
|
725
|
+
- id: runsec.csharp-dotnet.csh-039
|
|
726
|
+
metadata:
|
|
727
|
+
runsec_version: v1.0
|
|
728
|
+
confidence: |-
|
|
729
|
+
0.9
|
|
730
|
+
exploit_scenario: |-
|
|
731
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
732
|
+
fix_template: |-
|
|
733
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
734
|
+
pattern-either:
|
|
735
|
+
- pattern: |-
|
|
736
|
+
var role = context.RequestHeaders.GetValue("role");
|
|
737
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-039\\b'
|
|
738
|
+
message: |-
|
|
739
|
+
RunSec Detection [CSH-039]: gRPC security
|
|
740
|
+
languages:
|
|
741
|
+
- csharp
|
|
742
|
+
severity: WARNING
|
|
743
|
+
- id: runsec.csharp-dotnet.csh-040
|
|
744
|
+
metadata:
|
|
745
|
+
runsec_version: v1.0
|
|
746
|
+
confidence: |-
|
|
747
|
+
0.9
|
|
748
|
+
exploit_scenario: |-
|
|
749
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
750
|
+
fix_template: |-
|
|
751
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
752
|
+
pattern-either:
|
|
753
|
+
- pattern: |-
|
|
754
|
+
Field("ssn").Resolve(ctx => ctx.Source.InternalSsn)
|
|
755
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-040\\b'
|
|
756
|
+
message: |-
|
|
757
|
+
RunSec Detection [CSH-040]: GraphQL security
|
|
758
|
+
languages:
|
|
759
|
+
- csharp
|
|
760
|
+
severity: WARNING
|
|
761
|
+
- id: runsec.csharp-dotnet.csh-041
|
|
762
|
+
metadata:
|
|
763
|
+
runsec_version: v1.0
|
|
764
|
+
confidence: |-
|
|
765
|
+
0.9
|
|
766
|
+
exploit_scenario: |-
|
|
767
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
768
|
+
fix_template: |-
|
|
769
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
770
|
+
pattern-either:
|
|
771
|
+
- pattern: |-
|
|
772
|
+
FromSqlRaw($"...{id}...")
|
|
773
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-041\\b'
|
|
774
|
+
message: |-
|
|
775
|
+
RunSec Detection [CSH-041]: EF Core SQLi
|
|
776
|
+
languages:
|
|
777
|
+
- csharp
|
|
778
|
+
severity: WARNING
|
|
779
|
+
- id: runsec.csharp-dotnet.csh-042
|
|
780
|
+
metadata:
|
|
781
|
+
runsec_version: v1.0
|
|
782
|
+
confidence: |-
|
|
783
|
+
0.9
|
|
784
|
+
exploit_scenario: |-
|
|
785
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
786
|
+
fix_template: |-
|
|
787
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
788
|
+
pattern-either:
|
|
789
|
+
- pattern: |-
|
|
790
|
+
activity.SetTag("user.password", password);
|
|
791
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-042\\b'
|
|
792
|
+
message: |-
|
|
793
|
+
RunSec Detection [CSH-042]: Observability security
|
|
794
|
+
languages:
|
|
795
|
+
- csharp
|
|
796
|
+
severity: WARNING
|
|
797
|
+
- id: runsec.csharp-dotnet.csh-043
|
|
798
|
+
metadata:
|
|
799
|
+
runsec_version: v1.0
|
|
800
|
+
confidence: |-
|
|
801
|
+
0.9
|
|
802
|
+
exploit_scenario: |-
|
|
803
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
804
|
+
fix_template: |-
|
|
805
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
806
|
+
pattern-either:
|
|
807
|
+
- pattern: |-
|
|
808
|
+
new WebClient().DownloadString(url)
|
|
809
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-043\\b'
|
|
810
|
+
message: |-
|
|
811
|
+
RunSec Detection [CSH-043]: .NET networking hardening
|
|
812
|
+
languages:
|
|
813
|
+
- csharp
|
|
814
|
+
severity: WARNING
|
|
815
|
+
- id: runsec.csharp-dotnet.csh-044
|
|
816
|
+
metadata:
|
|
817
|
+
runsec_version: v1.0
|
|
818
|
+
confidence: |-
|
|
819
|
+
0.9
|
|
820
|
+
exploit_scenario: |-
|
|
821
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
822
|
+
fix_template: |-
|
|
823
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
824
|
+
pattern-either:
|
|
825
|
+
- pattern: |-
|
|
826
|
+
var svcPass = "hardcoded-service-secret";
|
|
827
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-044\\b'
|
|
828
|
+
message: |-
|
|
829
|
+
RunSec Detection [CSH-044]: CWE-798
|
|
830
|
+
languages:
|
|
831
|
+
- csharp
|
|
832
|
+
severity: WARNING
|
|
833
|
+
- id: runsec.csharp-dotnet.csh-045
|
|
834
|
+
metadata:
|
|
835
|
+
runsec_version: v1.0
|
|
836
|
+
confidence: |-
|
|
837
|
+
0.9
|
|
838
|
+
exploit_scenario: |-
|
|
839
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
840
|
+
fix_template: |-
|
|
841
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
842
|
+
pattern-either:
|
|
843
|
+
- pattern: |-
|
|
844
|
+
return await _repo.GetByIdAsync(id);
|
|
845
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-045\\b'
|
|
846
|
+
message: |-
|
|
847
|
+
RunSec Detection [CSH-045]: OWASP API1 BOLA
|
|
848
|
+
languages:
|
|
849
|
+
- csharp
|
|
850
|
+
severity: WARNING
|
|
851
|
+
- id: runsec.csharp-dotnet.csh-046
|
|
852
|
+
metadata:
|
|
853
|
+
runsec_version: v1.0
|
|
854
|
+
confidence: |-
|
|
855
|
+
0.9
|
|
856
|
+
exploit_scenario: |-
|
|
857
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
858
|
+
fix_template: |-
|
|
859
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
860
|
+
pattern-either:
|
|
861
|
+
- pattern: |-
|
|
862
|
+
File.Delete(userPath)
|
|
863
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-046\\b'
|
|
864
|
+
message: |-
|
|
865
|
+
RunSec Detection [CSH-046]: CWE-73
|
|
866
|
+
languages:
|
|
867
|
+
- csharp
|
|
868
|
+
severity: WARNING
|
|
869
|
+
- id: runsec.csharp-dotnet.csh-047
|
|
870
|
+
metadata:
|
|
871
|
+
runsec_version: v1.0
|
|
872
|
+
confidence: |-
|
|
873
|
+
0.9
|
|
874
|
+
exploit_scenario: |-
|
|
875
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
876
|
+
fix_template: |-
|
|
877
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
878
|
+
pattern-either:
|
|
879
|
+
- pattern: |-
|
|
880
|
+
new BinaryFormatter().Deserialize(stream)
|
|
881
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-047\\b'
|
|
882
|
+
message: |-
|
|
883
|
+
RunSec Detection [CSH-047]: CWE Final Certification
|
|
884
|
+
languages:
|
|
885
|
+
- csharp
|
|
886
|
+
severity: WARNING
|
|
887
|
+
- id: runsec.csharp-dotnet.csh-048
|
|
888
|
+
metadata:
|
|
889
|
+
runsec_version: v1.0
|
|
890
|
+
confidence: |-
|
|
891
|
+
0.9
|
|
892
|
+
exploit_scenario: |-
|
|
893
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
894
|
+
fix_template: |-
|
|
895
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
896
|
+
pattern-either:
|
|
897
|
+
- pattern: |-
|
|
898
|
+
Assembly.LoadFrom(userPath)
|
|
899
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-048\\b'
|
|
900
|
+
message: |-
|
|
901
|
+
RunSec Detection [CSH-048]: CWE Final Certification
|
|
902
|
+
languages:
|
|
903
|
+
- csharp
|
|
904
|
+
severity: WARNING
|
|
905
|
+
- id: runsec.csharp-dotnet.csh-049
|
|
906
|
+
metadata:
|
|
907
|
+
runsec_version: v1.0
|
|
908
|
+
confidence: |-
|
|
909
|
+
0.9
|
|
910
|
+
exploit_scenario: |-
|
|
911
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
912
|
+
fix_template: |-
|
|
913
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
914
|
+
pattern-either:
|
|
915
|
+
- pattern: |-
|
|
916
|
+
await _http.GetStringAsync("http://169.254.169.254/latest/meta-data/")
|
|
917
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-049\\b'
|
|
918
|
+
message: |-
|
|
919
|
+
RunSec Detection [CSH-049]: CWE-918
|
|
920
|
+
languages:
|
|
921
|
+
- csharp
|
|
922
|
+
severity: WARNING
|
|
923
|
+
- id: runsec.csharp-dotnet.csh-050
|
|
924
|
+
metadata:
|
|
925
|
+
runsec_version: v1.0
|
|
926
|
+
confidence: |-
|
|
927
|
+
0.9
|
|
928
|
+
exploit_scenario: |-
|
|
929
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
930
|
+
fix_template: |-
|
|
931
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
932
|
+
pattern-either:
|
|
933
|
+
- pattern: |-
|
|
934
|
+
WebRequest.CreateHttp("http://metadata.google.internal/computeMetadata/v1/")
|
|
935
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-050\\b'
|
|
936
|
+
message: |-
|
|
937
|
+
RunSec Detection [CSH-050]: CWE-918
|
|
938
|
+
languages:
|
|
939
|
+
- csharp
|
|
940
|
+
severity: WARNING
|
|
941
|
+
- id: runsec.csharp-dotnet.csh-051
|
|
942
|
+
metadata:
|
|
943
|
+
runsec_version: v1.0
|
|
944
|
+
confidence: |-
|
|
945
|
+
0.9
|
|
946
|
+
exploit_scenario: |-
|
|
947
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
948
|
+
fix_template: |-
|
|
949
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
950
|
+
pattern-either:
|
|
951
|
+
- pattern: |-
|
|
952
|
+
new RestClient("http://169.254.169.254").Execute(new RestRequest("/latest/meta-data/"))
|
|
953
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-051\\b'
|
|
954
|
+
message: |-
|
|
955
|
+
RunSec Detection [CSH-051]: CWE-918
|
|
956
|
+
languages:
|
|
957
|
+
- csharp
|
|
958
|
+
severity: WARNING
|
|
959
|
+
- id: runsec.csharp-dotnet.csh-052
|
|
960
|
+
metadata:
|
|
961
|
+
runsec_version: v1.0
|
|
962
|
+
confidence: |-
|
|
963
|
+
0.9
|
|
964
|
+
exploit_scenario: |-
|
|
965
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
966
|
+
fix_template: |-
|
|
967
|
+
Use using/try-finally and safe .NET APIs; enforce strict allowlists for untrusted input.
|
|
968
|
+
pattern-either:
|
|
969
|
+
- pattern: |-
|
|
970
|
+
await client.GetStringAsync("http://169.254.169.254/metadata/instance")
|
|
971
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-052\\b'
|
|
972
|
+
message: |-
|
|
973
|
+
RunSec Detection [CSH-052]: CWE-918
|
|
974
|
+
languages:
|
|
975
|
+
- csharp
|
|
976
|
+
severity: WARNING
|
|
977
|
+
- id: runsec.csharp-dotnet.csh-053
|
|
978
|
+
metadata:
|
|
979
|
+
runsec_version: v1.0
|
|
980
|
+
confidence: |-
|
|
981
|
+
0.9
|
|
982
|
+
exploit_scenario: |-
|
|
983
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
984
|
+
fix_template: |-
|
|
985
|
+
Replace == on secrets with CryptographicOperations.FixedTimeEquals or verified KDF APIs only.
|
|
986
|
+
pattern-either:
|
|
987
|
+
- pattern: |-
|
|
988
|
+
return storedHash == computedHash;
|
|
989
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-053\\b'
|
|
990
|
+
message: |-
|
|
991
|
+
RunSec Detection [CSH-053]: CWE-613
|
|
992
|
+
languages:
|
|
993
|
+
- csharp
|
|
994
|
+
severity: WARNING
|
|
995
|
+
- id: runsec.csharp-dotnet.csh-054
|
|
996
|
+
metadata:
|
|
997
|
+
runsec_version: v1.0
|
|
998
|
+
confidence: |-
|
|
999
|
+
0.9
|
|
1000
|
+
exploit_scenario: |-
|
|
1001
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
1002
|
+
fix_template: |-
|
|
1003
|
+
Enable lifetime validation and align clock skew with token issuer SLA.
|
|
1004
|
+
pattern-either:
|
|
1005
|
+
- pattern: |-
|
|
1006
|
+
ValidateLifetime = false
|
|
1007
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-054\\b'
|
|
1008
|
+
message: |-
|
|
1009
|
+
RunSec Detection [CSH-054]: CWE-924
|
|
1010
|
+
languages:
|
|
1011
|
+
- csharp
|
|
1012
|
+
severity: WARNING
|
|
1013
|
+
- id: runsec.csharp-dotnet.csh-055
|
|
1014
|
+
metadata:
|
|
1015
|
+
runsec_version: v1.0
|
|
1016
|
+
confidence: |-
|
|
1017
|
+
0.9
|
|
1018
|
+
exploit_scenario: |-
|
|
1019
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
1020
|
+
fix_template: |-
|
|
1021
|
+
Avoid TimeSpan.Zero unless IdP mandates; document skew rationale.
|
|
1022
|
+
pattern-either:
|
|
1023
|
+
- pattern: |-
|
|
1024
|
+
ClockSkew = TimeSpan.Zero
|
|
1025
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-055\\b'
|
|
1026
|
+
message: |-
|
|
1027
|
+
RunSec Detection [CSH-055]: CWE-613
|
|
1028
|
+
languages:
|
|
1029
|
+
- csharp
|
|
1030
|
+
severity: WARNING
|
|
1031
|
+
- id: runsec.csharp-dotnet.csh-056
|
|
1032
|
+
metadata:
|
|
1033
|
+
runsec_version: v1.0
|
|
1034
|
+
confidence: |-
|
|
1035
|
+
0.9
|
|
1036
|
+
exploit_scenario: |-
|
|
1037
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
1038
|
+
fix_template: |-
|
|
1039
|
+
Create temp files under app-controlled dir with explicit ACL, not default shared temp.
|
|
1040
|
+
pattern-either:
|
|
1041
|
+
- pattern: |-
|
|
1042
|
+
var tmp = Path.GetTempFileName();
|
|
1043
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-056\\b'
|
|
1044
|
+
message: |-
|
|
1045
|
+
RunSec Detection [CSH-056]: CWE-377
|
|
1046
|
+
languages:
|
|
1047
|
+
- csharp
|
|
1048
|
+
severity: WARNING
|
|
1049
|
+
- id: runsec.csharp-dotnet.csh-057
|
|
1050
|
+
metadata:
|
|
1051
|
+
runsec_version: v1.0
|
|
1052
|
+
confidence: |-
|
|
1053
|
+
0.9
|
|
1054
|
+
exploit_scenario: |-
|
|
1055
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
1056
|
+
fix_template: |-
|
|
1057
|
+
Always quote/structure paths with spaces; avoid single-string overloads for untrusted paths.
|
|
1058
|
+
pattern-either:
|
|
1059
|
+
- pattern: |-
|
|
1060
|
+
Process.Start("C:\\Program Files\\Vendor\\tool.exe");
|
|
1061
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-057\\b'
|
|
1062
|
+
message: |-
|
|
1063
|
+
RunSec Detection [CSH-057]: CWE-428
|
|
1064
|
+
languages:
|
|
1065
|
+
- csharp
|
|
1066
|
+
severity: WARNING
|
|
1067
|
+
- id: runsec.csharp-dotnet.csh-058
|
|
1068
|
+
metadata:
|
|
1069
|
+
runsec_version: v1.0
|
|
1070
|
+
confidence: |-
|
|
1071
|
+
0.9
|
|
1072
|
+
exploit_scenario: |-
|
|
1073
|
+
Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия.
|
|
1074
|
+
fix_template: |-
|
|
1075
|
+
Quote service binary paths in registry; validate against allowlist.
|
|
1076
|
+
pattern-either:
|
|
1077
|
+
- pattern: |-
|
|
1078
|
+
Registry.SetValue(key, "ImagePath", "C:\\Program Files\\App\\svc.exe");
|
|
1079
|
+
- pattern-regex: 'Vulnerable:\\s*CSH\\-058\\b'
|
|
1080
|
+
message: |-
|
|
1081
|
+
RunSec Detection [CSH-058]: CWE-428
|
|
1082
|
+
languages:
|
|
1083
|
+
- csharp
|
|
1084
|
+
severity: WARNING
|
|
1085
|
+
- id: runsec.csharp-dotnet.dnx-101
|
|
1086
|
+
metadata:
|
|
1087
|
+
runsec_version: v1.0
|
|
1088
|
+
confidence: |-
|
|
1089
|
+
0.9
|
|
1090
|
+
exploit_scenario: |-
|
|
1091
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
1092
|
+
fix_template: |-
|
|
1093
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
1094
|
+
pattern-either:
|
|
1095
|
+
- pattern: |-
|
|
1096
|
+
return _db.Orders.First(o => o.Id == id);
|
|
1097
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-101\\b'
|
|
1098
|
+
message: |-
|
|
1099
|
+
RunSec Detection [DNX-101]: CWE-639
|
|
1100
|
+
languages:
|
|
1101
|
+
- csharp
|
|
1102
|
+
severity: WARNING
|
|
1103
|
+
- id: runsec.csharp-dotnet.dnx-102
|
|
1104
|
+
metadata:
|
|
1105
|
+
runsec_version: v1.0
|
|
1106
|
+
confidence: |-
|
|
1107
|
+
0.9
|
|
1108
|
+
exploit_scenario: |-
|
|
1109
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
1110
|
+
fix_template: |-
|
|
1111
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
1112
|
+
pattern-either:
|
|
1113
|
+
- pattern: |-
|
|
1114
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
1115
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-102\\b'
|
|
1116
|
+
message: |-
|
|
1117
|
+
RunSec Detection [DNX-102]: CWE-89
|
|
1118
|
+
languages:
|
|
1119
|
+
- csharp
|
|
1120
|
+
severity: WARNING
|
|
1121
|
+
- id: runsec.csharp-dotnet.dnx-103
|
|
1122
|
+
metadata:
|
|
1123
|
+
runsec_version: v1.0
|
|
1124
|
+
confidence: |-
|
|
1125
|
+
0.9
|
|
1126
|
+
exploit_scenario: |-
|
|
1127
|
+
Deserialization gadgets can trigger remote code execution.
|
|
1128
|
+
fix_template: |-
|
|
1129
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
1130
|
+
pattern-either:
|
|
1131
|
+
- pattern: |-
|
|
1132
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
1133
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-103\\b'
|
|
1134
|
+
message: |-
|
|
1135
|
+
RunSec Detection [DNX-103]: CWE-502
|
|
1136
|
+
languages:
|
|
1137
|
+
- csharp
|
|
1138
|
+
severity: WARNING
|
|
1139
|
+
- id: runsec.csharp-dotnet.dnx-104
|
|
1140
|
+
metadata:
|
|
1141
|
+
runsec_version: v1.0
|
|
1142
|
+
confidence: |-
|
|
1143
|
+
0.9
|
|
1144
|
+
exploit_scenario: |-
|
|
1145
|
+
Model binder can set protected privilege and billing fields.
|
|
1146
|
+
fix_template: |-
|
|
1147
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
1148
|
+
pattern-either:
|
|
1149
|
+
- pattern: |-
|
|
1150
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
1151
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-104\\b'
|
|
1152
|
+
message: |-
|
|
1153
|
+
RunSec Detection [DNX-104]: CWE-915
|
|
1154
|
+
languages:
|
|
1155
|
+
- csharp
|
|
1156
|
+
severity: WARNING
|
|
1157
|
+
- id: runsec.csharp-dotnet.dnx-105
|
|
1158
|
+
metadata:
|
|
1159
|
+
runsec_version: v1.0
|
|
1160
|
+
confidence: |-
|
|
1161
|
+
0.9
|
|
1162
|
+
exploit_scenario: |-
|
|
1163
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
1164
|
+
fix_template: |-
|
|
1165
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
1166
|
+
pattern-either:
|
|
1167
|
+
- pattern: |-
|
|
1168
|
+
_cache[key] = value;
|
|
1169
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-105\\b'
|
|
1170
|
+
message: |-
|
|
1171
|
+
RunSec Detection [DNX-105]: CWE-662
|
|
1172
|
+
languages:
|
|
1173
|
+
- csharp
|
|
1174
|
+
severity: WARNING
|
|
1175
|
+
- id: runsec.csharp-dotnet.dnx-106
|
|
1176
|
+
metadata:
|
|
1177
|
+
runsec_version: v1.0
|
|
1178
|
+
confidence: |-
|
|
1179
|
+
0.9
|
|
1180
|
+
exploit_scenario: |-
|
|
1181
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
1182
|
+
fix_template: |-
|
|
1183
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
1184
|
+
pattern-either:
|
|
1185
|
+
- pattern: |-
|
|
1186
|
+
return _db.Orders.First(o => o.Id == id);
|
|
1187
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-106\\b'
|
|
1188
|
+
message: |-
|
|
1189
|
+
RunSec Detection [DNX-106]: CWE-639
|
|
1190
|
+
languages:
|
|
1191
|
+
- csharp
|
|
1192
|
+
severity: WARNING
|
|
1193
|
+
- id: runsec.csharp-dotnet.dnx-107
|
|
1194
|
+
metadata:
|
|
1195
|
+
runsec_version: v1.0
|
|
1196
|
+
confidence: |-
|
|
1197
|
+
0.9
|
|
1198
|
+
exploit_scenario: |-
|
|
1199
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
1200
|
+
fix_template: |-
|
|
1201
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
1202
|
+
pattern-either:
|
|
1203
|
+
- pattern: |-
|
|
1204
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
1205
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-107\\b'
|
|
1206
|
+
message: |-
|
|
1207
|
+
RunSec Detection [DNX-107]: CWE-89
|
|
1208
|
+
languages:
|
|
1209
|
+
- csharp
|
|
1210
|
+
severity: WARNING
|
|
1211
|
+
- id: runsec.csharp-dotnet.dnx-108
|
|
1212
|
+
metadata:
|
|
1213
|
+
runsec_version: v1.0
|
|
1214
|
+
confidence: |-
|
|
1215
|
+
0.9
|
|
1216
|
+
exploit_scenario: |-
|
|
1217
|
+
Deserialization gadgets can trigger remote code execution.
|
|
1218
|
+
fix_template: |-
|
|
1219
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
1220
|
+
pattern-either:
|
|
1221
|
+
- pattern: |-
|
|
1222
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
1223
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-108\\b'
|
|
1224
|
+
message: |-
|
|
1225
|
+
RunSec Detection [DNX-108]: CWE-502
|
|
1226
|
+
languages:
|
|
1227
|
+
- csharp
|
|
1228
|
+
severity: WARNING
|
|
1229
|
+
- id: runsec.csharp-dotnet.dnx-109
|
|
1230
|
+
metadata:
|
|
1231
|
+
runsec_version: v1.0
|
|
1232
|
+
confidence: |-
|
|
1233
|
+
0.9
|
|
1234
|
+
exploit_scenario: |-
|
|
1235
|
+
Model binder can set protected privilege and billing fields.
|
|
1236
|
+
fix_template: |-
|
|
1237
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
1238
|
+
pattern-either:
|
|
1239
|
+
- pattern: |-
|
|
1240
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
1241
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-109\\b'
|
|
1242
|
+
message: |-
|
|
1243
|
+
RunSec Detection [DNX-109]: CWE-915
|
|
1244
|
+
languages:
|
|
1245
|
+
- csharp
|
|
1246
|
+
severity: WARNING
|
|
1247
|
+
- id: runsec.csharp-dotnet.dnx-110
|
|
1248
|
+
metadata:
|
|
1249
|
+
runsec_version: v1.0
|
|
1250
|
+
confidence: |-
|
|
1251
|
+
0.9
|
|
1252
|
+
exploit_scenario: |-
|
|
1253
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
1254
|
+
fix_template: |-
|
|
1255
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
1256
|
+
pattern-either:
|
|
1257
|
+
- pattern: |-
|
|
1258
|
+
_cache[key] = value;
|
|
1259
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-110\\b'
|
|
1260
|
+
message: |-
|
|
1261
|
+
RunSec Detection [DNX-110]: CWE-662
|
|
1262
|
+
languages:
|
|
1263
|
+
- csharp
|
|
1264
|
+
severity: WARNING
|
|
1265
|
+
- id: runsec.csharp-dotnet.dnx-111
|
|
1266
|
+
metadata:
|
|
1267
|
+
runsec_version: v1.0
|
|
1268
|
+
confidence: |-
|
|
1269
|
+
0.9
|
|
1270
|
+
exploit_scenario: |-
|
|
1271
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
1272
|
+
fix_template: |-
|
|
1273
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
1274
|
+
pattern-either:
|
|
1275
|
+
- pattern: |-
|
|
1276
|
+
return _db.Orders.First(o => o.Id == id);
|
|
1277
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-111\\b'
|
|
1278
|
+
message: |-
|
|
1279
|
+
RunSec Detection [DNX-111]: CWE-639
|
|
1280
|
+
languages:
|
|
1281
|
+
- csharp
|
|
1282
|
+
severity: WARNING
|
|
1283
|
+
- id: runsec.csharp-dotnet.dnx-112
|
|
1284
|
+
metadata:
|
|
1285
|
+
runsec_version: v1.0
|
|
1286
|
+
confidence: |-
|
|
1287
|
+
0.9
|
|
1288
|
+
exploit_scenario: |-
|
|
1289
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
1290
|
+
fix_template: |-
|
|
1291
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
1292
|
+
pattern-either:
|
|
1293
|
+
- pattern: |-
|
|
1294
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
1295
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-112\\b'
|
|
1296
|
+
message: |-
|
|
1297
|
+
RunSec Detection [DNX-112]: CWE-89
|
|
1298
|
+
languages:
|
|
1299
|
+
- csharp
|
|
1300
|
+
severity: WARNING
|
|
1301
|
+
- id: runsec.csharp-dotnet.dnx-113
|
|
1302
|
+
metadata:
|
|
1303
|
+
runsec_version: v1.0
|
|
1304
|
+
confidence: |-
|
|
1305
|
+
0.9
|
|
1306
|
+
exploit_scenario: |-
|
|
1307
|
+
Deserialization gadgets can trigger remote code execution.
|
|
1308
|
+
fix_template: |-
|
|
1309
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
1310
|
+
pattern-either:
|
|
1311
|
+
- pattern: |-
|
|
1312
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
1313
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-113\\b'
|
|
1314
|
+
message: |-
|
|
1315
|
+
RunSec Detection [DNX-113]: CWE-502
|
|
1316
|
+
languages:
|
|
1317
|
+
- csharp
|
|
1318
|
+
severity: WARNING
|
|
1319
|
+
- id: runsec.csharp-dotnet.dnx-114
|
|
1320
|
+
metadata:
|
|
1321
|
+
runsec_version: v1.0
|
|
1322
|
+
confidence: |-
|
|
1323
|
+
0.9
|
|
1324
|
+
exploit_scenario: |-
|
|
1325
|
+
Model binder can set protected privilege and billing fields.
|
|
1326
|
+
fix_template: |-
|
|
1327
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
1328
|
+
pattern-either:
|
|
1329
|
+
- pattern: |-
|
|
1330
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
1331
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-114\\b'
|
|
1332
|
+
message: |-
|
|
1333
|
+
RunSec Detection [DNX-114]: CWE-915
|
|
1334
|
+
languages:
|
|
1335
|
+
- csharp
|
|
1336
|
+
severity: WARNING
|
|
1337
|
+
- id: runsec.csharp-dotnet.dnx-115
|
|
1338
|
+
metadata:
|
|
1339
|
+
runsec_version: v1.0
|
|
1340
|
+
confidence: |-
|
|
1341
|
+
0.9
|
|
1342
|
+
exploit_scenario: |-
|
|
1343
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
1344
|
+
fix_template: |-
|
|
1345
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
1346
|
+
pattern-either:
|
|
1347
|
+
- pattern: |-
|
|
1348
|
+
_cache[key] = value;
|
|
1349
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-115\\b'
|
|
1350
|
+
message: |-
|
|
1351
|
+
RunSec Detection [DNX-115]: CWE-662
|
|
1352
|
+
languages:
|
|
1353
|
+
- csharp
|
|
1354
|
+
severity: WARNING
|
|
1355
|
+
- id: runsec.csharp-dotnet.dnx-116
|
|
1356
|
+
metadata:
|
|
1357
|
+
runsec_version: v1.0
|
|
1358
|
+
confidence: |-
|
|
1359
|
+
0.9
|
|
1360
|
+
exploit_scenario: |-
|
|
1361
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
1362
|
+
fix_template: |-
|
|
1363
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
1364
|
+
pattern-either:
|
|
1365
|
+
- pattern: |-
|
|
1366
|
+
return _db.Orders.First(o => o.Id == id);
|
|
1367
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-116\\b'
|
|
1368
|
+
message: |-
|
|
1369
|
+
RunSec Detection [DNX-116]: CWE-639
|
|
1370
|
+
languages:
|
|
1371
|
+
- csharp
|
|
1372
|
+
severity: WARNING
|
|
1373
|
+
- id: runsec.csharp-dotnet.dnx-117
|
|
1374
|
+
metadata:
|
|
1375
|
+
runsec_version: v1.0
|
|
1376
|
+
confidence: |-
|
|
1377
|
+
0.9
|
|
1378
|
+
exploit_scenario: |-
|
|
1379
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
1380
|
+
fix_template: |-
|
|
1381
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
1382
|
+
pattern-either:
|
|
1383
|
+
- pattern: |-
|
|
1384
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
1385
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-117\\b'
|
|
1386
|
+
message: |-
|
|
1387
|
+
RunSec Detection [DNX-117]: CWE-89
|
|
1388
|
+
languages:
|
|
1389
|
+
- csharp
|
|
1390
|
+
severity: WARNING
|
|
1391
|
+
- id: runsec.csharp-dotnet.dnx-118
|
|
1392
|
+
metadata:
|
|
1393
|
+
runsec_version: v1.0
|
|
1394
|
+
confidence: |-
|
|
1395
|
+
0.9
|
|
1396
|
+
exploit_scenario: |-
|
|
1397
|
+
Deserialization gadgets can trigger remote code execution.
|
|
1398
|
+
fix_template: |-
|
|
1399
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
1400
|
+
pattern-either:
|
|
1401
|
+
- pattern: |-
|
|
1402
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
1403
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-118\\b'
|
|
1404
|
+
message: |-
|
|
1405
|
+
RunSec Detection [DNX-118]: CWE-502
|
|
1406
|
+
languages:
|
|
1407
|
+
- csharp
|
|
1408
|
+
severity: WARNING
|
|
1409
|
+
- id: runsec.csharp-dotnet.dnx-119
|
|
1410
|
+
metadata:
|
|
1411
|
+
runsec_version: v1.0
|
|
1412
|
+
confidence: |-
|
|
1413
|
+
0.9
|
|
1414
|
+
exploit_scenario: |-
|
|
1415
|
+
Model binder can set protected privilege and billing fields.
|
|
1416
|
+
fix_template: |-
|
|
1417
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
1418
|
+
pattern-either:
|
|
1419
|
+
- pattern: |-
|
|
1420
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
1421
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-119\\b'
|
|
1422
|
+
message: |-
|
|
1423
|
+
RunSec Detection [DNX-119]: CWE-915
|
|
1424
|
+
languages:
|
|
1425
|
+
- csharp
|
|
1426
|
+
severity: WARNING
|
|
1427
|
+
- id: runsec.csharp-dotnet.dnx-120
|
|
1428
|
+
metadata:
|
|
1429
|
+
runsec_version: v1.0
|
|
1430
|
+
confidence: |-
|
|
1431
|
+
0.9
|
|
1432
|
+
exploit_scenario: |-
|
|
1433
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
1434
|
+
fix_template: |-
|
|
1435
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
1436
|
+
pattern-either:
|
|
1437
|
+
- pattern: |-
|
|
1438
|
+
_cache[key] = value;
|
|
1439
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-120\\b'
|
|
1440
|
+
message: |-
|
|
1441
|
+
RunSec Detection [DNX-120]: CWE-662
|
|
1442
|
+
languages:
|
|
1443
|
+
- csharp
|
|
1444
|
+
severity: WARNING
|
|
1445
|
+
- id: runsec.csharp-dotnet.dnx-121
|
|
1446
|
+
metadata:
|
|
1447
|
+
runsec_version: v1.0
|
|
1448
|
+
confidence: |-
|
|
1449
|
+
0.9
|
|
1450
|
+
exploit_scenario: |-
|
|
1451
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
1452
|
+
fix_template: |-
|
|
1453
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
1454
|
+
pattern-either:
|
|
1455
|
+
- pattern: |-
|
|
1456
|
+
return _db.Orders.First(o => o.Id == id);
|
|
1457
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-121\\b'
|
|
1458
|
+
message: |-
|
|
1459
|
+
RunSec Detection [DNX-121]: CWE-639
|
|
1460
|
+
languages:
|
|
1461
|
+
- csharp
|
|
1462
|
+
severity: WARNING
|
|
1463
|
+
- id: runsec.csharp-dotnet.dnx-122
|
|
1464
|
+
metadata:
|
|
1465
|
+
runsec_version: v1.0
|
|
1466
|
+
confidence: |-
|
|
1467
|
+
0.9
|
|
1468
|
+
exploit_scenario: |-
|
|
1469
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
1470
|
+
fix_template: |-
|
|
1471
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
1472
|
+
pattern-either:
|
|
1473
|
+
- pattern: |-
|
|
1474
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
1475
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-122\\b'
|
|
1476
|
+
message: |-
|
|
1477
|
+
RunSec Detection [DNX-122]: CWE-89
|
|
1478
|
+
languages:
|
|
1479
|
+
- csharp
|
|
1480
|
+
severity: WARNING
|
|
1481
|
+
- id: runsec.csharp-dotnet.dnx-123
|
|
1482
|
+
metadata:
|
|
1483
|
+
runsec_version: v1.0
|
|
1484
|
+
confidence: |-
|
|
1485
|
+
0.9
|
|
1486
|
+
exploit_scenario: |-
|
|
1487
|
+
Deserialization gadgets can trigger remote code execution.
|
|
1488
|
+
fix_template: |-
|
|
1489
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
1490
|
+
pattern-either:
|
|
1491
|
+
- pattern: |-
|
|
1492
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
1493
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-123\\b'
|
|
1494
|
+
message: |-
|
|
1495
|
+
RunSec Detection [DNX-123]: CWE-502
|
|
1496
|
+
languages:
|
|
1497
|
+
- csharp
|
|
1498
|
+
severity: WARNING
|
|
1499
|
+
- id: runsec.csharp-dotnet.dnx-124
|
|
1500
|
+
metadata:
|
|
1501
|
+
runsec_version: v1.0
|
|
1502
|
+
confidence: |-
|
|
1503
|
+
0.9
|
|
1504
|
+
exploit_scenario: |-
|
|
1505
|
+
Model binder can set protected privilege and billing fields.
|
|
1506
|
+
fix_template: |-
|
|
1507
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
1508
|
+
pattern-either:
|
|
1509
|
+
- pattern: |-
|
|
1510
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
1511
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-124\\b'
|
|
1512
|
+
message: |-
|
|
1513
|
+
RunSec Detection [DNX-124]: CWE-915
|
|
1514
|
+
languages:
|
|
1515
|
+
- csharp
|
|
1516
|
+
severity: WARNING
|
|
1517
|
+
- id: runsec.csharp-dotnet.dnx-125
|
|
1518
|
+
metadata:
|
|
1519
|
+
runsec_version: v1.0
|
|
1520
|
+
confidence: |-
|
|
1521
|
+
0.9
|
|
1522
|
+
exploit_scenario: |-
|
|
1523
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
1524
|
+
fix_template: |-
|
|
1525
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
1526
|
+
pattern-either:
|
|
1527
|
+
- pattern: |-
|
|
1528
|
+
_cache[key] = value;
|
|
1529
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-125\\b'
|
|
1530
|
+
message: |-
|
|
1531
|
+
RunSec Detection [DNX-125]: CWE-662
|
|
1532
|
+
languages:
|
|
1533
|
+
- csharp
|
|
1534
|
+
severity: WARNING
|
|
1535
|
+
- id: runsec.csharp-dotnet.dnx-126
|
|
1536
|
+
metadata:
|
|
1537
|
+
runsec_version: v1.0
|
|
1538
|
+
confidence: |-
|
|
1539
|
+
0.9
|
|
1540
|
+
exploit_scenario: |-
|
|
1541
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
1542
|
+
fix_template: |-
|
|
1543
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
1544
|
+
pattern-either:
|
|
1545
|
+
- pattern: |-
|
|
1546
|
+
return _db.Orders.First(o => o.Id == id);
|
|
1547
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-126\\b'
|
|
1548
|
+
message: |-
|
|
1549
|
+
RunSec Detection [DNX-126]: CWE-639
|
|
1550
|
+
languages:
|
|
1551
|
+
- csharp
|
|
1552
|
+
severity: WARNING
|
|
1553
|
+
- id: runsec.csharp-dotnet.dnx-127
|
|
1554
|
+
metadata:
|
|
1555
|
+
runsec_version: v1.0
|
|
1556
|
+
confidence: |-
|
|
1557
|
+
0.9
|
|
1558
|
+
exploit_scenario: |-
|
|
1559
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
1560
|
+
fix_template: |-
|
|
1561
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
1562
|
+
pattern-either:
|
|
1563
|
+
- pattern: |-
|
|
1564
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
1565
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-127\\b'
|
|
1566
|
+
message: |-
|
|
1567
|
+
RunSec Detection [DNX-127]: CWE-89
|
|
1568
|
+
languages:
|
|
1569
|
+
- csharp
|
|
1570
|
+
severity: WARNING
|
|
1571
|
+
- id: runsec.csharp-dotnet.dnx-128
|
|
1572
|
+
metadata:
|
|
1573
|
+
runsec_version: v1.0
|
|
1574
|
+
confidence: |-
|
|
1575
|
+
0.9
|
|
1576
|
+
exploit_scenario: |-
|
|
1577
|
+
Deserialization gadgets can trigger remote code execution.
|
|
1578
|
+
fix_template: |-
|
|
1579
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
1580
|
+
pattern-either:
|
|
1581
|
+
- pattern: |-
|
|
1582
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
1583
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-128\\b'
|
|
1584
|
+
message: |-
|
|
1585
|
+
RunSec Detection [DNX-128]: CWE-502
|
|
1586
|
+
languages:
|
|
1587
|
+
- csharp
|
|
1588
|
+
severity: WARNING
|
|
1589
|
+
- id: runsec.csharp-dotnet.dnx-129
|
|
1590
|
+
metadata:
|
|
1591
|
+
runsec_version: v1.0
|
|
1592
|
+
confidence: |-
|
|
1593
|
+
0.9
|
|
1594
|
+
exploit_scenario: |-
|
|
1595
|
+
Model binder can set protected privilege and billing fields.
|
|
1596
|
+
fix_template: |-
|
|
1597
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
1598
|
+
pattern-either:
|
|
1599
|
+
- pattern: |-
|
|
1600
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
1601
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-129\\b'
|
|
1602
|
+
message: |-
|
|
1603
|
+
RunSec Detection [DNX-129]: CWE-915
|
|
1604
|
+
languages:
|
|
1605
|
+
- csharp
|
|
1606
|
+
severity: WARNING
|
|
1607
|
+
- id: runsec.csharp-dotnet.dnx-130
|
|
1608
|
+
metadata:
|
|
1609
|
+
runsec_version: v1.0
|
|
1610
|
+
confidence: |-
|
|
1611
|
+
0.9
|
|
1612
|
+
exploit_scenario: |-
|
|
1613
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
1614
|
+
fix_template: |-
|
|
1615
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
1616
|
+
pattern-either:
|
|
1617
|
+
- pattern: |-
|
|
1618
|
+
_cache[key] = value;
|
|
1619
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-130\\b'
|
|
1620
|
+
message: |-
|
|
1621
|
+
RunSec Detection [DNX-130]: CWE-662
|
|
1622
|
+
languages:
|
|
1623
|
+
- csharp
|
|
1624
|
+
severity: WARNING
|
|
1625
|
+
- id: runsec.csharp-dotnet.dnx-131
|
|
1626
|
+
metadata:
|
|
1627
|
+
runsec_version: v1.0
|
|
1628
|
+
confidence: |-
|
|
1629
|
+
0.9
|
|
1630
|
+
exploit_scenario: |-
|
|
1631
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
1632
|
+
fix_template: |-
|
|
1633
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
1634
|
+
pattern-either:
|
|
1635
|
+
- pattern: |-
|
|
1636
|
+
return _db.Orders.First(o => o.Id == id);
|
|
1637
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-131\\b'
|
|
1638
|
+
message: |-
|
|
1639
|
+
RunSec Detection [DNX-131]: CWE-639
|
|
1640
|
+
languages:
|
|
1641
|
+
- csharp
|
|
1642
|
+
severity: WARNING
|
|
1643
|
+
- id: runsec.csharp-dotnet.dnx-132
|
|
1644
|
+
metadata:
|
|
1645
|
+
runsec_version: v1.0
|
|
1646
|
+
confidence: |-
|
|
1647
|
+
0.9
|
|
1648
|
+
exploit_scenario: |-
|
|
1649
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
1650
|
+
fix_template: |-
|
|
1651
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
1652
|
+
pattern-either:
|
|
1653
|
+
- pattern: |-
|
|
1654
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
1655
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-132\\b'
|
|
1656
|
+
message: |-
|
|
1657
|
+
RunSec Detection [DNX-132]: CWE-89
|
|
1658
|
+
languages:
|
|
1659
|
+
- csharp
|
|
1660
|
+
severity: WARNING
|
|
1661
|
+
- id: runsec.csharp-dotnet.dnx-133
|
|
1662
|
+
metadata:
|
|
1663
|
+
runsec_version: v1.0
|
|
1664
|
+
confidence: |-
|
|
1665
|
+
0.9
|
|
1666
|
+
exploit_scenario: |-
|
|
1667
|
+
Deserialization gadgets can trigger remote code execution.
|
|
1668
|
+
fix_template: |-
|
|
1669
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
1670
|
+
pattern-either:
|
|
1671
|
+
- pattern: |-
|
|
1672
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
1673
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-133\\b'
|
|
1674
|
+
message: |-
|
|
1675
|
+
RunSec Detection [DNX-133]: CWE-502
|
|
1676
|
+
languages:
|
|
1677
|
+
- csharp
|
|
1678
|
+
severity: WARNING
|
|
1679
|
+
- id: runsec.csharp-dotnet.dnx-134
|
|
1680
|
+
metadata:
|
|
1681
|
+
runsec_version: v1.0
|
|
1682
|
+
confidence: |-
|
|
1683
|
+
0.9
|
|
1684
|
+
exploit_scenario: |-
|
|
1685
|
+
Model binder can set protected privilege and billing fields.
|
|
1686
|
+
fix_template: |-
|
|
1687
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
1688
|
+
pattern-either:
|
|
1689
|
+
- pattern: |-
|
|
1690
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
1691
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-134\\b'
|
|
1692
|
+
message: |-
|
|
1693
|
+
RunSec Detection [DNX-134]: CWE-915
|
|
1694
|
+
languages:
|
|
1695
|
+
- csharp
|
|
1696
|
+
severity: WARNING
|
|
1697
|
+
- id: runsec.csharp-dotnet.dnx-135
|
|
1698
|
+
metadata:
|
|
1699
|
+
runsec_version: v1.0
|
|
1700
|
+
confidence: |-
|
|
1701
|
+
0.9
|
|
1702
|
+
exploit_scenario: |-
|
|
1703
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
1704
|
+
fix_template: |-
|
|
1705
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
1706
|
+
pattern-either:
|
|
1707
|
+
- pattern: |-
|
|
1708
|
+
_cache[key] = value;
|
|
1709
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-135\\b'
|
|
1710
|
+
message: |-
|
|
1711
|
+
RunSec Detection [DNX-135]: CWE-662
|
|
1712
|
+
languages:
|
|
1713
|
+
- csharp
|
|
1714
|
+
severity: WARNING
|
|
1715
|
+
- id: runsec.csharp-dotnet.dnx-136
|
|
1716
|
+
metadata:
|
|
1717
|
+
runsec_version: v1.0
|
|
1718
|
+
confidence: |-
|
|
1719
|
+
0.9
|
|
1720
|
+
exploit_scenario: |-
|
|
1721
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
1722
|
+
fix_template: |-
|
|
1723
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
1724
|
+
pattern-either:
|
|
1725
|
+
- pattern: |-
|
|
1726
|
+
return _db.Orders.First(o => o.Id == id);
|
|
1727
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-136\\b'
|
|
1728
|
+
message: |-
|
|
1729
|
+
RunSec Detection [DNX-136]: CWE-639
|
|
1730
|
+
languages:
|
|
1731
|
+
- csharp
|
|
1732
|
+
severity: WARNING
|
|
1733
|
+
- id: runsec.csharp-dotnet.dnx-137
|
|
1734
|
+
metadata:
|
|
1735
|
+
runsec_version: v1.0
|
|
1736
|
+
confidence: |-
|
|
1737
|
+
0.9
|
|
1738
|
+
exploit_scenario: |-
|
|
1739
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
1740
|
+
fix_template: |-
|
|
1741
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
1742
|
+
pattern-either:
|
|
1743
|
+
- pattern: |-
|
|
1744
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
1745
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-137\\b'
|
|
1746
|
+
message: |-
|
|
1747
|
+
RunSec Detection [DNX-137]: CWE-89
|
|
1748
|
+
languages:
|
|
1749
|
+
- csharp
|
|
1750
|
+
severity: WARNING
|
|
1751
|
+
- id: runsec.csharp-dotnet.dnx-138
|
|
1752
|
+
metadata:
|
|
1753
|
+
runsec_version: v1.0
|
|
1754
|
+
confidence: |-
|
|
1755
|
+
0.9
|
|
1756
|
+
exploit_scenario: |-
|
|
1757
|
+
Deserialization gadgets can trigger remote code execution.
|
|
1758
|
+
fix_template: |-
|
|
1759
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
1760
|
+
pattern-either:
|
|
1761
|
+
- pattern: |-
|
|
1762
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
1763
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-138\\b'
|
|
1764
|
+
message: |-
|
|
1765
|
+
RunSec Detection [DNX-138]: CWE-502
|
|
1766
|
+
languages:
|
|
1767
|
+
- csharp
|
|
1768
|
+
severity: WARNING
|
|
1769
|
+
- id: runsec.csharp-dotnet.dnx-139
|
|
1770
|
+
metadata:
|
|
1771
|
+
runsec_version: v1.0
|
|
1772
|
+
confidence: |-
|
|
1773
|
+
0.9
|
|
1774
|
+
exploit_scenario: |-
|
|
1775
|
+
Model binder can set protected privilege and billing fields.
|
|
1776
|
+
fix_template: |-
|
|
1777
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
1778
|
+
pattern-either:
|
|
1779
|
+
- pattern: |-
|
|
1780
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
1781
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-139\\b'
|
|
1782
|
+
message: |-
|
|
1783
|
+
RunSec Detection [DNX-139]: CWE-915
|
|
1784
|
+
languages:
|
|
1785
|
+
- csharp
|
|
1786
|
+
severity: WARNING
|
|
1787
|
+
- id: runsec.csharp-dotnet.dnx-140
|
|
1788
|
+
metadata:
|
|
1789
|
+
runsec_version: v1.0
|
|
1790
|
+
confidence: |-
|
|
1791
|
+
0.9
|
|
1792
|
+
exploit_scenario: |-
|
|
1793
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
1794
|
+
fix_template: |-
|
|
1795
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
1796
|
+
pattern-either:
|
|
1797
|
+
- pattern: |-
|
|
1798
|
+
_cache[key] = value;
|
|
1799
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-140\\b'
|
|
1800
|
+
message: |-
|
|
1801
|
+
RunSec Detection [DNX-140]: CWE-662
|
|
1802
|
+
languages:
|
|
1803
|
+
- csharp
|
|
1804
|
+
severity: WARNING
|
|
1805
|
+
- id: runsec.csharp-dotnet.dnx-141
|
|
1806
|
+
metadata:
|
|
1807
|
+
runsec_version: v1.0
|
|
1808
|
+
confidence: |-
|
|
1809
|
+
0.9
|
|
1810
|
+
exploit_scenario: |-
|
|
1811
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
1812
|
+
fix_template: |-
|
|
1813
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
1814
|
+
pattern-either:
|
|
1815
|
+
- pattern: |-
|
|
1816
|
+
return _db.Orders.First(o => o.Id == id);
|
|
1817
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-141\\b'
|
|
1818
|
+
message: |-
|
|
1819
|
+
RunSec Detection [DNX-141]: CWE-639
|
|
1820
|
+
languages:
|
|
1821
|
+
- csharp
|
|
1822
|
+
severity: WARNING
|
|
1823
|
+
- id: runsec.csharp-dotnet.dnx-142
|
|
1824
|
+
metadata:
|
|
1825
|
+
runsec_version: v1.0
|
|
1826
|
+
confidence: |-
|
|
1827
|
+
0.9
|
|
1828
|
+
exploit_scenario: |-
|
|
1829
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
1830
|
+
fix_template: |-
|
|
1831
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
1832
|
+
pattern-either:
|
|
1833
|
+
- pattern: |-
|
|
1834
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
1835
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-142\\b'
|
|
1836
|
+
message: |-
|
|
1837
|
+
RunSec Detection [DNX-142]: CWE-89
|
|
1838
|
+
languages:
|
|
1839
|
+
- csharp
|
|
1840
|
+
severity: WARNING
|
|
1841
|
+
- id: runsec.csharp-dotnet.dnx-143
|
|
1842
|
+
metadata:
|
|
1843
|
+
runsec_version: v1.0
|
|
1844
|
+
confidence: |-
|
|
1845
|
+
0.9
|
|
1846
|
+
exploit_scenario: |-
|
|
1847
|
+
Deserialization gadgets can trigger remote code execution.
|
|
1848
|
+
fix_template: |-
|
|
1849
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
1850
|
+
pattern-either:
|
|
1851
|
+
- pattern: |-
|
|
1852
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
1853
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-143\\b'
|
|
1854
|
+
message: |-
|
|
1855
|
+
RunSec Detection [DNX-143]: CWE-502
|
|
1856
|
+
languages:
|
|
1857
|
+
- csharp
|
|
1858
|
+
severity: WARNING
|
|
1859
|
+
- id: runsec.csharp-dotnet.dnx-144
|
|
1860
|
+
metadata:
|
|
1861
|
+
runsec_version: v1.0
|
|
1862
|
+
confidence: |-
|
|
1863
|
+
0.9
|
|
1864
|
+
exploit_scenario: |-
|
|
1865
|
+
Model binder can set protected privilege and billing fields.
|
|
1866
|
+
fix_template: |-
|
|
1867
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
1868
|
+
pattern-either:
|
|
1869
|
+
- pattern: |-
|
|
1870
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
1871
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-144\\b'
|
|
1872
|
+
message: |-
|
|
1873
|
+
RunSec Detection [DNX-144]: CWE-915
|
|
1874
|
+
languages:
|
|
1875
|
+
- csharp
|
|
1876
|
+
severity: WARNING
|
|
1877
|
+
- id: runsec.csharp-dotnet.dnx-145
|
|
1878
|
+
metadata:
|
|
1879
|
+
runsec_version: v1.0
|
|
1880
|
+
confidence: |-
|
|
1881
|
+
0.9
|
|
1882
|
+
exploit_scenario: |-
|
|
1883
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
1884
|
+
fix_template: |-
|
|
1885
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
1886
|
+
pattern-either:
|
|
1887
|
+
- pattern: |-
|
|
1888
|
+
_cache[key] = value;
|
|
1889
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-145\\b'
|
|
1890
|
+
message: |-
|
|
1891
|
+
RunSec Detection [DNX-145]: CWE-662
|
|
1892
|
+
languages:
|
|
1893
|
+
- csharp
|
|
1894
|
+
severity: WARNING
|
|
1895
|
+
- id: runsec.csharp-dotnet.dnx-146
|
|
1896
|
+
metadata:
|
|
1897
|
+
runsec_version: v1.0
|
|
1898
|
+
confidence: |-
|
|
1899
|
+
0.9
|
|
1900
|
+
exploit_scenario: |-
|
|
1901
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
1902
|
+
fix_template: |-
|
|
1903
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
1904
|
+
pattern-either:
|
|
1905
|
+
- pattern: |-
|
|
1906
|
+
return _db.Orders.First(o => o.Id == id);
|
|
1907
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-146\\b'
|
|
1908
|
+
message: |-
|
|
1909
|
+
RunSec Detection [DNX-146]: CWE-639
|
|
1910
|
+
languages:
|
|
1911
|
+
- csharp
|
|
1912
|
+
severity: WARNING
|
|
1913
|
+
- id: runsec.csharp-dotnet.dnx-147
|
|
1914
|
+
metadata:
|
|
1915
|
+
runsec_version: v1.0
|
|
1916
|
+
confidence: |-
|
|
1917
|
+
0.9
|
|
1918
|
+
exploit_scenario: |-
|
|
1919
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
1920
|
+
fix_template: |-
|
|
1921
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
1922
|
+
pattern-either:
|
|
1923
|
+
- pattern: |-
|
|
1924
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
1925
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-147\\b'
|
|
1926
|
+
message: |-
|
|
1927
|
+
RunSec Detection [DNX-147]: CWE-89
|
|
1928
|
+
languages:
|
|
1929
|
+
- csharp
|
|
1930
|
+
severity: WARNING
|
|
1931
|
+
- id: runsec.csharp-dotnet.dnx-148
|
|
1932
|
+
metadata:
|
|
1933
|
+
runsec_version: v1.0
|
|
1934
|
+
confidence: |-
|
|
1935
|
+
0.9
|
|
1936
|
+
exploit_scenario: |-
|
|
1937
|
+
Deserialization gadgets can trigger remote code execution.
|
|
1938
|
+
fix_template: |-
|
|
1939
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
1940
|
+
pattern-either:
|
|
1941
|
+
- pattern: |-
|
|
1942
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
1943
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-148\\b'
|
|
1944
|
+
message: |-
|
|
1945
|
+
RunSec Detection [DNX-148]: CWE-502
|
|
1946
|
+
languages:
|
|
1947
|
+
- csharp
|
|
1948
|
+
severity: WARNING
|
|
1949
|
+
- id: runsec.csharp-dotnet.dnx-149
|
|
1950
|
+
metadata:
|
|
1951
|
+
runsec_version: v1.0
|
|
1952
|
+
confidence: |-
|
|
1953
|
+
0.9
|
|
1954
|
+
exploit_scenario: |-
|
|
1955
|
+
Model binder can set protected privilege and billing fields.
|
|
1956
|
+
fix_template: |-
|
|
1957
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
1958
|
+
pattern-either:
|
|
1959
|
+
- pattern: |-
|
|
1960
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
1961
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-149\\b'
|
|
1962
|
+
message: |-
|
|
1963
|
+
RunSec Detection [DNX-149]: CWE-915
|
|
1964
|
+
languages:
|
|
1965
|
+
- csharp
|
|
1966
|
+
severity: WARNING
|
|
1967
|
+
- id: runsec.csharp-dotnet.dnx-150
|
|
1968
|
+
metadata:
|
|
1969
|
+
runsec_version: v1.0
|
|
1970
|
+
confidence: |-
|
|
1971
|
+
0.9
|
|
1972
|
+
exploit_scenario: |-
|
|
1973
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
1974
|
+
fix_template: |-
|
|
1975
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
1976
|
+
pattern-either:
|
|
1977
|
+
- pattern: |-
|
|
1978
|
+
_cache[key] = value;
|
|
1979
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-150\\b'
|
|
1980
|
+
message: |-
|
|
1981
|
+
RunSec Detection [DNX-150]: CWE-662
|
|
1982
|
+
languages:
|
|
1983
|
+
- csharp
|
|
1984
|
+
severity: WARNING
|
|
1985
|
+
- id: runsec.csharp-dotnet.dnx-151
|
|
1986
|
+
metadata:
|
|
1987
|
+
runsec_version: v1.0
|
|
1988
|
+
confidence: |-
|
|
1989
|
+
0.9
|
|
1990
|
+
exploit_scenario: |-
|
|
1991
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
1992
|
+
fix_template: |-
|
|
1993
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
1994
|
+
pattern-either:
|
|
1995
|
+
- pattern: |-
|
|
1996
|
+
return _db.Orders.First(o => o.Id == id);
|
|
1997
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-151\\b'
|
|
1998
|
+
message: |-
|
|
1999
|
+
RunSec Detection [DNX-151]: CWE-639
|
|
2000
|
+
languages:
|
|
2001
|
+
- csharp
|
|
2002
|
+
severity: WARNING
|
|
2003
|
+
- id: runsec.csharp-dotnet.dnx-152
|
|
2004
|
+
metadata:
|
|
2005
|
+
runsec_version: v1.0
|
|
2006
|
+
confidence: |-
|
|
2007
|
+
0.9
|
|
2008
|
+
exploit_scenario: |-
|
|
2009
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
2010
|
+
fix_template: |-
|
|
2011
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
2012
|
+
pattern-either:
|
|
2013
|
+
- pattern: |-
|
|
2014
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
2015
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-152\\b'
|
|
2016
|
+
message: |-
|
|
2017
|
+
RunSec Detection [DNX-152]: CWE-89
|
|
2018
|
+
languages:
|
|
2019
|
+
- csharp
|
|
2020
|
+
severity: WARNING
|
|
2021
|
+
- id: runsec.csharp-dotnet.dnx-153
|
|
2022
|
+
metadata:
|
|
2023
|
+
runsec_version: v1.0
|
|
2024
|
+
confidence: |-
|
|
2025
|
+
0.9
|
|
2026
|
+
exploit_scenario: |-
|
|
2027
|
+
Deserialization gadgets can trigger remote code execution.
|
|
2028
|
+
fix_template: |-
|
|
2029
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
2030
|
+
pattern-either:
|
|
2031
|
+
- pattern: |-
|
|
2032
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
2033
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-153\\b'
|
|
2034
|
+
message: |-
|
|
2035
|
+
RunSec Detection [DNX-153]: CWE-502
|
|
2036
|
+
languages:
|
|
2037
|
+
- csharp
|
|
2038
|
+
severity: WARNING
|
|
2039
|
+
- id: runsec.csharp-dotnet.dnx-154
|
|
2040
|
+
metadata:
|
|
2041
|
+
runsec_version: v1.0
|
|
2042
|
+
confidence: |-
|
|
2043
|
+
0.9
|
|
2044
|
+
exploit_scenario: |-
|
|
2045
|
+
Model binder can set protected privilege and billing fields.
|
|
2046
|
+
fix_template: |-
|
|
2047
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
2048
|
+
pattern-either:
|
|
2049
|
+
- pattern: |-
|
|
2050
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
2051
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-154\\b'
|
|
2052
|
+
message: |-
|
|
2053
|
+
RunSec Detection [DNX-154]: CWE-915
|
|
2054
|
+
languages:
|
|
2055
|
+
- csharp
|
|
2056
|
+
severity: WARNING
|
|
2057
|
+
- id: runsec.csharp-dotnet.dnx-155
|
|
2058
|
+
metadata:
|
|
2059
|
+
runsec_version: v1.0
|
|
2060
|
+
confidence: |-
|
|
2061
|
+
0.9
|
|
2062
|
+
exploit_scenario: |-
|
|
2063
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
2064
|
+
fix_template: |-
|
|
2065
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
2066
|
+
pattern-either:
|
|
2067
|
+
- pattern: |-
|
|
2068
|
+
_cache[key] = value;
|
|
2069
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-155\\b'
|
|
2070
|
+
message: |-
|
|
2071
|
+
RunSec Detection [DNX-155]: CWE-662
|
|
2072
|
+
languages:
|
|
2073
|
+
- csharp
|
|
2074
|
+
severity: WARNING
|
|
2075
|
+
- id: runsec.csharp-dotnet.dnx-156
|
|
2076
|
+
metadata:
|
|
2077
|
+
runsec_version: v1.0
|
|
2078
|
+
confidence: |-
|
|
2079
|
+
0.9
|
|
2080
|
+
exploit_scenario: |-
|
|
2081
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
2082
|
+
fix_template: |-
|
|
2083
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
2084
|
+
pattern-either:
|
|
2085
|
+
- pattern: |-
|
|
2086
|
+
return _db.Orders.First(o => o.Id == id);
|
|
2087
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-156\\b'
|
|
2088
|
+
message: |-
|
|
2089
|
+
RunSec Detection [DNX-156]: CWE-639
|
|
2090
|
+
languages:
|
|
2091
|
+
- csharp
|
|
2092
|
+
severity: WARNING
|
|
2093
|
+
- id: runsec.csharp-dotnet.dnx-157
|
|
2094
|
+
metadata:
|
|
2095
|
+
runsec_version: v1.0
|
|
2096
|
+
confidence: |-
|
|
2097
|
+
0.9
|
|
2098
|
+
exploit_scenario: |-
|
|
2099
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
2100
|
+
fix_template: |-
|
|
2101
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
2102
|
+
pattern-either:
|
|
2103
|
+
- pattern: |-
|
|
2104
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
2105
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-157\\b'
|
|
2106
|
+
message: |-
|
|
2107
|
+
RunSec Detection [DNX-157]: CWE-89
|
|
2108
|
+
languages:
|
|
2109
|
+
- csharp
|
|
2110
|
+
severity: WARNING
|
|
2111
|
+
- id: runsec.csharp-dotnet.dnx-158
|
|
2112
|
+
metadata:
|
|
2113
|
+
runsec_version: v1.0
|
|
2114
|
+
confidence: |-
|
|
2115
|
+
0.9
|
|
2116
|
+
exploit_scenario: |-
|
|
2117
|
+
Deserialization gadgets can trigger remote code execution.
|
|
2118
|
+
fix_template: |-
|
|
2119
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
2120
|
+
pattern-either:
|
|
2121
|
+
- pattern: |-
|
|
2122
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
2123
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-158\\b'
|
|
2124
|
+
message: |-
|
|
2125
|
+
RunSec Detection [DNX-158]: CWE-502
|
|
2126
|
+
languages:
|
|
2127
|
+
- csharp
|
|
2128
|
+
severity: WARNING
|
|
2129
|
+
- id: runsec.csharp-dotnet.dnx-159
|
|
2130
|
+
metadata:
|
|
2131
|
+
runsec_version: v1.0
|
|
2132
|
+
confidence: |-
|
|
2133
|
+
0.9
|
|
2134
|
+
exploit_scenario: |-
|
|
2135
|
+
Model binder can set protected privilege and billing fields.
|
|
2136
|
+
fix_template: |-
|
|
2137
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
2138
|
+
pattern-either:
|
|
2139
|
+
- pattern: |-
|
|
2140
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
2141
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-159\\b'
|
|
2142
|
+
message: |-
|
|
2143
|
+
RunSec Detection [DNX-159]: CWE-915
|
|
2144
|
+
languages:
|
|
2145
|
+
- csharp
|
|
2146
|
+
severity: WARNING
|
|
2147
|
+
- id: runsec.csharp-dotnet.dnx-160
|
|
2148
|
+
metadata:
|
|
2149
|
+
runsec_version: v1.0
|
|
2150
|
+
confidence: |-
|
|
2151
|
+
0.9
|
|
2152
|
+
exploit_scenario: |-
|
|
2153
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
2154
|
+
fix_template: |-
|
|
2155
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
2156
|
+
pattern-either:
|
|
2157
|
+
- pattern: |-
|
|
2158
|
+
_cache[key] = value;
|
|
2159
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-160\\b'
|
|
2160
|
+
message: |-
|
|
2161
|
+
RunSec Detection [DNX-160]: CWE-662
|
|
2162
|
+
languages:
|
|
2163
|
+
- csharp
|
|
2164
|
+
severity: WARNING
|
|
2165
|
+
- id: runsec.csharp-dotnet.dnx-161
|
|
2166
|
+
metadata:
|
|
2167
|
+
runsec_version: v1.0
|
|
2168
|
+
confidence: |-
|
|
2169
|
+
0.9
|
|
2170
|
+
exploit_scenario: |-
|
|
2171
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
2172
|
+
fix_template: |-
|
|
2173
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
2174
|
+
pattern-either:
|
|
2175
|
+
- pattern: |-
|
|
2176
|
+
return _db.Orders.First(o => o.Id == id);
|
|
2177
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-161\\b'
|
|
2178
|
+
message: |-
|
|
2179
|
+
RunSec Detection [DNX-161]: CWE-639
|
|
2180
|
+
languages:
|
|
2181
|
+
- csharp
|
|
2182
|
+
severity: WARNING
|
|
2183
|
+
- id: runsec.csharp-dotnet.dnx-162
|
|
2184
|
+
metadata:
|
|
2185
|
+
runsec_version: v1.0
|
|
2186
|
+
confidence: |-
|
|
2187
|
+
0.9
|
|
2188
|
+
exploit_scenario: |-
|
|
2189
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
2190
|
+
fix_template: |-
|
|
2191
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
2192
|
+
pattern-either:
|
|
2193
|
+
- pattern: |-
|
|
2194
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
2195
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-162\\b'
|
|
2196
|
+
message: |-
|
|
2197
|
+
RunSec Detection [DNX-162]: CWE-89
|
|
2198
|
+
languages:
|
|
2199
|
+
- csharp
|
|
2200
|
+
severity: WARNING
|
|
2201
|
+
- id: runsec.csharp-dotnet.dnx-163
|
|
2202
|
+
metadata:
|
|
2203
|
+
runsec_version: v1.0
|
|
2204
|
+
confidence: |-
|
|
2205
|
+
0.9
|
|
2206
|
+
exploit_scenario: |-
|
|
2207
|
+
Deserialization gadgets can trigger remote code execution.
|
|
2208
|
+
fix_template: |-
|
|
2209
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
2210
|
+
pattern-either:
|
|
2211
|
+
- pattern: |-
|
|
2212
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
2213
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-163\\b'
|
|
2214
|
+
message: |-
|
|
2215
|
+
RunSec Detection [DNX-163]: CWE-502
|
|
2216
|
+
languages:
|
|
2217
|
+
- csharp
|
|
2218
|
+
severity: WARNING
|
|
2219
|
+
- id: runsec.csharp-dotnet.dnx-164
|
|
2220
|
+
metadata:
|
|
2221
|
+
runsec_version: v1.0
|
|
2222
|
+
confidence: |-
|
|
2223
|
+
0.9
|
|
2224
|
+
exploit_scenario: |-
|
|
2225
|
+
Model binder can set protected privilege and billing fields.
|
|
2226
|
+
fix_template: |-
|
|
2227
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
2228
|
+
pattern-either:
|
|
2229
|
+
- pattern: |-
|
|
2230
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
2231
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-164\\b'
|
|
2232
|
+
message: |-
|
|
2233
|
+
RunSec Detection [DNX-164]: CWE-915
|
|
2234
|
+
languages:
|
|
2235
|
+
- csharp
|
|
2236
|
+
severity: WARNING
|
|
2237
|
+
- id: runsec.csharp-dotnet.dnx-165
|
|
2238
|
+
metadata:
|
|
2239
|
+
runsec_version: v1.0
|
|
2240
|
+
confidence: |-
|
|
2241
|
+
0.9
|
|
2242
|
+
exploit_scenario: |-
|
|
2243
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
2244
|
+
fix_template: |-
|
|
2245
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
2246
|
+
pattern-either:
|
|
2247
|
+
- pattern: |-
|
|
2248
|
+
_cache[key] = value;
|
|
2249
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-165\\b'
|
|
2250
|
+
message: |-
|
|
2251
|
+
RunSec Detection [DNX-165]: CWE-662
|
|
2252
|
+
languages:
|
|
2253
|
+
- csharp
|
|
2254
|
+
severity: WARNING
|
|
2255
|
+
- id: runsec.csharp-dotnet.dnx-166
|
|
2256
|
+
metadata:
|
|
2257
|
+
runsec_version: v1.0
|
|
2258
|
+
confidence: |-
|
|
2259
|
+
0.9
|
|
2260
|
+
exploit_scenario: |-
|
|
2261
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
2262
|
+
fix_template: |-
|
|
2263
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
2264
|
+
pattern-either:
|
|
2265
|
+
- pattern: |-
|
|
2266
|
+
return _db.Orders.First(o => o.Id == id);
|
|
2267
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-166\\b'
|
|
2268
|
+
message: |-
|
|
2269
|
+
RunSec Detection [DNX-166]: CWE-639
|
|
2270
|
+
languages:
|
|
2271
|
+
- csharp
|
|
2272
|
+
severity: WARNING
|
|
2273
|
+
- id: runsec.csharp-dotnet.dnx-167
|
|
2274
|
+
metadata:
|
|
2275
|
+
runsec_version: v1.0
|
|
2276
|
+
confidence: |-
|
|
2277
|
+
0.9
|
|
2278
|
+
exploit_scenario: |-
|
|
2279
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
2280
|
+
fix_template: |-
|
|
2281
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
2282
|
+
pattern-either:
|
|
2283
|
+
- pattern: |-
|
|
2284
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
2285
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-167\\b'
|
|
2286
|
+
message: |-
|
|
2287
|
+
RunSec Detection [DNX-167]: CWE-89
|
|
2288
|
+
languages:
|
|
2289
|
+
- csharp
|
|
2290
|
+
severity: WARNING
|
|
2291
|
+
- id: runsec.csharp-dotnet.dnx-168
|
|
2292
|
+
metadata:
|
|
2293
|
+
runsec_version: v1.0
|
|
2294
|
+
confidence: |-
|
|
2295
|
+
0.9
|
|
2296
|
+
exploit_scenario: |-
|
|
2297
|
+
Deserialization gadgets can trigger remote code execution.
|
|
2298
|
+
fix_template: |-
|
|
2299
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
2300
|
+
pattern-either:
|
|
2301
|
+
- pattern: |-
|
|
2302
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
2303
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-168\\b'
|
|
2304
|
+
message: |-
|
|
2305
|
+
RunSec Detection [DNX-168]: CWE-502
|
|
2306
|
+
languages:
|
|
2307
|
+
- csharp
|
|
2308
|
+
severity: WARNING
|
|
2309
|
+
- id: runsec.csharp-dotnet.dnx-169
|
|
2310
|
+
metadata:
|
|
2311
|
+
runsec_version: v1.0
|
|
2312
|
+
confidence: |-
|
|
2313
|
+
0.9
|
|
2314
|
+
exploit_scenario: |-
|
|
2315
|
+
Model binder can set protected privilege and billing fields.
|
|
2316
|
+
fix_template: |-
|
|
2317
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
2318
|
+
pattern-either:
|
|
2319
|
+
- pattern: |-
|
|
2320
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
2321
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-169\\b'
|
|
2322
|
+
message: |-
|
|
2323
|
+
RunSec Detection [DNX-169]: CWE-915
|
|
2324
|
+
languages:
|
|
2325
|
+
- csharp
|
|
2326
|
+
severity: WARNING
|
|
2327
|
+
- id: runsec.csharp-dotnet.dnx-170
|
|
2328
|
+
metadata:
|
|
2329
|
+
runsec_version: v1.0
|
|
2330
|
+
confidence: |-
|
|
2331
|
+
0.9
|
|
2332
|
+
exploit_scenario: |-
|
|
2333
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
2334
|
+
fix_template: |-
|
|
2335
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
2336
|
+
pattern-either:
|
|
2337
|
+
- pattern: |-
|
|
2338
|
+
_cache[key] = value;
|
|
2339
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-170\\b'
|
|
2340
|
+
message: |-
|
|
2341
|
+
RunSec Detection [DNX-170]: CWE-662
|
|
2342
|
+
languages:
|
|
2343
|
+
- csharp
|
|
2344
|
+
severity: WARNING
|
|
2345
|
+
- id: runsec.csharp-dotnet.dnx-171
|
|
2346
|
+
metadata:
|
|
2347
|
+
runsec_version: v1.0
|
|
2348
|
+
confidence: |-
|
|
2349
|
+
0.9
|
|
2350
|
+
exploit_scenario: |-
|
|
2351
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
2352
|
+
fix_template: |-
|
|
2353
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
2354
|
+
pattern-either:
|
|
2355
|
+
- pattern: |-
|
|
2356
|
+
return _db.Orders.First(o => o.Id == id);
|
|
2357
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-171\\b'
|
|
2358
|
+
message: |-
|
|
2359
|
+
RunSec Detection [DNX-171]: CWE-639
|
|
2360
|
+
languages:
|
|
2361
|
+
- csharp
|
|
2362
|
+
severity: WARNING
|
|
2363
|
+
- id: runsec.csharp-dotnet.dnx-172
|
|
2364
|
+
metadata:
|
|
2365
|
+
runsec_version: v1.0
|
|
2366
|
+
confidence: |-
|
|
2367
|
+
0.9
|
|
2368
|
+
exploit_scenario: |-
|
|
2369
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
2370
|
+
fix_template: |-
|
|
2371
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
2372
|
+
pattern-either:
|
|
2373
|
+
- pattern: |-
|
|
2374
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
2375
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-172\\b'
|
|
2376
|
+
message: |-
|
|
2377
|
+
RunSec Detection [DNX-172]: CWE-89
|
|
2378
|
+
languages:
|
|
2379
|
+
- csharp
|
|
2380
|
+
severity: WARNING
|
|
2381
|
+
- id: runsec.csharp-dotnet.dnx-173
|
|
2382
|
+
metadata:
|
|
2383
|
+
runsec_version: v1.0
|
|
2384
|
+
confidence: |-
|
|
2385
|
+
0.9
|
|
2386
|
+
exploit_scenario: |-
|
|
2387
|
+
Deserialization gadgets can trigger remote code execution.
|
|
2388
|
+
fix_template: |-
|
|
2389
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
2390
|
+
pattern-either:
|
|
2391
|
+
- pattern: |-
|
|
2392
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
2393
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-173\\b'
|
|
2394
|
+
message: |-
|
|
2395
|
+
RunSec Detection [DNX-173]: CWE-502
|
|
2396
|
+
languages:
|
|
2397
|
+
- csharp
|
|
2398
|
+
severity: WARNING
|
|
2399
|
+
- id: runsec.csharp-dotnet.dnx-174
|
|
2400
|
+
metadata:
|
|
2401
|
+
runsec_version: v1.0
|
|
2402
|
+
confidence: |-
|
|
2403
|
+
0.9
|
|
2404
|
+
exploit_scenario: |-
|
|
2405
|
+
Model binder can set protected privilege and billing fields.
|
|
2406
|
+
fix_template: |-
|
|
2407
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
2408
|
+
pattern-either:
|
|
2409
|
+
- pattern: |-
|
|
2410
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
2411
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-174\\b'
|
|
2412
|
+
message: |-
|
|
2413
|
+
RunSec Detection [DNX-174]: CWE-915
|
|
2414
|
+
languages:
|
|
2415
|
+
- csharp
|
|
2416
|
+
severity: WARNING
|
|
2417
|
+
- id: runsec.csharp-dotnet.dnx-175
|
|
2418
|
+
metadata:
|
|
2419
|
+
runsec_version: v1.0
|
|
2420
|
+
confidence: |-
|
|
2421
|
+
0.9
|
|
2422
|
+
exploit_scenario: |-
|
|
2423
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
2424
|
+
fix_template: |-
|
|
2425
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
2426
|
+
pattern-either:
|
|
2427
|
+
- pattern: |-
|
|
2428
|
+
_cache[key] = value;
|
|
2429
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-175\\b'
|
|
2430
|
+
message: |-
|
|
2431
|
+
RunSec Detection [DNX-175]: CWE-662
|
|
2432
|
+
languages:
|
|
2433
|
+
- csharp
|
|
2434
|
+
severity: WARNING
|
|
2435
|
+
- id: runsec.csharp-dotnet.dnx-176
|
|
2436
|
+
metadata:
|
|
2437
|
+
runsec_version: v1.0
|
|
2438
|
+
confidence: |-
|
|
2439
|
+
0.9
|
|
2440
|
+
exploit_scenario: |-
|
|
2441
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
2442
|
+
fix_template: |-
|
|
2443
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
2444
|
+
pattern-either:
|
|
2445
|
+
- pattern: |-
|
|
2446
|
+
return _db.Orders.First(o => o.Id == id);
|
|
2447
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-176\\b'
|
|
2448
|
+
message: |-
|
|
2449
|
+
RunSec Detection [DNX-176]: CWE-639
|
|
2450
|
+
languages:
|
|
2451
|
+
- csharp
|
|
2452
|
+
severity: WARNING
|
|
2453
|
+
- id: runsec.csharp-dotnet.dnx-177
|
|
2454
|
+
metadata:
|
|
2455
|
+
runsec_version: v1.0
|
|
2456
|
+
confidence: |-
|
|
2457
|
+
0.9
|
|
2458
|
+
exploit_scenario: |-
|
|
2459
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
2460
|
+
fix_template: |-
|
|
2461
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
2462
|
+
pattern-either:
|
|
2463
|
+
- pattern: |-
|
|
2464
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
2465
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-177\\b'
|
|
2466
|
+
message: |-
|
|
2467
|
+
RunSec Detection [DNX-177]: CWE-89
|
|
2468
|
+
languages:
|
|
2469
|
+
- csharp
|
|
2470
|
+
severity: WARNING
|
|
2471
|
+
- id: runsec.csharp-dotnet.dnx-178
|
|
2472
|
+
metadata:
|
|
2473
|
+
runsec_version: v1.0
|
|
2474
|
+
confidence: |-
|
|
2475
|
+
0.9
|
|
2476
|
+
exploit_scenario: |-
|
|
2477
|
+
Deserialization gadgets can trigger remote code execution.
|
|
2478
|
+
fix_template: |-
|
|
2479
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
2480
|
+
pattern-either:
|
|
2481
|
+
- pattern: |-
|
|
2482
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
2483
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-178\\b'
|
|
2484
|
+
message: |-
|
|
2485
|
+
RunSec Detection [DNX-178]: CWE-502
|
|
2486
|
+
languages:
|
|
2487
|
+
- csharp
|
|
2488
|
+
severity: WARNING
|
|
2489
|
+
- id: runsec.csharp-dotnet.dnx-179
|
|
2490
|
+
metadata:
|
|
2491
|
+
runsec_version: v1.0
|
|
2492
|
+
confidence: |-
|
|
2493
|
+
0.9
|
|
2494
|
+
exploit_scenario: |-
|
|
2495
|
+
Model binder can set protected privilege and billing fields.
|
|
2496
|
+
fix_template: |-
|
|
2497
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
2498
|
+
pattern-either:
|
|
2499
|
+
- pattern: |-
|
|
2500
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
2501
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-179\\b'
|
|
2502
|
+
message: |-
|
|
2503
|
+
RunSec Detection [DNX-179]: CWE-915
|
|
2504
|
+
languages:
|
|
2505
|
+
- csharp
|
|
2506
|
+
severity: WARNING
|
|
2507
|
+
- id: runsec.csharp-dotnet.dnx-180
|
|
2508
|
+
metadata:
|
|
2509
|
+
runsec_version: v1.0
|
|
2510
|
+
confidence: |-
|
|
2511
|
+
0.9
|
|
2512
|
+
exploit_scenario: |-
|
|
2513
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
2514
|
+
fix_template: |-
|
|
2515
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
2516
|
+
pattern-either:
|
|
2517
|
+
- pattern: |-
|
|
2518
|
+
_cache[key] = value;
|
|
2519
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-180\\b'
|
|
2520
|
+
message: |-
|
|
2521
|
+
RunSec Detection [DNX-180]: CWE-662
|
|
2522
|
+
languages:
|
|
2523
|
+
- csharp
|
|
2524
|
+
severity: WARNING
|
|
2525
|
+
- id: runsec.csharp-dotnet.dnx-181
|
|
2526
|
+
metadata:
|
|
2527
|
+
runsec_version: v1.0
|
|
2528
|
+
confidence: |-
|
|
2529
|
+
0.9
|
|
2530
|
+
exploit_scenario: |-
|
|
2531
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
2532
|
+
fix_template: |-
|
|
2533
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
2534
|
+
pattern-either:
|
|
2535
|
+
- pattern: |-
|
|
2536
|
+
return _db.Orders.First(o => o.Id == id);
|
|
2537
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-181\\b'
|
|
2538
|
+
message: |-
|
|
2539
|
+
RunSec Detection [DNX-181]: CWE-639
|
|
2540
|
+
languages:
|
|
2541
|
+
- csharp
|
|
2542
|
+
severity: WARNING
|
|
2543
|
+
- id: runsec.csharp-dotnet.dnx-182
|
|
2544
|
+
metadata:
|
|
2545
|
+
runsec_version: v1.0
|
|
2546
|
+
confidence: |-
|
|
2547
|
+
0.9
|
|
2548
|
+
exploit_scenario: |-
|
|
2549
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
2550
|
+
fix_template: |-
|
|
2551
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
2552
|
+
pattern-either:
|
|
2553
|
+
- pattern: |-
|
|
2554
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
2555
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-182\\b'
|
|
2556
|
+
message: |-
|
|
2557
|
+
RunSec Detection [DNX-182]: CWE-89
|
|
2558
|
+
languages:
|
|
2559
|
+
- csharp
|
|
2560
|
+
severity: WARNING
|
|
2561
|
+
- id: runsec.csharp-dotnet.dnx-183
|
|
2562
|
+
metadata:
|
|
2563
|
+
runsec_version: v1.0
|
|
2564
|
+
confidence: |-
|
|
2565
|
+
0.9
|
|
2566
|
+
exploit_scenario: |-
|
|
2567
|
+
Deserialization gadgets can trigger remote code execution.
|
|
2568
|
+
fix_template: |-
|
|
2569
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
2570
|
+
pattern-either:
|
|
2571
|
+
- pattern: |-
|
|
2572
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
2573
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-183\\b'
|
|
2574
|
+
message: |-
|
|
2575
|
+
RunSec Detection [DNX-183]: CWE-502
|
|
2576
|
+
languages:
|
|
2577
|
+
- csharp
|
|
2578
|
+
severity: WARNING
|
|
2579
|
+
- id: runsec.csharp-dotnet.dnx-184
|
|
2580
|
+
metadata:
|
|
2581
|
+
runsec_version: v1.0
|
|
2582
|
+
confidence: |-
|
|
2583
|
+
0.9
|
|
2584
|
+
exploit_scenario: |-
|
|
2585
|
+
Model binder can set protected privilege and billing fields.
|
|
2586
|
+
fix_template: |-
|
|
2587
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
2588
|
+
pattern-either:
|
|
2589
|
+
- pattern: |-
|
|
2590
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
2591
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-184\\b'
|
|
2592
|
+
message: |-
|
|
2593
|
+
RunSec Detection [DNX-184]: CWE-915
|
|
2594
|
+
languages:
|
|
2595
|
+
- csharp
|
|
2596
|
+
severity: WARNING
|
|
2597
|
+
- id: runsec.csharp-dotnet.dnx-185
|
|
2598
|
+
metadata:
|
|
2599
|
+
runsec_version: v1.0
|
|
2600
|
+
confidence: |-
|
|
2601
|
+
0.9
|
|
2602
|
+
exploit_scenario: |-
|
|
2603
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
2604
|
+
fix_template: |-
|
|
2605
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
2606
|
+
pattern-either:
|
|
2607
|
+
- pattern: |-
|
|
2608
|
+
_cache[key] = value;
|
|
2609
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-185\\b'
|
|
2610
|
+
message: |-
|
|
2611
|
+
RunSec Detection [DNX-185]: CWE-662
|
|
2612
|
+
languages:
|
|
2613
|
+
- csharp
|
|
2614
|
+
severity: WARNING
|
|
2615
|
+
- id: runsec.csharp-dotnet.dnx-186
|
|
2616
|
+
metadata:
|
|
2617
|
+
runsec_version: v1.0
|
|
2618
|
+
confidence: |-
|
|
2619
|
+
0.9
|
|
2620
|
+
exploit_scenario: |-
|
|
2621
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
2622
|
+
fix_template: |-
|
|
2623
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
2624
|
+
pattern-either:
|
|
2625
|
+
- pattern: |-
|
|
2626
|
+
return _db.Orders.First(o => o.Id == id);
|
|
2627
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-186\\b'
|
|
2628
|
+
message: |-
|
|
2629
|
+
RunSec Detection [DNX-186]: CWE-639
|
|
2630
|
+
languages:
|
|
2631
|
+
- csharp
|
|
2632
|
+
severity: WARNING
|
|
2633
|
+
- id: runsec.csharp-dotnet.dnx-187
|
|
2634
|
+
metadata:
|
|
2635
|
+
runsec_version: v1.0
|
|
2636
|
+
confidence: |-
|
|
2637
|
+
0.9
|
|
2638
|
+
exploit_scenario: |-
|
|
2639
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
2640
|
+
fix_template: |-
|
|
2641
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
2642
|
+
pattern-either:
|
|
2643
|
+
- pattern: |-
|
|
2644
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
2645
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-187\\b'
|
|
2646
|
+
message: |-
|
|
2647
|
+
RunSec Detection [DNX-187]: CWE-89
|
|
2648
|
+
languages:
|
|
2649
|
+
- csharp
|
|
2650
|
+
severity: WARNING
|
|
2651
|
+
- id: runsec.csharp-dotnet.dnx-188
|
|
2652
|
+
metadata:
|
|
2653
|
+
runsec_version: v1.0
|
|
2654
|
+
confidence: |-
|
|
2655
|
+
0.9
|
|
2656
|
+
exploit_scenario: |-
|
|
2657
|
+
Deserialization gadgets can trigger remote code execution.
|
|
2658
|
+
fix_template: |-
|
|
2659
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
2660
|
+
pattern-either:
|
|
2661
|
+
- pattern: |-
|
|
2662
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
2663
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-188\\b'
|
|
2664
|
+
message: |-
|
|
2665
|
+
RunSec Detection [DNX-188]: CWE-502
|
|
2666
|
+
languages:
|
|
2667
|
+
- csharp
|
|
2668
|
+
severity: WARNING
|
|
2669
|
+
- id: runsec.csharp-dotnet.dnx-189
|
|
2670
|
+
metadata:
|
|
2671
|
+
runsec_version: v1.0
|
|
2672
|
+
confidence: |-
|
|
2673
|
+
0.9
|
|
2674
|
+
exploit_scenario: |-
|
|
2675
|
+
Model binder can set protected privilege and billing fields.
|
|
2676
|
+
fix_template: |-
|
|
2677
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
2678
|
+
pattern-either:
|
|
2679
|
+
- pattern: |-
|
|
2680
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
2681
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-189\\b'
|
|
2682
|
+
message: |-
|
|
2683
|
+
RunSec Detection [DNX-189]: CWE-915
|
|
2684
|
+
languages:
|
|
2685
|
+
- csharp
|
|
2686
|
+
severity: WARNING
|
|
2687
|
+
- id: runsec.csharp-dotnet.dnx-190
|
|
2688
|
+
metadata:
|
|
2689
|
+
runsec_version: v1.0
|
|
2690
|
+
confidence: |-
|
|
2691
|
+
0.9
|
|
2692
|
+
exploit_scenario: |-
|
|
2693
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
2694
|
+
fix_template: |-
|
|
2695
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
2696
|
+
pattern-either:
|
|
2697
|
+
- pattern: |-
|
|
2698
|
+
_cache[key] = value;
|
|
2699
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-190\\b'
|
|
2700
|
+
message: |-
|
|
2701
|
+
RunSec Detection [DNX-190]: CWE-662
|
|
2702
|
+
languages:
|
|
2703
|
+
- csharp
|
|
2704
|
+
severity: WARNING
|
|
2705
|
+
- id: runsec.csharp-dotnet.dnx-191
|
|
2706
|
+
metadata:
|
|
2707
|
+
runsec_version: v1.0
|
|
2708
|
+
confidence: |-
|
|
2709
|
+
0.9
|
|
2710
|
+
exploit_scenario: |-
|
|
2711
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
2712
|
+
fix_template: |-
|
|
2713
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
2714
|
+
pattern-either:
|
|
2715
|
+
- pattern: |-
|
|
2716
|
+
return _db.Orders.First(o => o.Id == id);
|
|
2717
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-191\\b'
|
|
2718
|
+
message: |-
|
|
2719
|
+
RunSec Detection [DNX-191]: CWE-639
|
|
2720
|
+
languages:
|
|
2721
|
+
- csharp
|
|
2722
|
+
severity: WARNING
|
|
2723
|
+
- id: runsec.csharp-dotnet.dnx-192
|
|
2724
|
+
metadata:
|
|
2725
|
+
runsec_version: v1.0
|
|
2726
|
+
confidence: |-
|
|
2727
|
+
0.9
|
|
2728
|
+
exploit_scenario: |-
|
|
2729
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
2730
|
+
fix_template: |-
|
|
2731
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
2732
|
+
pattern-either:
|
|
2733
|
+
- pattern: |-
|
|
2734
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
2735
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-192\\b'
|
|
2736
|
+
message: |-
|
|
2737
|
+
RunSec Detection [DNX-192]: CWE-89
|
|
2738
|
+
languages:
|
|
2739
|
+
- csharp
|
|
2740
|
+
severity: WARNING
|
|
2741
|
+
- id: runsec.csharp-dotnet.dnx-193
|
|
2742
|
+
metadata:
|
|
2743
|
+
runsec_version: v1.0
|
|
2744
|
+
confidence: |-
|
|
2745
|
+
0.9
|
|
2746
|
+
exploit_scenario: |-
|
|
2747
|
+
Deserialization gadgets can trigger remote code execution.
|
|
2748
|
+
fix_template: |-
|
|
2749
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
2750
|
+
pattern-either:
|
|
2751
|
+
- pattern: |-
|
|
2752
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
2753
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-193\\b'
|
|
2754
|
+
message: |-
|
|
2755
|
+
RunSec Detection [DNX-193]: CWE-502
|
|
2756
|
+
languages:
|
|
2757
|
+
- csharp
|
|
2758
|
+
severity: WARNING
|
|
2759
|
+
- id: runsec.csharp-dotnet.dnx-194
|
|
2760
|
+
metadata:
|
|
2761
|
+
runsec_version: v1.0
|
|
2762
|
+
confidence: |-
|
|
2763
|
+
0.9
|
|
2764
|
+
exploit_scenario: |-
|
|
2765
|
+
Model binder can set protected privilege and billing fields.
|
|
2766
|
+
fix_template: |-
|
|
2767
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
2768
|
+
pattern-either:
|
|
2769
|
+
- pattern: |-
|
|
2770
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
2771
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-194\\b'
|
|
2772
|
+
message: |-
|
|
2773
|
+
RunSec Detection [DNX-194]: CWE-915
|
|
2774
|
+
languages:
|
|
2775
|
+
- csharp
|
|
2776
|
+
severity: WARNING
|
|
2777
|
+
- id: runsec.csharp-dotnet.dnx-195
|
|
2778
|
+
metadata:
|
|
2779
|
+
runsec_version: v1.0
|
|
2780
|
+
confidence: |-
|
|
2781
|
+
0.9
|
|
2782
|
+
exploit_scenario: |-
|
|
2783
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
2784
|
+
fix_template: |-
|
|
2785
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
2786
|
+
pattern-either:
|
|
2787
|
+
- pattern: |-
|
|
2788
|
+
_cache[key] = value;
|
|
2789
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-195\\b'
|
|
2790
|
+
message: |-
|
|
2791
|
+
RunSec Detection [DNX-195]: CWE-662
|
|
2792
|
+
languages:
|
|
2793
|
+
- csharp
|
|
2794
|
+
severity: WARNING
|
|
2795
|
+
- id: runsec.csharp-dotnet.dnx-196
|
|
2796
|
+
metadata:
|
|
2797
|
+
runsec_version: v1.0
|
|
2798
|
+
confidence: |-
|
|
2799
|
+
0.9
|
|
2800
|
+
exploit_scenario: |-
|
|
2801
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
2802
|
+
fix_template: |-
|
|
2803
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
2804
|
+
pattern-either:
|
|
2805
|
+
- pattern: |-
|
|
2806
|
+
return _db.Orders.First(o => o.Id == id);
|
|
2807
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-196\\b'
|
|
2808
|
+
message: |-
|
|
2809
|
+
RunSec Detection [DNX-196]: CWE-639
|
|
2810
|
+
languages:
|
|
2811
|
+
- csharp
|
|
2812
|
+
severity: WARNING
|
|
2813
|
+
- id: runsec.csharp-dotnet.dnx-197
|
|
2814
|
+
metadata:
|
|
2815
|
+
runsec_version: v1.0
|
|
2816
|
+
confidence: |-
|
|
2817
|
+
0.9
|
|
2818
|
+
exploit_scenario: |-
|
|
2819
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
2820
|
+
fix_template: |-
|
|
2821
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
2822
|
+
pattern-either:
|
|
2823
|
+
- pattern: |-
|
|
2824
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
2825
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-197\\b'
|
|
2826
|
+
message: |-
|
|
2827
|
+
RunSec Detection [DNX-197]: CWE-89
|
|
2828
|
+
languages:
|
|
2829
|
+
- csharp
|
|
2830
|
+
severity: WARNING
|
|
2831
|
+
- id: runsec.csharp-dotnet.dnx-198
|
|
2832
|
+
metadata:
|
|
2833
|
+
runsec_version: v1.0
|
|
2834
|
+
confidence: |-
|
|
2835
|
+
0.9
|
|
2836
|
+
exploit_scenario: |-
|
|
2837
|
+
Deserialization gadgets can trigger remote code execution.
|
|
2838
|
+
fix_template: |-
|
|
2839
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
2840
|
+
pattern-either:
|
|
2841
|
+
- pattern: |-
|
|
2842
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
2843
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-198\\b'
|
|
2844
|
+
message: |-
|
|
2845
|
+
RunSec Detection [DNX-198]: CWE-502
|
|
2846
|
+
languages:
|
|
2847
|
+
- csharp
|
|
2848
|
+
severity: WARNING
|
|
2849
|
+
- id: runsec.csharp-dotnet.dnx-199
|
|
2850
|
+
metadata:
|
|
2851
|
+
runsec_version: v1.0
|
|
2852
|
+
confidence: |-
|
|
2853
|
+
0.9
|
|
2854
|
+
exploit_scenario: |-
|
|
2855
|
+
Model binder can set protected privilege and billing fields.
|
|
2856
|
+
fix_template: |-
|
|
2857
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
2858
|
+
pattern-either:
|
|
2859
|
+
- pattern: |-
|
|
2860
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
2861
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-199\\b'
|
|
2862
|
+
message: |-
|
|
2863
|
+
RunSec Detection [DNX-199]: CWE-915
|
|
2864
|
+
languages:
|
|
2865
|
+
- csharp
|
|
2866
|
+
severity: WARNING
|
|
2867
|
+
- id: runsec.csharp-dotnet.dnx-200
|
|
2868
|
+
metadata:
|
|
2869
|
+
runsec_version: v1.0
|
|
2870
|
+
confidence: |-
|
|
2871
|
+
0.9
|
|
2872
|
+
exploit_scenario: |-
|
|
2873
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
2874
|
+
fix_template: |-
|
|
2875
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
2876
|
+
pattern-either:
|
|
2877
|
+
- pattern: |-
|
|
2878
|
+
_cache[key] = value;
|
|
2879
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-200\\b'
|
|
2880
|
+
message: |-
|
|
2881
|
+
RunSec Detection [DNX-200]: CWE-662
|
|
2882
|
+
languages:
|
|
2883
|
+
- csharp
|
|
2884
|
+
severity: WARNING
|
|
2885
|
+
- id: runsec.csharp-dotnet.dnx-201
|
|
2886
|
+
metadata:
|
|
2887
|
+
runsec_version: v1.0
|
|
2888
|
+
confidence: |-
|
|
2889
|
+
0.9
|
|
2890
|
+
exploit_scenario: |-
|
|
2891
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
2892
|
+
fix_template: |-
|
|
2893
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
2894
|
+
pattern-either:
|
|
2895
|
+
- pattern: |-
|
|
2896
|
+
return _db.Orders.First(o => o.Id == id);
|
|
2897
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-201\\b'
|
|
2898
|
+
message: |-
|
|
2899
|
+
RunSec Detection [DNX-201]: CWE-639
|
|
2900
|
+
languages:
|
|
2901
|
+
- csharp
|
|
2902
|
+
severity: WARNING
|
|
2903
|
+
- id: runsec.csharp-dotnet.dnx-202
|
|
2904
|
+
metadata:
|
|
2905
|
+
runsec_version: v1.0
|
|
2906
|
+
confidence: |-
|
|
2907
|
+
0.9
|
|
2908
|
+
exploit_scenario: |-
|
|
2909
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
2910
|
+
fix_template: |-
|
|
2911
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
2912
|
+
pattern-either:
|
|
2913
|
+
- pattern: |-
|
|
2914
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
2915
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-202\\b'
|
|
2916
|
+
message: |-
|
|
2917
|
+
RunSec Detection [DNX-202]: CWE-89
|
|
2918
|
+
languages:
|
|
2919
|
+
- csharp
|
|
2920
|
+
severity: WARNING
|
|
2921
|
+
- id: runsec.csharp-dotnet.dnx-203
|
|
2922
|
+
metadata:
|
|
2923
|
+
runsec_version: v1.0
|
|
2924
|
+
confidence: |-
|
|
2925
|
+
0.9
|
|
2926
|
+
exploit_scenario: |-
|
|
2927
|
+
Deserialization gadgets can trigger remote code execution.
|
|
2928
|
+
fix_template: |-
|
|
2929
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
2930
|
+
pattern-either:
|
|
2931
|
+
- pattern: |-
|
|
2932
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
2933
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-203\\b'
|
|
2934
|
+
message: |-
|
|
2935
|
+
RunSec Detection [DNX-203]: CWE-502
|
|
2936
|
+
languages:
|
|
2937
|
+
- csharp
|
|
2938
|
+
severity: WARNING
|
|
2939
|
+
- id: runsec.csharp-dotnet.dnx-204
|
|
2940
|
+
metadata:
|
|
2941
|
+
runsec_version: v1.0
|
|
2942
|
+
confidence: |-
|
|
2943
|
+
0.9
|
|
2944
|
+
exploit_scenario: |-
|
|
2945
|
+
Model binder can set protected privilege and billing fields.
|
|
2946
|
+
fix_template: |-
|
|
2947
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
2948
|
+
pattern-either:
|
|
2949
|
+
- pattern: |-
|
|
2950
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
2951
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-204\\b'
|
|
2952
|
+
message: |-
|
|
2953
|
+
RunSec Detection [DNX-204]: CWE-915
|
|
2954
|
+
languages:
|
|
2955
|
+
- csharp
|
|
2956
|
+
severity: WARNING
|
|
2957
|
+
- id: runsec.csharp-dotnet.dnx-205
|
|
2958
|
+
metadata:
|
|
2959
|
+
runsec_version: v1.0
|
|
2960
|
+
confidence: |-
|
|
2961
|
+
0.9
|
|
2962
|
+
exploit_scenario: |-
|
|
2963
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
2964
|
+
fix_template: |-
|
|
2965
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
2966
|
+
pattern-either:
|
|
2967
|
+
- pattern: |-
|
|
2968
|
+
_cache[key] = value;
|
|
2969
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-205\\b'
|
|
2970
|
+
message: |-
|
|
2971
|
+
RunSec Detection [DNX-205]: CWE-662
|
|
2972
|
+
languages:
|
|
2973
|
+
- csharp
|
|
2974
|
+
severity: WARNING
|
|
2975
|
+
- id: runsec.csharp-dotnet.dnx-206
|
|
2976
|
+
metadata:
|
|
2977
|
+
runsec_version: v1.0
|
|
2978
|
+
confidence: |-
|
|
2979
|
+
0.9
|
|
2980
|
+
exploit_scenario: |-
|
|
2981
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
2982
|
+
fix_template: |-
|
|
2983
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
2984
|
+
pattern-either:
|
|
2985
|
+
- pattern: |-
|
|
2986
|
+
return _db.Orders.First(o => o.Id == id);
|
|
2987
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-206\\b'
|
|
2988
|
+
message: |-
|
|
2989
|
+
RunSec Detection [DNX-206]: CWE-639
|
|
2990
|
+
languages:
|
|
2991
|
+
- csharp
|
|
2992
|
+
severity: WARNING
|
|
2993
|
+
- id: runsec.csharp-dotnet.dnx-207
|
|
2994
|
+
metadata:
|
|
2995
|
+
runsec_version: v1.0
|
|
2996
|
+
confidence: |-
|
|
2997
|
+
0.9
|
|
2998
|
+
exploit_scenario: |-
|
|
2999
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
3000
|
+
fix_template: |-
|
|
3001
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
3002
|
+
pattern-either:
|
|
3003
|
+
- pattern: |-
|
|
3004
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
3005
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-207\\b'
|
|
3006
|
+
message: |-
|
|
3007
|
+
RunSec Detection [DNX-207]: CWE-89
|
|
3008
|
+
languages:
|
|
3009
|
+
- csharp
|
|
3010
|
+
severity: WARNING
|
|
3011
|
+
- id: runsec.csharp-dotnet.dnx-208
|
|
3012
|
+
metadata:
|
|
3013
|
+
runsec_version: v1.0
|
|
3014
|
+
confidence: |-
|
|
3015
|
+
0.9
|
|
3016
|
+
exploit_scenario: |-
|
|
3017
|
+
Deserialization gadgets can trigger remote code execution.
|
|
3018
|
+
fix_template: |-
|
|
3019
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
3020
|
+
pattern-either:
|
|
3021
|
+
- pattern: |-
|
|
3022
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
3023
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-208\\b'
|
|
3024
|
+
message: |-
|
|
3025
|
+
RunSec Detection [DNX-208]: CWE-502
|
|
3026
|
+
languages:
|
|
3027
|
+
- csharp
|
|
3028
|
+
severity: WARNING
|
|
3029
|
+
- id: runsec.csharp-dotnet.dnx-209
|
|
3030
|
+
metadata:
|
|
3031
|
+
runsec_version: v1.0
|
|
3032
|
+
confidence: |-
|
|
3033
|
+
0.9
|
|
3034
|
+
exploit_scenario: |-
|
|
3035
|
+
Model binder can set protected privilege and billing fields.
|
|
3036
|
+
fix_template: |-
|
|
3037
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
3038
|
+
pattern-either:
|
|
3039
|
+
- pattern: |-
|
|
3040
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
3041
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-209\\b'
|
|
3042
|
+
message: |-
|
|
3043
|
+
RunSec Detection [DNX-209]: CWE-915
|
|
3044
|
+
languages:
|
|
3045
|
+
- csharp
|
|
3046
|
+
severity: WARNING
|
|
3047
|
+
- id: runsec.csharp-dotnet.dnx-210
|
|
3048
|
+
metadata:
|
|
3049
|
+
runsec_version: v1.0
|
|
3050
|
+
confidence: |-
|
|
3051
|
+
0.9
|
|
3052
|
+
exploit_scenario: |-
|
|
3053
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
3054
|
+
fix_template: |-
|
|
3055
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
3056
|
+
pattern-either:
|
|
3057
|
+
- pattern: |-
|
|
3058
|
+
_cache[key] = value;
|
|
3059
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-210\\b'
|
|
3060
|
+
message: |-
|
|
3061
|
+
RunSec Detection [DNX-210]: CWE-662
|
|
3062
|
+
languages:
|
|
3063
|
+
- csharp
|
|
3064
|
+
severity: WARNING
|
|
3065
|
+
- id: runsec.csharp-dotnet.dnx-211
|
|
3066
|
+
metadata:
|
|
3067
|
+
runsec_version: v1.0
|
|
3068
|
+
confidence: |-
|
|
3069
|
+
0.9
|
|
3070
|
+
exploit_scenario: |-
|
|
3071
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
3072
|
+
fix_template: |-
|
|
3073
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
3074
|
+
pattern-either:
|
|
3075
|
+
- pattern: |-
|
|
3076
|
+
return _db.Orders.First(o => o.Id == id);
|
|
3077
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-211\\b'
|
|
3078
|
+
message: |-
|
|
3079
|
+
RunSec Detection [DNX-211]: CWE-639
|
|
3080
|
+
languages:
|
|
3081
|
+
- csharp
|
|
3082
|
+
severity: WARNING
|
|
3083
|
+
- id: runsec.csharp-dotnet.dnx-212
|
|
3084
|
+
metadata:
|
|
3085
|
+
runsec_version: v1.0
|
|
3086
|
+
confidence: |-
|
|
3087
|
+
0.9
|
|
3088
|
+
exploit_scenario: |-
|
|
3089
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
3090
|
+
fix_template: |-
|
|
3091
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
3092
|
+
pattern-either:
|
|
3093
|
+
- pattern: |-
|
|
3094
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
3095
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-212\\b'
|
|
3096
|
+
message: |-
|
|
3097
|
+
RunSec Detection [DNX-212]: CWE-89
|
|
3098
|
+
languages:
|
|
3099
|
+
- csharp
|
|
3100
|
+
severity: WARNING
|
|
3101
|
+
- id: runsec.csharp-dotnet.dnx-213
|
|
3102
|
+
metadata:
|
|
3103
|
+
runsec_version: v1.0
|
|
3104
|
+
confidence: |-
|
|
3105
|
+
0.9
|
|
3106
|
+
exploit_scenario: |-
|
|
3107
|
+
Deserialization gadgets can trigger remote code execution.
|
|
3108
|
+
fix_template: |-
|
|
3109
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
3110
|
+
pattern-either:
|
|
3111
|
+
- pattern: |-
|
|
3112
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
3113
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-213\\b'
|
|
3114
|
+
message: |-
|
|
3115
|
+
RunSec Detection [DNX-213]: CWE-502
|
|
3116
|
+
languages:
|
|
3117
|
+
- csharp
|
|
3118
|
+
severity: WARNING
|
|
3119
|
+
- id: runsec.csharp-dotnet.dnx-214
|
|
3120
|
+
metadata:
|
|
3121
|
+
runsec_version: v1.0
|
|
3122
|
+
confidence: |-
|
|
3123
|
+
0.9
|
|
3124
|
+
exploit_scenario: |-
|
|
3125
|
+
Model binder can set protected privilege and billing fields.
|
|
3126
|
+
fix_template: |-
|
|
3127
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
3128
|
+
pattern-either:
|
|
3129
|
+
- pattern: |-
|
|
3130
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
3131
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-214\\b'
|
|
3132
|
+
message: |-
|
|
3133
|
+
RunSec Detection [DNX-214]: CWE-915
|
|
3134
|
+
languages:
|
|
3135
|
+
- csharp
|
|
3136
|
+
severity: WARNING
|
|
3137
|
+
- id: runsec.csharp-dotnet.dnx-215
|
|
3138
|
+
metadata:
|
|
3139
|
+
runsec_version: v1.0
|
|
3140
|
+
confidence: |-
|
|
3141
|
+
0.9
|
|
3142
|
+
exploit_scenario: |-
|
|
3143
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
3144
|
+
fix_template: |-
|
|
3145
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
3146
|
+
pattern-either:
|
|
3147
|
+
- pattern: |-
|
|
3148
|
+
_cache[key] = value;
|
|
3149
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-215\\b'
|
|
3150
|
+
message: |-
|
|
3151
|
+
RunSec Detection [DNX-215]: CWE-662
|
|
3152
|
+
languages:
|
|
3153
|
+
- csharp
|
|
3154
|
+
severity: WARNING
|
|
3155
|
+
- id: runsec.csharp-dotnet.dnx-216
|
|
3156
|
+
metadata:
|
|
3157
|
+
runsec_version: v1.0
|
|
3158
|
+
confidence: |-
|
|
3159
|
+
0.9
|
|
3160
|
+
exploit_scenario: |-
|
|
3161
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
3162
|
+
fix_template: |-
|
|
3163
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
3164
|
+
pattern-either:
|
|
3165
|
+
- pattern: |-
|
|
3166
|
+
return _db.Orders.First(o => o.Id == id);
|
|
3167
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-216\\b'
|
|
3168
|
+
message: |-
|
|
3169
|
+
RunSec Detection [DNX-216]: CWE-639
|
|
3170
|
+
languages:
|
|
3171
|
+
- csharp
|
|
3172
|
+
severity: WARNING
|
|
3173
|
+
- id: runsec.csharp-dotnet.dnx-217
|
|
3174
|
+
metadata:
|
|
3175
|
+
runsec_version: v1.0
|
|
3176
|
+
confidence: |-
|
|
3177
|
+
0.9
|
|
3178
|
+
exploit_scenario: |-
|
|
3179
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
3180
|
+
fix_template: |-
|
|
3181
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
3182
|
+
pattern-either:
|
|
3183
|
+
- pattern: |-
|
|
3184
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
3185
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-217\\b'
|
|
3186
|
+
message: |-
|
|
3187
|
+
RunSec Detection [DNX-217]: CWE-89
|
|
3188
|
+
languages:
|
|
3189
|
+
- csharp
|
|
3190
|
+
severity: WARNING
|
|
3191
|
+
- id: runsec.csharp-dotnet.dnx-218
|
|
3192
|
+
metadata:
|
|
3193
|
+
runsec_version: v1.0
|
|
3194
|
+
confidence: |-
|
|
3195
|
+
0.9
|
|
3196
|
+
exploit_scenario: |-
|
|
3197
|
+
Deserialization gadgets can trigger remote code execution.
|
|
3198
|
+
fix_template: |-
|
|
3199
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
3200
|
+
pattern-either:
|
|
3201
|
+
- pattern: |-
|
|
3202
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
3203
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-218\\b'
|
|
3204
|
+
message: |-
|
|
3205
|
+
RunSec Detection [DNX-218]: CWE-502
|
|
3206
|
+
languages:
|
|
3207
|
+
- csharp
|
|
3208
|
+
severity: WARNING
|
|
3209
|
+
- id: runsec.csharp-dotnet.dnx-219
|
|
3210
|
+
metadata:
|
|
3211
|
+
runsec_version: v1.0
|
|
3212
|
+
confidence: |-
|
|
3213
|
+
0.9
|
|
3214
|
+
exploit_scenario: |-
|
|
3215
|
+
Model binder can set protected privilege and billing fields.
|
|
3216
|
+
fix_template: |-
|
|
3217
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
3218
|
+
pattern-either:
|
|
3219
|
+
- pattern: |-
|
|
3220
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
3221
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-219\\b'
|
|
3222
|
+
message: |-
|
|
3223
|
+
RunSec Detection [DNX-219]: CWE-915
|
|
3224
|
+
languages:
|
|
3225
|
+
- csharp
|
|
3226
|
+
severity: WARNING
|
|
3227
|
+
- id: runsec.csharp-dotnet.dnx-220
|
|
3228
|
+
metadata:
|
|
3229
|
+
runsec_version: v1.0
|
|
3230
|
+
confidence: |-
|
|
3231
|
+
0.9
|
|
3232
|
+
exploit_scenario: |-
|
|
3233
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
3234
|
+
fix_template: |-
|
|
3235
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
3236
|
+
pattern-either:
|
|
3237
|
+
- pattern: |-
|
|
3238
|
+
_cache[key] = value;
|
|
3239
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-220\\b'
|
|
3240
|
+
message: |-
|
|
3241
|
+
RunSec Detection [DNX-220]: CWE-662
|
|
3242
|
+
languages:
|
|
3243
|
+
- csharp
|
|
3244
|
+
severity: WARNING
|
|
3245
|
+
- id: runsec.csharp-dotnet.dnx-221
|
|
3246
|
+
metadata:
|
|
3247
|
+
runsec_version: v1.0
|
|
3248
|
+
confidence: |-
|
|
3249
|
+
0.9
|
|
3250
|
+
exploit_scenario: |-
|
|
3251
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
3252
|
+
fix_template: |-
|
|
3253
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
3254
|
+
pattern-either:
|
|
3255
|
+
- pattern: |-
|
|
3256
|
+
return _db.Orders.First(o => o.Id == id);
|
|
3257
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-221\\b'
|
|
3258
|
+
message: |-
|
|
3259
|
+
RunSec Detection [DNX-221]: CWE-639
|
|
3260
|
+
languages:
|
|
3261
|
+
- csharp
|
|
3262
|
+
severity: WARNING
|
|
3263
|
+
- id: runsec.csharp-dotnet.dnx-222
|
|
3264
|
+
metadata:
|
|
3265
|
+
runsec_version: v1.0
|
|
3266
|
+
confidence: |-
|
|
3267
|
+
0.9
|
|
3268
|
+
exploit_scenario: |-
|
|
3269
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
3270
|
+
fix_template: |-
|
|
3271
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
3272
|
+
pattern-either:
|
|
3273
|
+
- pattern: |-
|
|
3274
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
3275
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-222\\b'
|
|
3276
|
+
message: |-
|
|
3277
|
+
RunSec Detection [DNX-222]: CWE-89
|
|
3278
|
+
languages:
|
|
3279
|
+
- csharp
|
|
3280
|
+
severity: WARNING
|
|
3281
|
+
- id: runsec.csharp-dotnet.dnx-223
|
|
3282
|
+
metadata:
|
|
3283
|
+
runsec_version: v1.0
|
|
3284
|
+
confidence: |-
|
|
3285
|
+
0.9
|
|
3286
|
+
exploit_scenario: |-
|
|
3287
|
+
Deserialization gadgets can trigger remote code execution.
|
|
3288
|
+
fix_template: |-
|
|
3289
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
3290
|
+
pattern-either:
|
|
3291
|
+
- pattern: |-
|
|
3292
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
3293
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-223\\b'
|
|
3294
|
+
message: |-
|
|
3295
|
+
RunSec Detection [DNX-223]: CWE-502
|
|
3296
|
+
languages:
|
|
3297
|
+
- csharp
|
|
3298
|
+
severity: WARNING
|
|
3299
|
+
- id: runsec.csharp-dotnet.dnx-224
|
|
3300
|
+
metadata:
|
|
3301
|
+
runsec_version: v1.0
|
|
3302
|
+
confidence: |-
|
|
3303
|
+
0.9
|
|
3304
|
+
exploit_scenario: |-
|
|
3305
|
+
Model binder can set protected privilege and billing fields.
|
|
3306
|
+
fix_template: |-
|
|
3307
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
3308
|
+
pattern-either:
|
|
3309
|
+
- pattern: |-
|
|
3310
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
3311
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-224\\b'
|
|
3312
|
+
message: |-
|
|
3313
|
+
RunSec Detection [DNX-224]: CWE-915
|
|
3314
|
+
languages:
|
|
3315
|
+
- csharp
|
|
3316
|
+
severity: WARNING
|
|
3317
|
+
- id: runsec.csharp-dotnet.dnx-225
|
|
3318
|
+
metadata:
|
|
3319
|
+
runsec_version: v1.0
|
|
3320
|
+
confidence: |-
|
|
3321
|
+
0.9
|
|
3322
|
+
exploit_scenario: |-
|
|
3323
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
3324
|
+
fix_template: |-
|
|
3325
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
3326
|
+
pattern-either:
|
|
3327
|
+
- pattern: |-
|
|
3328
|
+
_cache[key] = value;
|
|
3329
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-225\\b'
|
|
3330
|
+
message: |-
|
|
3331
|
+
RunSec Detection [DNX-225]: CWE-662
|
|
3332
|
+
languages:
|
|
3333
|
+
- csharp
|
|
3334
|
+
severity: WARNING
|
|
3335
|
+
- id: runsec.csharp-dotnet.dnx-226
|
|
3336
|
+
metadata:
|
|
3337
|
+
runsec_version: v1.0
|
|
3338
|
+
confidence: |-
|
|
3339
|
+
0.9
|
|
3340
|
+
exploit_scenario: |-
|
|
3341
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
3342
|
+
fix_template: |-
|
|
3343
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
3344
|
+
pattern-either:
|
|
3345
|
+
- pattern: |-
|
|
3346
|
+
return _db.Orders.First(o => o.Id == id);
|
|
3347
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-226\\b'
|
|
3348
|
+
message: |-
|
|
3349
|
+
RunSec Detection [DNX-226]: CWE-639
|
|
3350
|
+
languages:
|
|
3351
|
+
- csharp
|
|
3352
|
+
severity: WARNING
|
|
3353
|
+
- id: runsec.csharp-dotnet.dnx-227
|
|
3354
|
+
metadata:
|
|
3355
|
+
runsec_version: v1.0
|
|
3356
|
+
confidence: |-
|
|
3357
|
+
0.9
|
|
3358
|
+
exploit_scenario: |-
|
|
3359
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
3360
|
+
fix_template: |-
|
|
3361
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
3362
|
+
pattern-either:
|
|
3363
|
+
- pattern: |-
|
|
3364
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
3365
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-227\\b'
|
|
3366
|
+
message: |-
|
|
3367
|
+
RunSec Detection [DNX-227]: CWE-89
|
|
3368
|
+
languages:
|
|
3369
|
+
- csharp
|
|
3370
|
+
severity: WARNING
|
|
3371
|
+
- id: runsec.csharp-dotnet.dnx-228
|
|
3372
|
+
metadata:
|
|
3373
|
+
runsec_version: v1.0
|
|
3374
|
+
confidence: |-
|
|
3375
|
+
0.9
|
|
3376
|
+
exploit_scenario: |-
|
|
3377
|
+
Deserialization gadgets can trigger remote code execution.
|
|
3378
|
+
fix_template: |-
|
|
3379
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
3380
|
+
pattern-either:
|
|
3381
|
+
- pattern: |-
|
|
3382
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
3383
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-228\\b'
|
|
3384
|
+
message: |-
|
|
3385
|
+
RunSec Detection [DNX-228]: CWE-502
|
|
3386
|
+
languages:
|
|
3387
|
+
- csharp
|
|
3388
|
+
severity: WARNING
|
|
3389
|
+
- id: runsec.csharp-dotnet.dnx-229
|
|
3390
|
+
metadata:
|
|
3391
|
+
runsec_version: v1.0
|
|
3392
|
+
confidence: |-
|
|
3393
|
+
0.9
|
|
3394
|
+
exploit_scenario: |-
|
|
3395
|
+
Model binder can set protected privilege and billing fields.
|
|
3396
|
+
fix_template: |-
|
|
3397
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
3398
|
+
pattern-either:
|
|
3399
|
+
- pattern: |-
|
|
3400
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
3401
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-229\\b'
|
|
3402
|
+
message: |-
|
|
3403
|
+
RunSec Detection [DNX-229]: CWE-915
|
|
3404
|
+
languages:
|
|
3405
|
+
- csharp
|
|
3406
|
+
severity: WARNING
|
|
3407
|
+
- id: runsec.csharp-dotnet.dnx-230
|
|
3408
|
+
metadata:
|
|
3409
|
+
runsec_version: v1.0
|
|
3410
|
+
confidence: |-
|
|
3411
|
+
0.9
|
|
3412
|
+
exploit_scenario: |-
|
|
3413
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
3414
|
+
fix_template: |-
|
|
3415
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
3416
|
+
pattern-either:
|
|
3417
|
+
- pattern: |-
|
|
3418
|
+
_cache[key] = value;
|
|
3419
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-230\\b'
|
|
3420
|
+
message: |-
|
|
3421
|
+
RunSec Detection [DNX-230]: CWE-662
|
|
3422
|
+
languages:
|
|
3423
|
+
- csharp
|
|
3424
|
+
severity: WARNING
|
|
3425
|
+
- id: runsec.csharp-dotnet.dnx-231
|
|
3426
|
+
metadata:
|
|
3427
|
+
runsec_version: v1.0
|
|
3428
|
+
confidence: |-
|
|
3429
|
+
0.9
|
|
3430
|
+
exploit_scenario: |-
|
|
3431
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
3432
|
+
fix_template: |-
|
|
3433
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
3434
|
+
pattern-either:
|
|
3435
|
+
- pattern: |-
|
|
3436
|
+
return _db.Orders.First(o => o.Id == id);
|
|
3437
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-231\\b'
|
|
3438
|
+
message: |-
|
|
3439
|
+
RunSec Detection [DNX-231]: CWE-639
|
|
3440
|
+
languages:
|
|
3441
|
+
- csharp
|
|
3442
|
+
severity: WARNING
|
|
3443
|
+
- id: runsec.csharp-dotnet.dnx-232
|
|
3444
|
+
metadata:
|
|
3445
|
+
runsec_version: v1.0
|
|
3446
|
+
confidence: |-
|
|
3447
|
+
0.9
|
|
3448
|
+
exploit_scenario: |-
|
|
3449
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
3450
|
+
fix_template: |-
|
|
3451
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
3452
|
+
pattern-either:
|
|
3453
|
+
- pattern: |-
|
|
3454
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
3455
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-232\\b'
|
|
3456
|
+
message: |-
|
|
3457
|
+
RunSec Detection [DNX-232]: CWE-89
|
|
3458
|
+
languages:
|
|
3459
|
+
- csharp
|
|
3460
|
+
severity: WARNING
|
|
3461
|
+
- id: runsec.csharp-dotnet.dnx-233
|
|
3462
|
+
metadata:
|
|
3463
|
+
runsec_version: v1.0
|
|
3464
|
+
confidence: |-
|
|
3465
|
+
0.9
|
|
3466
|
+
exploit_scenario: |-
|
|
3467
|
+
Deserialization gadgets can trigger remote code execution.
|
|
3468
|
+
fix_template: |-
|
|
3469
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
3470
|
+
pattern-either:
|
|
3471
|
+
- pattern: |-
|
|
3472
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
3473
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-233\\b'
|
|
3474
|
+
message: |-
|
|
3475
|
+
RunSec Detection [DNX-233]: CWE-502
|
|
3476
|
+
languages:
|
|
3477
|
+
- csharp
|
|
3478
|
+
severity: WARNING
|
|
3479
|
+
- id: runsec.csharp-dotnet.dnx-234
|
|
3480
|
+
metadata:
|
|
3481
|
+
runsec_version: v1.0
|
|
3482
|
+
confidence: |-
|
|
3483
|
+
0.9
|
|
3484
|
+
exploit_scenario: |-
|
|
3485
|
+
Model binder can set protected privilege and billing fields.
|
|
3486
|
+
fix_template: |-
|
|
3487
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
3488
|
+
pattern-either:
|
|
3489
|
+
- pattern: |-
|
|
3490
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
3491
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-234\\b'
|
|
3492
|
+
message: |-
|
|
3493
|
+
RunSec Detection [DNX-234]: CWE-915
|
|
3494
|
+
languages:
|
|
3495
|
+
- csharp
|
|
3496
|
+
severity: WARNING
|
|
3497
|
+
- id: runsec.csharp-dotnet.dnx-235
|
|
3498
|
+
metadata:
|
|
3499
|
+
runsec_version: v1.0
|
|
3500
|
+
confidence: |-
|
|
3501
|
+
0.9
|
|
3502
|
+
exploit_scenario: |-
|
|
3503
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
3504
|
+
fix_template: |-
|
|
3505
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
3506
|
+
pattern-either:
|
|
3507
|
+
- pattern: |-
|
|
3508
|
+
_cache[key] = value;
|
|
3509
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-235\\b'
|
|
3510
|
+
message: |-
|
|
3511
|
+
RunSec Detection [DNX-235]: CWE-662
|
|
3512
|
+
languages:
|
|
3513
|
+
- csharp
|
|
3514
|
+
severity: WARNING
|
|
3515
|
+
- id: runsec.csharp-dotnet.dnx-236
|
|
3516
|
+
metadata:
|
|
3517
|
+
runsec_version: v1.0
|
|
3518
|
+
confidence: |-
|
|
3519
|
+
0.9
|
|
3520
|
+
exploit_scenario: |-
|
|
3521
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
3522
|
+
fix_template: |-
|
|
3523
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
3524
|
+
pattern-either:
|
|
3525
|
+
- pattern: |-
|
|
3526
|
+
return _db.Orders.First(o => o.Id == id);
|
|
3527
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-236\\b'
|
|
3528
|
+
message: |-
|
|
3529
|
+
RunSec Detection [DNX-236]: CWE-639
|
|
3530
|
+
languages:
|
|
3531
|
+
- csharp
|
|
3532
|
+
severity: WARNING
|
|
3533
|
+
- id: runsec.csharp-dotnet.dnx-237
|
|
3534
|
+
metadata:
|
|
3535
|
+
runsec_version: v1.0
|
|
3536
|
+
confidence: |-
|
|
3537
|
+
0.9
|
|
3538
|
+
exploit_scenario: |-
|
|
3539
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
3540
|
+
fix_template: |-
|
|
3541
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
3542
|
+
pattern-either:
|
|
3543
|
+
- pattern: |-
|
|
3544
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
3545
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-237\\b'
|
|
3546
|
+
message: |-
|
|
3547
|
+
RunSec Detection [DNX-237]: CWE-89
|
|
3548
|
+
languages:
|
|
3549
|
+
- csharp
|
|
3550
|
+
severity: WARNING
|
|
3551
|
+
- id: runsec.csharp-dotnet.dnx-238
|
|
3552
|
+
metadata:
|
|
3553
|
+
runsec_version: v1.0
|
|
3554
|
+
confidence: |-
|
|
3555
|
+
0.9
|
|
3556
|
+
exploit_scenario: |-
|
|
3557
|
+
Deserialization gadgets can trigger remote code execution.
|
|
3558
|
+
fix_template: |-
|
|
3559
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
3560
|
+
pattern-either:
|
|
3561
|
+
- pattern: |-
|
|
3562
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
3563
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-238\\b'
|
|
3564
|
+
message: |-
|
|
3565
|
+
RunSec Detection [DNX-238]: CWE-502
|
|
3566
|
+
languages:
|
|
3567
|
+
- csharp
|
|
3568
|
+
severity: WARNING
|
|
3569
|
+
- id: runsec.csharp-dotnet.dnx-239
|
|
3570
|
+
metadata:
|
|
3571
|
+
runsec_version: v1.0
|
|
3572
|
+
confidence: |-
|
|
3573
|
+
0.9
|
|
3574
|
+
exploit_scenario: |-
|
|
3575
|
+
Model binder can set protected privilege and billing fields.
|
|
3576
|
+
fix_template: |-
|
|
3577
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
3578
|
+
pattern-either:
|
|
3579
|
+
- pattern: |-
|
|
3580
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
3581
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-239\\b'
|
|
3582
|
+
message: |-
|
|
3583
|
+
RunSec Detection [DNX-239]: CWE-915
|
|
3584
|
+
languages:
|
|
3585
|
+
- csharp
|
|
3586
|
+
severity: WARNING
|
|
3587
|
+
- id: runsec.csharp-dotnet.dnx-240
|
|
3588
|
+
metadata:
|
|
3589
|
+
runsec_version: v1.0
|
|
3590
|
+
confidence: |-
|
|
3591
|
+
0.9
|
|
3592
|
+
exploit_scenario: |-
|
|
3593
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
3594
|
+
fix_template: |-
|
|
3595
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
3596
|
+
pattern-either:
|
|
3597
|
+
- pattern: |-
|
|
3598
|
+
_cache[key] = value;
|
|
3599
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-240\\b'
|
|
3600
|
+
message: |-
|
|
3601
|
+
RunSec Detection [DNX-240]: CWE-662
|
|
3602
|
+
languages:
|
|
3603
|
+
- csharp
|
|
3604
|
+
severity: WARNING
|
|
3605
|
+
- id: runsec.csharp-dotnet.dnx-241
|
|
3606
|
+
metadata:
|
|
3607
|
+
runsec_version: v1.0
|
|
3608
|
+
confidence: |-
|
|
3609
|
+
0.9
|
|
3610
|
+
exploit_scenario: |-
|
|
3611
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
3612
|
+
fix_template: |-
|
|
3613
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
3614
|
+
pattern-either:
|
|
3615
|
+
- pattern: |-
|
|
3616
|
+
return _db.Orders.First(o => o.Id == id);
|
|
3617
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-241\\b'
|
|
3618
|
+
message: |-
|
|
3619
|
+
RunSec Detection [DNX-241]: CWE-639
|
|
3620
|
+
languages:
|
|
3621
|
+
- csharp
|
|
3622
|
+
severity: WARNING
|
|
3623
|
+
- id: runsec.csharp-dotnet.dnx-242
|
|
3624
|
+
metadata:
|
|
3625
|
+
runsec_version: v1.0
|
|
3626
|
+
confidence: |-
|
|
3627
|
+
0.9
|
|
3628
|
+
exploit_scenario: |-
|
|
3629
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
3630
|
+
fix_template: |-
|
|
3631
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
3632
|
+
pattern-either:
|
|
3633
|
+
- pattern: |-
|
|
3634
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
3635
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-242\\b'
|
|
3636
|
+
message: |-
|
|
3637
|
+
RunSec Detection [DNX-242]: CWE-89
|
|
3638
|
+
languages:
|
|
3639
|
+
- csharp
|
|
3640
|
+
severity: WARNING
|
|
3641
|
+
- id: runsec.csharp-dotnet.dnx-243
|
|
3642
|
+
metadata:
|
|
3643
|
+
runsec_version: v1.0
|
|
3644
|
+
confidence: |-
|
|
3645
|
+
0.9
|
|
3646
|
+
exploit_scenario: |-
|
|
3647
|
+
Deserialization gadgets can trigger remote code execution.
|
|
3648
|
+
fix_template: |-
|
|
3649
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
3650
|
+
pattern-either:
|
|
3651
|
+
- pattern: |-
|
|
3652
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
3653
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-243\\b'
|
|
3654
|
+
message: |-
|
|
3655
|
+
RunSec Detection [DNX-243]: CWE-502
|
|
3656
|
+
languages:
|
|
3657
|
+
- csharp
|
|
3658
|
+
severity: WARNING
|
|
3659
|
+
- id: runsec.csharp-dotnet.dnx-244
|
|
3660
|
+
metadata:
|
|
3661
|
+
runsec_version: v1.0
|
|
3662
|
+
confidence: |-
|
|
3663
|
+
0.9
|
|
3664
|
+
exploit_scenario: |-
|
|
3665
|
+
Model binder can set protected privilege and billing fields.
|
|
3666
|
+
fix_template: |-
|
|
3667
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
3668
|
+
pattern-either:
|
|
3669
|
+
- pattern: |-
|
|
3670
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
3671
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-244\\b'
|
|
3672
|
+
message: |-
|
|
3673
|
+
RunSec Detection [DNX-244]: CWE-915
|
|
3674
|
+
languages:
|
|
3675
|
+
- csharp
|
|
3676
|
+
severity: WARNING
|
|
3677
|
+
- id: runsec.csharp-dotnet.dnx-245
|
|
3678
|
+
metadata:
|
|
3679
|
+
runsec_version: v1.0
|
|
3680
|
+
confidence: |-
|
|
3681
|
+
0.9
|
|
3682
|
+
exploit_scenario: |-
|
|
3683
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
3684
|
+
fix_template: |-
|
|
3685
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
3686
|
+
pattern-either:
|
|
3687
|
+
- pattern: |-
|
|
3688
|
+
_cache[key] = value;
|
|
3689
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-245\\b'
|
|
3690
|
+
message: |-
|
|
3691
|
+
RunSec Detection [DNX-245]: CWE-662
|
|
3692
|
+
languages:
|
|
3693
|
+
- csharp
|
|
3694
|
+
severity: WARNING
|
|
3695
|
+
- id: runsec.csharp-dotnet.dnx-246
|
|
3696
|
+
metadata:
|
|
3697
|
+
runsec_version: v1.0
|
|
3698
|
+
confidence: |-
|
|
3699
|
+
0.9
|
|
3700
|
+
exploit_scenario: |-
|
|
3701
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
3702
|
+
fix_template: |-
|
|
3703
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
3704
|
+
pattern-either:
|
|
3705
|
+
- pattern: |-
|
|
3706
|
+
return _db.Orders.First(o => o.Id == id);
|
|
3707
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-246\\b'
|
|
3708
|
+
message: |-
|
|
3709
|
+
RunSec Detection [DNX-246]: CWE-639
|
|
3710
|
+
languages:
|
|
3711
|
+
- csharp
|
|
3712
|
+
severity: WARNING
|
|
3713
|
+
- id: runsec.csharp-dotnet.dnx-247
|
|
3714
|
+
metadata:
|
|
3715
|
+
runsec_version: v1.0
|
|
3716
|
+
confidence: |-
|
|
3717
|
+
0.9
|
|
3718
|
+
exploit_scenario: |-
|
|
3719
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
3720
|
+
fix_template: |-
|
|
3721
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
3722
|
+
pattern-either:
|
|
3723
|
+
- pattern: |-
|
|
3724
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
3725
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-247\\b'
|
|
3726
|
+
message: |-
|
|
3727
|
+
RunSec Detection [DNX-247]: CWE-89
|
|
3728
|
+
languages:
|
|
3729
|
+
- csharp
|
|
3730
|
+
severity: WARNING
|
|
3731
|
+
- id: runsec.csharp-dotnet.dnx-248
|
|
3732
|
+
metadata:
|
|
3733
|
+
runsec_version: v1.0
|
|
3734
|
+
confidence: |-
|
|
3735
|
+
0.9
|
|
3736
|
+
exploit_scenario: |-
|
|
3737
|
+
Deserialization gadgets can trigger remote code execution.
|
|
3738
|
+
fix_template: |-
|
|
3739
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
3740
|
+
pattern-either:
|
|
3741
|
+
- pattern: |-
|
|
3742
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
3743
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-248\\b'
|
|
3744
|
+
message: |-
|
|
3745
|
+
RunSec Detection [DNX-248]: CWE-502
|
|
3746
|
+
languages:
|
|
3747
|
+
- csharp
|
|
3748
|
+
severity: WARNING
|
|
3749
|
+
- id: runsec.csharp-dotnet.dnx-249
|
|
3750
|
+
metadata:
|
|
3751
|
+
runsec_version: v1.0
|
|
3752
|
+
confidence: |-
|
|
3753
|
+
0.9
|
|
3754
|
+
exploit_scenario: |-
|
|
3755
|
+
Model binder can set protected privilege and billing fields.
|
|
3756
|
+
fix_template: |-
|
|
3757
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
3758
|
+
pattern-either:
|
|
3759
|
+
- pattern: |-
|
|
3760
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
3761
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-249\\b'
|
|
3762
|
+
message: |-
|
|
3763
|
+
RunSec Detection [DNX-249]: CWE-915
|
|
3764
|
+
languages:
|
|
3765
|
+
- csharp
|
|
3766
|
+
severity: WARNING
|
|
3767
|
+
- id: runsec.csharp-dotnet.dnx-250
|
|
3768
|
+
metadata:
|
|
3769
|
+
runsec_version: v1.0
|
|
3770
|
+
confidence: |-
|
|
3771
|
+
0.9
|
|
3772
|
+
exploit_scenario: |-
|
|
3773
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
3774
|
+
fix_template: |-
|
|
3775
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
3776
|
+
pattern-either:
|
|
3777
|
+
- pattern: |-
|
|
3778
|
+
_cache[key] = value;
|
|
3779
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-250\\b'
|
|
3780
|
+
message: |-
|
|
3781
|
+
RunSec Detection [DNX-250]: CWE-662
|
|
3782
|
+
languages:
|
|
3783
|
+
- csharp
|
|
3784
|
+
severity: WARNING
|
|
3785
|
+
- id: runsec.csharp-dotnet.dnx-251
|
|
3786
|
+
metadata:
|
|
3787
|
+
runsec_version: v1.0
|
|
3788
|
+
confidence: |-
|
|
3789
|
+
0.9
|
|
3790
|
+
exploit_scenario: |-
|
|
3791
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
3792
|
+
fix_template: |-
|
|
3793
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
3794
|
+
pattern-either:
|
|
3795
|
+
- pattern: |-
|
|
3796
|
+
return _db.Orders.First(o => o.Id == id);
|
|
3797
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-251\\b'
|
|
3798
|
+
message: |-
|
|
3799
|
+
RunSec Detection [DNX-251]: CWE-639
|
|
3800
|
+
languages:
|
|
3801
|
+
- csharp
|
|
3802
|
+
severity: WARNING
|
|
3803
|
+
- id: runsec.csharp-dotnet.dnx-252
|
|
3804
|
+
metadata:
|
|
3805
|
+
runsec_version: v1.0
|
|
3806
|
+
confidence: |-
|
|
3807
|
+
0.9
|
|
3808
|
+
exploit_scenario: |-
|
|
3809
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
3810
|
+
fix_template: |-
|
|
3811
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
3812
|
+
pattern-either:
|
|
3813
|
+
- pattern: |-
|
|
3814
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
3815
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-252\\b'
|
|
3816
|
+
message: |-
|
|
3817
|
+
RunSec Detection [DNX-252]: CWE-89
|
|
3818
|
+
languages:
|
|
3819
|
+
- csharp
|
|
3820
|
+
severity: WARNING
|
|
3821
|
+
- id: runsec.csharp-dotnet.dnx-253
|
|
3822
|
+
metadata:
|
|
3823
|
+
runsec_version: v1.0
|
|
3824
|
+
confidence: |-
|
|
3825
|
+
0.9
|
|
3826
|
+
exploit_scenario: |-
|
|
3827
|
+
Deserialization gadgets can trigger remote code execution.
|
|
3828
|
+
fix_template: |-
|
|
3829
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
3830
|
+
pattern-either:
|
|
3831
|
+
- pattern: |-
|
|
3832
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
3833
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-253\\b'
|
|
3834
|
+
message: |-
|
|
3835
|
+
RunSec Detection [DNX-253]: CWE-502
|
|
3836
|
+
languages:
|
|
3837
|
+
- csharp
|
|
3838
|
+
severity: WARNING
|
|
3839
|
+
- id: runsec.csharp-dotnet.dnx-254
|
|
3840
|
+
metadata:
|
|
3841
|
+
runsec_version: v1.0
|
|
3842
|
+
confidence: |-
|
|
3843
|
+
0.9
|
|
3844
|
+
exploit_scenario: |-
|
|
3845
|
+
Model binder can set protected privilege and billing fields.
|
|
3846
|
+
fix_template: |-
|
|
3847
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
3848
|
+
pattern-either:
|
|
3849
|
+
- pattern: |-
|
|
3850
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
3851
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-254\\b'
|
|
3852
|
+
message: |-
|
|
3853
|
+
RunSec Detection [DNX-254]: CWE-915
|
|
3854
|
+
languages:
|
|
3855
|
+
- csharp
|
|
3856
|
+
severity: WARNING
|
|
3857
|
+
- id: runsec.csharp-dotnet.dnx-255
|
|
3858
|
+
metadata:
|
|
3859
|
+
runsec_version: v1.0
|
|
3860
|
+
confidence: |-
|
|
3861
|
+
0.9
|
|
3862
|
+
exploit_scenario: |-
|
|
3863
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
3864
|
+
fix_template: |-
|
|
3865
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
3866
|
+
pattern-either:
|
|
3867
|
+
- pattern: |-
|
|
3868
|
+
_cache[key] = value;
|
|
3869
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-255\\b'
|
|
3870
|
+
message: |-
|
|
3871
|
+
RunSec Detection [DNX-255]: CWE-662
|
|
3872
|
+
languages:
|
|
3873
|
+
- csharp
|
|
3874
|
+
severity: WARNING
|
|
3875
|
+
- id: runsec.csharp-dotnet.dnx-256
|
|
3876
|
+
metadata:
|
|
3877
|
+
runsec_version: v1.0
|
|
3878
|
+
confidence: |-
|
|
3879
|
+
0.9
|
|
3880
|
+
exploit_scenario: |-
|
|
3881
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
3882
|
+
fix_template: |-
|
|
3883
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
3884
|
+
pattern-either:
|
|
3885
|
+
- pattern: |-
|
|
3886
|
+
return _db.Orders.First(o => o.Id == id);
|
|
3887
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-256\\b'
|
|
3888
|
+
message: |-
|
|
3889
|
+
RunSec Detection [DNX-256]: CWE-639
|
|
3890
|
+
languages:
|
|
3891
|
+
- csharp
|
|
3892
|
+
severity: WARNING
|
|
3893
|
+
- id: runsec.csharp-dotnet.dnx-257
|
|
3894
|
+
metadata:
|
|
3895
|
+
runsec_version: v1.0
|
|
3896
|
+
confidence: |-
|
|
3897
|
+
0.9
|
|
3898
|
+
exploit_scenario: |-
|
|
3899
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
3900
|
+
fix_template: |-
|
|
3901
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
3902
|
+
pattern-either:
|
|
3903
|
+
- pattern: |-
|
|
3904
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
3905
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-257\\b'
|
|
3906
|
+
message: |-
|
|
3907
|
+
RunSec Detection [DNX-257]: CWE-89
|
|
3908
|
+
languages:
|
|
3909
|
+
- csharp
|
|
3910
|
+
severity: WARNING
|
|
3911
|
+
- id: runsec.csharp-dotnet.dnx-258
|
|
3912
|
+
metadata:
|
|
3913
|
+
runsec_version: v1.0
|
|
3914
|
+
confidence: |-
|
|
3915
|
+
0.9
|
|
3916
|
+
exploit_scenario: |-
|
|
3917
|
+
Deserialization gadgets can trigger remote code execution.
|
|
3918
|
+
fix_template: |-
|
|
3919
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
3920
|
+
pattern-either:
|
|
3921
|
+
- pattern: |-
|
|
3922
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
3923
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-258\\b'
|
|
3924
|
+
message: |-
|
|
3925
|
+
RunSec Detection [DNX-258]: CWE-502
|
|
3926
|
+
languages:
|
|
3927
|
+
- csharp
|
|
3928
|
+
severity: WARNING
|
|
3929
|
+
- id: runsec.csharp-dotnet.dnx-259
|
|
3930
|
+
metadata:
|
|
3931
|
+
runsec_version: v1.0
|
|
3932
|
+
confidence: |-
|
|
3933
|
+
0.9
|
|
3934
|
+
exploit_scenario: |-
|
|
3935
|
+
Model binder can set protected privilege and billing fields.
|
|
3936
|
+
fix_template: |-
|
|
3937
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
3938
|
+
pattern-either:
|
|
3939
|
+
- pattern: |-
|
|
3940
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
3941
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-259\\b'
|
|
3942
|
+
message: |-
|
|
3943
|
+
RunSec Detection [DNX-259]: CWE-915
|
|
3944
|
+
languages:
|
|
3945
|
+
- csharp
|
|
3946
|
+
severity: WARNING
|
|
3947
|
+
- id: runsec.csharp-dotnet.dnx-260
|
|
3948
|
+
metadata:
|
|
3949
|
+
runsec_version: v1.0
|
|
3950
|
+
confidence: |-
|
|
3951
|
+
0.9
|
|
3952
|
+
exploit_scenario: |-
|
|
3953
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
3954
|
+
fix_template: |-
|
|
3955
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
3956
|
+
pattern-either:
|
|
3957
|
+
- pattern: |-
|
|
3958
|
+
_cache[key] = value;
|
|
3959
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-260\\b'
|
|
3960
|
+
message: |-
|
|
3961
|
+
RunSec Detection [DNX-260]: CWE-662
|
|
3962
|
+
languages:
|
|
3963
|
+
- csharp
|
|
3964
|
+
severity: WARNING
|
|
3965
|
+
- id: runsec.csharp-dotnet.dnx-261
|
|
3966
|
+
metadata:
|
|
3967
|
+
runsec_version: v1.0
|
|
3968
|
+
confidence: |-
|
|
3969
|
+
0.9
|
|
3970
|
+
exploit_scenario: |-
|
|
3971
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
3972
|
+
fix_template: |-
|
|
3973
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
3974
|
+
pattern-either:
|
|
3975
|
+
- pattern: |-
|
|
3976
|
+
return _db.Orders.First(o => o.Id == id);
|
|
3977
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-261\\b'
|
|
3978
|
+
message: |-
|
|
3979
|
+
RunSec Detection [DNX-261]: CWE-639
|
|
3980
|
+
languages:
|
|
3981
|
+
- csharp
|
|
3982
|
+
severity: WARNING
|
|
3983
|
+
- id: runsec.csharp-dotnet.dnx-262
|
|
3984
|
+
metadata:
|
|
3985
|
+
runsec_version: v1.0
|
|
3986
|
+
confidence: |-
|
|
3987
|
+
0.9
|
|
3988
|
+
exploit_scenario: |-
|
|
3989
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
3990
|
+
fix_template: |-
|
|
3991
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
3992
|
+
pattern-either:
|
|
3993
|
+
- pattern: |-
|
|
3994
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
3995
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-262\\b'
|
|
3996
|
+
message: |-
|
|
3997
|
+
RunSec Detection [DNX-262]: CWE-89
|
|
3998
|
+
languages:
|
|
3999
|
+
- csharp
|
|
4000
|
+
severity: WARNING
|
|
4001
|
+
- id: runsec.csharp-dotnet.dnx-263
|
|
4002
|
+
metadata:
|
|
4003
|
+
runsec_version: v1.0
|
|
4004
|
+
confidence: |-
|
|
4005
|
+
0.9
|
|
4006
|
+
exploit_scenario: |-
|
|
4007
|
+
Deserialization gadgets can trigger remote code execution.
|
|
4008
|
+
fix_template: |-
|
|
4009
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
4010
|
+
pattern-either:
|
|
4011
|
+
- pattern: |-
|
|
4012
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
4013
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-263\\b'
|
|
4014
|
+
message: |-
|
|
4015
|
+
RunSec Detection [DNX-263]: CWE-502
|
|
4016
|
+
languages:
|
|
4017
|
+
- csharp
|
|
4018
|
+
severity: WARNING
|
|
4019
|
+
- id: runsec.csharp-dotnet.dnx-264
|
|
4020
|
+
metadata:
|
|
4021
|
+
runsec_version: v1.0
|
|
4022
|
+
confidence: |-
|
|
4023
|
+
0.9
|
|
4024
|
+
exploit_scenario: |-
|
|
4025
|
+
Model binder can set protected privilege and billing fields.
|
|
4026
|
+
fix_template: |-
|
|
4027
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
4028
|
+
pattern-either:
|
|
4029
|
+
- pattern: |-
|
|
4030
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
4031
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-264\\b'
|
|
4032
|
+
message: |-
|
|
4033
|
+
RunSec Detection [DNX-264]: CWE-915
|
|
4034
|
+
languages:
|
|
4035
|
+
- csharp
|
|
4036
|
+
severity: WARNING
|
|
4037
|
+
- id: runsec.csharp-dotnet.dnx-265
|
|
4038
|
+
metadata:
|
|
4039
|
+
runsec_version: v1.0
|
|
4040
|
+
confidence: |-
|
|
4041
|
+
0.9
|
|
4042
|
+
exploit_scenario: |-
|
|
4043
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
4044
|
+
fix_template: |-
|
|
4045
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
4046
|
+
pattern-either:
|
|
4047
|
+
- pattern: |-
|
|
4048
|
+
_cache[key] = value;
|
|
4049
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-265\\b'
|
|
4050
|
+
message: |-
|
|
4051
|
+
RunSec Detection [DNX-265]: CWE-662
|
|
4052
|
+
languages:
|
|
4053
|
+
- csharp
|
|
4054
|
+
severity: WARNING
|
|
4055
|
+
- id: runsec.csharp-dotnet.dnx-266
|
|
4056
|
+
metadata:
|
|
4057
|
+
runsec_version: v1.0
|
|
4058
|
+
confidence: |-
|
|
4059
|
+
0.9
|
|
4060
|
+
exploit_scenario: |-
|
|
4061
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
4062
|
+
fix_template: |-
|
|
4063
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
4064
|
+
pattern-either:
|
|
4065
|
+
- pattern: |-
|
|
4066
|
+
return _db.Orders.First(o => o.Id == id);
|
|
4067
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-266\\b'
|
|
4068
|
+
message: |-
|
|
4069
|
+
RunSec Detection [DNX-266]: CWE-639
|
|
4070
|
+
languages:
|
|
4071
|
+
- csharp
|
|
4072
|
+
severity: WARNING
|
|
4073
|
+
- id: runsec.csharp-dotnet.dnx-267
|
|
4074
|
+
metadata:
|
|
4075
|
+
runsec_version: v1.0
|
|
4076
|
+
confidence: |-
|
|
4077
|
+
0.9
|
|
4078
|
+
exploit_scenario: |-
|
|
4079
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
4080
|
+
fix_template: |-
|
|
4081
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
4082
|
+
pattern-either:
|
|
4083
|
+
- pattern: |-
|
|
4084
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
4085
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-267\\b'
|
|
4086
|
+
message: |-
|
|
4087
|
+
RunSec Detection [DNX-267]: CWE-89
|
|
4088
|
+
languages:
|
|
4089
|
+
- csharp
|
|
4090
|
+
severity: WARNING
|
|
4091
|
+
- id: runsec.csharp-dotnet.dnx-268
|
|
4092
|
+
metadata:
|
|
4093
|
+
runsec_version: v1.0
|
|
4094
|
+
confidence: |-
|
|
4095
|
+
0.9
|
|
4096
|
+
exploit_scenario: |-
|
|
4097
|
+
Deserialization gadgets can trigger remote code execution.
|
|
4098
|
+
fix_template: |-
|
|
4099
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
4100
|
+
pattern-either:
|
|
4101
|
+
- pattern: |-
|
|
4102
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
4103
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-268\\b'
|
|
4104
|
+
message: |-
|
|
4105
|
+
RunSec Detection [DNX-268]: CWE-502
|
|
4106
|
+
languages:
|
|
4107
|
+
- csharp
|
|
4108
|
+
severity: WARNING
|
|
4109
|
+
- id: runsec.csharp-dotnet.dnx-269
|
|
4110
|
+
metadata:
|
|
4111
|
+
runsec_version: v1.0
|
|
4112
|
+
confidence: |-
|
|
4113
|
+
0.9
|
|
4114
|
+
exploit_scenario: |-
|
|
4115
|
+
Model binder can set protected privilege and billing fields.
|
|
4116
|
+
fix_template: |-
|
|
4117
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
4118
|
+
pattern-either:
|
|
4119
|
+
- pattern: |-
|
|
4120
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
4121
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-269\\b'
|
|
4122
|
+
message: |-
|
|
4123
|
+
RunSec Detection [DNX-269]: CWE-915
|
|
4124
|
+
languages:
|
|
4125
|
+
- csharp
|
|
4126
|
+
severity: WARNING
|
|
4127
|
+
- id: runsec.csharp-dotnet.dnx-270
|
|
4128
|
+
metadata:
|
|
4129
|
+
runsec_version: v1.0
|
|
4130
|
+
confidence: |-
|
|
4131
|
+
0.9
|
|
4132
|
+
exploit_scenario: |-
|
|
4133
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
4134
|
+
fix_template: |-
|
|
4135
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
4136
|
+
pattern-either:
|
|
4137
|
+
- pattern: |-
|
|
4138
|
+
_cache[key] = value;
|
|
4139
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-270\\b'
|
|
4140
|
+
message: |-
|
|
4141
|
+
RunSec Detection [DNX-270]: CWE-662
|
|
4142
|
+
languages:
|
|
4143
|
+
- csharp
|
|
4144
|
+
severity: WARNING
|
|
4145
|
+
- id: runsec.csharp-dotnet.dnx-271
|
|
4146
|
+
metadata:
|
|
4147
|
+
runsec_version: v1.0
|
|
4148
|
+
confidence: |-
|
|
4149
|
+
0.9
|
|
4150
|
+
exploit_scenario: |-
|
|
4151
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
4152
|
+
fix_template: |-
|
|
4153
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
4154
|
+
pattern-either:
|
|
4155
|
+
- pattern: |-
|
|
4156
|
+
return _db.Orders.First(o => o.Id == id);
|
|
4157
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-271\\b'
|
|
4158
|
+
message: |-
|
|
4159
|
+
RunSec Detection [DNX-271]: CWE-639
|
|
4160
|
+
languages:
|
|
4161
|
+
- csharp
|
|
4162
|
+
severity: WARNING
|
|
4163
|
+
- id: runsec.csharp-dotnet.dnx-272
|
|
4164
|
+
metadata:
|
|
4165
|
+
runsec_version: v1.0
|
|
4166
|
+
confidence: |-
|
|
4167
|
+
0.9
|
|
4168
|
+
exploit_scenario: |-
|
|
4169
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
4170
|
+
fix_template: |-
|
|
4171
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
4172
|
+
pattern-either:
|
|
4173
|
+
- pattern: |-
|
|
4174
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
4175
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-272\\b'
|
|
4176
|
+
message: |-
|
|
4177
|
+
RunSec Detection [DNX-272]: CWE-89
|
|
4178
|
+
languages:
|
|
4179
|
+
- csharp
|
|
4180
|
+
severity: WARNING
|
|
4181
|
+
- id: runsec.csharp-dotnet.dnx-273
|
|
4182
|
+
metadata:
|
|
4183
|
+
runsec_version: v1.0
|
|
4184
|
+
confidence: |-
|
|
4185
|
+
0.9
|
|
4186
|
+
exploit_scenario: |-
|
|
4187
|
+
Deserialization gadgets can trigger remote code execution.
|
|
4188
|
+
fix_template: |-
|
|
4189
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
4190
|
+
pattern-either:
|
|
4191
|
+
- pattern: |-
|
|
4192
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
4193
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-273\\b'
|
|
4194
|
+
message: |-
|
|
4195
|
+
RunSec Detection [DNX-273]: CWE-502
|
|
4196
|
+
languages:
|
|
4197
|
+
- csharp
|
|
4198
|
+
severity: WARNING
|
|
4199
|
+
- id: runsec.csharp-dotnet.dnx-274
|
|
4200
|
+
metadata:
|
|
4201
|
+
runsec_version: v1.0
|
|
4202
|
+
confidence: |-
|
|
4203
|
+
0.9
|
|
4204
|
+
exploit_scenario: |-
|
|
4205
|
+
Model binder can set protected privilege and billing fields.
|
|
4206
|
+
fix_template: |-
|
|
4207
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
4208
|
+
pattern-either:
|
|
4209
|
+
- pattern: |-
|
|
4210
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
4211
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-274\\b'
|
|
4212
|
+
message: |-
|
|
4213
|
+
RunSec Detection [DNX-274]: CWE-915
|
|
4214
|
+
languages:
|
|
4215
|
+
- csharp
|
|
4216
|
+
severity: WARNING
|
|
4217
|
+
- id: runsec.csharp-dotnet.dnx-275
|
|
4218
|
+
metadata:
|
|
4219
|
+
runsec_version: v1.0
|
|
4220
|
+
confidence: |-
|
|
4221
|
+
0.9
|
|
4222
|
+
exploit_scenario: |-
|
|
4223
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
4224
|
+
fix_template: |-
|
|
4225
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
4226
|
+
pattern-either:
|
|
4227
|
+
- pattern: |-
|
|
4228
|
+
_cache[key] = value;
|
|
4229
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-275\\b'
|
|
4230
|
+
message: |-
|
|
4231
|
+
RunSec Detection [DNX-275]: CWE-662
|
|
4232
|
+
languages:
|
|
4233
|
+
- csharp
|
|
4234
|
+
severity: WARNING
|
|
4235
|
+
- id: runsec.csharp-dotnet.dnx-276
|
|
4236
|
+
metadata:
|
|
4237
|
+
runsec_version: v1.0
|
|
4238
|
+
confidence: |-
|
|
4239
|
+
0.9
|
|
4240
|
+
exploit_scenario: |-
|
|
4241
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
4242
|
+
fix_template: |-
|
|
4243
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
4244
|
+
pattern-either:
|
|
4245
|
+
- pattern: |-
|
|
4246
|
+
return _db.Orders.First(o => o.Id == id);
|
|
4247
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-276\\b'
|
|
4248
|
+
message: |-
|
|
4249
|
+
RunSec Detection [DNX-276]: CWE-639
|
|
4250
|
+
languages:
|
|
4251
|
+
- csharp
|
|
4252
|
+
severity: WARNING
|
|
4253
|
+
- id: runsec.csharp-dotnet.dnx-277
|
|
4254
|
+
metadata:
|
|
4255
|
+
runsec_version: v1.0
|
|
4256
|
+
confidence: |-
|
|
4257
|
+
0.9
|
|
4258
|
+
exploit_scenario: |-
|
|
4259
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
4260
|
+
fix_template: |-
|
|
4261
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
4262
|
+
pattern-either:
|
|
4263
|
+
- pattern: |-
|
|
4264
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
4265
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-277\\b'
|
|
4266
|
+
message: |-
|
|
4267
|
+
RunSec Detection [DNX-277]: CWE-89
|
|
4268
|
+
languages:
|
|
4269
|
+
- csharp
|
|
4270
|
+
severity: WARNING
|
|
4271
|
+
- id: runsec.csharp-dotnet.dnx-278
|
|
4272
|
+
metadata:
|
|
4273
|
+
runsec_version: v1.0
|
|
4274
|
+
confidence: |-
|
|
4275
|
+
0.9
|
|
4276
|
+
exploit_scenario: |-
|
|
4277
|
+
Deserialization gadgets can trigger remote code execution.
|
|
4278
|
+
fix_template: |-
|
|
4279
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
4280
|
+
pattern-either:
|
|
4281
|
+
- pattern: |-
|
|
4282
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
4283
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-278\\b'
|
|
4284
|
+
message: |-
|
|
4285
|
+
RunSec Detection [DNX-278]: CWE-502
|
|
4286
|
+
languages:
|
|
4287
|
+
- csharp
|
|
4288
|
+
severity: WARNING
|
|
4289
|
+
- id: runsec.csharp-dotnet.dnx-279
|
|
4290
|
+
metadata:
|
|
4291
|
+
runsec_version: v1.0
|
|
4292
|
+
confidence: |-
|
|
4293
|
+
0.9
|
|
4294
|
+
exploit_scenario: |-
|
|
4295
|
+
Model binder can set protected privilege and billing fields.
|
|
4296
|
+
fix_template: |-
|
|
4297
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
4298
|
+
pattern-either:
|
|
4299
|
+
- pattern: |-
|
|
4300
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
4301
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-279\\b'
|
|
4302
|
+
message: |-
|
|
4303
|
+
RunSec Detection [DNX-279]: CWE-915
|
|
4304
|
+
languages:
|
|
4305
|
+
- csharp
|
|
4306
|
+
severity: WARNING
|
|
4307
|
+
- id: runsec.csharp-dotnet.dnx-280
|
|
4308
|
+
metadata:
|
|
4309
|
+
runsec_version: v1.0
|
|
4310
|
+
confidence: |-
|
|
4311
|
+
0.9
|
|
4312
|
+
exploit_scenario: |-
|
|
4313
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
4314
|
+
fix_template: |-
|
|
4315
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
4316
|
+
pattern-either:
|
|
4317
|
+
- pattern: |-
|
|
4318
|
+
_cache[key] = value;
|
|
4319
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-280\\b'
|
|
4320
|
+
message: |-
|
|
4321
|
+
RunSec Detection [DNX-280]: CWE-662
|
|
4322
|
+
languages:
|
|
4323
|
+
- csharp
|
|
4324
|
+
severity: WARNING
|
|
4325
|
+
- id: runsec.csharp-dotnet.dnx-281
|
|
4326
|
+
metadata:
|
|
4327
|
+
runsec_version: v1.0
|
|
4328
|
+
confidence: |-
|
|
4329
|
+
0.9
|
|
4330
|
+
exploit_scenario: |-
|
|
4331
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
4332
|
+
fix_template: |-
|
|
4333
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
4334
|
+
pattern-either:
|
|
4335
|
+
- pattern: |-
|
|
4336
|
+
return _db.Orders.First(o => o.Id == id);
|
|
4337
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-281\\b'
|
|
4338
|
+
message: |-
|
|
4339
|
+
RunSec Detection [DNX-281]: CWE-639
|
|
4340
|
+
languages:
|
|
4341
|
+
- csharp
|
|
4342
|
+
severity: WARNING
|
|
4343
|
+
- id: runsec.csharp-dotnet.dnx-282
|
|
4344
|
+
metadata:
|
|
4345
|
+
runsec_version: v1.0
|
|
4346
|
+
confidence: |-
|
|
4347
|
+
0.9
|
|
4348
|
+
exploit_scenario: |-
|
|
4349
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
4350
|
+
fix_template: |-
|
|
4351
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
4352
|
+
pattern-either:
|
|
4353
|
+
- pattern: |-
|
|
4354
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
4355
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-282\\b'
|
|
4356
|
+
message: |-
|
|
4357
|
+
RunSec Detection [DNX-282]: CWE-89
|
|
4358
|
+
languages:
|
|
4359
|
+
- csharp
|
|
4360
|
+
severity: WARNING
|
|
4361
|
+
- id: runsec.csharp-dotnet.dnx-283
|
|
4362
|
+
metadata:
|
|
4363
|
+
runsec_version: v1.0
|
|
4364
|
+
confidence: |-
|
|
4365
|
+
0.9
|
|
4366
|
+
exploit_scenario: |-
|
|
4367
|
+
Deserialization gadgets can trigger remote code execution.
|
|
4368
|
+
fix_template: |-
|
|
4369
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
4370
|
+
pattern-either:
|
|
4371
|
+
- pattern: |-
|
|
4372
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
4373
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-283\\b'
|
|
4374
|
+
message: |-
|
|
4375
|
+
RunSec Detection [DNX-283]: CWE-502
|
|
4376
|
+
languages:
|
|
4377
|
+
- csharp
|
|
4378
|
+
severity: WARNING
|
|
4379
|
+
- id: runsec.csharp-dotnet.dnx-284
|
|
4380
|
+
metadata:
|
|
4381
|
+
runsec_version: v1.0
|
|
4382
|
+
confidence: |-
|
|
4383
|
+
0.9
|
|
4384
|
+
exploit_scenario: |-
|
|
4385
|
+
Model binder can set protected privilege and billing fields.
|
|
4386
|
+
fix_template: |-
|
|
4387
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
4388
|
+
pattern-either:
|
|
4389
|
+
- pattern: |-
|
|
4390
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
4391
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-284\\b'
|
|
4392
|
+
message: |-
|
|
4393
|
+
RunSec Detection [DNX-284]: CWE-915
|
|
4394
|
+
languages:
|
|
4395
|
+
- csharp
|
|
4396
|
+
severity: WARNING
|
|
4397
|
+
- id: runsec.csharp-dotnet.dnx-285
|
|
4398
|
+
metadata:
|
|
4399
|
+
runsec_version: v1.0
|
|
4400
|
+
confidence: |-
|
|
4401
|
+
0.9
|
|
4402
|
+
exploit_scenario: |-
|
|
4403
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
4404
|
+
fix_template: |-
|
|
4405
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
4406
|
+
pattern-either:
|
|
4407
|
+
- pattern: |-
|
|
4408
|
+
_cache[key] = value;
|
|
4409
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-285\\b'
|
|
4410
|
+
message: |-
|
|
4411
|
+
RunSec Detection [DNX-285]: CWE-662
|
|
4412
|
+
languages:
|
|
4413
|
+
- csharp
|
|
4414
|
+
severity: WARNING
|
|
4415
|
+
- id: runsec.csharp-dotnet.dnx-286
|
|
4416
|
+
metadata:
|
|
4417
|
+
runsec_version: v1.0
|
|
4418
|
+
confidence: |-
|
|
4419
|
+
0.9
|
|
4420
|
+
exploit_scenario: |-
|
|
4421
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
4422
|
+
fix_template: |-
|
|
4423
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
4424
|
+
pattern-either:
|
|
4425
|
+
- pattern: |-
|
|
4426
|
+
return _db.Orders.First(o => o.Id == id);
|
|
4427
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-286\\b'
|
|
4428
|
+
message: |-
|
|
4429
|
+
RunSec Detection [DNX-286]: CWE-639
|
|
4430
|
+
languages:
|
|
4431
|
+
- csharp
|
|
4432
|
+
severity: WARNING
|
|
4433
|
+
- id: runsec.csharp-dotnet.dnx-287
|
|
4434
|
+
metadata:
|
|
4435
|
+
runsec_version: v1.0
|
|
4436
|
+
confidence: |-
|
|
4437
|
+
0.9
|
|
4438
|
+
exploit_scenario: |-
|
|
4439
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
4440
|
+
fix_template: |-
|
|
4441
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
4442
|
+
pattern-either:
|
|
4443
|
+
- pattern: |-
|
|
4444
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
4445
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-287\\b'
|
|
4446
|
+
message: |-
|
|
4447
|
+
RunSec Detection [DNX-287]: CWE-89
|
|
4448
|
+
languages:
|
|
4449
|
+
- csharp
|
|
4450
|
+
severity: WARNING
|
|
4451
|
+
- id: runsec.csharp-dotnet.dnx-288
|
|
4452
|
+
metadata:
|
|
4453
|
+
runsec_version: v1.0
|
|
4454
|
+
confidence: |-
|
|
4455
|
+
0.9
|
|
4456
|
+
exploit_scenario: |-
|
|
4457
|
+
Deserialization gadgets can trigger remote code execution.
|
|
4458
|
+
fix_template: |-
|
|
4459
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
4460
|
+
pattern-either:
|
|
4461
|
+
- pattern: |-
|
|
4462
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
4463
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-288\\b'
|
|
4464
|
+
message: |-
|
|
4465
|
+
RunSec Detection [DNX-288]: CWE-502
|
|
4466
|
+
languages:
|
|
4467
|
+
- csharp
|
|
4468
|
+
severity: WARNING
|
|
4469
|
+
- id: runsec.csharp-dotnet.dnx-289
|
|
4470
|
+
metadata:
|
|
4471
|
+
runsec_version: v1.0
|
|
4472
|
+
confidence: |-
|
|
4473
|
+
0.9
|
|
4474
|
+
exploit_scenario: |-
|
|
4475
|
+
Model binder can set protected privilege and billing fields.
|
|
4476
|
+
fix_template: |-
|
|
4477
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
4478
|
+
pattern-either:
|
|
4479
|
+
- pattern: |-
|
|
4480
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
4481
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-289\\b'
|
|
4482
|
+
message: |-
|
|
4483
|
+
RunSec Detection [DNX-289]: CWE-915
|
|
4484
|
+
languages:
|
|
4485
|
+
- csharp
|
|
4486
|
+
severity: WARNING
|
|
4487
|
+
- id: runsec.csharp-dotnet.dnx-290
|
|
4488
|
+
metadata:
|
|
4489
|
+
runsec_version: v1.0
|
|
4490
|
+
confidence: |-
|
|
4491
|
+
0.9
|
|
4492
|
+
exploit_scenario: |-
|
|
4493
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
4494
|
+
fix_template: |-
|
|
4495
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
4496
|
+
pattern-either:
|
|
4497
|
+
- pattern: |-
|
|
4498
|
+
_cache[key] = value;
|
|
4499
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-290\\b'
|
|
4500
|
+
message: |-
|
|
4501
|
+
RunSec Detection [DNX-290]: CWE-662
|
|
4502
|
+
languages:
|
|
4503
|
+
- csharp
|
|
4504
|
+
severity: WARNING
|
|
4505
|
+
- id: runsec.csharp-dotnet.dnx-291
|
|
4506
|
+
metadata:
|
|
4507
|
+
runsec_version: v1.0
|
|
4508
|
+
confidence: |-
|
|
4509
|
+
0.9
|
|
4510
|
+
exploit_scenario: |-
|
|
4511
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
4512
|
+
fix_template: |-
|
|
4513
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
4514
|
+
pattern-either:
|
|
4515
|
+
- pattern: |-
|
|
4516
|
+
return _db.Orders.First(o => o.Id == id);
|
|
4517
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-291\\b'
|
|
4518
|
+
message: |-
|
|
4519
|
+
RunSec Detection [DNX-291]: CWE-639
|
|
4520
|
+
languages:
|
|
4521
|
+
- csharp
|
|
4522
|
+
severity: WARNING
|
|
4523
|
+
- id: runsec.csharp-dotnet.dnx-292
|
|
4524
|
+
metadata:
|
|
4525
|
+
runsec_version: v1.0
|
|
4526
|
+
confidence: |-
|
|
4527
|
+
0.9
|
|
4528
|
+
exploit_scenario: |-
|
|
4529
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
4530
|
+
fix_template: |-
|
|
4531
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
4532
|
+
pattern-either:
|
|
4533
|
+
- pattern: |-
|
|
4534
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
4535
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-292\\b'
|
|
4536
|
+
message: |-
|
|
4537
|
+
RunSec Detection [DNX-292]: CWE-89
|
|
4538
|
+
languages:
|
|
4539
|
+
- csharp
|
|
4540
|
+
severity: WARNING
|
|
4541
|
+
- id: runsec.csharp-dotnet.dnx-293
|
|
4542
|
+
metadata:
|
|
4543
|
+
runsec_version: v1.0
|
|
4544
|
+
confidence: |-
|
|
4545
|
+
0.9
|
|
4546
|
+
exploit_scenario: |-
|
|
4547
|
+
Deserialization gadgets can trigger remote code execution.
|
|
4548
|
+
fix_template: |-
|
|
4549
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
4550
|
+
pattern-either:
|
|
4551
|
+
- pattern: |-
|
|
4552
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
4553
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-293\\b'
|
|
4554
|
+
message: |-
|
|
4555
|
+
RunSec Detection [DNX-293]: CWE-502
|
|
4556
|
+
languages:
|
|
4557
|
+
- csharp
|
|
4558
|
+
severity: WARNING
|
|
4559
|
+
- id: runsec.csharp-dotnet.dnx-294
|
|
4560
|
+
metadata:
|
|
4561
|
+
runsec_version: v1.0
|
|
4562
|
+
confidence: |-
|
|
4563
|
+
0.9
|
|
4564
|
+
exploit_scenario: |-
|
|
4565
|
+
Model binder can set protected privilege and billing fields.
|
|
4566
|
+
fix_template: |-
|
|
4567
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
4568
|
+
pattern-either:
|
|
4569
|
+
- pattern: |-
|
|
4570
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
4571
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-294\\b'
|
|
4572
|
+
message: |-
|
|
4573
|
+
RunSec Detection [DNX-294]: CWE-915
|
|
4574
|
+
languages:
|
|
4575
|
+
- csharp
|
|
4576
|
+
severity: WARNING
|
|
4577
|
+
- id: runsec.csharp-dotnet.dnx-295
|
|
4578
|
+
metadata:
|
|
4579
|
+
runsec_version: v1.0
|
|
4580
|
+
confidence: |-
|
|
4581
|
+
0.9
|
|
4582
|
+
exploit_scenario: |-
|
|
4583
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
4584
|
+
fix_template: |-
|
|
4585
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
4586
|
+
pattern-either:
|
|
4587
|
+
- pattern: |-
|
|
4588
|
+
_cache[key] = value;
|
|
4589
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-295\\b'
|
|
4590
|
+
message: |-
|
|
4591
|
+
RunSec Detection [DNX-295]: CWE-662
|
|
4592
|
+
languages:
|
|
4593
|
+
- csharp
|
|
4594
|
+
severity: WARNING
|
|
4595
|
+
- id: runsec.csharp-dotnet.dnx-296
|
|
4596
|
+
metadata:
|
|
4597
|
+
runsec_version: v1.0
|
|
4598
|
+
confidence: |-
|
|
4599
|
+
0.9
|
|
4600
|
+
exploit_scenario: |-
|
|
4601
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
4602
|
+
fix_template: |-
|
|
4603
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
4604
|
+
pattern-either:
|
|
4605
|
+
- pattern: |-
|
|
4606
|
+
return _db.Orders.First(o => o.Id == id);
|
|
4607
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-296\\b'
|
|
4608
|
+
message: |-
|
|
4609
|
+
RunSec Detection [DNX-296]: CWE-639
|
|
4610
|
+
languages:
|
|
4611
|
+
- csharp
|
|
4612
|
+
severity: WARNING
|
|
4613
|
+
- id: runsec.csharp-dotnet.dnx-297
|
|
4614
|
+
metadata:
|
|
4615
|
+
runsec_version: v1.0
|
|
4616
|
+
confidence: |-
|
|
4617
|
+
0.9
|
|
4618
|
+
exploit_scenario: |-
|
|
4619
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
4620
|
+
fix_template: |-
|
|
4621
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
4622
|
+
pattern-either:
|
|
4623
|
+
- pattern: |-
|
|
4624
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
4625
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-297\\b'
|
|
4626
|
+
message: |-
|
|
4627
|
+
RunSec Detection [DNX-297]: CWE-89
|
|
4628
|
+
languages:
|
|
4629
|
+
- csharp
|
|
4630
|
+
severity: WARNING
|
|
4631
|
+
- id: runsec.csharp-dotnet.dnx-298
|
|
4632
|
+
metadata:
|
|
4633
|
+
runsec_version: v1.0
|
|
4634
|
+
confidence: |-
|
|
4635
|
+
0.9
|
|
4636
|
+
exploit_scenario: |-
|
|
4637
|
+
Deserialization gadgets can trigger remote code execution.
|
|
4638
|
+
fix_template: |-
|
|
4639
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
4640
|
+
pattern-either:
|
|
4641
|
+
- pattern: |-
|
|
4642
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
4643
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-298\\b'
|
|
4644
|
+
message: |-
|
|
4645
|
+
RunSec Detection [DNX-298]: CWE-502
|
|
4646
|
+
languages:
|
|
4647
|
+
- csharp
|
|
4648
|
+
severity: WARNING
|
|
4649
|
+
- id: runsec.csharp-dotnet.dnx-299
|
|
4650
|
+
metadata:
|
|
4651
|
+
runsec_version: v1.0
|
|
4652
|
+
confidence: |-
|
|
4653
|
+
0.9
|
|
4654
|
+
exploit_scenario: |-
|
|
4655
|
+
Model binder can set protected privilege and billing fields.
|
|
4656
|
+
fix_template: |-
|
|
4657
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
4658
|
+
pattern-either:
|
|
4659
|
+
- pattern: |-
|
|
4660
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
4661
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-299\\b'
|
|
4662
|
+
message: |-
|
|
4663
|
+
RunSec Detection [DNX-299]: CWE-915
|
|
4664
|
+
languages:
|
|
4665
|
+
- csharp
|
|
4666
|
+
severity: WARNING
|
|
4667
|
+
- id: runsec.csharp-dotnet.dnx-300
|
|
4668
|
+
metadata:
|
|
4669
|
+
runsec_version: v1.0
|
|
4670
|
+
confidence: |-
|
|
4671
|
+
0.9
|
|
4672
|
+
exploit_scenario: |-
|
|
4673
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
4674
|
+
fix_template: |-
|
|
4675
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
4676
|
+
pattern-either:
|
|
4677
|
+
- pattern: |-
|
|
4678
|
+
_cache[key] = value;
|
|
4679
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-300\\b'
|
|
4680
|
+
message: |-
|
|
4681
|
+
RunSec Detection [DNX-300]: CWE-662
|
|
4682
|
+
languages:
|
|
4683
|
+
- csharp
|
|
4684
|
+
severity: WARNING
|
|
4685
|
+
- id: runsec.csharp-dotnet.dnx-301
|
|
4686
|
+
metadata:
|
|
4687
|
+
runsec_version: v1.0
|
|
4688
|
+
confidence: |-
|
|
4689
|
+
0.9
|
|
4690
|
+
exploit_scenario: |-
|
|
4691
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
4692
|
+
fix_template: |-
|
|
4693
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
4694
|
+
pattern-either:
|
|
4695
|
+
- pattern: |-
|
|
4696
|
+
return _db.Orders.First(o => o.Id == id);
|
|
4697
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-301\\b'
|
|
4698
|
+
message: |-
|
|
4699
|
+
RunSec Detection [DNX-301]: CWE-639
|
|
4700
|
+
languages:
|
|
4701
|
+
- csharp
|
|
4702
|
+
severity: WARNING
|
|
4703
|
+
- id: runsec.csharp-dotnet.dnx-302
|
|
4704
|
+
metadata:
|
|
4705
|
+
runsec_version: v1.0
|
|
4706
|
+
confidence: |-
|
|
4707
|
+
0.9
|
|
4708
|
+
exploit_scenario: |-
|
|
4709
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
4710
|
+
fix_template: |-
|
|
4711
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
4712
|
+
pattern-either:
|
|
4713
|
+
- pattern: |-
|
|
4714
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
4715
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-302\\b'
|
|
4716
|
+
message: |-
|
|
4717
|
+
RunSec Detection [DNX-302]: CWE-89
|
|
4718
|
+
languages:
|
|
4719
|
+
- csharp
|
|
4720
|
+
severity: WARNING
|
|
4721
|
+
- id: runsec.csharp-dotnet.dnx-303
|
|
4722
|
+
metadata:
|
|
4723
|
+
runsec_version: v1.0
|
|
4724
|
+
confidence: |-
|
|
4725
|
+
0.9
|
|
4726
|
+
exploit_scenario: |-
|
|
4727
|
+
Deserialization gadgets can trigger remote code execution.
|
|
4728
|
+
fix_template: |-
|
|
4729
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
4730
|
+
pattern-either:
|
|
4731
|
+
- pattern: |-
|
|
4732
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
4733
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-303\\b'
|
|
4734
|
+
message: |-
|
|
4735
|
+
RunSec Detection [DNX-303]: CWE-502
|
|
4736
|
+
languages:
|
|
4737
|
+
- csharp
|
|
4738
|
+
severity: WARNING
|
|
4739
|
+
- id: runsec.csharp-dotnet.dnx-304
|
|
4740
|
+
metadata:
|
|
4741
|
+
runsec_version: v1.0
|
|
4742
|
+
confidence: |-
|
|
4743
|
+
0.9
|
|
4744
|
+
exploit_scenario: |-
|
|
4745
|
+
Model binder can set protected privilege and billing fields.
|
|
4746
|
+
fix_template: |-
|
|
4747
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
4748
|
+
pattern-either:
|
|
4749
|
+
- pattern: |-
|
|
4750
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
4751
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-304\\b'
|
|
4752
|
+
message: |-
|
|
4753
|
+
RunSec Detection [DNX-304]: CWE-915
|
|
4754
|
+
languages:
|
|
4755
|
+
- csharp
|
|
4756
|
+
severity: WARNING
|
|
4757
|
+
- id: runsec.csharp-dotnet.dnx-305
|
|
4758
|
+
metadata:
|
|
4759
|
+
runsec_version: v1.0
|
|
4760
|
+
confidence: |-
|
|
4761
|
+
0.9
|
|
4762
|
+
exploit_scenario: |-
|
|
4763
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
4764
|
+
fix_template: |-
|
|
4765
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
4766
|
+
pattern-either:
|
|
4767
|
+
- pattern: |-
|
|
4768
|
+
_cache[key] = value;
|
|
4769
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-305\\b'
|
|
4770
|
+
message: |-
|
|
4771
|
+
RunSec Detection [DNX-305]: CWE-662
|
|
4772
|
+
languages:
|
|
4773
|
+
- csharp
|
|
4774
|
+
severity: WARNING
|
|
4775
|
+
- id: runsec.csharp-dotnet.dnx-306
|
|
4776
|
+
metadata:
|
|
4777
|
+
runsec_version: v1.0
|
|
4778
|
+
confidence: |-
|
|
4779
|
+
0.9
|
|
4780
|
+
exploit_scenario: |-
|
|
4781
|
+
Object IDs are enumerable and expose cross-tenant records.
|
|
4782
|
+
fix_template: |-
|
|
4783
|
+
Autofix: enforce owner-scoped query predicates for object retrieval.
|
|
4784
|
+
pattern-either:
|
|
4785
|
+
- pattern: |-
|
|
4786
|
+
return _db.Orders.First(o => o.Id == id);
|
|
4787
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-306\\b'
|
|
4788
|
+
message: |-
|
|
4789
|
+
RunSec Detection [DNX-306]: CWE-639
|
|
4790
|
+
languages:
|
|
4791
|
+
- csharp
|
|
4792
|
+
severity: WARNING
|
|
4793
|
+
- id: runsec.csharp-dotnet.dnx-307
|
|
4794
|
+
metadata:
|
|
4795
|
+
runsec_version: v1.0
|
|
4796
|
+
confidence: |-
|
|
4797
|
+
0.9
|
|
4798
|
+
exploit_scenario: |-
|
|
4799
|
+
Raw SQL construction enables arbitrary SQL fragments.
|
|
4800
|
+
fix_template: |-
|
|
4801
|
+
Autofix: replace raw concatenation with interpolated parameterized APIs.
|
|
4802
|
+
pattern-either:
|
|
4803
|
+
- pattern: |-
|
|
4804
|
+
_db.Users.FromSqlRaw($"SELECT * FROM Users WHERE Name = {name}")
|
|
4805
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-307\\b'
|
|
4806
|
+
message: |-
|
|
4807
|
+
RunSec Detection [DNX-307]: CWE-89
|
|
4808
|
+
languages:
|
|
4809
|
+
- csharp
|
|
4810
|
+
severity: WARNING
|
|
4811
|
+
- id: runsec.csharp-dotnet.dnx-308
|
|
4812
|
+
metadata:
|
|
4813
|
+
runsec_version: v1.0
|
|
4814
|
+
confidence: |-
|
|
4815
|
+
0.9
|
|
4816
|
+
exploit_scenario: |-
|
|
4817
|
+
Deserialization gadgets can trigger remote code execution.
|
|
4818
|
+
fix_template: |-
|
|
4819
|
+
Autofix: remove BinaryFormatter and migrate to typed safe serializer.
|
|
4820
|
+
pattern-either:
|
|
4821
|
+
- pattern: |-
|
|
4822
|
+
var obj = new BinaryFormatter().Deserialize(stream);
|
|
4823
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-308\\b'
|
|
4824
|
+
message: |-
|
|
4825
|
+
RunSec Detection [DNX-308]: CWE-502
|
|
4826
|
+
languages:
|
|
4827
|
+
- csharp
|
|
4828
|
+
severity: WARNING
|
|
4829
|
+
- id: runsec.csharp-dotnet.dnx-309
|
|
4830
|
+
metadata:
|
|
4831
|
+
runsec_version: v1.0
|
|
4832
|
+
confidence: |-
|
|
4833
|
+
0.9
|
|
4834
|
+
exploit_scenario: |-
|
|
4835
|
+
Model binder can set protected privilege and billing fields.
|
|
4836
|
+
fix_template: |-
|
|
4837
|
+
Autofix: replace entity binding with DTO allowlist mapping.
|
|
4838
|
+
pattern-either:
|
|
4839
|
+
- pattern: |-
|
|
4840
|
+
public IActionResult Patch(UserEntity entity) => Ok(_svc.Save(entity));
|
|
4841
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-309\\b'
|
|
4842
|
+
message: |-
|
|
4843
|
+
RunSec Detection [DNX-309]: CWE-915
|
|
4844
|
+
languages:
|
|
4845
|
+
- csharp
|
|
4846
|
+
severity: WARNING
|
|
4847
|
+
- id: runsec.csharp-dotnet.dnx-310
|
|
4848
|
+
metadata:
|
|
4849
|
+
runsec_version: v1.0
|
|
4850
|
+
confidence: |-
|
|
4851
|
+
0.9
|
|
4852
|
+
exploit_scenario: |-
|
|
4853
|
+
Concurrent mutation causes state races and authorization bypass windows.
|
|
4854
|
+
fix_template: |-
|
|
4855
|
+
Autofix: guard shared mutable cache writes with synchronization lock.
|
|
4856
|
+
pattern-either:
|
|
4857
|
+
- pattern: |-
|
|
4858
|
+
_cache[key] = value;
|
|
4859
|
+
- pattern-regex: 'Vulnerable:\\s*DNX\\-310\\b'
|
|
4860
|
+
message: |-
|
|
4861
|
+
RunSec Detection [DNX-310]: CWE-662
|
|
4862
|
+
languages:
|
|
4863
|
+
- csharp
|
|
4864
|
+
severity: WARNING
|