dd-trace 2.4.1 → 2.6.0

package/packages/dd-trace/src/appsec/recommended.json

@@ -1,7 +1,7 @@
 {
   "version": "2.2",
   "metadata": {
-    "rules_version": "1.2.6"
+    "rules_version": "1.3.1"
   },
   "rules": [
     {
@@ -280,9 +280,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -297,53 +294,54 @@
               }
             ],
             "list": [
-              ".htaccess",
-              ".htdigest",
-              ".htpasswd",
-              ".addressbook",
-              ".aptitude/config",
-              ".bash_config",
-              ".bash_history",
-              ".bash_logout",
-              ".bash_profile",
-              ".bashrc",
+              "/.htaccess",
+              "/.htdigest",
+              "/.htpasswd",
+              "/.addressbook",
+              "/.aptitude/config",
+              "/.bash_config",
+              "/.bash_history",
+              "/.bash_logout",
+              "/.bash_profile",
+              "/.bashrc",
               ".cache/notify-osd.log",
               ".config/odesk/odesk team.conf",
-              ".cshrc",
-              ".dockerignore",
+              "/.cshrc",
+              "/.dockerignore",
               ".drush/",
-              ".eslintignore",
-              ".fbcindex",
-              ".forward",
-              ".git",
-              ".gitattributes",
-              ".gitconfig",
+              "/.eslintignore",
+              "/.fbcindex",
+              "/.forward",
+              "/.git",
+              ".git/",
+              "/.gitattributes",
+              "/.gitconfig",
               ".gnupg/",
               ".hplip/hplip.conf",
-              ".ksh_history",
-              ".lesshst",
+              "/.ksh_history",
+              "/.lesshst",
               ".lftp/",
-              ".lhistory",
-              ".lldb-history",
+              "/.lhistory",
+              "/.lldb-history",
               ".local/share/mc/",
-              ".lynx_cookies",
-              ".my.cnf",
-              ".mysql_history",
-              ".nano_history",
-              ".node_repl_history",
-              ".pearrc",
-              ".php_history",
-              ".pinerc",
+              "/.lynx_cookies",
+              "/.my.cnf",
+              "/.mysql_history",
+              "/.nano_history",
+              "/.node_repl_history",
+              "/.pearrc",
+              "/.php_history",
+              "/.pinerc",
               ".pki/",
-              ".proclog",
-              ".procmailrc",
-              ".psql_history",
-              ".python_history",
-              ".rediscli_history",
-              ".rhistory",
-              ".rhosts",
-              ".sh_history",
-              ".sqlite_history",
+              "/.proclog",
+              "/.procmailrc",
+              "/.psql_history",
+              "/.python_history",
+              "/.rediscli_history",
+              "/.rhistory",
+              "/.rhosts",
+              "/.sh_history",
+              "/.sqlite_history",
               ".ssh/authorized_keys",
               ".ssh/config",
               ".ssh/id_dsa",
@@ -357,17 +355,17 @@
               ".subversion/config",
               ".subversion/servers",
               ".tconn/tconn.conf",
-              ".tcshrc",
+              "/.tcshrc",
               ".vidalia/vidalia.conf",
-              ".viminfo",
-              ".vimrc",
-              ".www_acl",
-              ".wwwacl",
-              ".xauthority",
-              ".zhistory",
-              ".zshrc",
-              ".zsh_history",
-              ".nsconfig",
+              "/.viminfo",
+              "/.vimrc",
+              "/.www_acl",
+              "/.wwwacl",
+              "/.xauthority",
+              "/.zhistory",
+              "/.zshrc",
+              "/.zsh_history",
+              "/.nsconfig",
               "etc/redis.conf",
               "etc/redis-sentinel.conf",
               "etc/php.ini",
@@ -1349,26 +1347,26 @@
               "etc/vmware-tools/vmware-tools-libraries.conf",
               "var/log/vmware/hostd.log",
               "var/log/vmware/hostd-1.log",
-              "wp-config.php",
-              "wp-config.bak",
-              "wp-config.old",
-              "wp-config.temp",
-              "wp-config.tmp",
-              "wp-config.txt",
-              "config.yml",
-              "config_dev.yml",
-              "config_prod.yml",
-              "config_test.yml",
-              "parameters.yml",
-              "routing.yml",
-              "security.yml",
-              "services.yml",
+              "/wp-config.php",
+              "/wp-config.bak",
+              "/wp-config.old",
+              "/wp-config.temp",
+              "/wp-config.tmp",
+              "/wp-config.txt",
+              "/config.yml",
+              "/config_dev.yml",
+              "/config_prod.yml",
+              "/config_test.yml",
+              "/parameters.yml",
+              "/routing.yml",
+              "/security.yml",
+              "/services.yml",
               "sites/default/default.settings.php",
               "sites/default/settings.php",
               "sites/default/settings.local.php",
               "app/etc/local.xml",
-              "sftp-config.json",
-              "web.config",
+              "/sftp-config.json",
+              "/web.config",
               "includes/config.php",
               "includes/configure.php",
               "config.inc.php",
@@ -1392,14 +1390,14 @@
               "system32/config/system",
               "system32/config/software",
               "winnt/repair/sam._",
-              "package.json",
-              "package-lock.json",
-              "gruntfile.js",
-              "npm-debug.log",
-              "ormconfig.json",
-              "tsconfig.json",
-              "webpack.config.js",
-              "yarn.lock"
+              "/package.json",
+              "/package-lock.json",
+              "/gruntfile.js",
+              "/npm-debug.log",
+              "/ormconfig.json",
+              "/tsconfig.json",
+              "/webpack.config.js",
+              "/yarn.lock"
             ]
           },
           "operator": "phrase_match"
@@ -1481,9 +1479,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -1781,9 +1776,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -1838,9 +1830,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -1877,9 +1866,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -1915,9 +1901,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -1997,9 +1980,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -2035,9 +2015,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.headers.no_cookies"
               },
@@ -2077,9 +2054,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -2118,9 +2092,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -2157,9 +2128,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.headers.no_cookies",
                 "key_path": [
@@ -2205,9 +2173,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.headers.no_cookies",
                 "key_path": [
@@ -2257,9 +2222,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.headers.no_cookies",
                 "key_path": [
@@ -2309,9 +2271,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.headers.no_cookies",
                 "key_path": [
@@ -2361,9 +2320,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -2407,9 +2363,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -2448,9 +2401,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -2489,9 +2439,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -2530,9 +2477,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -2570,9 +2514,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -2612,9 +2553,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -2652,9 +2590,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -2692,9 +2627,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -2732,9 +2664,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -2772,9 +2701,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -2811,9 +2737,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -2850,9 +2773,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -2886,9 +2806,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -2925,9 +2842,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -2963,9 +2877,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -3001,9 +2912,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -3040,9 +2948,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -3078,9 +2983,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -3116,9 +3018,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -3141,7 +3040,9 @@
           "operator": "match_regex"
         }
       ],
-      "transformers": []
+      "transformers": [
+        "keys_only"
+      ]
     },
     {
       "id": "crs-942-360",
@@ -3155,9 +3056,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -3193,9 +3091,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -3232,9 +3127,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -3277,9 +3169,6 @@
               {
                 "address": "server.request.path_params"
               },
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.headers.no_cookies"
               },
@@ -3321,9 +3210,6 @@
               {
                 "address": "server.request.path_params"
               },
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.headers.no_cookies"
               },
@@ -3351,9 +3237,6 @@
               {
                 "address": "server.request.path_params"
               },
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.headers.no_cookies"
               },
@@ -3395,9 +3278,6 @@
               {
                 "address": "server.request.path_params"
               },
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.headers.no_cookies"
               },
@@ -3503,9 +3383,6 @@
           "operator": "match_regex",
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -3540,9 +3417,6 @@
           "operator": "match_regex",
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -3568,6 +3442,33 @@
       ],
       "transformers": []
     },
+    {
+      "id": "dog-000-004",
+      "name": "Spring4Shell - Attempts to exploit the Spring4shell vulnerability",
+      "tags": {
+        "type": "exploit_detection",
+        "category": "attack_attempt"
+      },
+      "conditions": [
+        {
+          "operator": "match_regex",
+          "parameters": {
+            "inputs": [
+              {
+                "address": "server.request.body"
+              }
+            ],
+            "regex": "^class\\.module\\.classLoader\\.",
+            "options": {
+              "case_sensitive": false
+            }
+          }
+        }
+      ],
+      "transformers": [
+        "keys_only"
+      ]
+    },
     {
       "id": "nfd-000-001",
       "name": "Detect common directory discovery scans",
@@ -4198,15 +4099,23 @@
           "parameters": {
             "inputs": [
               {
-                "address": "server.request.headers.no_cookies"
+                "address": "server.request.query"
+              },
+              {
+                "address": "server.request.body"
+              },
+              {
+                "address": "server.request.path_params"
               }
             ],
-            "regex": "\\$(eq|ne|lte?|gte?|n?in)\\b"
+            "regex": "^\\$(eq|ne|(l|g)te?|n?in|not|(n|x|)or|and|regex|where|expr|exists)$"
           },
           "operator": "match_regex"
         }
       ],
-      "transformers": []
+      "transformers": [
+        "keys_only"
+      ]
     },
     {
       "id": "sqr-000-008",
@@ -4484,9 +4393,9 @@
     },
     {
       "id": "sqr-000-017",
-      "name": "JNDI: Attempt to exploit log4j CVE-2021-44228",
+      "name": "Log4shell: Attempt to exploit log4j CVE-2021-44228",
       "tags": {
-        "type": "java_code_injection",
+        "type": "exploit_detection",
         "category": "attack_attempt"
       },
       "conditions": [
@@ -5726,4 +5635,4 @@
       "transformers": []
     }
   ]
-}
+}