dd-trace 5.45.0 → 5.47.0

package/packages/dd-trace/src/appsec/recommended.json

@@ -1,7 +1,7 @@
 {
   "version": "2.2",
   "metadata": {
-    "rules_version": "1.13.3"
+    "rules_version": "1.14.2"
   },
   "rules": [
     {
@@ -4864,6 +4864,36 @@
       ],
       "transformers": []
     },
+    {
+      "id": "ua0-600-68x",
+      "name": "xorbot",
+      "tags": {
+        "type": "attack_tool",
+        "category": "attack_attempt",
+        "cwe": "200",
+        "capec": "1000/118/169",
+        "tool_name": "xorbot",
+        "confidence": "0",
+        "module": "waf"
+      },
+      "conditions": [
+        {
+          "parameters": {
+            "inputs": [
+              {
+                "address": "server.request.headers.no_cookies",
+                "key_path": [
+                  "user-agent"
+                ]
+              }
+            ],
+            "regex": "\\bmasjesu\\b"
+          },
+          "operator": "match_regex"
+        }
+      ],
+      "transformers": []
+    },
     {
       "id": "dog-913-001",
       "name": "BurpCollaborator OOB domain",
@@ -5422,6 +5452,82 @@
       ],
       "transformers": []
     },
+    {
+      "id": "dog-913-013",
+      "name": "Public PoC for CVE-2025-24813",
+      "tags": {
+        "type": "attack_tool",
+        "category": "attack_attempt",
+        "cwe": "200",
+        "capec": "1000/118/169",
+        "confidence": "1",
+        "module": "waf"
+      },
+      "conditions": [
+        {
+          "parameters": {
+            "inputs": [
+              {
+                "address": "server.request.uri.raw"
+              }
+            ],
+            "regex": "/iSee857/session",
+            "options": {
+              "case_sensitive": false,
+              "min_length": 16
+            }
+          },
+          "operator": "match_regex"
+        }
+      ],
+      "transformers": []
+    },
+    {
+      "id": "dog-913-014",
+      "name": "Exploit attempt for Next.js Middleware Exploit (CVE-2025-29927)",
+      "tags": {
+        "type": "security_scanner",
+        "category": "attack_attempt",
+        "cwe": "200",
+        "capec": "1000/118/169",
+        "confidence": "0",
+        "module": "waf"
+      },
+      "conditions": [
+        {
+          "parameters": {
+            "inputs": [
+              {
+                "address": "server.request.headers.no_cookies",
+                "key_path": [
+                  "x-middleware-subrequest"
+                ]
+              }
+            ],
+            "regex": ".*",
+            "options": {
+              "min_length": 1
+            }
+          },
+          "operator": "match_regex"
+        },
+        {
+          "parameters": {
+            "inputs": [
+              {
+                "address": "server.request.headers.no_cookies",
+                "key_path": [
+                  "x-middleware-subrequest"
+                ]
+              }
+            ],
+            "regex": "[0-9a-fA-F]{40}|\\[\\w+\\]"
+          },
+          "operator": "!match_regex"
+        }
+      ],
+      "transformers": []
+    },
     {
       "id": "dog-920-001",
       "name": "JWT authentication bypass",
@@ -6314,7 +6420,7 @@
                 "address": "server.request.uri.raw"
               }
             ],
-            "regex": "(?:/swagger\\b|/api[-/]docs?\\b)",
+            "regex": "(?:^|/)(?:swagger|api[-/]?docs?|openapi)\\b",
             "options": {
               "case_sensitive": false
             }
@@ -6331,7 +6437,7 @@
         "category": "vulnerability_trigger",
         "cwe": "22",
         "capec": "1000/255/153/126",
-        "confidence": "0",
+        "confidence": "1",
         "module": "rasp"
       },
       "conditions": [
@@ -6379,7 +6485,7 @@
         "category": "vulnerability_trigger",
         "cwe": "77",
         "capec": "1000/152/248/88",
-        "confidence": "0",
+        "confidence": "1",
         "module": "rasp"
       },
       "conditions": [
@@ -6427,7 +6533,7 @@
         "category": "vulnerability_trigger",
         "cwe": "77",
         "capec": "1000/152/248/88",
-        "confidence": "0",
+        "confidence": "1",
         "module": "rasp"
       },
       "conditions": [
@@ -6479,6 +6585,20 @@
         "module": "rasp"
       },
       "conditions": [
+        {
+          "parameters": {
+            "inputs": [
+              {
+                "address": "server.io.net.url"
+              }
+            ],
+            "regex": "^(jar:)?https?:\\/\\/\\W*([0-9oq]{1,5}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}|[0-9]{1,10}|(\\[)?[:0-9a-f\\.x]{2,}(\\])?|metadata\\.google\\.internal|(?:[a-z0-9:@\\.\\-]*\\.)?(?:burpcollaborator\\.net|localtest\\.me|mail\\.ebc\\.apple\\.com|bugbounty\\.dod\\.network|.*\\.[nx]ip\\.io|oastify\\.com|oast\\.(?:pro|live|site|online|fun|me)|sslip\\.io|requestbin\\.com|requestbin\\.net|hookbin\\.com|webhook\\.site|canarytokens\\.com|interact\\.sh|ngrok\\.io|bugbounty\\.click|prbly\\.win|qualysperiscope\\.com|vii\\.one|act1on3\\.ru|ifconfig\\.pro|dnslog\\.\\w+))(:[0-9]{1,5})?(\\/[^:@]*)?$",
+            "options": {
+              "case_sensitive": false
+            }
+          },
+          "operator": "match_regex"
+        },
         {
           "parameters": {
             "resource": [
@@ -6523,7 +6643,7 @@
         "category": "vulnerability_trigger",
         "cwe": "89",
         "capec": "1000/152/248/66",
-        "confidence": "0",
+        "confidence": "1",
         "module": "rasp"
       },
       "conditions": [
@@ -6957,7 +7077,7 @@
                 "address": "graphql.server.resolver"
               }
             ],
-            "regex": "(http|https):\\/\\/(?:.*\\.)?(?:burpcollaborator\\.net|localtest\\.me|mail\\.ebc\\.apple\\.com|bugbounty\\.dod\\.network|.*\\.[nx]ip\\.io|oastify\\.com|oast\\.(?:pro|live|site|online|fun|me)|sslip\\.io|requestbin\\.com|requestbin\\.net|hookbin\\.com|webhook\\.site|canarytokens\\.com|interact\\.sh|ngrok\\.io|bugbounty\\.click|prbly\\.win|qualysperiscope\\.com|vii\\.one|act1on3\\.ru)"
+            "regex": "(http|https):\\/\\/(?:.*\\.)?(?:burpcollaborator\\.net|localtest\\.me|mail\\.ebc\\.apple\\.com|bugbounty\\.dod\\.network|.*\\.[nx]ip\\.io|oastify\\.com|oast\\.(?:pro|live|site|online|fun|me)|sslip\\.io|requestbin\\.com|requestbin\\.net|hookbin\\.com|webhook\\.site|canarytokens\\.com|interact\\.sh|ngrok\\.io|bugbounty\\.click|prbly\\.win|qualysperiscope\\.com|vii\\.one|act1on3\\.ru|dnslog\\.\\w+)"
           },
           "operator": "match_regex"
         }
@@ -7765,7 +7885,7 @@
                 ]
               }
             ],
-            "regex": "nmap (nse|scripting engine)"
+            "regex": "nmap (nse|scripting engine|icap-client/)"
           },
           "operator": "match_regex"
         }
@@ -8537,6 +8657,126 @@
       ],
       "transformers": []
     },
+    {
+      "id": "ua0-600-64x",
+      "name": "ddg_win",
+      "tags": {
+        "type": "attack_tool",
+        "category": "attack_attempt",
+        "cwe": "200",
+        "capec": "1000/118/169",
+        "tool_name": "ddg_win",
+        "confidence": "1",
+        "module": "waf"
+      },
+      "conditions": [
+        {
+          "parameters": {
+            "inputs": [
+              {
+                "address": "server.request.headers.no_cookies",
+                "key_path": [
+                  "user-agent"
+                ]
+              }
+            ],
+            "regex": "\\bddg_win\\b"
+          },
+          "operator": "match_regex"
+        }
+      ],
+      "transformers": []
+    },
+    {
+      "id": "ua0-600-65x",
+      "name": "ISS",
+      "tags": {
+        "type": "commercial_scanner",
+        "category": "attack_attempt",
+        "cwe": "200",
+        "capec": "1000/118/169",
+        "tool_name": "iss",
+        "confidence": "0",
+        "module": "waf"
+      },
+      "conditions": [
+        {
+          "parameters": {
+            "inputs": [
+              {
+                "address": "server.request.headers.no_cookies",
+                "key_path": [
+                  "user-agent"
+                ]
+              }
+            ],
+            "regex": "\\bisscyberriskcrawler/\\d\\.\\d"
+          },
+          "operator": "match_regex"
+        }
+      ],
+      "transformers": []
+    },
+    {
+      "id": "ua0-600-66x",
+      "name": "BountyBot",
+      "tags": {
+        "type": "attack_tool",
+        "category": "attack_attempt",
+        "cwe": "200",
+        "capec": "1000/118/169",
+        "tool_name": "bountybot",
+        "confidence": "1",
+        "module": "waf"
+      },
+      "conditions": [
+        {
+          "parameters": {
+            "inputs": [
+              {
+                "address": "server.request.headers.no_cookies",
+                "key_path": [
+                  "user-agent"
+                ]
+              }
+            ],
+            "regex": "\\bbountybot\\b"
+          },
+          "operator": "match_regex"
+        }
+      ],
+      "transformers": []
+    },
+    {
+      "id": "ua0-600-67x",
+      "name": "ZumBot",
+      "tags": {
+        "type": "attack_tool",
+        "category": "attack_attempt",
+        "cwe": "200",
+        "capec": "1000/118/169",
+        "tool_name": "zumbot",
+        "confidence": "1",
+        "module": "waf"
+      },
+      "conditions": [
+        {
+          "parameters": {
+            "inputs": [
+              {
+                "address": "server.request.headers.no_cookies",
+                "key_path": [
+                  "user-agent"
+                ]
+              }
+            ],
+            "regex": "\\bzumbot\\b"
+          },
+          "operator": "match_regex"
+        }
+      ],
+      "transformers": []
+    },
     {
       "id": "ua0-600-6xx",
       "name": "Stealthy scanner",
@@ -8634,24 +8874,7 @@
     {
       "id": "http-endpoint-fingerprint",
       "generator": "http_endpoint_fingerprint",
-      "conditions": [
-        {
-          "operator": "exists",
-          "parameters": {
-            "inputs": [
-              {
-                "address": "waf.context.event"
-              },
-              {
-                "address": "server.business_logic.users.login.failure"
-              },
-              {
-                "address": "server.business_logic.users.login.success"
-              }
-            ]
-          }
-        }
-      ],
+      "conditions": [],
       "parameters": {
         "mappings": [
           {
@@ -8679,7 +8902,7 @@
           }
         ]
       },
-      "evaluate": false,
+      "evaluate": true,
       "output": true
     },
     {
@@ -8835,24 +9058,7 @@
     {
       "id": "http-header-fingerprint",
       "generator": "http_header_fingerprint",
-      "conditions": [
-        {
-          "operator": "exists",
-          "parameters": {
-            "inputs": [
-              {
-                "address": "waf.context.event"
-              },
-              {
-                "address": "server.business_logic.users.login.failure"
-              },
-              {
-                "address": "server.business_logic.users.login.success"
-              }
-            ]
-          }
-        }
-      ],
+      "conditions": [],
       "parameters": {
         "mappings": [
           {
@@ -8865,30 +9071,13 @@
           }
         ]
       },
-      "evaluate": false,
+      "evaluate": true,
       "output": true
     },
     {
       "id": "http-network-fingerprint",
       "generator": "http_network_fingerprint",
-      "conditions": [
-        {
-          "operator": "exists",
-          "parameters": {
-            "inputs": [
-              {
-                "address": "waf.context.event"
-              },
-              {
-                "address": "server.business_logic.users.login.failure"
-              },
-              {
-                "address": "server.business_logic.users.login.success"
-              }
-            ]
-          }
-        }
-      ],
+      "conditions": [],
       "parameters": {
         "mappings": [
           {
@@ -8901,30 +9090,13 @@
           }
         ]
       },
-      "evaluate": false,
+      "evaluate": true,
       "output": true
     },
     {
       "id": "session-fingerprint",
       "generator": "session_fingerprint",
-      "conditions": [
-        {
-          "operator": "exists",
-          "parameters": {
-            "inputs": [
-              {
-                "address": "waf.context.event"
-              },
-              {
-                "address": "server.business_logic.users.login.failure"
-              },
-              {
-                "address": "server.business_logic.users.login.success"
-              }
-            ]
-          }
-        }
-      ],
+      "conditions": [],
       "parameters": {
         "mappings": [
           {
@@ -8947,7 +9119,7 @@
           }
         ]
       },
-      "evaluate": false,
+      "evaluate": true,
       "output": true
     }
   ],

package/packages/dd-trace/src/appsec/reporter.js

@@ -6,12 +6,13 @@ const web = require('../plugins/util/web')
 const { ipHeaderList } = require('../plugins/util/ip_extractor')
 const {
   incrementWafInitMetric,
-  updateWafRequestsMetricTags,
-  updateRaspRequestsMetricTags,
   incrementWafUpdatesMetric,
   incrementWafRequestsMetric,
-  getRequestMetrics,
-  updateRateLimitedMetric
+  updateWafRequestsMetricTags,
+  updateRaspRequestsMetricTags,
+  updateRaspRuleSkippedMetricTags,
+  updateRateLimitedMetric,
+  getRequestMetrics
 } = require('./telemetry')
 const zlib = require('zlib')
 const { keepTrace } = require('../priority_sampler')
@@ -294,6 +295,7 @@ module.exports = {
   reportMetrics,
   reportAttack,
   reportWafUpdate: incrementWafUpdatesMetric,
+  reportRaspRuleSkipped: updateRaspRuleSkippedMetricTags,
   reportDerivatives,
   finishRequest,
   setRateLimit,

package/packages/dd-trace/src/appsec/telemetry/index.js

@@ -1,8 +1,13 @@
 'use strict'
 
 const { DD_TELEMETRY_REQUEST_METRICS } = require('./common')
-const { addRaspRequestMetrics, trackRaspMetrics } = require('./rasp')
 const { incrementMissingUserId, incrementMissingUserLogin, incrementSdkEvent } = require('./user')
+const {
+  addRaspRequestMetrics,
+  trackRaspMetrics,
+  trackRaspRuleMatch,
+  trackRaspRuleSkipped
+} = require('./rasp')
 const {
   addWafRequestMetrics,
   trackWafMetrics,
@@ -34,7 +39,10 @@ function newStore () {
       wafTimeouts: 0,
       raspTimeouts: 0,
       wafErrorCode: null,
-      raspErrorCode: null
+      raspErrorCode: null,
+      wafVersion: null,
+      rulesVersion: null,
+      ruleTriggered: null
     }
   }
 }
@@ -58,7 +66,21 @@ function updateRaspRequestsMetricTags (metrics, req, raspRule) {
 
   if (!enabled) return
 
-  trackRaspMetrics(metrics, raspRule)
+  trackRaspMetrics(store, metrics, raspRule)
+}
+
+function updateRaspRuleMatchMetricTags (req, raspRule, blockTriggered, blocked) {
+  if (!enabled || !req) return
+
+  const store = getStore(req)
+
+  trackRaspRuleMatch(store, raspRule, blockTriggered, blocked)
+}
+
+function updateRaspRuleSkippedMetricTags (raspRule, reason) {
+  if (!enabled) return
+
+  trackRaspRuleSkipped(raspRule, reason)
 }
 
 function updateWafRequestsMetricTags (metrics, req) {
@@ -142,6 +164,8 @@ module.exports = {
   updateRateLimitedMetric,
   updateBlockFailureMetric,
   updateRaspRequestsMetricTags,
+  updateRaspRuleMatchMetricTags,
+  updateRaspRuleSkippedMetricTags,
   incrementWafInitMetric,
   incrementWafUpdatesMetric,
   incrementWafRequestsMetric,

package/packages/dd-trace/src/appsec/telemetry/rasp.js

@@ -1,10 +1,16 @@
 'use strict'
 
 const telemetryMetrics = require('../../telemetry/metrics')
-const { DD_TELEMETRY_REQUEST_METRICS } = require('./common')
+const { DD_TELEMETRY_REQUEST_METRICS, getVersionsTags } = require('./common')
 
 const appsecMetrics = telemetryMetrics.manager.namespace('appsec')
 
+const BLOCKING_STATUS = {
+  FAILURE: 'failure',
+  IRRELEVANT: 'irrelevant',
+  SUCCESS: 'success'
+}
+
 function addRaspRequestMetrics (store, { duration, durationExt, wafTimeout, errorCode }) {
   store[DD_TELEMETRY_REQUEST_METRICS].raspDuration += duration || 0
   store[DD_TELEMETRY_REQUEST_METRICS].raspDurationExt += durationExt || 0
@@ -26,25 +32,83 @@ function addRaspRequestMetrics (store, { duration, durationExt, wafTimeout, erro
   }
 }
 
-function trackRaspMetrics (metrics, raspRule) {
-  const tags = { rule_type: raspRule.type, waf_version: metrics.wafVersion }
+function trackRaspMetrics (store, metrics, raspRule) {
+  const versionsTags = getVersionsTags(metrics.wafVersion, metrics.rulesVersion)
+  const tags = { rule_type: raspRule.type, ...versionsTags }
+  const telemetryMetrics = store[DD_TELEMETRY_REQUEST_METRICS]
 
   if (raspRule.variant) {
     tags.rule_variant = raspRule.variant
   }
 
+  if (metrics.wafVersion) {
+    telemetryMetrics.wafVersion = metrics.wafVersion
+  }
+
+  if (metrics.rulesVersion) {
+    telemetryMetrics.rulesVersion = metrics.rulesVersion
+  }
+
+  if (metrics.ruleTriggered) {
+    telemetryMetrics.ruleTriggered = true
+  }
+
   appsecMetrics.count('rasp.rule.eval', tags).inc(1)
 
+  if (metrics.errorCode) {
+    const errorTags = { ...tags, waf_error: metrics.errorCode }
+
+    appsecMetrics.count('rasp.error', errorTags).inc(1)
+  }
+
   if (metrics.wafTimeout) {
     appsecMetrics.count('rasp.timeout', tags).inc(1)
   }
+}
 
-  if (metrics.ruleTriggered) {
-    appsecMetrics.count('rasp.rule.match', tags).inc(1)
+function trackRaspRuleMatch (store, raspRule, blockTriggered, blocked) {
+  const telemetryMetrics = store[DD_TELEMETRY_REQUEST_METRICS]
+  if (!telemetryMetrics.ruleTriggered) return
+
+  const tags = {
+    waf_version: telemetryMetrics.wafVersion,
+    event_rules_version: telemetryMetrics.rulesVersion,
+    rule_type: raspRule.type,
+    block: getRuleMatchBlockingStatus(blockTriggered, blocked)
+  }
+
+  if (raspRule.variant) {
+    tags.rule_variant = raspRule.variant
+  }
+
+  appsecMetrics.count('rasp.rule.match', tags).inc(1)
+
+  // this is needed to not count it twice for the same match
+  // but it also means it can only be called once per waf call even if there are multiple rasp match
+  telemetryMetrics.ruleTriggered = null
+}
+
+function trackRaspRuleSkipped (raspRule, reason) {
+  const tags = { reason, rule_type: raspRule.type }
+
+  if (raspRule.variant) {
+    tags.rule_variant = raspRule.variant
+  }
+
+  appsecMetrics.count('rasp.rule.skipped', tags).inc(1)
+}
+
+function getRuleMatchBlockingStatus (blockTriggered, blocked) {
+  if (!blockTriggered) {
+    return BLOCKING_STATUS.IRRELEVANT
   }
+
+  return blocked ? BLOCKING_STATUS.SUCCESS : BLOCKING_STATUS.FAILURE
 }
 
 module.exports = {
   addRaspRequestMetrics,
-  trackRaspMetrics
+  trackRaspMetrics,
+  trackRaspRuleMatch,
+  trackRaspRuleSkipped
 }