Skip to content

Commit 677324a

Browse files
ValentinZakharovValentinZakharov
committed
Upgrade to AppSec rules v1.12.0
1 parent fba0450 commit 677324a

1 file changed

Lines changed: 208 additions & 3 deletions

File tree

‎dd-java-agent/appsec/src/main/resources/default_config.json‎

Lines changed: 208 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"version": "2.2",
33
"metadata": {
4-
"rules_version": "1.11.0"
4+
"rules_version": "1.12.0"
55
},
66
"rules": [
77
{
@@ -1921,7 +1921,6 @@
19211921
"$ifs",
19221922
"$oldpwd",
19231923
"$ostype",
1924-
"$path",
19251924
"$pwd",
19261925
"dev/fd/",
19271926
"dev/null",
@@ -5849,7 +5848,8 @@
58495848
"/website.php",
58505849
"/stats.php",
58515850
"/assets/plugins/mp3_id/mp3_id.php",
5852-
"/siteminderagent/forms/smpwservices.fcc"
5851+
"/siteminderagent/forms/smpwservices.fcc",
5852+
"/eval-stdin.php"
58535853
]
58545854
}
58555855
}
@@ -6236,6 +6236,155 @@
62366236
],
62376237
"transformers": []
62386238
},
6239+
{
6240+
"id": "rasp-930-100",
6241+
"name": "Local file inclusion exploit",
6242+
"enabled": false,
6243+
"tags": {
6244+
"type": "lfi",
6245+
"category": "vulnerability_trigger",
6246+
"cwe": "22",
6247+
"capec": "1000/255/153/126",
6248+
"confidence": "0",
6249+
"module": "rasp"
6250+
},
6251+
"conditions": [
6252+
{
6253+
"parameters": {
6254+
"resource": [
6255+
{
6256+
"address": "server.io.fs.file"
6257+
}
6258+
],
6259+
"params": [
6260+
{
6261+
"address": "server.request.query"
6262+
},
6263+
{
6264+
"address": "server.request.body"
6265+
},
6266+
{
6267+
"address": "server.request.path_params"
6268+
},
6269+
{
6270+
"address": "grpc.server.request.message"
6271+
},
6272+
{
6273+
"address": "graphql.server.all_resolvers"
6274+
},
6275+
{
6276+
"address": "graphql.server.resolver"
6277+
}
6278+
]
6279+
},
6280+
"operator": "lfi_detector"
6281+
}
6282+
],
6283+
"transformers": [],
6284+
"on_match": [
6285+
"stack_trace"
6286+
]
6287+
},
6288+
{
6289+
"id": "rasp-934-100",
6290+
"name": "Server-side request forgery exploit",
6291+
"enabled": false,
6292+
"tags": {
6293+
"type": "ssrf",
6294+
"category": "vulnerability_trigger",
6295+
"cwe": "918",
6296+
"capec": "1000/225/115/664",
6297+
"confidence": "0",
6298+
"module": "rasp"
6299+
},
6300+
"conditions": [
6301+
{
6302+
"parameters": {
6303+
"resource": [
6304+
{
6305+
"address": "server.io.net.url"
6306+
}
6307+
],
6308+
"params": [
6309+
{
6310+
"address": "server.request.query"
6311+
},
6312+
{
6313+
"address": "server.request.body"
6314+
},
6315+
{
6316+
"address": "server.request.path_params"
6317+
},
6318+
{
6319+
"address": "grpc.server.request.message"
6320+
},
6321+
{
6322+
"address": "graphql.server.all_resolvers"
6323+
},
6324+
{
6325+
"address": "graphql.server.resolver"
6326+
}
6327+
]
6328+
},
6329+
"operator": "ssrf_detector"
6330+
}
6331+
],
6332+
"transformers": [],
6333+
"on_match": [
6334+
"stack_trace"
6335+
]
6336+
},
6337+
{
6338+
"id": "rasp-942-100",
6339+
"name": "SQL injection exploit",
6340+
"enabled": false,
6341+
"tags": {
6342+
"type": "sql_injection",
6343+
"category": "vulnerability_trigger",
6344+
"cwe": "89",
6345+
"capec": "1000/152/248/66",
6346+
"confidence": "0",
6347+
"module": "rasp"
6348+
},
6349+
"conditions": [
6350+
{
6351+
"parameters": {
6352+
"resource": [
6353+
{
6354+
"address": "server.db.statement"
6355+
}
6356+
],
6357+
"params": [
6358+
{
6359+
"address": "server.request.query"
6360+
},
6361+
{
6362+
"address": "server.request.body"
6363+
},
6364+
{
6365+
"address": "server.request.path_params"
6366+
},
6367+
{
6368+
"address": "graphql.server.all_resolvers"
6369+
},
6370+
{
6371+
"address": "graphql.server.resolver"
6372+
}
6373+
],
6374+
"db_type": [
6375+
{
6376+
"address": "server.db.system"
6377+
}
6378+
]
6379+
},
6380+
"operator": "sqli_detector"
6381+
}
6382+
],
6383+
"transformers": [],
6384+
"on_match": [
6385+
"stack_trace"
6386+
]
6387+
},
62396388
{
62406389
"id": "sqr-000-001",
62416390
"name": "SSRF: Try to access the credential manager of the main cloud services",
@@ -8391,6 +8540,34 @@
83918540
}
83928541
],
83938542
"scanners": [
8543+
{
8544+
"id": "406f8606-52c4-4663-8db9-df70f9e8766c",
8545+
"name": "ZIP Code",
8546+
"key": {
8547+
"operator": "match_regex",
8548+
"parameters": {
8549+
"regex": "\\b(?:zip|postal)\\b",
8550+
"options": {
8551+
"case_sensitive": false,
8552+
"min_length": 3
8553+
}
8554+
}
8555+
},
8556+
"value": {
8557+
"operator": "match_regex",
8558+
"parameters": {
8559+
"regex": "^[0-9]{5}(?:-[0-9]{4})?$",
8560+
"options": {
8561+
"case_sensitive": true,
8562+
"min_length": 5
8563+
}
8564+
}
8565+
},
8566+
"tags": {
8567+
"type": "zipcode",
8568+
"category": "address"
8569+
}
8570+
},
83948571
{
83958572
"id": "JU1sRk3mSzqSUJn6GrVn7g",
83968573
"name": "American Express Card Scanner (4+4+4+3 digits)",
@@ -9157,6 +9334,34 @@
91579334
"category": "payment"
91589335
}
91599336
},
9337+
{
9338+
"id": "18b608bd7a764bff5b2344c0",
9339+
"name": "Phone number",
9340+
"key": {
9341+
"operator": "match_regex",
9342+
"parameters": {
9343+
"regex": "\\bphone|number|mobile\\b",
9344+
"options": {
9345+
"case_sensitive": false,
9346+
"min_length": 3
9347+
}
9348+
}
9349+
},
9350+
"value": {
9351+
"operator": "match_regex",
9352+
"parameters": {
9353+
"regex": "^(?:\\(\\+\\d{1,3}\\)|\\+\\d{1,3}|00\\d{1,3})?[-\\s\\.]?(?:\\(\\d{3}\\)[-\\s\\.]?)?(?:\\d[-\\s\\.]?){6,10}$",
9354+
"options": {
9355+
"case_sensitive": false,
9356+
"min_length": 6
9357+
}
9358+
}
9359+
},
9360+
"tags": {
9361+
"type": "phone",
9362+
"category": "pii"
9363+
}
9364+
},
91609365
{
91619366
"id": "de0899e0cbaaa812bb624cf04c912071012f616d-mod",
91629367
"name": "UK National Insurance Number Scanner",

0 commit comments

Comments
 (0)