diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md new file mode 100644 index 00000000..d1397a45 --- /dev/null +++ b/.github/pull_request_template.md @@ -0,0 +1,25 @@ +## Goal + + + +## Changes + + +- + +## Testing + + +- + +## Artifacts & Screenshots + + + +--- + +### Checklist + +- [ ] PR title is clear and descriptive +- [ ] Documentation updated if needed +- [ ] No secrets or large temporary files committed diff --git a/.gitignore b/.gitignore new file mode 100644 index 00000000..a38dbc03 --- /dev/null +++ b/.gitignore @@ -0,0 +1,164 @@ +### Python template +# Byte-compiled / optimized / DLL files +__pycache__/ +*.py[cod] +*$py.class + +# C extensions +*.so + +# Distribution / packaging +.Python +build/ +develop-eggs/ +dist/ +downloads/ +eggs/ +.eggs/ +lib/ +lib64/ +parts/ +sdist/ +var/ +wheels/ +share/python-wheels/ +*.egg-info/ +.installed.cfg +*.egg +MANIFEST + +# PyInstaller +# Usually these files are written by a python script from a template +# before PyInstaller builds the exe, so as to inject date/other infos into it. +*.manifest +*.spec + +# Installer logs +pip-log.txt +pip-delete-this-directory.txt + +# Unit test / coverage reports +htmlcov/ +.tox/ +.nox/ +.coverage +.coverage.* +.cache +nosetests.xml +coverage.xml +*.cover +*.py,cover +.hypothesis/ +.pytest_cache/ +cover/ + +# Translations +*.mo +*.pot + +# Django stuff: +*.log +local_settings.py +db.sqlite3 +db.sqlite3-journal + +# Flask stuff: +instance/ +.webassets-cache + +# Scrapy stuff: +.scrapy + +# Sphinx documentation +docs/_build/ + +# PyBuilder +.pybuilder/ +target/ + +# Jupyter Notebook +.ipynb_checkpoints + +# IPython +profile_default/ +ipython_config.py + +# pyenv +# For a library or package, you might want to ignore these files since the code is +# intended to run in multiple environments; otherwise, check them in: +# .python-version + +# pipenv +# According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control. +# However, in case of collaboration, if having platform-specific dependencies or dependencies +# having no cross-platform support, pipenv may install dependencies that don't work, or not +# install all needed dependencies. +#Pipfile.lock + +# poetry +# Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control. +# This is especially recommended for binary packages to ensure reproducibility, and is more +# commonly ignored for libraries. +# https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control +#poetry.lock + +# pdm +# Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control. +#pdm.lock +# pdm stores project-wide configurations in .pdm.toml, but it is recommended to not include it +# in version control. +# https://pdm.fming.dev/latest/usage/project/#working-with-version-control +.pdm.toml +.pdm-python +.pdm-build/ + +# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm +__pypackages__/ + +# Celery stuff +celerybeat-schedule +celerybeat.pid + +# SageMath parsed files +*.sage.py + +# Environments +.env +.venv +env/ +venv/ +ENV/ +env.bak/ +venv.bak/ + +# Spyder project settings +.spyderproject +.spyproject + +# Rope project settings +.ropeproject + +# mkdocs documentation +/site + +# mypy +.mypy_cache/ +.dmypy.json +dmypy.json + +# Pyre type checker +.pyre/ + +# pytype static type analyzer +.pytype/ + +# Cython debug symbols +cython_debug/ + +# PyCharm +# JetBrains specific template is maintained in a separate JetBrains.gitignore that can +# be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore +# and can be added to the global gitignore or merged into this file. For a more nuclear +# option (not recommended) you can uncomment the following to ignore the entire idea folder. +.idea/ + diff --git a/labs/lab10/imports/import-grype-vuln-results.json.json b/labs/lab10/imports/import-grype-vuln-results.json.json new file mode 100644 index 00000000..039b3356 --- /dev/null +++ b/labs/lab10/imports/import-grype-vuln-results.json.json @@ -0,0 +1 @@ +{"minimum_severity":"Info","active":false,"verified":false,"endpoint_to_add":null,"product_type_name":"Engineering","product_name":"Juice Shop","engagement_name":"Labs Security Testing","auto_create_context":true,"deduplication_on_engagement":false,"lead":null,"push_to_jira":false,"api_scan_configuration":null,"create_finding_groups_for_all_findings":true,"test_id":4,"engagement_id":1,"product_id":1,"product_type_id":2,"statistics":{"after":{"info":{"active":12,"verified":0,"duplicate":0,"false_p":0,"out_of_scope":0,"is_mitigated":0,"risk_accepted":0,"total":12},"low":{"active":3,"verified":0,"duplicate":0,"false_p":0,"out_of_scope":0,"is_mitigated":0,"risk_accepted":0,"total":3},"medium":{"active":32,"verified":0,"duplicate":0,"false_p":0,"out_of_scope":0,"is_mitigated":0,"risk_accepted":0,"total":32},"high":{"active":64,"verified":0,"duplicate":0,"false_p":0,"out_of_scope":0,"is_mitigated":0,"risk_accepted":0,"total":64},"critical":{"active":11,"verified":0,"duplicate":0,"false_p":0,"out_of_scope":0,"is_mitigated":0,"risk_accepted":0,"total":11},"total":{"active":122,"verified":0,"duplicate":0,"false_p":0,"out_of_scope":0,"is_mitigated":0,"risk_accepted":0,"total":122}}},"apply_tags_to_findings":false,"apply_tags_to_endpoints":false,"scan_type":"Anchore Grype","close_old_findings":false,"close_old_findings_product_scope":false,"test":4} \ No newline at end of file diff --git a/labs/lab10/imports/import-semgrep-results.json.json b/labs/lab10/imports/import-semgrep-results.json.json new file mode 100644 index 00000000..759d255d --- /dev/null +++ b/labs/lab10/imports/import-semgrep-results.json.json @@ -0,0 +1 @@ +{"minimum_severity":"Info","active":false,"verified":false,"endpoint_to_add":null,"product_type_name":"Engineering","product_name":"Juice Shop","engagement_name":"Labs Security Testing","auto_create_context":true,"deduplication_on_engagement":false,"lead":null,"push_to_jira":false,"api_scan_configuration":null,"create_finding_groups_for_all_findings":true,"test_id":2,"engagement_id":1,"product_id":1,"product_type_id":2,"statistics":{"after":{"info":{"active":0,"verified":0,"duplicate":0,"false_p":0,"out_of_scope":0,"is_mitigated":0,"risk_accepted":0,"total":0},"low":{"active":0,"verified":0,"duplicate":0,"false_p":0,"out_of_scope":0,"is_mitigated":0,"risk_accepted":0,"total":0},"medium":{"active":18,"verified":0,"duplicate":0,"false_p":0,"out_of_scope":0,"is_mitigated":0,"risk_accepted":0,"total":18},"high":{"active":7,"verified":0,"duplicate":0,"false_p":0,"out_of_scope":0,"is_mitigated":0,"risk_accepted":0,"total":7},"critical":{"active":0,"verified":0,"duplicate":0,"false_p":0,"out_of_scope":0,"is_mitigated":0,"risk_accepted":0,"total":0},"total":{"active":25,"verified":0,"duplicate":0,"false_p":0,"out_of_scope":0,"is_mitigated":0,"risk_accepted":0,"total":25}}},"pro":["Did you know, Pro has an automated no-code connector for Semgrep JSON Report? Try today for free or email us at hello@defectdojo.com"],"apply_tags_to_findings":false,"apply_tags_to_endpoints":false,"scan_type":"Semgrep JSON Report","close_old_findings":false,"close_old_findings_product_scope":false,"test":2} \ No newline at end of file diff --git a/labs/lab10/imports/import-trivy-vuln-detailed.json.json b/labs/lab10/imports/import-trivy-vuln-detailed.json.json new file mode 100644 index 00000000..7fe6e51e --- /dev/null +++ b/labs/lab10/imports/import-trivy-vuln-detailed.json.json @@ -0,0 +1 @@ +{"minimum_severity":"Info","active":false,"verified":false,"endpoint_to_add":null,"product_type_name":"Engineering","product_name":"Juice Shop","engagement_name":"Labs Security Testing","auto_create_context":true,"deduplication_on_engagement":false,"lead":null,"push_to_jira":false,"api_scan_configuration":null,"create_finding_groups_for_all_findings":true,"test_id":3,"engagement_id":1,"product_id":1,"product_type_id":2,"statistics":{"after":{"info":{"active":0,"verified":0,"duplicate":0,"false_p":0,"out_of_scope":0,"is_mitigated":0,"risk_accepted":0,"total":0},"low":{"active":18,"verified":18,"duplicate":0,"false_p":0,"out_of_scope":0,"is_mitigated":0,"risk_accepted":0,"total":18},"medium":{"active":36,"verified":34,"duplicate":0,"false_p":0,"out_of_scope":0,"is_mitigated":0,"risk_accepted":0,"total":36},"high":{"active":83,"verified":81,"duplicate":0,"false_p":0,"out_of_scope":0,"is_mitigated":0,"risk_accepted":0,"total":83},"critical":{"active":10,"verified":10,"duplicate":0,"false_p":0,"out_of_scope":0,"is_mitigated":0,"risk_accepted":0,"total":10},"total":{"active":147,"verified":143,"duplicate":0,"false_p":0,"out_of_scope":0,"is_mitigated":0,"risk_accepted":0,"total":147}}},"apply_tags_to_findings":false,"apply_tags_to_endpoints":false,"scan_type":"Trivy Scan","close_old_findings":false,"close_old_findings_product_scope":false,"test":3} \ No newline at end of file diff --git a/labs/lab10/imports/import-zap-report-noauth.json.json b/labs/lab10/imports/import-zap-report-noauth.json.json new file mode 100644 index 00000000..207345f6 --- /dev/null +++ b/labs/lab10/imports/import-zap-report-noauth.json.json @@ -0,0 +1 @@ +{"message":"['Internal error: Wrong file format, please use xml.']","pro":["Pro comes with support. Try today for free or email us at hello@defectdojo.com"]} \ No newline at end of file diff --git a/labs/lab10/report/dojo-report.html b/labs/lab10/report/dojo-report.html new file mode 100644 index 00000000..9d83aec5 --- /dev/null +++ b/labs/lab10/report/dojo-report.html @@ -0,0 +1,25462 @@ + + + +
+ +
+ Engagement: Labs Security Testing
+
Generated: Apr 13, 2026
+
+ This report represents a security assessment performed by the Security Team team including + confidential information about the state of your network and applications. +
+| Start Date | +End Date | +Status | +Lead | +
|---|---|---|---|
| + April 13, 2026 + | ++ April 13, 2027 + | ++ In Progress + | ++ Admin User + - Admin User (admin) + | +
The engagement included the following tests:
++ A total of 143 findings of varying + severity are represented in this report. +
+| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Critical + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 787 + + | + +41 | +
| Component | + + +Version | + + +
|---|---|
| libssl3 | + + +3.0.17-1~deb12u2 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+ + +openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version: 3.0.18-1~deb12u2Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with
+
+maliciously crafted AEAD parameters can trigger a stack buffer overflow.Impact summary: A stack buffer overflow may lead to a crash, causing Denial
+
+of Service, or potentially remote code execution.When parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as
+
+AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is
+copied into a fixed-size stack buffer without verifying that its length fits
+the destination. An attacker can supply a crafted CMS message with an
+oversized IV, causing a stack-based out-of-bounds write before any
+authentication or tag verification occurs.Applications and services that parse untrusted CMS or PKCS#7 content using
+
+AEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable.
+Because the overflow occurs prior to authentication, no valid key material
+is required to trigger it. While exploitability to remote code execution
+depends on platform and toolchain mitigations, the stack-based write
+primitive represents a severe risk.The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this
+
+issue, as the CMS implementation is outside the OpenSSL FIPS module
+boundary.OpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.
+OpenSSL 1.1.1 and 1.0.2 are not affected by this issue.
+ + + + + +3.0.18-1~deb12u2
+ + + + + + + +fixed
+ + + + + + + +http://www.openwall.com/lists/oss-security/2026/01/27/10
+http://www.openwall.com/lists/oss-security/2026/02/25/6
+https://access.redhat.com/errata/RHSA-2026:1472
+https://access.redhat.com/security/cve/CVE-2025-15467
+https://bugzilla.redhat.com/2430375
+https://bugzilla.redhat.com/2430376
+https://bugzilla.redhat.com/2430377
+https://bugzilla.redhat.com/2430378
+https://bugzilla.redhat.com/2430379
+https://bugzilla.redhat.com/2430380
+https://bugzilla.redhat.com/2430381
+https://bugzilla.redhat.com/2430386
+https://bugzilla.redhat.com/2430387
+https://bugzilla.redhat.com/2430388
+https://bugzilla.redhat.com/2430389
+https://bugzilla.redhat.com/2430390
+https://bugzilla.redhat.com/show_bug.cgi?id=2430375
+https://bugzilla.redhat.com/show_bug.cgi?id=2430376
+https://bugzilla.redhat.com/show_bug.cgi?id=2430377
+https://bugzilla.redhat.com/show_bug.cgi?id=2430378
+https://bugzilla.redhat.com/show_bug.cgi?id=2430379
+https://bugzilla.redhat.com/show_bug.cgi?id=2430380
+https://bugzilla.redhat.com/show_bug.cgi?id=2430381
+https://bugzilla.redhat.com/show_bug.cgi?id=2430386
+https://bugzilla.redhat.com/show_bug.cgi?id=2430387
+https://bugzilla.redhat.com/show_bug.cgi?id=2430388
+https://bugzilla.redhat.com/show_bug.cgi?id=2430389
+https://bugzilla.redhat.com/show_bug.cgi?id=2430390
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796
+https://errata.almalinux.org/10/ALSA-2026-1472.html
+https://errata.rockylinux.org/RLSA-2026:1472
+https://github.com/openssl/openssl/commit/2c8f0e5fa9b6ee5508a0349e4572ddb74db5a703
+https://github.com/openssl/openssl/commit/5f26d4202f5b89664c5c3f3c62086276026ba9a9
+https://github.com/openssl/openssl/commit/6ced0fe6b10faa560e410e3ee8d6c82f06c65ea3
+https://github.com/openssl/openssl/commit/ce39170276daec87f55c39dad1f629b56344429e
+https://github.com/openssl/openssl/commit/d0071a0799f20cc8101730145349ed4487c268dc
+https://linux.oracle.com/cve/CVE-2025-15467.html
+https://linux.oracle.com/errata/ELSA-2026-50081.html
+https://nvd.nist.gov/vuln/detail/CVE-2025-15467
+https://openssl-library.org/news/secadv/20260127.txt
+https://ubuntu.com/security/notices/USN-7980-1
+https://www.cve.org/CVERecord?id=CVE-2025-15467
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Critical + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 328 + + | + +57 | +
| Component | + + +Version | + + +
|---|---|
| crypto-js | + + +3.3.0 | + + +
| File Path | +
|---|
| juice-shop/node_modules/crypto-js/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
+ + +crypto-js: PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 4.2.0crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a cryptographic hash algorithm considered insecure since at least 2005, and defaults to one single iteration, a 'strength' or 'difficulty' value specified at 1,000 when specified in 1993. PBKDF2 relies on iteration count as a countermeasure to preimage and collision attacks. If used to protect passwords, the impact is high. If used to generate signatures, the impact is high. Version 4.2.0 contains a patch for this issue. As a workaround, configure crypto-js to use SHA256 with at least 250,000 iterations.
+ + + + + +4.2.0
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2023-46233
+https://github.com/brix/crypto-js
+https://github.com/brix/crypto-js/commit/421dd538b2d34e7c24a5b72cc64dc2b9167db40a
+https://github.com/brix/crypto-js/security/advisories/GHSA-xwcq-pm8m-c4vf
+https://lists.debian.org/debian-lts-announce/2023/11/msg00025.html
+https://nvd.nist.gov/vuln/detail/CVE-2023-46233
+https://ubuntu.com/security/notices/USN-6753-1
+https://www.cve.org/CVERecord?id=CVE-2023-46233
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Critical + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 20 + + | + +67 | +
| Component | + + +Version | + + +
|---|---|
| jsonwebtoken | + + +0.1.0 | + + +
| File Path | +
|---|
| juice-shop/node_modules/express-jwt/node_modules/jsonwebtoken/package.json | +
+ + +CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+ + +nodejs-jsonwebtoken: verification step bypass with an altered token
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 4.2.2In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).
+ + + + + +4.2.2
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2015-9235
+https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries
+https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/
+https://github.com/advisories/GHSA-c7hr-j4mj-j2w6
+https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687
+https://nodesecurity.io/advisories/17
+https://nvd.nist.gov/vuln/detail/CVE-2015-9235
+https://www.cve.org/CVERecord?id=CVE-2015-9235
+https://www.npmjs.com/advisories/17
+https://www.timmclean.net/2015/02/25/jwt-alg-none.html
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Critical + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 20 + + | + +72 | +
| Component | + + +Version | + + +
|---|---|
| jsonwebtoken | + + +0.4.0 | + + +
| File Path | +
|---|
| juice-shop/node_modules/jsonwebtoken/package.json | +
+ + +CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+ + +nodejs-jsonwebtoken: verification step bypass with an altered token
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 4.2.2In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).
+ + + + + +4.2.2
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2015-9235
+https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries
+https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/
+https://github.com/advisories/GHSA-c7hr-j4mj-j2w6
+https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687
+https://nodesecurity.io/advisories/17
+https://nvd.nist.gov/vuln/detail/CVE-2015-9235
+https://www.cve.org/CVERecord?id=CVE-2015-9235
+https://www.npmjs.com/advisories/17
+https://www.timmclean.net/2015/02/25/jwt-alg-none.html
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Critical + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 1321 + + | + +79 | +
| Component | + + +Version | + + +
|---|---|
| lodash | + + +2.4.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
+ + +nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 4.17.12Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
+ + + + + +4.17.12
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/errata/RHSA-2019:3024
+https://access.redhat.com/security/cve/CVE-2019-10744
+https://github.com/advisories/GHSA-jf85-cpcp-j695
+https://github.com/lodash/lodash/pull/4336
+https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2019-10744.yml
+https://nvd.nist.gov/vuln/detail/CVE-2019-10744
+https://security.netapp.com/advisory/ntap-20191004-0005
+https://security.netapp.com/advisory/ntap-20191004-0005/
+https://snyk.io/vuln/SNYK-JS-LODASH-450202
+https://support.f5.com/csp/article/K47105354
+https://support.f5.com/csp/article/K47105354?utm_source=f5support&%3Butm_medium=RSS
+https://support.f5.com/csp/article/K47105354?utm_source=f5support&utm_medium=RSS
+https://www.cve.org/CVERecord?id=CVE-2019-10744
+https://www.npmjs.com/advisories/1065
+https://www.oracle.com/security-alerts/cpujan2021.html
+https://www.oracle.com/security-alerts/cpuoct2020.html
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +Dojo ID | +
|---|---|---|---|---|---|---|
| + + + Critical + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + +85 | +
| Component | + + +Version | + + +
|---|---|
| marsdb | + + +0.6.11 | + + +
| File Path | +
|---|
| juice-shop/node_modules/marsdb/package.json | +
+ + + + + + +Command Injection in marsdb
+
+Target: Node.js
+Type: node-pkg
+Fixed version:All versions of
+marsdbare vulnerable to Command Injection. In theDocumentMatcherclass, selectors on$whereclauses are passed to a Function constructor unsanitized. This allows attackers to run arbitrary commands in the system when the function is executed.Recommendation
+No fix is currently available. Consider using an alternative package until a fix is made available.
+ + + + + + + +affected
+ + + + + + + +https://github.com/bkimminich/juice-shop/issues/1173
+https://www.npmjs.com/advisories/1122
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Critical + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 74 + + | + +163 | +
| Component | + + +Version | + + +
|---|---|
| vm2 | + + +3.9.17 | + + +
| File Path | +
|---|
| juice-shop/node_modules/vm2/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+ + +vm2: Sandbox Escape
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 3.9.18vm2 is a sandbox that can run untrusted code with Node's built-in modules. A sandbox escape vulnerability exists in vm2 for versions up to and including 3.9.17. It abuses an unexpected creation of a host object based on the specification of
Proxy. As a result a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version3.9.18ofvm2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
+ + + + + +3.9.18
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2023-32314
+https://gist.github.com/arkark/e9f5cf5782dec8321095be3e52acf5ac
+https://github.com/patriksimek/vm2
+https://github.com/patriksimek/vm2/commit/d88105f99752305c5b8a77b63ddee3ec86912daf
+https://github.com/patriksimek/vm2/releases/tag/3.9.18
+https://github.com/patriksimek/vm2/security/advisories/GHSA-whpj-8f3w-67p5
+https://nvd.nist.gov/vuln/detail/CVE-2023-32314
+https://www.cve.org/CVERecord?id=CVE-2023-32314
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Critical + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 94 + + | + +164 | +
| Component | + + +Version | + + +
|---|---|
| vm2 | + + +3.9.17 | + + +
| File Path | +
|---|
| juice-shop/node_modules/vm2/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+ + +vm2: Promise handler sanitization can be bypassed allowing attackers to escape the sandbox and run arbitrary code
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 3.10.0vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19,
Promisehandler sanitization can be bypassed with the@@speciesaccessor property allowing attackers to escape the sandbox and run arbitrary code, potentially allowing remote code execution inside the context of vm2 sandbox. Version 3.10.0 contains a patch for the issue.
+ + + + + +3.10.0
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2023-37466
+https://gist.github.com/leesh3288/f693061e6523c97274ad5298eb2c74e9
+https://github.com/patriksimek/vm2
+https://github.com/patriksimek/vm2/commit/d9a1fde8ec5a5a9c9e5a69bf91d703950859d744
+https://github.com/patriksimek/vm2/releases/tag/v3.10.0
+https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5
+https://nvd.nist.gov/vuln/detail/CVE-2023-37466
+https://security.netapp.com/advisory/ntap-20230831-0007
+https://security.netapp.com/advisory/ntap-20241108-0002
+https://security.netapp.com/advisory/ntap-20241108-0002/
+https://www.cve.org/CVERecord?id=CVE-2023-37466
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Critical + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 78 + + | + +165 | +
| Component | + + +Version | + + +
|---|---|
| vm2 | + + +3.9.17 | + + +
| File Path | +
|---|
| juice-shop/node_modules/vm2/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+ + + + + + +vm2: custom inspect function allows attackers to escape the sandbox and run arbitrary code
+
+Target: Node.js
+Type: node-pkg
+Fixed version:vm2 is an open source vm/sandbox for Node.js. In vm2 for versions up to and including 3.9.19, Node.js custom inspect function allows attackers to escape the sandbox and run arbitrary code. This may result in Remote Code Execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox. There are no patches and no known workarounds. Users are advised to find an alternative software.
+ + + + + + + +affected
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2023-37903
+https://github.com/patriksimek/vm2
+https://github.com/patriksimek/vm2/security/advisories/GHSA-g644-9gfx-q4q4
+https://nvd.nist.gov/vuln/detail/CVE-2023-37903
+https://security.netapp.com/advisory/ntap-20230831-0007
+https://security.netapp.com/advisory/ntap-20230831-0007/
+https://security.netapp.com/advisory/ntap-20241108-0002
+https://security.netapp.com/advisory/ntap-20241108-0002/
+https://www.cve.org/CVERecord?id=CVE-2023-37903
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Critical + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 94 + + | + +166 | +
| Component | + + +Version | + + +
|---|---|
| vm2 | + + +3.9.17 | + + +
| File Path | +
|---|
| juice-shop/node_modules/vm2/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+ + +vm2 has a Sandbox Escape
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 3.10.2vm2 is an open source vm/sandbox for Node.js. In vm2 prior to version 3.10.2,
Promise.prototype.thenPromise.prototype.catchcallback sanitization can be bypassed. This allows attackers to escape the sandbox and run arbitrary code. In lib/setup-sandbox.js, the callback function oflocalPromise.prototype.thenis sanitized, butglobalPromise.prototype.thenis not sanitized. The return value of async functions isglobalPromiseobject. Version 3.10.2 fixes the issue.
+ + + + + +3.10.2
+ + + + + + + +fixed
+ + + + + + + +https://github.com/patriksimek/vm2
+https://github.com/patriksimek/vm2/commit/4b009c2d4b1131c01810c1205e641d614c322a29
+https://github.com/patriksimek/vm2/releases/tag/v3.10.2
+https://github.com/patriksimek/vm2/security/advisories/GHSA-99p7-6v5w-7xg8
+https://nvd.nist.gov/vuln/detail/CVE-2026-22709
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 426 + + | + +27 | +
| Component | + + +Version | + + +
|---|---|
| libc6 | + + +2.36-9+deb12u10 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + +CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
+ + +glibc: static setuid binary dlopen may incorrectly search LD_LIBRARY_PATH
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version: 2.36-9+deb12u11Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo).
+ + + + + +2.36-9+deb12u11
+ + + + + + + +fixed
+ + + + + + + +http://www.openwall.com/lists/oss-security/2025/05/16/7
+http://www.openwall.com/lists/oss-security/2025/05/17/2
+https://access.redhat.com/errata/RHSA-2025:8686
+https://access.redhat.com/security/cve/CVE-2025-4802
+https://bugzilla.redhat.com/2367468
+https://bugzilla.redhat.com/show_bug.cgi?id=2367468
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4802
+https://errata.almalinux.org/8/ALSA-2025-8686.html
+https://errata.rockylinux.org/RLSA-2025:8655
+https://linux.oracle.com/cve/CVE-2025-4802.html
+https://linux.oracle.com/errata/ELSA-2025-8686.html
+https://lists.debian.org/debian-lts-announce/2025/05/msg00033.html
+https://nvd.nist.gov/vuln/detail/CVE-2025-4802
+https://sourceware.org/bugzilla/show_bug.cgi?id=32976
+https://sourceware.org/cgit/glibc/commit/?id=1e18586c5820e329f741d5c710275e165581380e
+https://sourceware.org/cgit/glibc/commit/?id=5451fa962cd0a90a0e2ec1d8910a559ace02bba0
+https://ubuntu.com/security/notices/USN-7541-1
+https://www.cve.org/CVERecord?id=CVE-2025-4802
+https://www.openwall.com/lists/oss-security/2025/05/16/7
+https://www.openwall.com/lists/oss-security/2025/05/17/2
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 190 + + | + +28 | +
| Component | + + +Version | + + +
|---|---|
| libc6 | + + +2.36-9+deb12u10 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + +CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
+ + + + + + +glibc: Integer overflow in memalign leads to heap corruption
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version:Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption.
+Note that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this. The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument. This limits the malicious inputs for the alignment for memalign to the range [1<<62+ 1, 1<<63] and exactly 1<<63 for posix_memalign and aligned_alloc.
+Typically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice. An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments.
+ + + + + + + +affected
+ + + + + + + +http://www.openwall.com/lists/oss-security/2026/01/16/5
+https://access.redhat.com/errata/RHSA-2026:1334
+https://access.redhat.com/security/cve/CVE-2026-0861
+https://bugzilla.redhat.com/2429771
+https://bugzilla.redhat.com/2430201
+https://bugzilla.redhat.com/show_bug.cgi?id=2429771
+https://bugzilla.redhat.com/show_bug.cgi?id=2430201
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0861
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0915
+https://errata.almalinux.org/10/ALSA-2026-1334.html
+https://errata.rockylinux.org/RLSA-2026:1334
+https://linux.oracle.com/cve/CVE-2026-0861.html
+https://linux.oracle.com/errata/ELSA-2026-50120.html
+https://nvd.nist.gov/vuln/detail/CVE-2026-0861
+https://sourceware.org/bugzilla/show_bug.cgi?id=33796
+https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0001
+https://ubuntu.com/security/notices/USN-8005-1
+https://www.cve.org/CVERecord?id=CVE-2026-0861
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 787 + + | + +42 | +
| Component | + + +Version | + + +
|---|---|
| libssl3 | + + +3.0.17-1~deb12u2 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + +CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
+ + +openssl: OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version: 3.0.18-1~deb12u2Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously
+
+crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing
+non-ASCII BMP code point can trigger a one byte write before the allocated
+buffer.Impact summary: The out-of-bounds write can cause a memory corruption
+
+which can have various consequences including a Denial of Service.The OPENSSL_uni2utf8() function performs a two-pass conversion of a PKCS#12
+
+BMPString (UTF-16BE) to UTF-8. In the second pass, when emitting UTF-8 bytes,
+the helper function bmp_to_utf8() incorrectly forwards the remaining UTF-16
+source byte count as the destination buffer capacity to UTF8_putc(). For BMP
+code points above U+07FF, UTF-8 requires three bytes, but the forwarded
+capacity can be just two bytes. UTF8_putc() then returns -1, and this negative
+value is added to the output length without validation, causing the
+length to become negative. The subsequent trailing NUL byte is then written
+at a negative offset, causing write outside of heap allocated buffer.The vulnerability is reachable via the public PKCS12_get_friendlyname() API
+
+when parsing attacker-controlled PKCS#12 files. While PKCS12_parse() uses a
+different code path that avoids this issue, PKCS12_get_friendlyname() directly
+invokes the vulnerable function. Exploitation requires an attacker to provide
+a malicious PKCS#12 file to be parsed by the application and the attacker
+can just trigger a one zero byte write before the allocated buffer.
+For that reason the issue was assessed as Low severity according to our
+Security Policy.The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,
+
+as the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.
+OpenSSL 1.0.2 is not affected by this issue.
+ + + + + +3.0.18-1~deb12u2
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/errata/RHSA-2026:3042
+https://access.redhat.com/security/cve/CVE-2025-69419
+https://bugzilla.redhat.com/2430386
+https://bugzilla.redhat.com/show_bug.cgi?id=2430375
+https://bugzilla.redhat.com/show_bug.cgi?id=2430376
+https://bugzilla.redhat.com/show_bug.cgi?id=2430377
+https://bugzilla.redhat.com/show_bug.cgi?id=2430378
+https://bugzilla.redhat.com/show_bug.cgi?id=2430379
+https://bugzilla.redhat.com/show_bug.cgi?id=2430380
+https://bugzilla.redhat.com/show_bug.cgi?id=2430381
+https://bugzilla.redhat.com/show_bug.cgi?id=2430386
+https://bugzilla.redhat.com/show_bug.cgi?id=2430387
+https://bugzilla.redhat.com/show_bug.cgi?id=2430388
+https://bugzilla.redhat.com/show_bug.cgi?id=2430389
+https://bugzilla.redhat.com/show_bug.cgi?id=2430390
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796
+https://errata.almalinux.org/8/ALSA-2026-3042.html
+https://errata.rockylinux.org/RLSA-2026:1472
+https://github.com/openssl/openssl/commit/41be0f216404f14457bbf3b9cc488dba60b49296
+https://github.com/openssl/openssl/commit/7e9cac9832e4705b91987c2474ed06a37a93cecb
+https://github.com/openssl/openssl/commit/a26a90d38edec3748566129d824e664b54bee2e2
+https://github.com/openssl/openssl/commit/cda12de3bc0e333ea8d2c6fd15001dbdaf280015
+https://github.com/openssl/openssl/commit/ff628933755075446bca8307e8417c14d164b535
+https://linux.oracle.com/cve/CVE-2025-69419.html
+https://linux.oracle.com/errata/ELSA-2026-50131.html
+https://nvd.nist.gov/vuln/detail/CVE-2025-69419
+https://openssl-library.org/news/secadv/20260127.txt
+https://ubuntu.com/security/notices/USN-7980-1
+https://ubuntu.com/security/notices/USN-7980-2
+https://www.cve.org/CVERecord?id=CVE-2025-69419
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 476 + + | + +43 | +
| Component | + + +Version | + + +
|---|---|
| libssl3 | + + +3.0.17-1~deb12u2 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +openssl: OpenSSL: Denial of Service via malformed PKCS#12 file processing
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version: 3.0.18-1~deb12u2Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer
+
+dereference in the PKCS12_item_decrypt_d2i_ex() function.Impact summary: A NULL pointer dereference can trigger a crash which leads to
+
+Denial of Service for an application processing PKCS#12 files.The PKCS12_item_decrypt_d2i_ex() function does not check whether the oct
+
+parameter is NULL before dereferencing it. When called from
+PKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can
+be NULL, causing a crash. The vulnerability is limited to Denial of Service
+and cannot be escalated to achieve code execution or memory disclosure.Exploiting this issue requires an attacker to provide a malformed PKCS#12 file
+
+to an application that processes it. For that reason the issue was assessed as
+Low severity according to our Security Policy.The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,
+
+as the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.
+ + + + + +3.0.18-1~deb12u2
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/errata/RHSA-2026:1472
+https://access.redhat.com/security/cve/CVE-2025-69421
+https://bugzilla.redhat.com/2430375
+https://bugzilla.redhat.com/2430376
+https://bugzilla.redhat.com/2430377
+https://bugzilla.redhat.com/2430378
+https://bugzilla.redhat.com/2430379
+https://bugzilla.redhat.com/2430380
+https://bugzilla.redhat.com/2430381
+https://bugzilla.redhat.com/2430386
+https://bugzilla.redhat.com/2430387
+https://bugzilla.redhat.com/2430388
+https://bugzilla.redhat.com/2430389
+https://bugzilla.redhat.com/2430390
+https://bugzilla.redhat.com/show_bug.cgi?id=2430375
+https://bugzilla.redhat.com/show_bug.cgi?id=2430376
+https://bugzilla.redhat.com/show_bug.cgi?id=2430377
+https://bugzilla.redhat.com/show_bug.cgi?id=2430378
+https://bugzilla.redhat.com/show_bug.cgi?id=2430379
+https://bugzilla.redhat.com/show_bug.cgi?id=2430380
+https://bugzilla.redhat.com/show_bug.cgi?id=2430381
+https://bugzilla.redhat.com/show_bug.cgi?id=2430386
+https://bugzilla.redhat.com/show_bug.cgi?id=2430387
+https://bugzilla.redhat.com/show_bug.cgi?id=2430388
+https://bugzilla.redhat.com/show_bug.cgi?id=2430389
+https://bugzilla.redhat.com/show_bug.cgi?id=2430390
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796
+https://errata.almalinux.org/10/ALSA-2026-1472.html
+https://errata.rockylinux.org/RLSA-2026:1472
+https://github.com/openssl/openssl/commit/3524a29271f8191b8fd8a5257eb05173982a097b
+https://github.com/openssl/openssl/commit/36ecb4960872a4ce04bf6f1e1f4e78d75ec0c0c7
+https://github.com/openssl/openssl/commit/4bbc8d41a72c842ce4077a8a3eccd1109aaf74bd
+https://github.com/openssl/openssl/commit/643986985cd1c21221f941129d76fe0c2785aeb3
+https://github.com/openssl/openssl/commit/a2dbc539f0f9cc63832709fa5aa33ad9495eb19c
+https://linux.oracle.com/cve/CVE-2025-69421.html
+https://linux.oracle.com/errata/ELSA-2026-50081.html
+https://nvd.nist.gov/vuln/detail/CVE-2025-69421
+https://openssl-library.org/news/secadv/20260127.txt
+https://ubuntu.com/security/notices/USN-7980-1
+https://ubuntu.com/security/notices/USN-7980-2
+https://www.cve.org/CVERecord?id=CVE-2025-69421
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +Dojo ID | +
|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + +53 | +
| Component | + + +Version | + + +
|---|---|
| base64url | + + +0.0.6 | + + +
| File Path | +
|---|
| juice-shop/node_modules/base64url/package.json | +
+ + +Out-of-bounds Read
+
+Target: Node.js
+Type: node-pkg
+Fixed version: >=3.0.0
base64urlallocates uninitialized Buffers when number is passed in input on Node.js 4.x and below
+ + + + + ++=3.0.0
+
+ + + + + + + +fixed
+ + + + + + + +https://github.com/brianloveswords/base64url/pull/25
+https://hackerone.com/reports/321687
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 1050 + + | + +55 | +
| Component | + + +Version | + + +
|---|---|
| braces | + + +2.3.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/braces/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +braces: fails to limit the number of characters it can handle
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 3.0.3The NPM package
braces, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. Inlib/parse.js,if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.
+ + + + + +3.0.3
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2024-4068
+https://devhub.checkmarx.com/cve-details/CVE-2024-4068
+https://devhub.checkmarx.com/cve-details/CVE-2024-4068/
+https://github.com/micromatch/braces
+https://github.com/micromatch/braces/blob/98414f9f1fabe021736e26836d8306d5de747e0d/lib/parse.js#L308
+https://github.com/micromatch/braces/commit/415d660c3002d1ab7e63dbf490c9851da80596ff
+https://github.com/micromatch/braces/issues/35
+https://github.com/micromatch/braces/pull/37
+https://github.com/micromatch/braces/pull/40
+https://nvd.nist.gov/vuln/detail/CVE-2024-4068
+https://www.cve.org/CVERecord?id=CVE-2024-4068
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 285 + + | + +61 | +
| Component | + + +Version | + + +
|---|---|
| express-jwt | + + +0.1.3 | + + +
| File Path | +
|---|
| juice-shop/node_modules/express-jwt/package.json | +
+ + +CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
+ + +Authorization bypass in express-jwt
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 6.0.0In express-jwt (NPM package) up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforced. When algorithms is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. You are affected by this vulnerability if all of the following conditions apply: - You are using express-jwt - You do not have algorithms configured in your express-jwt configuration. - You are using libraries such as jwks-rsa as the secret. You can fix this by specifying algorithms in the express-jwt configuration. See linked GHSA for example. This is also fixed in version 6.0.0.
+ + + + + +6.0.0
+ + + + + + + +fixed
+ + + + + + + +https://github.com/auth0/express-jwt/commit/7ecab5f8f0cab5297c2b863596566eb0c019cdef
+https://github.com/auth0/express-jwt/security/advisories/GHSA-6g6m-m6h5-w9gf
+https://nvd.nist.gov/vuln/detail/CVE-2020-15084
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 78 + + | + +62 | +
| Component | + + +Version | + + +
|---|---|
| glob | + + +10.4.5 | + + +
| File Path | +
|---|
| juice-shop/node_modules/glob/package.json | +
+ + +CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
+ + +glob: glob: Command Injection Vulnerability via Malicious Filenames
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 11.1.0, 10.5.0Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files with malicious names. When glob -c <command> <patterns> are used, matched filenames are passed to a shell with shell: true, enabling shell metacharacters in filenames to trigger command injection and achieve arbitrary code execution under the user or CI account privileges. This issue has been patched in versions 10.5.0 and 11.1.0.
+ + + + + +11.1.0, 10.5.0
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2025-64756
+https://github.com/isaacs/node-glob
+https://github.com/isaacs/node-glob/commit/1e4e297342a09f2aa0ced87fcd4a70ddc325d75f
+https://github.com/isaacs/node-glob/commit/47473c046b91c67269df7a66eab782a6c2716146
+https://github.com/isaacs/node-glob/security/advisories/GHSA-5j98-mcp5-4vw2
+https://nvd.nist.gov/vuln/detail/CVE-2025-64756
+https://www.cve.org/CVERecord?id=CVE-2025-64756
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 1333 + + | + +64 | +
| Component | + + +Version | + + +
|---|---|
| http-cache-semantics | + + +3.8.1 | + + +
| File Path | +
|---|
| juice-shop/node_modules/http-cache-semantics/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 4.1.1This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.
+ + + + + +4.1.1
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/errata/RHSA-2023:1743
+https://access.redhat.com/security/cve/CVE-2022-25881
+https://bugzilla.redhat.com/2134609
+https://bugzilla.redhat.com/2156324
+https://bugzilla.redhat.com/2165824
+https://bugzilla.redhat.com/2168631
+https://bugzilla.redhat.com/2170644
+https://bugzilla.redhat.com/2171935
+https://bugzilla.redhat.com/2172217
+https://bugzilla.redhat.com/show_bug.cgi?id=2165824
+https://bugzilla.redhat.com/show_bug.cgi?id=2168631
+https://bugzilla.redhat.com/show_bug.cgi?id=2171935
+https://bugzilla.redhat.com/show_bug.cgi?id=2172190
+https://bugzilla.redhat.com/show_bug.cgi?id=2172204
+https://bugzilla.redhat.com/show_bug.cgi?id=2172217
+https://bugzilla.redhat.com/show_bug.cgi?id=2178076
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25881
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4904
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23918
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23920
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23936
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24807
+https://errata.almalinux.org/8/ALSA-2023-1743.html
+https://errata.rockylinux.org/RLSA-2023:2655
+https://github.com/kornelski/http-cache-semantics
+https://github.com/kornelski/http-cache-semantics/blob/master/index.js%23L83
+https://github.com/kornelski/http-cache-semantics/commit/560b2d8ef452bbba20ffed69dc155d63ac757b74
+https://linux.oracle.com/cve/CVE-2022-25881.html
+https://linux.oracle.com/errata/ELSA-2023-2655.html
+https://nvd.nist.gov/vuln/detail/CVE-2022-25881
+https://security.netapp.com/advisory/ntap-20230622-0008
+https://security.netapp.com/advisory/ntap-20230622-0008/
+https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3253332
+https://security.snyk.io/vuln/SNYK-JS-HTTPCACHESEMANTICS-3248783
+https://www.cve.org/CVERecord?id=CVE-2022-25881
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 918 + + | + +65 | +
| Component | + + +Version | + + +
|---|---|
| ip | + + +2.0.1 | + + +
| File Path | +
|---|
| juice-shop/node_modules/ip/package.json | +
+ + +CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
+ + + + + + +node-ip: Incomplete fix for CVE-2023-42282
+
+Target: Node.js
+Type: node-pkg
+Fixed version:The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.
+ + + + + + + +affected
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2024-29415
+https://cosmosofcyberspace.github.io/npm_ip_cve/npm_ip_cve.html
+https://github.com/indutny/node-ip
+https://github.com/indutny/node-ip/issues/150
+https://github.com/indutny/node-ip/pull/143
+https://github.com/indutny/node-ip/pull/144
+https://nvd.nist.gov/vuln/detail/CVE-2024-29415
+https://security.netapp.com/advisory/ntap-20250117-0010
+https://security.netapp.com/advisory/ntap-20250117-0010/
+https://www.cve.org/CVERecord?id=CVE-2024-29415
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 327 + + | + +68 | +
| Component | + + +Version | + + +
|---|---|
| jsonwebtoken | + + +0.1.0 | + + +
| File Path | +
|---|
| juice-shop/node_modules/express-jwt/node_modules/jsonwebtoken/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
+ + +jsonwebtoken: Unrestricted key type could lead to legacy keys usagen
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 9.0.0Versions
<=8.5.1ofjsonwebtokenlibrary could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set theallowInvalidAsymmetricKeyTypesoption totruein thesign()and/orverify()functions.
+ + + + + +9.0.0
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2022-23539
+https://github.com/auth0/node-jsonwebtoken
+https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3
+https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-8cf7-32gw-wr33
+https://nvd.nist.gov/vuln/detail/CVE-2022-23539
+https://security.netapp.com/advisory/ntap-20240621-0007
+https://security.netapp.com/advisory/ntap-20240621-0007/
+https://www.cve.org/CVERecord?id=CVE-2022-23539
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +Dojo ID | +
|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + +69 | +
| Component | + + +Version | + + +
|---|---|
| jsonwebtoken | + + +0.1.0 | + + +
| File Path | +
|---|
| juice-shop/node_modules/express-jwt/node_modules/jsonwebtoken/package.json | +
+ + +Verification Bypass
+
+Target: Node.js
+Type: node-pkg
+Fixed version: >=4.2.2It is possible for an attacker to bypass verification when "a token digitally signed with an asymetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family)" [1]
+ + + + + ++=4.2.2
+
+ + + + + + + +fixed
+ + + + + + + +https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/
+https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687
+https://www.timmclean.net/2015/02/25/jwt-alg-none.html
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 327 + + | + +73 | +
| Component | + + +Version | + + +
|---|---|
| jsonwebtoken | + + +0.4.0 | + + +
| File Path | +
|---|
| juice-shop/node_modules/jsonwebtoken/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
+ + +jsonwebtoken: Unrestricted key type could lead to legacy keys usagen
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 9.0.0Versions
<=8.5.1ofjsonwebtokenlibrary could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set theallowInvalidAsymmetricKeyTypesoption totruein thesign()and/orverify()functions.
+ + + + + +9.0.0
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2022-23539
+https://github.com/auth0/node-jsonwebtoken
+https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3
+https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-8cf7-32gw-wr33
+https://nvd.nist.gov/vuln/detail/CVE-2022-23539
+https://security.netapp.com/advisory/ntap-20240621-0007
+https://security.netapp.com/advisory/ntap-20240621-0007/
+https://www.cve.org/CVERecord?id=CVE-2022-23539
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +Dojo ID | +
|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + +74 | +
| Component | + + +Version | + + +
|---|---|
| jsonwebtoken | + + +0.4.0 | + + +
| File Path | +
|---|
| juice-shop/node_modules/jsonwebtoken/package.json | +
+ + +Verification Bypass
+
+Target: Node.js
+Type: node-pkg
+Fixed version: >=4.2.2It is possible for an attacker to bypass verification when "a token digitally signed with an asymetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family)" [1]
+ + + + + ++=4.2.2
+
+ + + + + + + +fixed
+ + + + + + + +https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/
+https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687
+https://www.timmclean.net/2015/02/25/jwt-alg-none.html
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +Dojo ID | +
|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + +77 | +
| Component | + + +Version | + + +
|---|---|
| jws | + + +0.2.6 | + + +
| File Path | +
|---|
| juice-shop/node_modules/jws/package.json | +
+ + +CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
+ + +Forgeable Public/Private Tokens
+
+Target: Node.js
+Type: node-pkg
+Fixed version: >=3.0.0Since "algorithm" isn't enforced in
+jws.verify(), a malicious user could choose what algorithm is sent to the server. If the server is expecting RSA but is sent HMAC-SHA with RSA's public key, the server will think the public key is actually an HMAC private key. This could be used to forge any data an attacker wants.In addition, there is the
+nonealgorithm to be concerned about. In versions prior to 3.0.0, verification of the token could be bypassed when thealgfield is set tonone.Edit ( 7/29/16 ): A previous version of this advisory incorrectly stated that the vulnerability was patched in version 2.0.0 instead of 3.0.0. The advisory has been updated to reflect this new information. Thanks to Fabien Catteau for reporting the error.
+ + + + + ++=3.0.0
+
+ + + + + + + +fixed
+ + + + + + + +https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries
+https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/
+https://github.com/brianloveswords/node-jws
+https://github.com/brianloveswords/node-jws/commit/585d0e1e97b6747c10cf5b7689ccc5618a89b299#diff-4ac32a78649ca5bdd8e0ba38b7006a1e
+https://nvd.nist.gov/vuln/detail/CVE-2016-1000223
+https://snyk.io/vuln/npm:jws:20160726
+https://www.npmjs.com/advisories/88
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 347 + + | + +78 | +
| Component | + + +Version | + + +
|---|---|
| jws | + + +0.2.6 | + + +
| File Path | +
|---|
| juice-shop/node_modules/jws/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
+ + +node-jws: auth0/node-jws: Improper signature verification in HS256 algorithm
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 3.2.3, 4.0.1auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are affected when they use the jws.createVerify() function for HMAC algorithms and use user-provided data from the JSON Web Signature protected header or payload in HMAC secret lookup routines, which can allow attackers to bypass signature verification. This issue has been patched in versions 3.2.3 and 4.0.1.
+ + + + + +3.2.3, 4.0.1
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2025-65945
+https://github.com/auth0/node-jws
+https://github.com/auth0/node-jws/commit/34c45b2c04434f925b638de6a061de9339c0ea2e
+https://github.com/auth0/node-jws/commit/4f6e73f24df42f07d632dec6431ade8eda8d11a6
+https://github.com/auth0/node-jws/releases/tag/v3.2.3
+https://github.com/auth0/node-jws/releases/tag/v4.0.1
+https://github.com/auth0/node-jws/security/advisories/GHSA-869p-cjfg-cm3x
+https://nvd.nist.gov/vuln/detail/CVE-2025-65945
+https://www.cve.org/CVERecord?id=CVE-2025-65945
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 400 + + | + +80 | +
| Component | + + +Version | + + +
|---|---|
| lodash | + + +2.4.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json | +
+ + +CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
+ + +lodash: Prototype pollution in utilities function
+
+Target: Node.js
+Type: node-pkg
+Fixed version: >=4.17.11A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.
+ + + + + ++=4.17.11
+
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2018-16487
+https://github.com/advisories/GHSA-4xc9-xhrj-v574
+https://github.com/lodash/lodash/commit/90e6199a161b6445b01454517b40ef65ebecd2ad
+https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2018-16487.yml
+https://hackerone.com/reports/380873
+https://nvd.nist.gov/vuln/detail/CVE-2018-16487
+https://security.netapp.com/advisory/ntap-20190919-0004
+https://security.netapp.com/advisory/ntap-20190919-0004/
+https://www.cve.org/CVERecord?id=CVE-2018-16487
+https://www.npmjs.com/advisories/782
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 94 + + | + +81 | +
| Component | + + +Version | + + +
|---|---|
| lodash | + + +2.4.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
+ + +nodejs-lodash: command injection via template
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 4.17.21Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
+ + + + + +4.17.21
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2021-23337
+https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
+https://github.com/advisories/GHSA-35jh-r3h4-6jhm
+https://github.com/lodash/lodash
+https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js
+https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js#L14851
+https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851
+https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c
+https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2021-23337.yml
+https://nvd.nist.gov/vuln/detail/CVE-2021-23337
+https://security.netapp.com/advisory/ntap-20210312-0006
+https://security.netapp.com/advisory/ntap-20210312-0006/
+https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932
+https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930
+https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928
+https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931
+https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929
+https://snyk.io/vuln/SNYK-JS-LODASH-1040724
+https://www.cve.org/CVERecord?id=CVE-2021-23337
+https://www.oracle.com//security-alerts/cpujul2021.html
+https://www.oracle.com/security-alerts/cpujan2022.html
+https://www.oracle.com/security-alerts/cpujul2022.html
+https://www.oracle.com/security-alerts/cpuoct2021.html
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 770 + + | + +84 | +
| Component | + + +Version | + + +
|---|---|
| lodash.set | + + +4.3.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/lodash.set/package.json | +
+ + +CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
+ + + + + + +nodejs-lodash: prototype pollution in zipObjectDeep function
+
+Target: Node.js
+Type: node-pkg
+Fixed version:Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
+ + + + + + + +affected
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2020-8203
+https://github.com/advisories/GHSA-p6mc-m468-83gw
+https://github.com/github/advisory-database/pull/2884
+https://github.com/lodash/lodash
+https://github.com/lodash/lodash/commit/c84fe82760fb2d3e03a63379b297a1cc1a2fce12
+https://github.com/lodash/lodash/issues/4744
+https://github.com/lodash/lodash/issues/4874
+https://github.com/lodash/lodash/wiki/Changelog#v41719
+https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2020-8203.yml
+https://hackerone.com/reports/712065
+https://hackerone.com/reports/864701
+https://nvd.nist.gov/vuln/detail/CVE-2020-8203
+https://security.netapp.com/advisory/ntap-20200724-0006
+https://security.netapp.com/advisory/ntap-20200724-0006/
+https://web.archive.org/web/20210914001339/https://github.com/lodash/lodash/issues/4744
+https://www.cve.org/CVERecord?id=CVE-2020-8203
+https://www.npmjs.com/advisories/1523
+https://www.oracle.com//security-alerts/cpujul2021.html
+https://www.oracle.com/security-alerts/cpuApr2021.html
+https://www.oracle.com/security-alerts/cpuapr2022.html
+https://www.oracle.com/security-alerts/cpujan2022.html
+https://www.oracle.com/security-alerts/cpuoct2021.html
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 1333 + + | + +88 | +
| Component | + + +Version | + + +
|---|---|
| minimatch | + + +3.0.5 | + + +
| File Path | +
|---|
| juice-shop/node_modules/replace/node_modules/minimatch/package.json | +
+ + +minimatch: minimatch: Denial of Service via specially crafted glob patterns
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.
+ + + + + +10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-26996
+https://github.com/isaacs/minimatch
+https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5
+https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26
+https://nvd.nist.gov/vuln/detail/CVE-2026-26996
+https://www.cve.org/CVERecord?id=CVE-2026-26996
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 407 + + | + +89 | +
| Component | + + +Version | + + +
|---|---|
| minimatch | + + +3.0.5 | + + +
| File Path | +
|---|
| juice-shop/node_modules/replace/node_modules/minimatch/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3,
matchOne()performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent**(GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- wherenis the number of path segments andkis the number of globstars. With k=11 and n=30, a call to the defaultminimatch()API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed tominimatch()is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.
+ + + + + +10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-27903
+https://github.com/isaacs/minimatch
+https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748
+https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj
+https://nvd.nist.gov/vuln/detail/CVE-2026-27903
+https://www.cve.org/CVERecord?id=CVE-2026-27903
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 1333 + + | + +90 | +
| Component | + + +Version | + + +
|---|---|
| minimatch | + + +3.0.5 | + + +
| File Path | +
|---|
| juice-shop/node_modules/replace/node_modules/minimatch/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested
*()extglobs produce regexps with nested unbounded quantifiers (e.g.(?:(?:a|b)*)*), which exhibit catastrophic backtracking in V8. With a 12-byte pattern*(*(*(a|b)))and an 18-byte non-matching input,minimatch()stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the defaultminimatch()API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects+()extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.
+ + + + + +10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-27904
+https://github.com/isaacs/minimatch
+https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce
+https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74
+https://nvd.nist.gov/vuln/detail/CVE-2026-27904
+https://www.cve.org/CVERecord?id=CVE-2026-27904
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 1333 + + | + +91 | +
| Component | + + +Version | + + +
|---|---|
| minimatch | + + +3.0.8 | + + +
| File Path | +
|---|
| juice-shop/node_modules/grunt/node_modules/minimatch/package.json | +
+ + +minimatch: minimatch: Denial of Service via specially crafted glob patterns
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.
+ + + + + +10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-26996
+https://github.com/isaacs/minimatch
+https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5
+https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26
+https://nvd.nist.gov/vuln/detail/CVE-2026-26996
+https://www.cve.org/CVERecord?id=CVE-2026-26996
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 407 + + | + +92 | +
| Component | + + +Version | + + +
|---|---|
| minimatch | + + +3.0.8 | + + +
| File Path | +
|---|
| juice-shop/node_modules/grunt/node_modules/minimatch/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3,
matchOne()performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent**(GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- wherenis the number of path segments andkis the number of globstars. With k=11 and n=30, a call to the defaultminimatch()API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed tominimatch()is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.
+ + + + + +10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-27903
+https://github.com/isaacs/minimatch
+https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748
+https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj
+https://nvd.nist.gov/vuln/detail/CVE-2026-27903
+https://www.cve.org/CVERecord?id=CVE-2026-27903
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 1333 + + | + +93 | +
| Component | + + +Version | + + +
|---|---|
| minimatch | + + +3.0.8 | + + +
| File Path | +
|---|
| juice-shop/node_modules/grunt/node_modules/minimatch/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested
*()extglobs produce regexps with nested unbounded quantifiers (e.g.(?:(?:a|b)*)*), which exhibit catastrophic backtracking in V8. With a 12-byte pattern*(*(*(a|b)))and an 18-byte non-matching input,minimatch()stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the defaultminimatch()API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects+()extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.
+ + + + + +10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-27904
+https://github.com/isaacs/minimatch
+https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce
+https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74
+https://nvd.nist.gov/vuln/detail/CVE-2026-27904
+https://www.cve.org/CVERecord?id=CVE-2026-27904
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 1333 + + | + +94 | +
| Component | + + +Version | + + +
|---|---|
| minimatch | + + +3.1.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/archiver-utils/node_modules/minimatch/package.json | +
+ + +minimatch: minimatch: Denial of Service via specially crafted glob patterns
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.
+ + + + + +10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-26996
+https://github.com/isaacs/minimatch
+https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5
+https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26
+https://nvd.nist.gov/vuln/detail/CVE-2026-26996
+https://www.cve.org/CVERecord?id=CVE-2026-26996
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 1333 + + | + +95 | +
| Component | + + +Version | + + +
|---|---|
| minimatch | + + +3.1.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/archiver/node_modules/minimatch/package.json | +
+ + +minimatch: minimatch: Denial of Service via specially crafted glob patterns
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.
+ + + + + +10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-26996
+https://github.com/isaacs/minimatch
+https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5
+https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26
+https://nvd.nist.gov/vuln/detail/CVE-2026-26996
+https://www.cve.org/CVERecord?id=CVE-2026-26996
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 1333 + + | + +96 | +
| Component | + + +Version | + + +
|---|---|
| minimatch | + + +3.1.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/file-js/node_modules/minimatch/package.json | +
+ + +minimatch: minimatch: Denial of Service via specially crafted glob patterns
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.
+ + + + + +10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-26996
+https://github.com/isaacs/minimatch
+https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5
+https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26
+https://nvd.nist.gov/vuln/detail/CVE-2026-26996
+https://www.cve.org/CVERecord?id=CVE-2026-26996
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 1333 + + | + +97 | +
| Component | + + +Version | + + +
|---|---|
| minimatch | + + +3.1.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/fstream/node_modules/minimatch/package.json | +
+ + +minimatch: minimatch: Denial of Service via specially crafted glob patterns
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.
+ + + + + +10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-26996
+https://github.com/isaacs/minimatch
+https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5
+https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26
+https://nvd.nist.gov/vuln/detail/CVE-2026-26996
+https://www.cve.org/CVERecord?id=CVE-2026-26996
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 1333 + + | + +98 | +
| Component | + + +Version | + + +
|---|---|
| minimatch | + + +3.1.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/ignore-walk/node_modules/minimatch/package.json | +
+ + +minimatch: minimatch: Denial of Service via specially crafted glob patterns
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.
+ + + + + +10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-26996
+https://github.com/isaacs/minimatch
+https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5
+https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26
+https://nvd.nist.gov/vuln/detail/CVE-2026-26996
+https://www.cve.org/CVERecord?id=CVE-2026-26996
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 1333 + + | + +99 | +
| Component | + + +Version | + + +
|---|---|
| minimatch | + + +3.1.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/node-pre-gyp/node_modules/minimatch/package.json | +
+ + +minimatch: minimatch: Denial of Service via specially crafted glob patterns
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.
+ + + + + +10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-26996
+https://github.com/isaacs/minimatch
+https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5
+https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26
+https://nvd.nist.gov/vuln/detail/CVE-2026-26996
+https://www.cve.org/CVERecord?id=CVE-2026-26996
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 1333 + + | + +100 | +
| Component | + + +Version | + + +
|---|---|
| minimatch | + + +3.1.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/rimraf/node_modules/minimatch/package.json | +
+ + +minimatch: minimatch: Denial of Service via specially crafted glob patterns
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.
+ + + + + +10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-26996
+https://github.com/isaacs/minimatch
+https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5
+https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26
+https://nvd.nist.gov/vuln/detail/CVE-2026-26996
+https://www.cve.org/CVERecord?id=CVE-2026-26996
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 1333 + + | + +101 | +
| Component | + + +Version | + + +
|---|---|
| minimatch | + + +3.1.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/sqlite3/node_modules/minimatch/package.json | +
+ + +minimatch: minimatch: Denial of Service via specially crafted glob patterns
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.
+ + + + + +10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-26996
+https://github.com/isaacs/minimatch
+https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5
+https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26
+https://nvd.nist.gov/vuln/detail/CVE-2026-26996
+https://www.cve.org/CVERecord?id=CVE-2026-26996
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 1333 + + | + +102 | +
| Component | + + +Version | + + +
|---|---|
| minimatch | + + +3.1.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/ts-node-dev/node_modules/minimatch/package.json | +
+ + +minimatch: minimatch: Denial of Service via specially crafted glob patterns
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.
+ + + + + +10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-26996
+https://github.com/isaacs/minimatch
+https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5
+https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26
+https://nvd.nist.gov/vuln/detail/CVE-2026-26996
+https://www.cve.org/CVERecord?id=CVE-2026-26996
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 407 + + | + +103 | +
| Component | + + +Version | + + +
|---|---|
| minimatch | + + +3.1.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/archiver-utils/node_modules/minimatch/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3,
matchOne()performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent**(GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- wherenis the number of path segments andkis the number of globstars. With k=11 and n=30, a call to the defaultminimatch()API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed tominimatch()is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.
+ + + + + +10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-27903
+https://github.com/isaacs/minimatch
+https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748
+https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj
+https://nvd.nist.gov/vuln/detail/CVE-2026-27903
+https://www.cve.org/CVERecord?id=CVE-2026-27903
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 407 + + | + +104 | +
| Component | + + +Version | + + +
|---|---|
| minimatch | + + +3.1.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/archiver/node_modules/minimatch/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3,
matchOne()performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent**(GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- wherenis the number of path segments andkis the number of globstars. With k=11 and n=30, a call to the defaultminimatch()API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed tominimatch()is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.
+ + + + + +10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-27903
+https://github.com/isaacs/minimatch
+https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748
+https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj
+https://nvd.nist.gov/vuln/detail/CVE-2026-27903
+https://www.cve.org/CVERecord?id=CVE-2026-27903
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 407 + + | + +105 | +
| Component | + + +Version | + + +
|---|---|
| minimatch | + + +3.1.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/file-js/node_modules/minimatch/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3,
matchOne()performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent**(GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- wherenis the number of path segments andkis the number of globstars. With k=11 and n=30, a call to the defaultminimatch()API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed tominimatch()is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.
+ + + + + +10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-27903
+https://github.com/isaacs/minimatch
+https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748
+https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj
+https://nvd.nist.gov/vuln/detail/CVE-2026-27903
+https://www.cve.org/CVERecord?id=CVE-2026-27903
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 407 + + | + +106 | +
| Component | + + +Version | + + +
|---|---|
| minimatch | + + +3.1.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/fstream/node_modules/minimatch/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3,
matchOne()performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent**(GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- wherenis the number of path segments andkis the number of globstars. With k=11 and n=30, a call to the defaultminimatch()API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed tominimatch()is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.
+ + + + + +10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-27903
+https://github.com/isaacs/minimatch
+https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748
+https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj
+https://nvd.nist.gov/vuln/detail/CVE-2026-27903
+https://www.cve.org/CVERecord?id=CVE-2026-27903
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 407 + + | + +107 | +
| Component | + + +Version | + + +
|---|---|
| minimatch | + + +3.1.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/ignore-walk/node_modules/minimatch/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3,
matchOne()performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent**(GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- wherenis the number of path segments andkis the number of globstars. With k=11 and n=30, a call to the defaultminimatch()API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed tominimatch()is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.
+ + + + + +10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-27903
+https://github.com/isaacs/minimatch
+https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748
+https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj
+https://nvd.nist.gov/vuln/detail/CVE-2026-27903
+https://www.cve.org/CVERecord?id=CVE-2026-27903
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 407 + + | + +108 | +
| Component | + + +Version | + + +
|---|---|
| minimatch | + + +3.1.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/node-pre-gyp/node_modules/minimatch/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3,
matchOne()performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent**(GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- wherenis the number of path segments andkis the number of globstars. With k=11 and n=30, a call to the defaultminimatch()API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed tominimatch()is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.
+ + + + + +10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-27903
+https://github.com/isaacs/minimatch
+https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748
+https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj
+https://nvd.nist.gov/vuln/detail/CVE-2026-27903
+https://www.cve.org/CVERecord?id=CVE-2026-27903
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 407 + + | + +109 | +
| Component | + + +Version | + + +
|---|---|
| minimatch | + + +3.1.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/rimraf/node_modules/minimatch/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3,
matchOne()performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent**(GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- wherenis the number of path segments andkis the number of globstars. With k=11 and n=30, a call to the defaultminimatch()API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed tominimatch()is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.
+ + + + + +10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-27903
+https://github.com/isaacs/minimatch
+https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748
+https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj
+https://nvd.nist.gov/vuln/detail/CVE-2026-27903
+https://www.cve.org/CVERecord?id=CVE-2026-27903
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 407 + + | + +110 | +
| Component | + + +Version | + + +
|---|---|
| minimatch | + + +3.1.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/sqlite3/node_modules/minimatch/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3,
matchOne()performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent**(GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- wherenis the number of path segments andkis the number of globstars. With k=11 and n=30, a call to the defaultminimatch()API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed tominimatch()is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.
+ + + + + +10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-27903
+https://github.com/isaacs/minimatch
+https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748
+https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj
+https://nvd.nist.gov/vuln/detail/CVE-2026-27903
+https://www.cve.org/CVERecord?id=CVE-2026-27903
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 407 + + | + +111 | +
| Component | + + +Version | + + +
|---|---|
| minimatch | + + +3.1.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/ts-node-dev/node_modules/minimatch/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3,
matchOne()performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent**(GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- wherenis the number of path segments andkis the number of globstars. With k=11 and n=30, a call to the defaultminimatch()API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed tominimatch()is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.
+ + + + + +10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-27903
+https://github.com/isaacs/minimatch
+https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748
+https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj
+https://nvd.nist.gov/vuln/detail/CVE-2026-27903
+https://www.cve.org/CVERecord?id=CVE-2026-27903
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 1333 + + | + +112 | +
| Component | + + +Version | + + +
|---|---|
| minimatch | + + +3.1.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/archiver-utils/node_modules/minimatch/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested
*()extglobs produce regexps with nested unbounded quantifiers (e.g.(?:(?:a|b)*)*), which exhibit catastrophic backtracking in V8. With a 12-byte pattern*(*(*(a|b)))and an 18-byte non-matching input,minimatch()stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the defaultminimatch()API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects+()extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.
+ + + + + +10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-27904
+https://github.com/isaacs/minimatch
+https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce
+https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74
+https://nvd.nist.gov/vuln/detail/CVE-2026-27904
+https://www.cve.org/CVERecord?id=CVE-2026-27904
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 1333 + + | + +113 | +
| Component | + + +Version | + + +
|---|---|
| minimatch | + + +3.1.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/archiver/node_modules/minimatch/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested
*()extglobs produce regexps with nested unbounded quantifiers (e.g.(?:(?:a|b)*)*), which exhibit catastrophic backtracking in V8. With a 12-byte pattern*(*(*(a|b)))and an 18-byte non-matching input,minimatch()stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the defaultminimatch()API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects+()extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.
+ + + + + +10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-27904
+https://github.com/isaacs/minimatch
+https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce
+https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74
+https://nvd.nist.gov/vuln/detail/CVE-2026-27904
+https://www.cve.org/CVERecord?id=CVE-2026-27904
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 1333 + + | + +114 | +
| Component | + + +Version | + + +
|---|---|
| minimatch | + + +3.1.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/file-js/node_modules/minimatch/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested
*()extglobs produce regexps with nested unbounded quantifiers (e.g.(?:(?:a|b)*)*), which exhibit catastrophic backtracking in V8. With a 12-byte pattern*(*(*(a|b)))and an 18-byte non-matching input,minimatch()stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the defaultminimatch()API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects+()extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.
+ + + + + +10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-27904
+https://github.com/isaacs/minimatch
+https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce
+https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74
+https://nvd.nist.gov/vuln/detail/CVE-2026-27904
+https://www.cve.org/CVERecord?id=CVE-2026-27904
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 1333 + + | + +115 | +
| Component | + + +Version | + + +
|---|---|
| minimatch | + + +3.1.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/fstream/node_modules/minimatch/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested
*()extglobs produce regexps with nested unbounded quantifiers (e.g.(?:(?:a|b)*)*), which exhibit catastrophic backtracking in V8. With a 12-byte pattern*(*(*(a|b)))and an 18-byte non-matching input,minimatch()stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the defaultminimatch()API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects+()extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.
+ + + + + +10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-27904
+https://github.com/isaacs/minimatch
+https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce
+https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74
+https://nvd.nist.gov/vuln/detail/CVE-2026-27904
+https://www.cve.org/CVERecord?id=CVE-2026-27904
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 1333 + + | + +116 | +
| Component | + + +Version | + + +
|---|---|
| minimatch | + + +3.1.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/ignore-walk/node_modules/minimatch/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested
*()extglobs produce regexps with nested unbounded quantifiers (e.g.(?:(?:a|b)*)*), which exhibit catastrophic backtracking in V8. With a 12-byte pattern*(*(*(a|b)))and an 18-byte non-matching input,minimatch()stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the defaultminimatch()API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects+()extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.
+ + + + + +10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-27904
+https://github.com/isaacs/minimatch
+https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce
+https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74
+https://nvd.nist.gov/vuln/detail/CVE-2026-27904
+https://www.cve.org/CVERecord?id=CVE-2026-27904
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 1333 + + | + +117 | +
| Component | + + +Version | + + +
|---|---|
| minimatch | + + +3.1.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/node-pre-gyp/node_modules/minimatch/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested
*()extglobs produce regexps with nested unbounded quantifiers (e.g.(?:(?:a|b)*)*), which exhibit catastrophic backtracking in V8. With a 12-byte pattern*(*(*(a|b)))and an 18-byte non-matching input,minimatch()stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the defaultminimatch()API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects+()extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.
+ + + + + +10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-27904
+https://github.com/isaacs/minimatch
+https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce
+https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74
+https://nvd.nist.gov/vuln/detail/CVE-2026-27904
+https://www.cve.org/CVERecord?id=CVE-2026-27904
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 1333 + + | + +118 | +
| Component | + + +Version | + + +
|---|---|
| minimatch | + + +3.1.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/rimraf/node_modules/minimatch/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested
*()extglobs produce regexps with nested unbounded quantifiers (e.g.(?:(?:a|b)*)*), which exhibit catastrophic backtracking in V8. With a 12-byte pattern*(*(*(a|b)))and an 18-byte non-matching input,minimatch()stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the defaultminimatch()API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects+()extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.
+ + + + + +10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-27904
+https://github.com/isaacs/minimatch
+https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce
+https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74
+https://nvd.nist.gov/vuln/detail/CVE-2026-27904
+https://www.cve.org/CVERecord?id=CVE-2026-27904
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 1333 + + | + +119 | +
| Component | + + +Version | + + +
|---|---|
| minimatch | + + +3.1.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/sqlite3/node_modules/minimatch/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested
*()extglobs produce regexps with nested unbounded quantifiers (e.g.(?:(?:a|b)*)*), which exhibit catastrophic backtracking in V8. With a 12-byte pattern*(*(*(a|b)))and an 18-byte non-matching input,minimatch()stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the defaultminimatch()API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects+()extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.
+ + + + + +10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-27904
+https://github.com/isaacs/minimatch
+https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce
+https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74
+https://nvd.nist.gov/vuln/detail/CVE-2026-27904
+https://www.cve.org/CVERecord?id=CVE-2026-27904
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 1333 + + | + +120 | +
| Component | + + +Version | + + +
|---|---|
| minimatch | + + +3.1.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/ts-node-dev/node_modules/minimatch/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested
*()extglobs produce regexps with nested unbounded quantifiers (e.g.(?:(?:a|b)*)*), which exhibit catastrophic backtracking in V8. With a 12-byte pattern*(*(*(a|b)))and an 18-byte non-matching input,minimatch()stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the defaultminimatch()API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects+()extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.
+ + + + + +10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-27904
+https://github.com/isaacs/minimatch
+https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce
+https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74
+https://nvd.nist.gov/vuln/detail/CVE-2026-27904
+https://www.cve.org/CVERecord?id=CVE-2026-27904
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 1333 + + | + +121 | +
| Component | + + +Version | + + +
|---|---|
| minimatch | + + +5.1.6 | + + +
| File Path | +
|---|
| juice-shop/node_modules/filehound/node_modules/minimatch/package.json | +
+ + +minimatch: minimatch: Denial of Service via specially crafted glob patterns
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.
+ + + + + +10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-26996
+https://github.com/isaacs/minimatch
+https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5
+https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26
+https://nvd.nist.gov/vuln/detail/CVE-2026-26996
+https://www.cve.org/CVERecord?id=CVE-2026-26996
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 407 + + | + +122 | +
| Component | + + +Version | + + +
|---|---|
| minimatch | + + +5.1.6 | + + +
| File Path | +
|---|
| juice-shop/node_modules/filehound/node_modules/minimatch/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3,
matchOne()performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent**(GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- wherenis the number of path segments andkis the number of globstars. With k=11 and n=30, a call to the defaultminimatch()API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed tominimatch()is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.
+ + + + + +10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-27903
+https://github.com/isaacs/minimatch
+https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748
+https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj
+https://nvd.nist.gov/vuln/detail/CVE-2026-27903
+https://www.cve.org/CVERecord?id=CVE-2026-27903
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 1333 + + | + +123 | +
| Component | + + +Version | + + +
|---|---|
| minimatch | + + +5.1.6 | + + +
| File Path | +
|---|
| juice-shop/node_modules/filehound/node_modules/minimatch/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested
*()extglobs produce regexps with nested unbounded quantifiers (e.g.(?:(?:a|b)*)*), which exhibit catastrophic backtracking in V8. With a 12-byte pattern*(*(*(a|b)))and an 18-byte non-matching input,minimatch()stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the defaultminimatch()API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects+()extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.
+ + + + + +10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-27904
+https://github.com/isaacs/minimatch
+https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce
+https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74
+https://nvd.nist.gov/vuln/detail/CVE-2026-27904
+https://www.cve.org/CVERecord?id=CVE-2026-27904
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 1333 + + | + +124 | +
| Component | + + +Version | + + +
|---|---|
| minimatch | + + +9.0.5 | + + +
| File Path | +
|---|
| juice-shop/node_modules/glob/node_modules/minimatch/package.json | +
+ + +minimatch: minimatch: Denial of Service via specially crafted glob patterns
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.
+ + + + + +10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-26996
+https://github.com/isaacs/minimatch
+https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5
+https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26
+https://nvd.nist.gov/vuln/detail/CVE-2026-26996
+https://www.cve.org/CVERecord?id=CVE-2026-26996
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 407 + + | + +125 | +
| Component | + + +Version | + + +
|---|---|
| minimatch | + + +9.0.5 | + + +
| File Path | +
|---|
| juice-shop/node_modules/glob/node_modules/minimatch/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3,
matchOne()performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent**(GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- wherenis the number of path segments andkis the number of globstars. With k=11 and n=30, a call to the defaultminimatch()API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed tominimatch()is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.
+ + + + + +10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-27903
+https://github.com/isaacs/minimatch
+https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748
+https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj
+https://nvd.nist.gov/vuln/detail/CVE-2026-27903
+https://www.cve.org/CVERecord?id=CVE-2026-27903
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 1333 + + | + +126 | +
| Component | + + +Version | + + +
|---|---|
| minimatch | + + +9.0.5 | + + +
| File Path | +
|---|
| juice-shop/node_modules/glob/node_modules/minimatch/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested
*()extglobs produce regexps with nested unbounded quantifiers (e.g.(?:(?:a|b)*)*), which exhibit catastrophic backtracking in V8. With a 12-byte pattern*(*(*(a|b)))and an 18-byte non-matching input,minimatch()stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the defaultminimatch()API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects+()extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.
+ + + + + +10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-27904
+https://github.com/isaacs/minimatch
+https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce
+https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74
+https://nvd.nist.gov/vuln/detail/CVE-2026-27904
+https://www.cve.org/CVERecord?id=CVE-2026-27904
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 400 + + | + +127 | +
| Component | + + +Version | + + +
|---|---|
| moment | + + +2.0.0 | + + +
| File Path | +
|---|
| juice-shop/node_modules/express-jwt/node_modules/moment/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +nodejs-moment: Regular expression denial of service
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 2.19.3The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-2016-4055.
+ + + + + +2.19.3
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2017-18214
+https://github.com/advisories/GHSA-446m-mv8f-q348
+https://github.com/moment/moment
+https://github.com/moment/moment/commit/69ed9d44957fa6ab12b73d2ae29d286a857b80eb
+https://github.com/moment/moment/issues/4163
+https://github.com/moment/moment/pull/4326
+https://nodesecurity.io/advisories/532
+https://nvd.nist.gov/vuln/detail/CVE-2017-18214
+https://ubuntu.com/security/notices/USN-4786-1
+https://www.cve.org/CVERecord?id=CVE-2017-18214
+https://www.npmjs.com/advisories/532
+https://www.tenable.com/security/tns-2019-02
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 22 + + | + +128 | +
| Component | + + +Version | + + +
|---|---|
| moment | + + +2.0.0 | + + +
| File Path | +
|---|
| juice-shop/node_modules/express-jwt/node_modules/moment/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
+ + +Moment.js: Path traversal in moment.locale
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 2.29.2Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.
+ + + + + +2.29.2
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2022-24785
+https://github.com/moment/moment
+https://github.com/moment/moment/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5
+https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4
+https://lists.debian.org/debian-lts-announce/2023/01/msg00035.html
+https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QIO6YNLTK2T7SPKDS4JEL45FANLNC2Q
+https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QIO6YNLTK2T7SPKDS4JEL45FANLNC2Q/
+https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORJX2LF6KMPIHP6B2P6KZIVKMLE3LVJ5
+https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORJX2LF6KMPIHP6B2P6KZIVKMLE3LVJ5/
+https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6QIO6YNLTK2T7SPKDS4JEL45FANLNC2Q
+https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ORJX2LF6KMPIHP6B2P6KZIVKMLE3LVJ5
+https://nvd.nist.gov/vuln/detail/CVE-2022-24785
+https://security.netapp.com/advisory/ntap-20220513-0006
+https://security.netapp.com/advisory/ntap-20220513-0006/
+https://security.netapp.com/advisory/ntap-20241108-0002
+https://security.netapp.com/advisory/ntap-20241108-0002/
+https://ubuntu.com/security/notices/USN-5559-1
+https://www.cve.org/CVERecord?id=CVE-2022-24785
+https://www.tenable.com/security/tns-2022-09
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 401 + + | + +130 | +
| Component | + + +Version | + + +
|---|---|
| multer | + + +1.4.5-lts.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/multer/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +Multer vulnerable to Denial of Service via memory leaks from unclosed streams
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 2.0.0Multer is a node.js middleware for handling
multipart/form-data. Versions prior to 2.0.0 are vulnerable to a resource exhaustion and memory leak issue due to improper stream handling. When the HTTP request stream emits an error, the internalbusboystream is not closed, violating Node.js stream safety guidance. This leads to unclosed streams accumulating over time, consuming memory and file descriptors. Under sustained or repeated failure conditions, this can result in denial of service, requiring manual server restarts to recover. All users of Multer handling file uploads are potentially impacted. Users should upgrade to 2.0.0 to receive a patch. No known workarounds are available.
+ + + + + +2.0.0
+ + + + + + + +fixed
+ + + + + + + +https://github.com/expressjs/multer
+https://github.com/expressjs/multer/commit/2c8505f207d923dd8de13a9f93a4563e59933665
+https://github.com/expressjs/multer/pull/1120
+https://github.com/expressjs/multer/security/advisories/GHSA-44fp-w29j-9vj5
+https://nvd.nist.gov/vuln/detail/CVE-2025-47935
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 248 + + | + +131 | +
| Component | + + +Version | + + +
|---|---|
| multer | + + +1.4.5-lts.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/multer/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +Multer vulnerable to Denial of Service from maliciously crafted requests
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 2.0.0Multer is a node.js middleware for handling
multipart/form-data. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.0 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to version 2.0.0 to receive a patch. No known workarounds are available.
+ + + + + +2.0.0
+ + + + + + + +fixed
+ + + + + + + +https://github.com/expressjs/multer
+https://github.com/expressjs/multer/commit/2c8505f207d923dd8de13a9f93a4563e59933665
+https://github.com/expressjs/multer/issues/1176
+https://github.com/expressjs/multer/security/advisories/GHSA-4pg4-qvpc-4q3h
+https://nvd.nist.gov/vuln/detail/CVE-2025-47944
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 248 + + | + +132 | +
| Component | + + +Version | + + +
|---|---|
| multer | + + +1.4.5-lts.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/multer/package.json | +
+ + +multer: Multer vulnerable to Denial of Service via unhandled exception
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 2.0.1Multer is a node.js middleware for handling
multipart/form-data. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.1 allows an attacker to trigger a Denial of Service (DoS) by sending an upload file request with an empty string field name. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to2.0.1to receive a patch. No known workarounds are available.
+ + + + + +2.0.1
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2025-48997
+https://github.com/expressjs/multer
+https://github.com/expressjs/multer/commit/35a3272b611945155e046dd5cef11088587635e9
+https://github.com/expressjs/multer/issues/1233
+https://github.com/expressjs/multer/pull/1256
+https://github.com/expressjs/multer/security/advisories/GHSA-g5hg-p3ph-g8qg
+https://nvd.nist.gov/vuln/detail/CVE-2025-48997
+https://www.cve.org/CVERecord?id=CVE-2025-48997
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 248 + + | + +133 | +
| Component | + + +Version | + + +
|---|---|
| multer | + + +1.4.5-lts.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/multer/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +multer: Multer Denial of Service
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 2.0.2Multer is a node.js middleware for handling
multipart/form-data. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.2 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to version 2.0.2 to receive a patch. No known workarounds are available.
+ + + + + +2.0.2
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2025-7338
+https://cna.openjsf.org/security-advisories.html
+https://github.com/expressjs/multer
+https://github.com/expressjs/multer/commit/adfeaf669f0e7fe953eab191a762164a452d143b
+https://github.com/expressjs/multer/security/advisories/GHSA-fjgf-rc76-4x9p
+https://nvd.nist.gov/vuln/detail/CVE-2025-7338
+https://www.cve.org/CVERecord?id=CVE-2025-7338
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 20 + + | + +135 | +
| Component | + + +Version | + + +
|---|---|
| qs | + + +6.13.0 | + + +
| File Path | +
|---|
| juice-shop/node_modules/qs/package.json | +
+ + +qs: qs: Denial of Service via improper input validation in array parsing
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 6.14.1Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.
+Summary
+The arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit should apply uniformly across all array notations.
+Note: The default parameterLimit of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than parameterLimit regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity has been reduced accordingly.
+Details
+The arrayLimit option only checked limits for indexed notation (a[0]=1&a[1]=2) but did not enforce it for bracket notation (a[]=1&a[]=2).
+Vulnerable code (lib/parse.js:159-162):
+if (root === '[]' && options.parseArrays) {
+
+ obj = utils.combine([], leaf); // No arrayLimit check
+}Working code (lib/parse.js:175):
+else if (index <= options.arrayLimit) { // Limit checked here
+
+ obj = [];
+ obj[index] = leaf;
+}The bracket notation handler at line 159 uses utils.combine([], leaf) without validating against options.arrayLimit, while indexed notation at line 175 checks index <= options.arrayLimit before creating arrays.
+PoC
+const qs = require('qs');
+
+const result = qs.parse('a[]=1&a[]=2&a[]=3&a[]=4&a[]=5&a[]=6', { arrayLimit: 5 });
+console.log(result.a.length); // Output: 6 (should be max 5)Note on parameterLimit interaction: The original advisory's "DoS demonstration" claimed a length of 10,000, but parameterLimit (default: 1000) caps parsing to 1,000 parameters. With default options, the actual output is 1,000, not 10,000.
+Impact
+Consistency bug in arrayLimit enforcement. With default parameterLimit, the practical DoS risk is negligible since parameterLimit already caps the total number of parsed parameters (and thus array elements from bracket notation). The risk increases only when parameterLimit is explicitly set to a very high value.
+ + + + + +6.14.1
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2025-15284
+https://github.com/ljharb/qs
+https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9
+https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p
+https://nvd.nist.gov/vuln/detail/CVE-2025-15284
+https://www.cve.org/CVERecord?id=CVE-2025-15284
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 1333 + + | + +137 | +
| Component | + + +Version | + + +
|---|---|
| sanitize-html | + + +1.4.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/sanitize-html/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +sanitize-html: insecure global regular expression replacement logic may lead to ReDoS
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 2.7.1The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.
+ + + + + +2.7.1
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2022-25887
+https://github.com/apostrophecms/sanitize-html/commit/b4682c12fd30e12e82fa2d9b766de91d7d2cd23c
+https://github.com/apostrophecms/sanitize-html/pull/557
+https://nvd.nist.gov/vuln/detail/CVE-2022-25887
+https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3008102
+https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-2957526
+https://ubuntu.com/security/notices/USN-7464-1
+https://www.cve.org/CVERecord?id=CVE-2022-25887
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 22 + + | + +147 | +
| Component | + + +Version | + + +
|---|---|
| tar | + + +4.4.19 | + + +
| File Path | +
|---|
| juice-shop/node_modules/node-pre-gyp/node_modules/tar/package.json | +
+ + +node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 7.5.3node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.
+ + + + + +7.5.3
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-23745
+https://github.com/isaacs/node-tar
+https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e
+https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97
+https://nvd.nist.gov/vuln/detail/CVE-2026-23745
+https://www.cve.org/CVERecord?id=CVE-2026-23745
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 176 + + | + +148 | +
| Component | + + +Version | + + +
|---|---|
| tar | + + +4.4.19 | + + +
| File Path | +
|---|
| juice-shop/node_modules/node-pre-gyp/node_modules/tar/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L
+ + +node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 7.5.4node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the
path-reservationssystem. On case-insensitive or normalization-insensitive filesystems (such as macOS APFS, In which it has been tested), the library fails to lock colliding paths (e.g.,ßandss), allowing them to be processed in parallel. This bypasses the library's internal concurrency safeguards and permits Symlink Poisoning attacks via race conditions. The library uses aPathReservationssystem to ensure that metadata checks and file operations for the same path are serialized. This prevents race conditions where one entry might clobber another concurrently. This is a Race Condition which enables Arbitrary File Overwrite. This vulnerability affects users and systems using node-tar on macOS (APFS/HFS+). Because of usingNFDUnicode normalization (in whichßandssare different), conflicting paths do not have their order properly preserved under filesystems that ignore Unicode normalization (e.g., APFS (in whichßcauses an inode collision withss)). This enables an attacker to circumvent internal parallelization locks (PathReservations) using conflicting filenames within a malicious tar archive. The patch in version 7.5.4 updatespath-reservations.jsto use a normalization form that matches the target filesystem's behavior (e.g.,NFKD), followed by firsttoLocaleLowerCase('en')and thentoLocaleUpperCase('en'). As a workaround, users who cannot upgrade promptly, and who are programmatically usingnode-tarto extract arbitrary tarball data should filter out allSymbolicLinkentries (as npm does) to defend against arbitrary file writes via this file system entry name collision issue.
+ + + + + +7.5.4
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-23950
+https://github.com/isaacs/node-tar
+https://github.com/isaacs/node-tar/commit/3b1abfae650056edfabcbe0a0df5954d390521e6
+https://github.com/isaacs/node-tar/security/advisories/GHSA-r6q2-hw4h-h46w
+https://nvd.nist.gov/vuln/detail/CVE-2026-23950
+https://www.cve.org/CVERecord?id=CVE-2026-23950
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 22 + + | + +149 | +
| Component | + + +Version | + + +
|---|---|
| tar | + + +4.4.19 | + + +
| File Path | +
|---|
| juice-shop/node_modules/node-pre-gyp/node_modules/tar/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
+ + +node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 7.5.7node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.
+ + + + + +7.5.7
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-24842
+https://github.com/isaacs/node-tar
+https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46
+https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v
+https://nvd.nist.gov/vuln/detail/CVE-2026-24842
+https://www.cve.org/CVERecord?id=CVE-2026-24842
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 22 + + | + +150 | +
| Component | + + +Version | + + +
|---|---|
| tar | + + +4.4.19 | + + +
| File Path | +
|---|
| juice-shop/node_modules/node-pre-gyp/node_modules/tar/package.json | +
+ + +CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
+ + +tar: node-tar: node-tar: Arbitrary file read/write via malicious archive hardlink creation
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 7.5.8node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive. This issue has been fixed in version 7.5.8.
+ + + + + +7.5.8
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-26960
+https://github.com/isaacs/node-tar
+https://github.com/isaacs/node-tar/commit/2cb1120bcefe28d7ecc719b41441ade59c52e384
+https://github.com/isaacs/node-tar/commit/d18e4e1f846f4ddddc153b0f536a19c050e7499f
+https://github.com/isaacs/node-tar/security/advisories/GHSA-83g3-92jg-28cx
+https://nvd.nist.gov/vuln/detail/CVE-2026-26960
+https://www.cve.org/CVERecord?id=CVE-2026-26960
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 22 + + | + +152 | +
| Component | + + +Version | + + +
|---|---|
| tar | + + +6.2.1 | + + +
| File Path | +
|---|
| juice-shop/node_modules/sqlite3/node_modules/tar/package.json | +
+ + +node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 7.5.3node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.
+ + + + + +7.5.3
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-23745
+https://github.com/isaacs/node-tar
+https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e
+https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97
+https://nvd.nist.gov/vuln/detail/CVE-2026-23745
+https://www.cve.org/CVERecord?id=CVE-2026-23745
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 176 + + | + +153 | +
| Component | + + +Version | + + +
|---|---|
| tar | + + +6.2.1 | + + +
| File Path | +
|---|
| juice-shop/node_modules/sqlite3/node_modules/tar/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L
+ + +node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 7.5.4node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the
path-reservationssystem. On case-insensitive or normalization-insensitive filesystems (such as macOS APFS, In which it has been tested), the library fails to lock colliding paths (e.g.,ßandss), allowing them to be processed in parallel. This bypasses the library's internal concurrency safeguards and permits Symlink Poisoning attacks via race conditions. The library uses aPathReservationssystem to ensure that metadata checks and file operations for the same path are serialized. This prevents race conditions where one entry might clobber another concurrently. This is a Race Condition which enables Arbitrary File Overwrite. This vulnerability affects users and systems using node-tar on macOS (APFS/HFS+). Because of usingNFDUnicode normalization (in whichßandssare different), conflicting paths do not have their order properly preserved under filesystems that ignore Unicode normalization (e.g., APFS (in whichßcauses an inode collision withss)). This enables an attacker to circumvent internal parallelization locks (PathReservations) using conflicting filenames within a malicious tar archive. The patch in version 7.5.4 updatespath-reservations.jsto use a normalization form that matches the target filesystem's behavior (e.g.,NFKD), followed by firsttoLocaleLowerCase('en')and thentoLocaleUpperCase('en'). As a workaround, users who cannot upgrade promptly, and who are programmatically usingnode-tarto extract arbitrary tarball data should filter out allSymbolicLinkentries (as npm does) to defend against arbitrary file writes via this file system entry name collision issue.
+ + + + + +7.5.4
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-23950
+https://github.com/isaacs/node-tar
+https://github.com/isaacs/node-tar/commit/3b1abfae650056edfabcbe0a0df5954d390521e6
+https://github.com/isaacs/node-tar/security/advisories/GHSA-r6q2-hw4h-h46w
+https://nvd.nist.gov/vuln/detail/CVE-2026-23950
+https://www.cve.org/CVERecord?id=CVE-2026-23950
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 22 + + | + +154 | +
| Component | + + +Version | + + +
|---|---|
| tar | + + +6.2.1 | + + +
| File Path | +
|---|
| juice-shop/node_modules/sqlite3/node_modules/tar/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
+ + +node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 7.5.7node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.
+ + + + + +7.5.7
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-24842
+https://github.com/isaacs/node-tar
+https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46
+https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v
+https://nvd.nist.gov/vuln/detail/CVE-2026-24842
+https://www.cve.org/CVERecord?id=CVE-2026-24842
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 22 + + | + +155 | +
| Component | + + +Version | + + +
|---|---|
| tar | + + +6.2.1 | + + +
| File Path | +
|---|
| juice-shop/node_modules/sqlite3/node_modules/tar/package.json | +
+ + +CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
+ + +tar: node-tar: node-tar: Arbitrary file read/write via malicious archive hardlink creation
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 7.5.8node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive. This issue has been fixed in version 7.5.8.
+ + + + + +7.5.8
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-26960
+https://github.com/isaacs/node-tar
+https://github.com/isaacs/node-tar/commit/2cb1120bcefe28d7ecc719b41441ade59c52e384
+https://github.com/isaacs/node-tar/commit/d18e4e1f846f4ddddc153b0f536a19c050e7499f
+https://github.com/isaacs/node-tar/security/advisories/GHSA-83g3-92jg-28cx
+https://nvd.nist.gov/vuln/detail/CVE-2026-26960
+https://www.cve.org/CVERecord?id=CVE-2026-26960
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 22 + + | + +156 | +
| Component | + + +Version | + + +
|---|---|
| tar | + + +7.4.3 | + + +
| File Path | +
|---|
| juice-shop/node_modules/tar/package.json | +
+ + +node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 7.5.3node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.
+ + + + + +7.5.3
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-23745
+https://github.com/isaacs/node-tar
+https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e
+https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97
+https://nvd.nist.gov/vuln/detail/CVE-2026-23745
+https://www.cve.org/CVERecord?id=CVE-2026-23745
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 176 + + | + +157 | +
| Component | + + +Version | + + +
|---|---|
| tar | + + +7.4.3 | + + +
| File Path | +
|---|
| juice-shop/node_modules/tar/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L
+ + +node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 7.5.4node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the
path-reservationssystem. On case-insensitive or normalization-insensitive filesystems (such as macOS APFS, In which it has been tested), the library fails to lock colliding paths (e.g.,ßandss), allowing them to be processed in parallel. This bypasses the library's internal concurrency safeguards and permits Symlink Poisoning attacks via race conditions. The library uses aPathReservationssystem to ensure that metadata checks and file operations for the same path are serialized. This prevents race conditions where one entry might clobber another concurrently. This is a Race Condition which enables Arbitrary File Overwrite. This vulnerability affects users and systems using node-tar on macOS (APFS/HFS+). Because of usingNFDUnicode normalization (in whichßandssare different), conflicting paths do not have their order properly preserved under filesystems that ignore Unicode normalization (e.g., APFS (in whichßcauses an inode collision withss)). This enables an attacker to circumvent internal parallelization locks (PathReservations) using conflicting filenames within a malicious tar archive. The patch in version 7.5.4 updatespath-reservations.jsto use a normalization form that matches the target filesystem's behavior (e.g.,NFKD), followed by firsttoLocaleLowerCase('en')and thentoLocaleUpperCase('en'). As a workaround, users who cannot upgrade promptly, and who are programmatically usingnode-tarto extract arbitrary tarball data should filter out allSymbolicLinkentries (as npm does) to defend against arbitrary file writes via this file system entry name collision issue.
+ + + + + +7.5.4
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-23950
+https://github.com/isaacs/node-tar
+https://github.com/isaacs/node-tar/commit/3b1abfae650056edfabcbe0a0df5954d390521e6
+https://github.com/isaacs/node-tar/security/advisories/GHSA-r6q2-hw4h-h46w
+https://nvd.nist.gov/vuln/detail/CVE-2026-23950
+https://www.cve.org/CVERecord?id=CVE-2026-23950
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 22 + + | + +158 | +
| Component | + + +Version | + + +
|---|---|
| tar | + + +7.4.3 | + + +
| File Path | +
|---|
| juice-shop/node_modules/tar/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
+ + +node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 7.5.7node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.
+ + + + + +7.5.7
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-24842
+https://github.com/isaacs/node-tar
+https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46
+https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v
+https://nvd.nist.gov/vuln/detail/CVE-2026-24842
+https://www.cve.org/CVERecord?id=CVE-2026-24842
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 22 + + | + +159 | +
| Component | + + +Version | + + +
|---|---|
| tar | + + +7.4.3 | + + +
| File Path | +
|---|
| juice-shop/node_modules/tar/package.json | +
+ + +CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
+ + +tar: node-tar: node-tar: Arbitrary file read/write via malicious archive hardlink creation
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 7.5.8node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive. This issue has been fixed in version 7.5.8.
+ + + + + +7.5.8
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-26960
+https://github.com/isaacs/node-tar
+https://github.com/isaacs/node-tar/commit/2cb1120bcefe28d7ecc719b41441ade59c52e384
+https://github.com/isaacs/node-tar/commit/d18e4e1f846f4ddddc153b0f536a19c050e7499f
+https://github.com/isaacs/node-tar/security/advisories/GHSA-83g3-92jg-28cx
+https://nvd.nist.gov/vuln/detail/CVE-2026-26960
+https://www.cve.org/CVERecord?id=CVE-2026-26960
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 22 + + | + +160 | +
| Component | + + +Version | + + +
|---|---|
| tar-fs | + + +2.1.3 | + + +
| File Path | +
|---|
| juice-shop/node_modules/tar-fs/package.json | +
+ + +tar-fs: tar-fs symlink validation bypass
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 3.1.1, 2.1.4, 1.16.6tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.1.1, 2.1.3, and 1.16.5 are vulnerable to symlink validation bypass if the destination directory is predictable with a specific tarball. This issue has been patched in version 3.1.1, 2.1.4, and 1.16.6. A workaround involves using the ignore option on non files/directories.
+ + + + + +3.1.1, 2.1.4, 1.16.6
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2025-59343
+https://github.com/mafintosh/tar-fs
+https://github.com/mafintosh/tar-fs/commit/0bd54cdf06da2b7b5b95cd4b062c9f4e0a8c4e09
+https://github.com/mafintosh/tar-fs/security/advisories/GHSA-vj76-c3g6-qr5v
+https://lists.debian.org/debian-lts-announce/2025/09/msg00028.html
+https://nvd.nist.gov/vuln/detail/CVE-2025-59343
+https://www.cve.org/CVERecord?id=CVE-2025-59343
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 792 + + | + +161 | +
| Component | + + +Version | + + +
|---|---|
| validator | + + +13.15.15 | + + +
| File Path | +
|---|
| juice-shop/node_modules/validator/package.json | +
+ + +Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 13.15.22Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() function that does not take into account Unicode variation selectors (\uFE0F, \uFE0E) appearing in a sequence which lead to improper string length calculation. This can lead to an application using isLength for input validation accepting strings significantly longer than intended, resulting in issues like data truncation in databases, buffer overflows in other system components, or denial-of-service.
+ + + + + +13.15.22
+ + + + + + + +fixed
+ + + + + + + +http://seclists.org/fulldisclosure/2026/Jan/27
+https://gist.github.com/koral--/ad31208b25b9e3d1e2e35f1d4d72572e
+https://github.com/validatorjs/validator.js
+https://github.com/validatorjs/validator.js/commit/d457ecaf55b0f3d8bd379d82757425d0d13dd382
+https://github.com/validatorjs/validator.js/pull/2616
+https://nvd.nist.gov/vuln/detail/CVE-2025-12758
+https://security.snyk.io/vuln/SNYK-JS-VALIDATOR-13653476
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 476 + + | + +168 | +
| Component | + + +Version | + + +
|---|---|
| ws | + + +7.4.6 | + + +
| File Path | +
|---|
| juice-shop/node_modules/engine.io/node_modules/ws/package.json | +
+ + +nodejs-ws: denial of service when handling a request with many HTTP headers
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 5.2.4, 6.2.3, 7.5.10, 8.17.1ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.
+ + + + + +5.2.4, 6.2.3, 7.5.10, 8.17.1
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2024-37890
+https://github.com/websockets/ws
+https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f
+https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e
+https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c
+https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63
+https://github.com/websockets/ws/issues/2230
+https://github.com/websockets/ws/pull/2231
+https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q
+https://nodejs.org/api/http.html#servermaxheaderscount
+https://nvd.nist.gov/vuln/detail/CVE-2024-37890
+https://www.cve.org/CVERecord?id=CVE-2024-37890
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 908 + + | + +29 | +
| Component | + + +Version | + + +
|---|---|
| libc6 | + + +2.36-9+deb12u10 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + +CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + + + + + +glibc: wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version:Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.
+ + + + + + + +affected
+ + + + + + + +http://www.openwall.com/lists/oss-security/2026/01/20/3
+https://access.redhat.com/errata/RHSA-2026:2786
+https://access.redhat.com/security/cve/CVE-2025-15281
+https://bugzilla.redhat.com/2429771
+https://bugzilla.redhat.com/2430201
+https://bugzilla.redhat.com/2431196
+https://bugzilla.redhat.com/show_bug.cgi?id=2429771
+https://bugzilla.redhat.com/show_bug.cgi?id=2430201
+https://bugzilla.redhat.com/show_bug.cgi?id=2431196
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15281
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0861
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0915
+https://errata.almalinux.org/9/ALSA-2026-2786.html
+https://errata.rockylinux.org/RLSA-2026:2786
+https://linux.oracle.com/cve/CVE-2025-15281.html
+https://linux.oracle.com/errata/ELSA-2026-50120.html
+https://nvd.nist.gov/vuln/detail/CVE-2025-15281
+https://sourceware.org/bugzilla/show_bug.cgi?id=33814
+https://ubuntu.com/security/notices/USN-8005-1
+https://www.cve.org/CVERecord?id=CVE-2025-15281
+https://www.openwall.com/lists/oss-security/2026/01/20/3
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 415 + + | + +30 | +
| Component | + + +Version | + + +
|---|---|
| libc6 | + + +2.36-9+deb12u10 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + +CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
+ + +glibc: Double free in glibc
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version: 2.36-9+deb12u13The regcomp function in the GNU C library version from 2.4 to 2.41 is
+subject to a double free if some previous allocation fails. It can be
+accomplished either by a malloc failure or by using an interposed malloc
+ that injects random malloc failures. The double free can allow buffer
+manipulation depending of how the regex is constructed. This issue
+affects all architectures and ABIs supported by the GNU C library.
+ + + + + +2.36-9+deb12u13
+ + + + + + + +fixed
+ + + + + + + +http://www.openwall.com/lists/oss-security/2025/07/23/1
+https://access.redhat.com/errata/RHSA-2025:12980
+https://access.redhat.com/security/cve/CVE-2025-8058
+https://bugzilla.redhat.com/2383146
+https://bugzilla.redhat.com/show_bug.cgi?id=2383146
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8058
+https://errata.almalinux.org/8/ALSA-2025-12980.html
+https://errata.rockylinux.org/RLSA-2025:13240
+https://linux.oracle.com/cve/CVE-2025-8058.html
+https://linux.oracle.com/errata/ELSA-2025-28054.html
+https://nvd.nist.gov/vuln/detail/CVE-2025-8058
+https://sourceware.org/bugzilla/show_bug.cgi?id=33185
+https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2025-0005
+https://sourceware.org/git/?p=glibc.git;a=commit;h=3ff17af18c38727b88d9115e536c069e6b5d601f
+https://ubuntu.com/security/notices/USN-7760-1
+https://ubuntu.com/security/notices/USN-8005-1
+https://www.cve.org/CVERecord?id=CVE-2025-8058
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 908 + + | + +31 | +
| Component | + + +Version | + + +
|---|---|
| libc6 | + + +2.36-9+deb12u10 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
+ + + + + + +glibc: glibc: Information disclosure via zero-valued network query
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version:Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to version 2.42 can leak stack contents to the configured DNS resolver.
+ + + + + + + +affected
+ + + + + + + +http://www.openwall.com/lists/oss-security/2026/01/16/6
+https://access.redhat.com/errata/RHSA-2026:1334
+https://access.redhat.com/security/cve/CVE-2026-0915
+https://bugzilla.redhat.com/2429771
+https://bugzilla.redhat.com/2430201
+https://bugzilla.redhat.com/show_bug.cgi?id=2429771
+https://bugzilla.redhat.com/show_bug.cgi?id=2430201
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0861
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0915
+https://errata.almalinux.org/10/ALSA-2026-1334.html
+https://errata.rockylinux.org/RLSA-2026:1334
+https://linux.oracle.com/cve/CVE-2026-0915.html
+https://linux.oracle.com/errata/ELSA-2026-50120.html
+https://nvd.nist.gov/vuln/detail/CVE-2026-0915
+https://sourceware.org/bugzilla/show_bug.cgi?id=33802
+https://ubuntu.com/security/notices/USN-8005-1
+https://www.cve.org/CVERecord?id=CVE-2026-0915
+https://www.openwall.com/lists/oss-security/2026/01/16/6
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 787 + + | + +44 | +
| Component | + + +Version | + + +
|---|---|
| libssl3 | + + +3.0.17-1~deb12u2 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + +CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
+ + +openssl: OpenSSL: Denial of Service due to out-of-bounds write in BIO filter
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version: 3.0.18-1~deb12u2Issue summary: Writing large, newline-free data into a BIO chain using the
+
+line-buffering filter where the next BIO performs short writes can trigger
+a heap-based out-of-bounds write.Impact summary: This out-of-bounds write can cause memory corruption which
+
+typically results in a crash, leading to Denial of Service for an application.The line-buffering BIO filter (BIO_f_linebuffer) is not used by default in
+
+TLS/SSL data paths. In OpenSSL command-line applications, it is typically
+only pushed onto stdout/stderr on VMS systems. Third-party applications that
+explicitly use this filter with a BIO chain that can short-write and that
+write large, newline-free data influenced by an attacker would be affected.
+However, the circumstances where this could happen are unlikely to be under
+attacker control, and BIO_f_linebuffer is unlikely to be handling non-curated
+data controlled by an attacker. For that reason the issue was assessed as
+Low severity.The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,
+
+as the BIO implementation is outside the OpenSSL FIPS module boundary.OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.
+ + + + + +3.0.18-1~deb12u2
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/errata/RHSA-2026:1472
+https://access.redhat.com/security/cve/CVE-2025-68160
+https://bugzilla.redhat.com/2430375
+https://bugzilla.redhat.com/2430376
+https://bugzilla.redhat.com/2430377
+https://bugzilla.redhat.com/2430378
+https://bugzilla.redhat.com/2430379
+https://bugzilla.redhat.com/2430380
+https://bugzilla.redhat.com/2430381
+https://bugzilla.redhat.com/2430386
+https://bugzilla.redhat.com/2430387
+https://bugzilla.redhat.com/2430388
+https://bugzilla.redhat.com/2430389
+https://bugzilla.redhat.com/2430390
+https://bugzilla.redhat.com/show_bug.cgi?id=2430375
+https://bugzilla.redhat.com/show_bug.cgi?id=2430376
+https://bugzilla.redhat.com/show_bug.cgi?id=2430377
+https://bugzilla.redhat.com/show_bug.cgi?id=2430378
+https://bugzilla.redhat.com/show_bug.cgi?id=2430379
+https://bugzilla.redhat.com/show_bug.cgi?id=2430380
+https://bugzilla.redhat.com/show_bug.cgi?id=2430381
+https://bugzilla.redhat.com/show_bug.cgi?id=2430386
+https://bugzilla.redhat.com/show_bug.cgi?id=2430387
+https://bugzilla.redhat.com/show_bug.cgi?id=2430388
+https://bugzilla.redhat.com/show_bug.cgi?id=2430389
+https://bugzilla.redhat.com/show_bug.cgi?id=2430390
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796
+https://errata.almalinux.org/10/ALSA-2026-1472.html
+https://errata.rockylinux.org/RLSA-2026:1472
+https://github.com/openssl/openssl/commit/384011202af92605d926fafe4a0bcd6b65d162ad
+https://github.com/openssl/openssl/commit/475c466ef2fbd8fc1df6fae1c3eed9c813fc8ff6
+https://github.com/openssl/openssl/commit/4c96fbba618e1940f038012506ee9e21d32ee12c
+https://github.com/openssl/openssl/commit/6845c3b6460a98b1ec4e463baa2ea1a63a32d7c0
+https://github.com/openssl/openssl/commit/68a7cd2e2816c3a02f4d45a2ce43fc04fac97096
+https://linux.oracle.com/cve/CVE-2025-68160.html
+https://linux.oracle.com/errata/ELSA-2026-50081.html
+https://nvd.nist.gov/vuln/detail/CVE-2025-68160
+https://openssl-library.org/news/secadv/20260127.txt
+https://ubuntu.com/security/notices/USN-7980-1
+https://ubuntu.com/security/notices/USN-7980-2
+https://www.cve.org/CVERecord?id=CVE-2025-68160
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 325 + + | + +45 | +
| Component | + + +Version | + + +
|---|---|
| libssl3 | + + +3.0.17-1~deb12u2 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + +CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
+ + +openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version: 3.0.18-1~deb12u2Issue summary: When using the low-level OCB API directly with AES-NI or
other hardware-accelerated code paths, inputs whose length is not a multiple
of 16 bytes can leave the final partial block unencrypted and unauthenticated.
Impact summary: The trailing 1-15 bytes of a message may be exposed in
cleartext on encryption and are not covered by the authentication tag,
allowing an attacker to read or tamper with those bytes without detection.
The low-level OCB encrypt and decrypt routines in the hardware-accelerated
stream path process full 16-byte blocks but do not advance the input/output
pointers. The subsequent tail-handling code then operates on the original
base pointers, effectively reprocessing the beginning of the buffer while
leaving the actual trailing bytes unprocessed. The authentication checksum
also excludes the true tail bytes.
However, typical OpenSSL consumers using EVP are not affected because the
higher-level EVP and provider OCB implementations split inputs so that full
blocks and trailing partial blocks are processed in separate calls, avoiding
the problematic code path. Additionally, TLS does not use OCB ciphersuites.
The vulnerability only affects applications that call the low-level
CRYPTO_ocb128_encrypt() or CRYPTO_ocb128_decrypt() functions directly with
non-block-aligned lengths in a single call on hardware-accelerated builds.
For these reasons the issue was assessed as Low severity.
The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected
by this issue, as OCB mode is not a FIPS-approved algorithm.
OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.
OpenSSL 1.0.2 is not affected by this issue.
+ + + + + +3.0.18-1~deb12u2
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/errata/RHSA-2026:1472
+https://access.redhat.com/security/cve/CVE-2025-69418
+https://bugzilla.redhat.com/2430375
+https://bugzilla.redhat.com/2430376
+https://bugzilla.redhat.com/2430377
+https://bugzilla.redhat.com/2430378
+https://bugzilla.redhat.com/2430379
+https://bugzilla.redhat.com/2430380
+https://bugzilla.redhat.com/2430381
+https://bugzilla.redhat.com/2430386
+https://bugzilla.redhat.com/2430387
+https://bugzilla.redhat.com/2430388
+https://bugzilla.redhat.com/2430389
+https://bugzilla.redhat.com/2430390
+https://bugzilla.redhat.com/show_bug.cgi?id=2430375
+https://bugzilla.redhat.com/show_bug.cgi?id=2430376
+https://bugzilla.redhat.com/show_bug.cgi?id=2430377
+https://bugzilla.redhat.com/show_bug.cgi?id=2430378
+https://bugzilla.redhat.com/show_bug.cgi?id=2430379
+https://bugzilla.redhat.com/show_bug.cgi?id=2430380
+https://bugzilla.redhat.com/show_bug.cgi?id=2430381
+https://bugzilla.redhat.com/show_bug.cgi?id=2430386
+https://bugzilla.redhat.com/show_bug.cgi?id=2430387
+https://bugzilla.redhat.com/show_bug.cgi?id=2430388
+https://bugzilla.redhat.com/show_bug.cgi?id=2430389
+https://bugzilla.redhat.com/show_bug.cgi?id=2430390
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796
+https://errata.almalinux.org/10/ALSA-2026-1472.html
+https://errata.rockylinux.org/RLSA-2026:1472
+https://github.com/openssl/openssl/commit/372fc5c77529695b05b4f5b5187691a57ef5dffc
+https://github.com/openssl/openssl/commit/4016975d4469cd6b94927c607f7c511385f928d8
+https://github.com/openssl/openssl/commit/52d23c86a54adab5ee9f80e48b242b52c4cc2347
+https://github.com/openssl/openssl/commit/a7589230356d908c0eca4b969ec4f62106f4f5ae
+https://github.com/openssl/openssl/commit/ed40856d7d4ba6cb42779b6770666a65f19cb977
+https://linux.oracle.com/cve/CVE-2025-69418.html
+https://linux.oracle.com/errata/ELSA-2026-50081.html
+https://nvd.nist.gov/vuln/detail/CVE-2025-69418
+https://openssl-library.org/news/secadv/20260127.txt
+https://ubuntu.com/security/notices/USN-7980-1
+https://ubuntu.com/security/notices/USN-7980-2
+https://www.cve.org/CVERecord?id=CVE-2025-69418
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 754 + + | + +46 | +
| Component | + + +Version | + + +
|---|---|
| libssl3 | + + +3.0.17-1~deb12u2 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + +CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +openssl: OpenSSL: Denial of Service via malformed TimeStamp Response
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version: 3.0.18-1~deb12u2Issue summary: A type confusion vulnerability exists in the TimeStamp Response
+
+verification code where an ASN1_TYPE union member is accessed without first
+validating the type, causing an invalid or NULL pointer dereference when
+processing a malformed TimeStamp Response file.Impact summary: An application calling TS_RESP_verify_response() with a
+
+malformed TimeStamp Response can be caused to dereference an invalid or
+NULL pointer when reading, resulting in a Denial of Service.The functions ossl_ess_get_signing_cert() and ossl_ess_get_signing_cert_v2()
+
+access the signing cert attribute value without validating its type.
+When the type is not V_ASN1_SEQUENCE, this results in accessing invalid memory
+through the ASN1_TYPE union, causing a crash.Exploiting this vulnerability requires an attacker to provide a malformed
+
+TimeStamp Response to an application that verifies timestamp responses. The
+TimeStamp protocol (RFC 3161) is not widely used and the impact of the
+exploit is just a Denial of Service. For these reasons the issue was
+assessed as Low severity.The FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,
+
+as the TimeStamp Response implementation is outside the OpenSSL FIPS module
+boundary.OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.
+OpenSSL 1.0.2 is not affected by this issue.
+ + + + + +3.0.18-1~deb12u2
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/errata/RHSA-2026:1472
+https://access.redhat.com/security/cve/CVE-2025-69420
+https://bugzilla.redhat.com/2430375
+https://bugzilla.redhat.com/2430376
+https://bugzilla.redhat.com/2430377
+https://bugzilla.redhat.com/2430378
+https://bugzilla.redhat.com/2430379
+https://bugzilla.redhat.com/2430380
+https://bugzilla.redhat.com/2430381
+https://bugzilla.redhat.com/2430386
+https://bugzilla.redhat.com/2430387
+https://bugzilla.redhat.com/2430388
+https://bugzilla.redhat.com/2430389
+https://bugzilla.redhat.com/2430390
+https://bugzilla.redhat.com/show_bug.cgi?id=2430375
+https://bugzilla.redhat.com/show_bug.cgi?id=2430376
+https://bugzilla.redhat.com/show_bug.cgi?id=2430377
+https://bugzilla.redhat.com/show_bug.cgi?id=2430378
+https://bugzilla.redhat.com/show_bug.cgi?id=2430379
+https://bugzilla.redhat.com/show_bug.cgi?id=2430380
+https://bugzilla.redhat.com/show_bug.cgi?id=2430381
+https://bugzilla.redhat.com/show_bug.cgi?id=2430386
+https://bugzilla.redhat.com/show_bug.cgi?id=2430387
+https://bugzilla.redhat.com/show_bug.cgi?id=2430388
+https://bugzilla.redhat.com/show_bug.cgi?id=2430389
+https://bugzilla.redhat.com/show_bug.cgi?id=2430390
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796
+https://errata.almalinux.org/10/ALSA-2026-1472.html
+https://errata.rockylinux.org/RLSA-2026:1472
+https://github.com/openssl/openssl/commit/27c7012c91cc986a598d7540f3079dfde2416eb9
+https://github.com/openssl/openssl/commit/4e254b48ad93cc092be3dd62d97015f33f73133a
+https://github.com/openssl/openssl/commit/564fd9c73787f25693bf9e75faf7bf6bb1305d4e
+https://github.com/openssl/openssl/commit/5eb0770ffcf11b785cf374ff3c19196245e54f1b
+https://github.com/openssl/openssl/commit/a99349ebfc519999edc50620abe24d599b9eb085
+https://linux.oracle.com/cve/CVE-2025-69420.html
+https://linux.oracle.com/errata/ELSA-2026-50081.html
+https://nvd.nist.gov/vuln/detail/CVE-2025-69420
+https://openssl-library.org/news/secadv/20260127.txt
+https://ubuntu.com/security/notices/USN-7980-1
+https://ubuntu.com/security/notices/USN-7980-2
+https://www.cve.org/CVERecord?id=CVE-2025-69420
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 125 + + | + +47 | +
| Component | + + +Version | + + +
|---|---|
| libssl3 | + + +3.0.17-1~deb12u2 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + +CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
+ + +openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version: 3.0.17-1~deb12u3Issue summary: An application trying to decrypt CMS messages encrypted using
+
+password based encryption can trigger an out-of-bounds read and write.Impact summary: This out-of-bounds read may trigger a crash which leads to
+
+Denial of Service for an application. The out-of-bounds write can cause
+a memory corruption which can have various consequences including
+a Denial of Service or Execution of attacker-supplied code.Although the consequences of a successful exploit of this vulnerability
+
+could be severe, the probability that the attacker would be able to
+perform it is low. Besides, password based (PWRI) encryption support in CMS
+messages is very rarely used. For that reason the issue was assessed as
+Moderate severity according to our Security Policy.The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this
+issue, as the CMS implementation is outside the OpenSSL FIPS module
+boundary.
+ + + + + +3.0.17-1~deb12u3
+ + + + + + + +fixed
+ + + + + + + +http://www.openwall.com/lists/oss-security/2025/09/30/5
+https://access.redhat.com/errata/RHSA-2026:0337
+https://access.redhat.com/security/cve/CVE-2025-9230
+https://bugzilla.redhat.com/2396054
+https://bugzilla.redhat.com/show_bug.cgi?id=2396054
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9230
+https://errata.almalinux.org/8/ALSA-2026-0337.html
+https://errata.rockylinux.org/RLSA-2025:21248
+https://github.com/openssl/openssl/commit/5965ea5dd6960f36d8b7f74f8eac67a8eb8f2b45
+https://github.com/openssl/openssl/commit/9e91358f365dee6c446dcdcdb01c04d2743fd280
+https://github.com/openssl/openssl/commit/a79c4ce559c6a3a8fd4109e9f33c1185d5bf2def
+https://github.com/openssl/openssl/commit/b5282d677551afda7d20e9c00e09561b547b2dfd
+https://github.com/openssl/openssl/commit/bae259a211ada6315dc50900686daaaaaa55f482
+https://github.openssl.org/openssl/extended-releases/commit/c2b96348bfa662f25f4fabf81958ae822063dae3
+https://github.openssl.org/openssl/extended-releases/commit/dfbaf161d8dafc1132dd88cd48ad990ed9b4c8ba
+https://linux.oracle.com/cve/CVE-2025-9230.html
+https://linux.oracle.com/errata/ELSA-2026-50114.html
+https://lists.debian.org/debian-lts-announce/2025/10/msg00001.html
+https://nvd.nist.gov/vuln/detail/CVE-2025-9230
+https://openssl-library.org/news/secadv/20250930.txt
+https://ubuntu.com/security/notices/USN-7786-1
+https://www.cve.org/CVERecord?id=CVE-2025-9230
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 754 + + | + +48 | +
| Component | + + +Version | + + +
|---|---|
| libssl3 | + + +3.0.17-1~deb12u2 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + +CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
+ + +openssl: OpenSSL: Denial of Service due to type confusion in PKCS#12 file processing
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version: 3.0.18-1~deb12u2Issue summary: An invalid or NULL pointer dereference can happen in
+
+an application processing a malformed PKCS#12 file.Impact summary: An application processing a malformed PKCS#12 file can be
+
+caused to dereference an invalid or NULL pointer on memory read, resulting
+in a Denial of Service.A type confusion vulnerability exists in PKCS#12 parsing code where
+
+an ASN1_TYPE union member is accessed without first validating the type,
+causing an invalid pointer read.The location is constrained to a 1-byte address space, meaning any
+
+attempted pointer manipulation can only target addresses between 0x00 and 0xFF.
+This range corresponds to the zero page, which is unmapped on most modern
+operating systems and will reliably result in a crash, leading only to a
+Denial of Service. Exploiting this issue also requires a user or application
+to process a maliciously crafted PKCS#12 file. It is uncommon to accept
+untrusted PKCS#12 files in applications as they are usually used to store
+private keys which are trusted by definition. For these reasons, the issue
+was assessed as Low severity.The FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,
+
+as the PKCS12 implementation is outside the OpenSSL FIPS module boundary.OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.
+OpenSSL 1.0.2 is not affected by this issue.
+ + + + + +3.0.18-1~deb12u2
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/errata/RHSA-2026:1472
+https://access.redhat.com/security/cve/CVE-2026-22795
+https://bugzilla.redhat.com/2430375
+https://bugzilla.redhat.com/2430376
+https://bugzilla.redhat.com/2430377
+https://bugzilla.redhat.com/2430378
+https://bugzilla.redhat.com/2430379
+https://bugzilla.redhat.com/2430380
+https://bugzilla.redhat.com/2430381
+https://bugzilla.redhat.com/2430386
+https://bugzilla.redhat.com/2430387
+https://bugzilla.redhat.com/2430388
+https://bugzilla.redhat.com/2430389
+https://bugzilla.redhat.com/2430390
+https://bugzilla.redhat.com/show_bug.cgi?id=2430375
+https://bugzilla.redhat.com/show_bug.cgi?id=2430376
+https://bugzilla.redhat.com/show_bug.cgi?id=2430377
+https://bugzilla.redhat.com/show_bug.cgi?id=2430378
+https://bugzilla.redhat.com/show_bug.cgi?id=2430379
+https://bugzilla.redhat.com/show_bug.cgi?id=2430380
+https://bugzilla.redhat.com/show_bug.cgi?id=2430381
+https://bugzilla.redhat.com/show_bug.cgi?id=2430386
+https://bugzilla.redhat.com/show_bug.cgi?id=2430387
+https://bugzilla.redhat.com/show_bug.cgi?id=2430388
+https://bugzilla.redhat.com/show_bug.cgi?id=2430389
+https://bugzilla.redhat.com/show_bug.cgi?id=2430390
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796
+https://errata.almalinux.org/10/ALSA-2026-1472.html
+https://errata.rockylinux.org/RLSA-2026:1472
+https://github.com/openssl/openssl/commit/2502e7b7d4c0cf4f972a881641fe09edc67aeec4
+https://github.com/openssl/openssl/commit/572844beca95068394c916626a6d3a490f831a49
+https://github.com/openssl/openssl/commit/7bbca05be55b129651d9df4bdb92becc45002c12
+https://github.com/openssl/openssl/commit/eeee3cbd4d682095ed431052f00403004596373e
+https://github.com/openssl/openssl/commit/ef2fb66ec571564d64d1c74a12e388a2a54d05d2
+https://linux.oracle.com/cve/CVE-2026-22795.html
+https://linux.oracle.com/errata/ELSA-2026-50081.html
+https://nvd.nist.gov/vuln/detail/CVE-2026-22795
+https://openssl-library.org/news/secadv/20260127.txt
+https://ubuntu.com/security/notices/USN-7980-1
+https://ubuntu.com/security/notices/USN-7980-2
+https://www.cve.org/CVERecord?id=CVE-2026-22795
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 754 + + | + +49 | +
| Component | + + +Version | + + +
|---|---|
| libssl3 | + + +3.0.17-1~deb12u2 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + +CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +openssl: OpenSSL: Denial of Service via type confusion in PKCS#7 signature verification
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version: 3.0.18-1~deb12u2Issue summary: A type confusion vulnerability exists in the signature
+
+verification of signed PKCS#7 data where an ASN1_TYPE union member is
+accessed without first validating the type, causing an invalid or NULL
+pointer dereference when processing malformed PKCS#7 data.Impact summary: An application performing signature verification of PKCS#7
+
+data or calling directly the PKCS7_digest_from_attributes() function can be
+caused to dereference an invalid or NULL pointer when reading, resulting in
+a Denial of Service.The function PKCS7_digest_from_attributes() accesses the message digest attribute
+
+value without validating its type. When the type is not V_ASN1_OCTET_STRING,
+this results in accessing invalid memory through the ASN1_TYPE union, causing
+a crash.Exploiting this vulnerability requires an attacker to provide a malformed
+
+signed PKCS#7 to an application that verifies it. The impact of the
+exploit is just a Denial of Service, the PKCS7 API is legacy and applications
+should be using the CMS API instead. For these reasons the issue was
+assessed as Low severity.The FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,
+
+as the PKCS#7 parsing implementation is outside the OpenSSL FIPS module
+boundary.OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.
+ + + + + +3.0.18-1~deb12u2
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/errata/RHSA-2026:1472
+https://access.redhat.com/security/cve/CVE-2026-22796
+https://bugzilla.redhat.com/2430375
+https://bugzilla.redhat.com/2430376
+https://bugzilla.redhat.com/2430377
+https://bugzilla.redhat.com/2430378
+https://bugzilla.redhat.com/2430379
+https://bugzilla.redhat.com/2430380
+https://bugzilla.redhat.com/2430381
+https://bugzilla.redhat.com/2430386
+https://bugzilla.redhat.com/2430387
+https://bugzilla.redhat.com/2430388
+https://bugzilla.redhat.com/2430389
+https://bugzilla.redhat.com/2430390
+https://bugzilla.redhat.com/show_bug.cgi?id=2430375
+https://bugzilla.redhat.com/show_bug.cgi?id=2430376
+https://bugzilla.redhat.com/show_bug.cgi?id=2430377
+https://bugzilla.redhat.com/show_bug.cgi?id=2430378
+https://bugzilla.redhat.com/show_bug.cgi?id=2430379
+https://bugzilla.redhat.com/show_bug.cgi?id=2430380
+https://bugzilla.redhat.com/show_bug.cgi?id=2430381
+https://bugzilla.redhat.com/show_bug.cgi?id=2430386
+https://bugzilla.redhat.com/show_bug.cgi?id=2430387
+https://bugzilla.redhat.com/show_bug.cgi?id=2430388
+https://bugzilla.redhat.com/show_bug.cgi?id=2430389
+https://bugzilla.redhat.com/show_bug.cgi?id=2430390
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796
+https://errata.almalinux.org/10/ALSA-2026-1472.html
+https://errata.rockylinux.org/RLSA-2026:1472
+https://github.com/openssl/openssl/commit/2502e7b7d4c0cf4f972a881641fe09edc67aeec4
+https://github.com/openssl/openssl/commit/572844beca95068394c916626a6d3a490f831a49
+https://github.com/openssl/openssl/commit/7bbca05be55b129651d9df4bdb92becc45002c12
+https://github.com/openssl/openssl/commit/eeee3cbd4d682095ed431052f00403004596373e
+https://github.com/openssl/openssl/commit/ef2fb66ec571564d64d1c74a12e388a2a54d05d2
+https://linux.oracle.com/cve/CVE-2026-22796.html
+https://linux.oracle.com/errata/ELSA-2026-50081.html
+https://nvd.nist.gov/vuln/detail/CVE-2026-22796
+https://openssl-library.org/news/secadv/20260127.txt
+https://ubuntu.com/security/notices/USN-7980-1
+https://ubuntu.com/security/notices/USN-7980-2
+https://www.cve.org/CVERecord?id=CVE-2026-22796
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +Dojo ID | +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + +54 | +
| Component | + + +Version | + + +
|---|---|
| base64url | + + +0.0.6 | + + +
| File Path | +
|---|
| juice-shop/node_modules/base64url/package.json | +
+ + +Out-of-bounds Read in base64url
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 3.0.0Versions of
+base64urlbefore 3.0.0 are vulnerable to to out-of-bounds reads as it allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below.Recommendation
+Update to version 3.0.0 or later.
+ + + + + +3.0.0
+ + + + + + + +fixed
+ + + + + + + +https://github.com/brianloveswords/base64url
+https://github.com/brianloveswords/base64url/commit/4fbd954a0a69e9d898de2146557cc6e893e79542
+https://github.com/brianloveswords/base64url/pull/25
+https://hackerone.com/reports/321687
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 1321 + + | + +59 | +
| Component | + + +Version | + + +
|---|---|
| dottie | + + +2.0.6 | + + +
| File Path | +
|---|
| juice-shop/node_modules/dottie/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
+ + +dottie.js: dottie.js: Unauthorized object modification via prototype pollution bypass
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 2.0.7Dottie provides nested object access and manipulation in JavaScript. Versions 2.0.4 through 2.0.6 contain an incomplete fix for CVE-2023-26132. The prototype pollution guard introduced in commit
7d3aee1only validates the first segment of a dot-separated path, allowing an attacker to bypass the protection by placing__proto__at any position other than the first. Bothdottie.set()anddottie.transform()are affected. Version 2.0.7 contains an updated fix to address the residual vulnerability.
+ + + + + +2.0.7
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-27837
+https://github.com/advisories/GHSA-4gxf-g5gf-22h4
+https://github.com/mickhansen/dottie.js
+https://github.com/mickhansen/dottie.js/commit/7e8fa1345a4b46325f0eab8d7aeb1c4deaefdb14
+https://github.com/mickhansen/dottie.js/security/advisories/GHSA-r5mx-6wc6-7h9w
+https://nvd.nist.gov/vuln/detail/CVE-2026-27837
+https://www.cve.org/CVERecord?id=CVE-2026-27837
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 248 + + | + +60 | +
| Component | + + +Version | + + +
|---|---|
| engine.io | + + +4.1.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/engine.io/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
+ + +engine.io: Specially crafted HTTP request can trigger an uncaught exception
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 3.6.1, 6.2.1Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the engine.io package, including those who uses depending packages like socket.io. There is no known workaround except upgrading to a safe version. There are patches for this issue released in versions 3.6.1 and 6.2.1.
+ + + + + +3.6.1, 6.2.1
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2022-41940
+https://github.com/socketio/engine.io
+https://github.com/socketio/engine.io/commit/425e833ab13373edf1dd5a0706f07100db14e3c6
+https://github.com/socketio/engine.io/commit/83c4071af871fc188298d7d591e95670bf9f9085
+https://github.com/socketio/engine.io/security/advisories/GHSA-r7qp-cfhv-p84w
+https://nvd.nist.gov/vuln/detail/CVE-2022-41940
+https://www.cve.org/CVERecord?id=CVE-2022-41940
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +Dojo ID | +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + +63 | +
| Component | + + +Version | + + +
|---|---|
| got | + + +8.3.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/got/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
+ + +nodejs-got: missing verification of requested URLs allows redirects to UNIX sockets
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 12.1.0, 11.8.5The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
+ + + + + +12.1.0, 11.8.5
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/errata/RHSA-2022:6448
+https://access.redhat.com/security/cve/CVE-2022-33987
+https://bugzilla.redhat.com/2102001
+https://bugzilla.redhat.com/2105422
+https://bugzilla.redhat.com/2105426
+https://bugzilla.redhat.com/2105428
+https://bugzilla.redhat.com/2105430
+https://bugzilla.redhat.com/show_bug.cgi?id=1907444
+https://bugzilla.redhat.com/show_bug.cgi?id=1945459
+https://bugzilla.redhat.com/show_bug.cgi?id=1964461
+https://bugzilla.redhat.com/show_bug.cgi?id=2007557
+https://bugzilla.redhat.com/show_bug.cgi?id=2098556
+https://bugzilla.redhat.com/show_bug.cgi?id=2102001
+https://bugzilla.redhat.com/show_bug.cgi?id=2105422
+https://bugzilla.redhat.com/show_bug.cgi?id=2105426
+https://bugzilla.redhat.com/show_bug.cgi?id=2105428
+https://bugzilla.redhat.com/show_bug.cgi?id=2105430
+https://bugzilla.redhat.com/show_bug.cgi?id=2121019
+https://bugzilla.redhat.com/show_bug.cgi?id=2124299
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28469
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7788
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33502
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3807
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29244
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32213
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32214
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32215
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33987
+https://errata.almalinux.org/8/ALSA-2022-6448.html
+https://errata.rockylinux.org/RLSA-2022:6595
+https://github.com/sindresorhus/got
+https://github.com/sindresorhus/got/commit/861ccd9ac2237df762a9e2beed7edd88c60782dc
+https://github.com/sindresorhus/got/compare/v12.0.3...v12.1.0
+https://github.com/sindresorhus/got/pull/2047
+https://github.com/sindresorhus/got/releases/tag/v11.8.5
+https://github.com/sindresorhus/got/releases/tag/v12.1.0
+https://linux.oracle.com/cve/CVE-2022-33987.html
+https://linux.oracle.com/errata/ELSA-2022-6595.html
+https://nvd.nist.gov/vuln/detail/CVE-2022-33987
+https://www.cve.org/CVERecord?id=CVE-2022-33987
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 1321 + + | + +66 | +
| Component | + + +Version | + + +
|---|---|
| js-yaml | + + +3.14.1 | + + +
| File Path | +
|---|
| juice-shop/node_modules/js-yaml/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
+ + +js-yaml: js-yaml prototype pollution in merge
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 4.1.1, 3.14.2js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (
__proto__). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by usingnode --disable-proto=deleteordeno(in Deno, pollution protection is on by default).
+ + + + + +4.1.1, 3.14.2
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2025-64718
+https://github.com/advisories/GHSA-mh29-5h37-fv8m
+https://github.com/nodeca/js-yaml
+https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879
+https://github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266
+https://github.com/nodeca/js-yaml/issues/730#issuecomment-3549635876
+https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m
+https://nvd.nist.gov/vuln/detail/CVE-2025-64718
+https://www.cve.org/CVERecord?id=CVE-2025-64718
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 287 + + | + +70 | +
| Component | + + +Version | + + +
|---|---|
| jsonwebtoken | + + +0.1.0 | + + +
| File Path | +
|---|
| juice-shop/node_modules/express-jwt/node_modules/jsonwebtoken/package.json | +
+ + +CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L
+ + +jsonwebtoken: Insecure default algorithm in jwt.verify() could lead to signature validation bypass
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 9.0.0In versions
<=8.5.1ofjsonwebtokenlibrary, lack of algorithm definition in thejwt.verify()function can lead to signature validation bypass due to defaulting to thenonealgorithm for signature verification. Users are affected if you do not specify algorithms in thejwt.verify()function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in thejwt.verify()method. There will be no impact, if you update to version 9.0.0 and you don’t need to allow for thenonealgorithm. If you need 'none' algorithm, you have to explicitly specify that injwt.verify()options.
+ + + + + +9.0.0
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2022-23540
+https://github.com/auth0/node-jsonwebtoken
+https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3
+https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-qwph-4952-7xr6
+https://nvd.nist.gov/vuln/detail/CVE-2022-23540
+https://security.netapp.com/advisory/ntap-20240621-0007
+https://security.netapp.com/advisory/ntap-20240621-0007/
+https://www.cve.org/CVERecord?id=CVE-2022-23540
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 287 + + | + +71 | +
| Component | + + +Version | + + +
|---|---|
| jsonwebtoken | + + +0.1.0 | + + +
| File Path | +
|---|
| juice-shop/node_modules/express-jwt/node_modules/jsonwebtoken/package.json | +
+ + +CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
+ + +jsonwebtoken: Insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 9.0.0jsonwebtoken is an implementation of JSON Web Tokens. Versions
<= 8.5.1ofjsonwebtokenlibrary can be misconfigured so that passing a poorly implemented key retrieval function referring to thesecretOrPublicKeyargument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.
+ + + + + +9.0.0
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2022-23541
+https://github.com/auth0/node-jsonwebtoken
+https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3
+https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0
+https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959
+https://nvd.nist.gov/vuln/detail/CVE-2022-23541
+https://security.netapp.com/advisory/ntap-20240621-0007
+https://security.netapp.com/advisory/ntap-20240621-0007/
+https://www.cve.org/CVERecord?id=CVE-2022-23541
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 287 + + | + +75 | +
| Component | + + +Version | + + +
|---|---|
| jsonwebtoken | + + +0.4.0 | + + +
| File Path | +
|---|
| juice-shop/node_modules/jsonwebtoken/package.json | +
+ + +CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L
+ + +jsonwebtoken: Insecure default algorithm in jwt.verify() could lead to signature validation bypass
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 9.0.0In versions
<=8.5.1ofjsonwebtokenlibrary, lack of algorithm definition in thejwt.verify()function can lead to signature validation bypass due to defaulting to thenonealgorithm for signature verification. Users are affected if you do not specify algorithms in thejwt.verify()function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in thejwt.verify()method. There will be no impact, if you update to version 9.0.0 and you don’t need to allow for thenonealgorithm. If you need 'none' algorithm, you have to explicitly specify that injwt.verify()options.
+ + + + + +9.0.0
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2022-23540
+https://github.com/auth0/node-jsonwebtoken
+https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3
+https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-qwph-4952-7xr6
+https://nvd.nist.gov/vuln/detail/CVE-2022-23540
+https://security.netapp.com/advisory/ntap-20240621-0007
+https://security.netapp.com/advisory/ntap-20240621-0007/
+https://www.cve.org/CVERecord?id=CVE-2022-23540
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 287 + + | + +76 | +
| Component | + + +Version | + + +
|---|---|
| jsonwebtoken | + + +0.4.0 | + + +
| File Path | +
|---|
| juice-shop/node_modules/jsonwebtoken/package.json | +
+ + +CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
+ + +jsonwebtoken: Insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 9.0.0jsonwebtoken is an implementation of JSON Web Tokens. Versions
<= 8.5.1ofjsonwebtokenlibrary can be misconfigured so that passing a poorly implemented key retrieval function referring to thesecretOrPublicKeyargument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.
+ + + + + +9.0.0
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2022-23541
+https://github.com/auth0/node-jsonwebtoken
+https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3
+https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0
+https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959
+https://nvd.nist.gov/vuln/detail/CVE-2022-23541
+https://security.netapp.com/advisory/ntap-20240621-0007
+https://security.netapp.com/advisory/ntap-20240621-0007/
+https://www.cve.org/CVERecord?id=CVE-2022-23541
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 1321 + + | + +83 | +
| Component | + + +Version | + + +
|---|---|
| lodash | + + +4.17.21 | + + +
| File Path | +
|---|
| juice-shop/node_modules/lodash/package.json | +
+ + +lodash: prototype pollution in .unset and .omit functions
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 4.17.23Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the .unset and .omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.
+The issue permits deletion of properties but does not allow overwriting their original behavior.
+This issue is patched on 4.17.23
+ + + + + +4.17.23
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/errata/RHSA-2026:2438
+https://access.redhat.com/security/cve/CVE-2025-13465
+https://bugzilla.redhat.com/2431740
+https://errata.almalinux.org/10/ALSA-2026-2438.html
+https://github.com/lodash/lodash
+https://github.com/lodash/lodash/commit/edadd452146f7e4bad4ea684e955708931d84d81
+https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg
+https://linux.oracle.com/cve/CVE-2025-13465.html
+https://linux.oracle.com/errata/ELSA-2026-2452.html
+https://nvd.nist.gov/vuln/detail/CVE-2025-13465
+https://www.cve.org/CVERecord?id=CVE-2025-13465
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 1333 + + | + +87 | +
| Component | + + +Version | + + +
|---|---|
| micromatch | + + +3.1.10 | + + +
| File Path | +
|---|
| juice-shop/node_modules/micromatch/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
+ + +micromatch: vulnerable to Regular Expression Denial of Service
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 4.0.8The NPM package
micromatchprior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs inmicromatch.braces()inindex.jsbecause the pattern.*will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. This issue was fixed in version 4.0.8.
+ + + + + +4.0.8
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2024-4067
+https://advisory.checkmarx.net/advisory/CVE-2024-4067
+https://advisory.checkmarx.net/advisory/CVE-2024-4067/
+https://devhub.checkmarx.com/cve-details/CVE-2024-4067
+https://devhub.checkmarx.com/cve-details/CVE-2024-4067/
+https://github.com/micromatch/micromatch
+https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448
+https://github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2ade
+https://github.com/micromatch/micromatch/commit/500d5d6f42f0e8dfa1cb5464c6cb420b1b6aaaa0
+https://github.com/micromatch/micromatch/issues/243
+https://github.com/micromatch/micromatch/pull/247
+https://github.com/micromatch/micromatch/pull/266
+https://github.com/micromatch/micromatch/releases/tag/4.0.8
+https://nvd.nist.gov/vuln/detail/CVE-2024-4067
+https://www.cve.org/CVERecord?id=CVE-2024-4067
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 400 + + | + +129 | +
| Component | + + +Version | + + +
|---|---|
| moment | + + +2.0.0 | + + +
| File Path | +
|---|
| juice-shop/node_modules/express-jwt/node_modules/moment/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
+ + +moment.js: regular expression denial of service
+
+Target: Node.js
+Type: node-pkg
+Fixed version: >=2.11.2The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a "regular expression Denial of Service (ReDoS)."
+ + + + + ++=2.11.2
+
+ + + + + + + +fixed
+ + + + + + + +http://www.openwall.com/lists/oss-security/2016/04/20/11
+http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
+http://www.securityfocus.com/bid/95849
+https://access.redhat.com/security/cve/CVE-2016-4055
+https://github.com/advisories/GHSA-87vv-r9j6-g5qv
+https://github.com/moment/moment
+https://lists.apache.org/thread.html/10f0f3aefd51444d1198c65f44ffdf2d78ca3359423dbc1c168c9731%40%3Cdev.flink.apache.org%3E
+https://lists.apache.org/thread.html/10f0f3aefd51444d1198c65f44ffdf2d78ca3359423dbc1c168c9731@%3Cdev.flink.apache.org%3E
+https://lists.apache.org/thread.html/17ff53f7999e74fbe3cc0ceb4e1c3b00b180b7c5afec8e978837bc49%40%3Cuser.flink.apache.org%3E
+https://lists.apache.org/thread.html/17ff53f7999e74fbe3cc0ceb4e1c3b00b180b7c5afec8e978837bc49@%3Cuser.flink.apache.org%3E
+https://lists.apache.org/thread.html/52bafac05ad174000ea465fe275fd3cc7bd5c25535a7631c0bc9bfb2%40%3Cuser.flink.apache.org%3E
+https://lists.apache.org/thread.html/52bafac05ad174000ea465fe275fd3cc7bd5c25535a7631c0bc9bfb2@%3Cuser.flink.apache.org%3E
+https://lists.apache.org/thread.html/54df3aeb4239b64b50b356f0ca6f986e3c4ca5b84c515dce077c7854%40%3Cuser.flink.apache.org%3E
+https://lists.apache.org/thread.html/54df3aeb4239b64b50b356f0ca6f986e3c4ca5b84c515dce077c7854@%3Cuser.flink.apache.org%3E
+https://nodesecurity.io/advisories/55
+https://nvd.nist.gov/vuln/detail/CVE-2016-4055
+https://ubuntu.com/security/notices/USN-4786-1
+https://www.cve.org/CVERecord?id=CVE-2016-4055
+https://www.npmjs.com/advisories/55
+https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS
+https://www.tenable.com/security/tns-2019-02
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 1321 + + | + +134 | +
| Component | + + +Version | + + +
|---|---|
| notevil | + + +1.3.3 | + + +
| File Path | +
|---|
| juice-shop/node_modules/notevil/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
+ + + + + + +Sandbox escape in notevil and argencoders-notevil
+
+Target: Node.js
+Type: node-pkg
+Fixed version:This affects all versions of package notevil; all versions of package argencoders-notevil. It is vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing an attacker to add or modify an object's prototype. Note: This vulnerability derives from an incomplete fix in SNYK-JS-NOTEVIL-608878.
+ + + + + + + +affected
+ + + + + + + +https://github.com/mmckegg/notevil
+https://nvd.nist.gov/vuln/detail/CVE-2021-23771
+https://snyk.io/vuln/SNYK-JS-ARGENCODERSNOTEVIL-2388587
+https://snyk.io/vuln/SNYK-JS-NOTEVIL-2385946
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 79 + + | + +138 | +
| Component | + + +Version | + + +
|---|---|
| sanitize-html | + + +1.4.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/sanitize-html/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+ + +XSS - Sanitization not applied recursively
+
+Target: Node.js
+Type: node-pkg
+Fixed version: >=1.4.3sanitize-html before 1.4.3 has XSS.
+ + + + + ++=1.4.3
+
+ + + + + + + +fixed
+ + + + + + + +https://github.com/apostrophecms/sanitize-html/commit/762fbc7bba389f3f789cc291c1eb2b64f60f2caf
+https://github.com/apostrophecms/sanitize-html/issues/29
+https://github.com/punkave/sanitize-html/issues/29
+https://nodesecurity.io/advisories/135
+https://nvd.nist.gov/vuln/detail/CVE-2016-1000237
+https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000237.json
+https://www.npmjs.com/advisories/135
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 79 + + | + +139 | +
| Component | + + +Version | + + +
|---|---|
| sanitize-html | + + +1.4.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/sanitize-html/package.json | +
+ + +CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+ + +Cross-Site Scripting in sanitize-html
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 1.11.4Sanitize-html is a library for scrubbing html input of malicious values. Versions 1.11.1 and below are vulnerable to cross site scripting (XSS) in certain scenarios: If allowed at least one nonTextTags, the result is a potential XSS vulnerability.
+ + + + + +1.11.4
+ + + + + + + +fixed
+ + + + + + + +https://github.com/advisories/GHSA-xc6g-ggrc-qq4r
+https://github.com/punkave/sanitize-html/commit/5d205a1005ba0df80e21d8c64a15bb3accdb2403
+https://github.com/punkave/sanitize-html/commit/5d205a1005ba0df80e21d8c64a15bb3accdb2403)))
+https://github.com/punkave/sanitize-html/issues/100
+https://nodesecurity.io/advisories/154
+https://npmjs.com/package/sanitize-html#discarding-the-entire-contents-of-a-disallowed-tag
+https://nvd.nist.gov/vuln/detail/CVE-2017-16016
+https://www.npmjs.com/advisories/154
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 79 + + | + +140 | +
| Component | + + +Version | + + +
|---|---|
| sanitize-html | + + +1.4.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/sanitize-html/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+ + +sanitize-html: sanitize-html cross site scripting
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 2.0.0-beta
sanitize-htmlprior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). ThesanitizeHtml()function inindex.jsdoes not sanitize content when using the customtransformTagsoption, which is intended to convert attribute values into text. As a result, malicious input can be transformed into executable code.
+ + + + + +2.0.0-beta
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2019-25225
+https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2019/CVE-2019-25225
+https://github.com/apostrophecms/sanitize-html
+https://github.com/apostrophecms/sanitize-html/commit/712cb6895825c8bb6ede71a16b42bade42abcaf3
+https://github.com/apostrophecms/sanitize-html/issues/293
+https://github.com/apostrophecms/sanitize-html/pull/156
+https://nvd.nist.gov/vuln/detail/CVE-2019-25225
+https://www.cve.org/CVERecord?id=CVE-2019-25225
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +Dojo ID | +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + +141 | +
| Component | + + +Version | + + +
|---|---|
| sanitize-html | + + +1.4.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/sanitize-html/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
+ + +sanitize-html: improper handling of internationalized domain name (IDN) can lead to bypass hostname whitelist validation
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 2.3.1Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the "allowedIframeHostnames" option.
+ + + + + +2.3.1
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2021-26539
+https://advisory.checkmarx.net/advisory/CX-2021-4308
+https://github.com/apostrophecms/sanitize-html
+https://github.com/apostrophecms/sanitize-html/blob/main/CHANGELOG.md#231-2021-01-22
+https://github.com/apostrophecms/sanitize-html/commit/bdf7836ef8f0e5b21f9a1aab0623ae8fcd09c1da
+https://github.com/apostrophecms/sanitize-html/pull/458
+https://nvd.nist.gov/vuln/detail/CVE-2021-26539
+https://www.cve.org/CVERecord?id=CVE-2021-26539
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +Dojo ID | +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + +142 | +
| Component | + + +Version | + + +
|---|---|
| sanitize-html | + + +1.4.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/sanitize-html/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
+ + +sanitize-html: improper validation of hostnames set by the "allowedIframeHostnames" option can lead to bypass hostname whitelist for iframe element
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 2.3.2Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts with "/\example.com".
+ + + + + +2.3.2
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2021-26540
+https://advisory.checkmarx.net/advisory/CX-2021-4309
+https://github.com/apostrophecms/sanitize-html/blob/main/CHANGELOG.md#232-2021-01-26
+https://github.com/apostrophecms/sanitize-html/pull/460
+https://nvd.nist.gov/vuln/detail/CVE-2021-26540
+https://www.cve.org/CVERecord?id=CVE-2021-26540
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 200 + + | + +143 | +
| Component | + + +Version | + + +
|---|---|
| sanitize-html | + + +1.4.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/sanitize-html/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
+ + +sanitize-html: Information Exposure when used on the backend
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 2.12.1Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.
+ + + + + +2.12.1
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2024-21501
+https://gist.github.com/Slonser/8b4d061abe6ee1b2e10c7242987674cf
+https://github.com/apostrophecms/apostrophe/discussions/4436
+https://github.com/apostrophecms/sanitize-html
+https://github.com/apostrophecms/sanitize-html/commit/c5dbdf77fe8b836d3bf4554ea39edb45281ec0b4
+https://github.com/apostrophecms/sanitize-html/pull/650
+https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EB5JPYRCTS64EA5AMV3INHDPI6I4AW7
+https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EB5JPYRCTS64EA5AMV3INHDPI6I4AW7/
+https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P4I5X6V3LYUNBMZ5YOW4BV427TH3IK4S
+https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P4I5X6V3LYUNBMZ5YOW4BV427TH3IK4S/
+https://nvd.nist.gov/vuln/detail/CVE-2024-21501
+https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6276557
+https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-6256334
+https://www.cve.org/CVERecord?id=CVE-2024-21501
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +Dojo ID | +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + +144 | +
| Component | + + +Version | + + +
|---|---|
| sanitize-html | + + +1.4.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/sanitize-html/package.json | +
+ + +Cross Site Scripting
+
+Target: Node.js
+Type: node-pkg
+Fixed version: >=1.11.4Sanitize-html is a library for scrubbing html input of malicious values.
+Versions 1.11.1 and below are vulnerable to cross site scripting (XSS) in certain scenarios:
+If allowed at least one nonTextTags, the result is a potential XSS vulnerability.
+
+PoC:var sanitizeHtml = require('sanitize-html'); + +var dirty = '!<textarea></textarea><svg/onload=prompt`xs`></textarea>!'; +var clean = sanitizeHtml(dirty, { + allowedTags: [ 'textarea' ] +}); + +console.log(clean); + +// !<textarea></textarea><svg/onload=prompt`xs`></textarea>! +
+ + + + + ++=1.11.4
+
+ + + + + + + +fixed
+ + + + + + + +https://github.com/punkave/sanitize-html/commit/5d205a1005ba0df80e21d8c64a15bb3accdb2403
+https://github.com/punkave/sanitize-html/issues/100
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 20 + + | + +145 | +
| Component | + + +Version | + + +
|---|---|
| socket.io | + + +3.1.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/socket.io/package.json | +
+ + +socket.io: Unhandled 'error' event
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 2.5.1, 4.6.2Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit
15af22fc22which has been included insocket.io@4.6.2(released in May 2023). The fix was backported in the 2.x branch as well with commitd30630ba10. Users are advised to upgrade. Users unable to upgrade may attach a listener for the "error" event to catch these errors.
+ + + + + +2.5.1, 4.6.2
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2024-38355
+https://github.com/socketio/socket.io
+https://github.com/socketio/socket.io/commit/15af22fc22bc6030fcead322c106f07640336115
+https://github.com/socketio/socket.io/commit/d30630ba10562bf987f4d2b42440fc41a828119c
+https://github.com/socketio/socket.io/security/advisories/GHSA-25hc-qcg6-38wj
+https://nvd.nist.gov/vuln/detail/CVE-2024-38355
+https://www.cve.org/CVERecord?id=CVE-2024-38355
+https://www.vicarius.io/vsociety/posts/unhandled-exception-in-socketio-cve-2024-38355
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 20 + + | + +146 | +
| Component | + + +Version | + + +
|---|---|
| socket.io-parser | + + +4.0.5 | + + +
| File Path | +
|---|
| juice-shop/node_modules/socket.io-parser/package.json | +
+ + +socket.io parser is a socket.io encoder and decoder written in JavaScr ...
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 4.2.3, 3.4.3, 3.3.4socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3.
+ + + + + +4.2.3, 3.4.3, 3.3.4
+ + + + + + + +fixed
+ + + + + + + +https://github.com/socketio/socket.io-parser
+https://github.com/socketio/socket.io-parser/commit/1c220ddbf45ea4b44bc8dbf6f9ae245f672ba1b9
+https://github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced
+https://github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3
+https://github.com/socketio/socket.io-parser/commit/ee006607495eca4ec7262ad080dd3a91439a5ba4
+https://github.com/socketio/socket.io-parser/releases/tag/4.2.3
+https://github.com/socketio/socket.io-parser/security/advisories/GHSA-cqmj-92xf-r6r9
+https://nvd.nist.gov/vuln/detail/CVE-2023-32695
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 400 + + | + +151 | +
| Component | + + +Version | + + +
|---|---|
| tar | + + +4.4.19 | + + +
| File Path | +
|---|
| juice-shop/node_modules/node-pre-gyp/node_modules/tar/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
+ + +node-tar: denial of service while parsing a tar file due to lack of folders depth validation
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 6.2.1node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.
+ + + + + +6.2.1
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/errata/RHSA-2024:6148
+https://access.redhat.com/security/cve/CVE-2024-28863
+https://bugzilla.redhat.com/2293200
+https://bugzilla.redhat.com/2296417
+https://bugzilla.redhat.com/show_bug.cgi?id=2293200
+https://bugzilla.redhat.com/show_bug.cgi?id=2296417
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22020
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28863
+https://errata.almalinux.org/8/ALSA-2024-6148.html
+https://errata.rockylinux.org/RLSA-2024:6147
+https://github.com/isaacs/node-tar
+https://github.com/isaacs/node-tar/commit/fe8cd57da5686f8695415414bda49206a545f7f7
+https://github.com/isaacs/node-tar/commit/fe8cd57da5686f8695415414bda49206a545f7f7 (v6.2.1)
+https://github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36
+https://linux.oracle.com/cve/CVE-2024-28863.html
+https://linux.oracle.com/errata/ELSA-2024-6148.html
+https://nvd.nist.gov/vuln/detail/CVE-2024-28863
+https://security.netapp.com/advisory/ntap-20240524-0005
+https://security.netapp.com/advisory/ntap-20240524-0005/
+https://www.cve.org/CVERecord?id=CVE-2024-28863
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 79 + + | + +162 | +
| Component | + + +Version | + + +
|---|---|
| validator | + + +13.15.15 | + + +
| File Path | +
|---|
| juice-shop/node_modules/validator/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+ + +validator.js has a URL validation bypass vulnerability in its isURL function
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 13.15.20A URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.
+ + + + + +13.15.20
+ + + + + + + +fixed
+ + + + + + + +http://validatorjs.com
+https://gist.github.com/junan-98/27ae092aa40e2a057d41a0f95148f666
+https://gist.github.com/junan-98/a93130505b258b9e4ec9f393e7533596
+https://github.com/validatorjs/validator.js
+https://github.com/validatorjs/validator.js/commit/cbef5088f02d36caf978f378bb845fe49bdc0809
+https://github.com/validatorjs/validator.js/issues/2600
+https://github.com/validatorjs/validator.js/pull/2608
+https://github.com/validatorjs/validator.js/releases/tag/13.15.20
+https://nvd.nist.gov/vuln/detail/CVE-2025-56200
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 74 + + | + +167 | +
| Component | + + +Version | + + +
|---|---|
| vm2 | + + +3.9.17 | + + +
| File Path | +
|---|
| juice-shop/node_modules/vm2/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
+ + +vm2: Inspect Manipulation
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 3.9.18vm2 is a sandbox that can run untrusted code with Node's built-in modules. In versions 3.9.17 and lower of vm2 it was possible to get a read-write reference to the node
inspectmethod and edit options forconsole.log. As a result a threat actor can edit options for theconsole.logcommand. This vulnerability was patched in the release of version3.9.18ofvm2. Users are advised to upgrade. Users unable to upgrade may make theinspectmethod readonly withvm.readonly(inspect)after creating a vm.
+ + + + + +3.9.18
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2023-32313
+https://gist.github.com/arkark/c1c57eaf3e0a649af1a70c2b93b17550
+https://github.com/patriksimek/vm2
+https://github.com/patriksimek/vm2/commit/5206ba25afd86ef547a2c9d48d46ca7a9e6ec238
+https://github.com/patriksimek/vm2/releases/tag/3.9.18
+https://github.com/patriksimek/vm2/security/advisories/GHSA-p5gc-c584-jj6v
+https://nvd.nist.gov/vuln/detail/CVE-2023-32313
+https://www.cve.org/CVERecord?id=CVE-2023-32313
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Low + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 674 + + | + +26 | +
| Component | + + +Version | + + +
|---|---|
| gcc-12-base | + + +12.2.0-14+deb12u1 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + +CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
+ + + + + + +binutils: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack exhaustion in demangle_const
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version:libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.
+ + + + + + + +affected
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2022-27943
+https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039
+https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=1a770b01ef415e114164b6151d1e55acdee09371
+https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=9234cdca6ee88badfc00297e72f13dac4e540c79
+https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=fc968115a742d9e4674d9725ce9c2106b91b6ead
+https://gcc.gnu.org/pipermail/gcc-patches/2022-March/592244.html
+https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/
+https://nvd.nist.gov/vuln/detail/CVE-2022-27943
+https://sourceware.org/bugzilla/show_bug.cgi?id=28995
+https://www.cve.org/CVERecord?id=CVE-2022-27943
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Low + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 399 + + | + +32 | +
| Component | + + +Version | + + +
|---|---|
| libc6 | + + +2.36-9+deb12u10 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + + + + + +glibc: glob implementation can cause excessive CPU and memory consumption due to crafted glob expressions
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version:The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.
+ + + + + + + +affected
+ + + + + + + +http://cxib.net/stuff/glob-0day.c
+http://securityreason.com/achievement_securityalert/89
+http://securityreason.com/exploitalert/9223
+https://access.redhat.com/security/cve/CVE-2010-4756
+https://bugzilla.redhat.com/show_bug.cgi?id=681681
+https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4756
+https://nvd.nist.gov/vuln/detail/CVE-2010-4756
+https://security.netapp.com/advisory/ntap-20241108-0002/
+https://www.cve.org/CVERecord?id=CVE-2010-4756
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Low + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 674 + + | + +33 | +
| Component | + + +Version | + + +
|---|---|
| libc6 | + + +2.36-9+deb12u10 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + +CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + + + + + +glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version:In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\1\1|t1|\\2537)+' in grep.
+ + + + + + + +affected
+ + + + + + + +http://www.securityfocus.com/bid/107160
+https://access.redhat.com/security/cve/CVE-2018-20796
+https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141
+https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html
+https://nvd.nist.gov/vuln/detail/CVE-2018-20796
+https://security.netapp.com/advisory/ntap-20190315-0002/
+https://support.f5.com/csp/article/K26346590?utm_source=f5support&%3Butm_medium=RSS
+https://www.cve.org/CVERecord?id=CVE-2018-20796
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Low + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 119 + + | + +34 | +
| Component | + + +Version | + + +
|---|---|
| libc6 | + + +2.36-9+deb12u10 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + +CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+ + + + + + +glibc: stack guard protection bypass
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version:GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.
+ + + + + + + +affected
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2019-1010022
+https://nvd.nist.gov/vuln/detail/CVE-2019-1010022
+https://security-tracker.debian.org/tracker/CVE-2019-1010022
+https://sourceware.org/bugzilla/show_bug.cgi?id=22850
+https://sourceware.org/bugzilla/show_bug.cgi?id=22850#c3
+https://ubuntu.com/security/CVE-2019-1010022
+https://www.cve.org/CVERecord?id=CVE-2019-1010022
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +Dojo ID | +
|---|---|---|---|---|---|---|
| + + + Low + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + +35 | +
| Component | + + +Version | + + +
|---|---|
| libc6 | + + +2.36-9+deb12u10 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + +CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
+ + + + + + +glibc: running ldd on malicious ELF leads to code execution because of wrong size computation
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version:GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.
+ + + + + + + +affected
+ + + + + + + +http://www.securityfocus.com/bid/109167
+https://access.redhat.com/security/cve/CVE-2019-1010023
+https://nvd.nist.gov/vuln/detail/CVE-2019-1010023
+https://security-tracker.debian.org/tracker/CVE-2019-1010023
+https://sourceware.org/bugzilla/show_bug.cgi?id=22851
+https://support.f5.com/csp/article/K11932200?utm_source=f5support&%3Butm_medium=RSS
+https://ubuntu.com/security/CVE-2019-1010023
+https://www.cve.org/CVERecord?id=CVE-2019-1010023
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Low + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 200 + + | + +36 | +
| Component | + + +Version | + + +
|---|---|
| libc6 | + + +2.36-9+deb12u10 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + +CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
+ + + + + + +glibc: ASLR bypass using cache of thread stack and heap
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version:GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.
+ + + + + + + +affected
+ + + + + + + +http://www.securityfocus.com/bid/109162
+https://access.redhat.com/security/cve/CVE-2019-1010024
+https://nvd.nist.gov/vuln/detail/CVE-2019-1010024
+https://security-tracker.debian.org/tracker/CVE-2019-1010024
+https://sourceware.org/bugzilla/show_bug.cgi?id=22852
+https://support.f5.com/csp/article/K06046097
+https://support.f5.com/csp/article/K06046097?utm_source=f5support&%3Butm_medium=RSS
+https://ubuntu.com/security/CVE-2019-1010024
+https://www.cve.org/CVERecord?id=CVE-2019-1010024
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Low + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 330 + + | + +37 | +
| Component | + + +Version | + + +
|---|---|
| libc6 | + + +2.36-9+deb12u10 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + +CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
+ + + + + + +glibc: information disclosure of heap addresses of pthread_created thread
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version:GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is "ASLR bypass itself is not a vulnerability.
+ + + + + + + +affected
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2019-1010025
+https://nvd.nist.gov/vuln/detail/CVE-2019-1010025
+https://security-tracker.debian.org/tracker/CVE-2019-1010025
+https://sourceware.org/bugzilla/show_bug.cgi?id=22853
+https://support.f5.com/csp/article/K06046097
+https://support.f5.com/csp/article/K06046097?utm_source=f5support&%3Butm_medium=RSS
+https://ubuntu.com/security/CVE-2019-1010025
+https://www.cve.org/CVERecord?id=CVE-2019-1010025
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Low + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 674 + + | + +38 | +
| Component | + + +Version | + + +
|---|---|
| libc6 | + + +2.36-9+deb12u10 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + +CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + + + + + +glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version:In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\1\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern
+ + + + + + + +affected
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2019-9192
+https://nvd.nist.gov/vuln/detail/CVE-2019-9192
+https://sourceware.org/bugzilla/show_bug.cgi?id=24269
+https://support.f5.com/csp/article/K26346590?utm_source=f5support&%3Butm_medium=RSS
+https://www.cve.org/CVERecord?id=CVE-2019-9192
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Low + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 674 + + | + +39 | +
| Component | + + +Version | + + +
|---|---|
| libgcc-s1 | + + +12.2.0-14+deb12u1 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + +CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
+ + + + + + +binutils: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack exhaustion in demangle_const
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version:libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.
+ + + + + + + +affected
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2022-27943
+https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039
+https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=1a770b01ef415e114164b6151d1e55acdee09371
+https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=9234cdca6ee88badfc00297e72f13dac4e540c79
+https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=fc968115a742d9e4674d9725ce9c2106b91b6ead
+https://gcc.gnu.org/pipermail/gcc-patches/2022-March/592244.html
+https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/
+https://nvd.nist.gov/vuln/detail/CVE-2022-27943
+https://sourceware.org/bugzilla/show_bug.cgi?id=28995
+https://www.cve.org/CVERecord?id=CVE-2022-27943
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Low + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 674 + + | + +40 | +
| Component | + + +Version | + + +
|---|---|
| libgomp1 | + + +12.2.0-14+deb12u1 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + +CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
+ + + + + + +binutils: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack exhaustion in demangle_const
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version:libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.
+ + + + + + + +affected
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2022-27943
+https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039
+https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=1a770b01ef415e114164b6151d1e55acdee09371
+https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=9234cdca6ee88badfc00297e72f13dac4e540c79
+https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=fc968115a742d9e4674d9725ce9c2106b91b6ead
+https://gcc.gnu.org/pipermail/gcc-patches/2022-March/592244.html
+https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/
+https://nvd.nist.gov/vuln/detail/CVE-2022-27943
+https://sourceware.org/bugzilla/show_bug.cgi?id=28995
+https://www.cve.org/CVERecord?id=CVE-2022-27943
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Low + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 385 + + | + +50 | +
| Component | + + +Version | + + +
|---|---|
| libssl3 | + + +3.0.17-1~deb12u2 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + + + + + +OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable ...
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version:OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of random messages using the EVP_DigestSign API, and then using the private key to extract the K value (nonce) from the signatures. Next, based on the bit size of the extracted nonce, one can compare the signing time of full-sized nonces to signatures that used smaller nonces, via statistical tests. There is a side-channel in the P-364 curve that allows private key extraction (also, there is a dependency between the bit size of K and the size of the side channel). NOTE: This CVE is disputed because the OpenSSL security policy explicitly notes that any side channels which require same physical system to be detected are outside of the threat model for the software. The timing signal is so small that it is infeasible to be detected without having the attacking process running on the same physical system.
+ + + + + + + +affected
+ + + + + + + +https://github.com/openssl/openssl/issues/24253
+https://minerva.crocs.fi.muni.cz
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Low + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 125 + + | + +51 | +
| Component | + + +Version | + + +
|---|---|
| libssl3 | + + +3.0.17-1~deb12u2 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + +CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
+ + +openssl: Out-of-bounds read in HTTP client no_proxy handling
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version: 3.0.17-1~deb12u3Issue summary: An application using the OpenSSL HTTP client API functions may
+
+trigger an out-of-bounds read if the 'no_proxy' environment variable is set and
+the host portion of the authority component of the HTTP URL is an IPv6 address.Impact summary: An out-of-bounds read can trigger a crash which leads to
+
+Denial of Service for an application.The OpenSSL HTTP client API functions can be used directly by applications
+
+but they are also used by the OCSP client functions and CMP (Certificate
+Management Protocol) client implementation in OpenSSL. However the URLs used
+by these implementations are unlikely to be controlled by an attacker.In this vulnerable code the out of bounds read can only trigger a crash.
+
+Furthermore the vulnerability requires an attacker-controlled URL to be
+passed from an application to the OpenSSL function and the user has to have
+a 'no_proxy' environment variable set. For the aforementioned reasons the
+issue was assessed as Low severity.The vulnerable code was introduced in the following patch releases:
+
+3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0.The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this
+issue, as the HTTP client implementation is outside the OpenSSL FIPS module
+boundary.
+ + + + + +3.0.17-1~deb12u3
+ + + + + + + +fixed
+ + + + + + + +http://www.openwall.com/lists/oss-security/2025/09/30/5
+https://access.redhat.com/security/cve/CVE-2025-9232
+https://github.com/openssl/openssl/commit/2b4ec20e47959170422922eaff25346d362dcb35
+https://github.com/openssl/openssl/commit/654dc11d23468a74fc8ea4672b702dd3feb7be4b
+https://github.com/openssl/openssl/commit/7cf21a30513c9e43c4bc3836c237cf086e194af3
+https://github.com/openssl/openssl/commit/89e790ac431125a4849992858490bed6b225eadf
+https://github.com/openssl/openssl/commit/bbf38c034cdabd0a13330abcc4855c866f53d2e0
+https://nvd.nist.gov/vuln/detail/CVE-2025-9232
+https://openssl-library.org/news/secadv/20250930.txt
+https://ubuntu.com/security/notices/USN-7786-1
+https://ubuntu.com/security/notices/USN-7894-1
+https://www.cve.org/CVERecord?id=CVE-2025-9232
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Low + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 674 + + | + +52 | +
| Component | + + +Version | + + +
|---|---|
| libstdc++6 | + + +12.2.0-14+deb12u1 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + +CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
+ + + + + + +binutils: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack exhaustion in demangle_const
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version:libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.
+ + + + + + + +affected
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2022-27943
+https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039
+https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=1a770b01ef415e114164b6151d1e55acdee09371
+https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=9234cdca6ee88badfc00297e72f13dac4e540c79
+https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=fc968115a742d9e4674d9725ce9c2106b91b6ead
+https://gcc.gnu.org/pipermail/gcc-patches/2022-March/592244.html
+https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/
+https://nvd.nist.gov/vuln/detail/CVE-2022-27943
+https://sourceware.org/bugzilla/show_bug.cgi?id=28995
+https://www.cve.org/CVERecord?id=CVE-2022-27943
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Low + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 74 + + | + +56 | +
| Component | + + +Version | + + +
|---|---|
| cookie | + + +0.4.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/engine.io/node_modules/cookie/package.json | +
+ + +CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
+ + +cookie: cookie accepts cookie name, path, and domain with out of bounds characters
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 0.7.0cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.
+ + + + + +0.7.0
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2024-47764
+https://github.com/jshttp/cookie
+https://github.com/jshttp/cookie/commit/e10042845354fea83bd8f34af72475eed1dadf5c
+https://github.com/jshttp/cookie/pull/167
+https://github.com/jshttp/cookie/security/advisories/GHSA-pxg6-pf52-xh8x
+https://nvd.nist.gov/vuln/detail/CVE-2024-47764
+https://www.cve.org/CVERecord?id=CVE-2024-47764
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Low + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 400 + + | + +58 | +
| Component | + + +Version | + + +
|---|---|
| diff | + + +4.0.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/ts-node-dev/node_modules/diff/package.json | +
+ + +jsdiff: denial of service vulnerability in parsePatch and applyPatch
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 8.0.3, 5.2.2, 4.0.4, 3.5.1jsdiff is a JavaScript text differencing implementation. Prior to versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1, attempting to parse a patch whose filename headers contain the line break characters
\r,\u2028, or\u2029can cause theparsePatchmethod to enter an infinite loop. It then consumes memory without limit until the process crashes due to running out of memory. Applications are therefore likely to be vulnerable to a denial-of-service attack if they callparsePatchwith a user-provided patch as input. A large payload is not needed to trigger the vulnerability, so size limits on user input do not provide any protection. Furthermore, some applications may be vulnerable even when callingparsePatchon a patch generated by the application itself if the user is nonetheless able to control the filename headers (e.g. by directly providing the filenames of the files to be diffed). TheapplyPatchmethod is similarly affected if (and only if) called with a string representation of a patch as an argument, since under the hood it parses that string usingparsePatch. Other methods of the library are unaffected. Finally, a second and lesser interdependent bug - a ReDOS - also exhibits when those same line break characters are present in a patch's patch header (also known as its "leading garbage"). A maliciously-crafted patch header of length n can takeparsePatchO(n³) time to parse. Versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1 contain a fix. As a workaround, do not attempt to parse patches that contain any of these characters:\r,\u2028, or\u2029.
+ + + + + +8.0.3, 5.2.2, 4.0.4, 3.5.1
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2026-24001
+https://github.com/kpdecker/jsdiff
+https://github.com/kpdecker/jsdiff/commit/15a1585230748c8ae6f8274c202e0c87309142f5
+https://github.com/kpdecker/jsdiff/issues/653
+https://github.com/kpdecker/jsdiff/pull/649
+https://github.com/kpdecker/jsdiff/security/advisories/GHSA-73rr-hh4g-fpgx
+https://nvd.nist.gov/vuln/detail/CVE-2026-24001
+https://www.cve.org/CVERecord?id=CVE-2026-24001
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Low + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 471 + + | + +82 | +
| Component | + + +Version | + + +
|---|---|
| lodash | + + +2.4.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
+ + +lodash: Prototype pollution in utilities function
+
+Target: Node.js
+Type: node-pkg
+Fixed version: >=4.17.5lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.
+ + + + + ++=4.17.5
+
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2018-3721
+https://github.com/advisories/GHSA-fvqr-27wr-82fm
+https://github.com/lodash/lodash/commit/d8e069cc3410082e44eb18fcf8e7f3d08ebe1d4a
+https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2018-3721.yml
+https://hackerone.com/reports/310443
+https://nvd.nist.gov/vuln/detail/CVE-2018-3721
+https://security.netapp.com/advisory/ntap-20190919-0004
+https://security.netapp.com/advisory/ntap-20190919-0004/
+https://snyk.io/vuln/npm:lodash:20180130
+https://www.cve.org/CVERecord?id=CVE-2018-3721
+https://www.npmjs.com/advisories/577
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Low + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 1321 + + | + +86 | +
| Component | + + +Version | + + +
|---|---|
| messageformat | + + +2.3.0 | + + +
| File Path | +
|---|
| juice-shop/node_modules/messageformat/package.json | +
+ + +messageformat has a prototype pollution vulnerability
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 3.0.0-beta.0The messageformat package, an implementation of the Unicode MessageFormat 2 specification for JavaScript, is vulnerable to prototype pollution due to improper handling of message key paths in versions prior to 2.3.0. The flaw arises when processing nested message keys containing special characters (e.g., proto ), which can lead to unintended modification of the JavaScript Object prototype. This vulnerability may allow a remote attacker to inject properties into the global object prototype via specially crafted message input, potentially causing denial of service or other undefined behaviors in applications using the affected component.
+ + + + + +3.0.0-beta.0
+ + + + + + + +fixed
+ + + + + + + +https://github.com/messageformat/messageformat
+https://github.com/messageformat/messageformat/issues/452
+https://nvd.nist.gov/vuln/detail/CVE-2025-57349
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + +Dojo ID | +
|---|---|---|---|---|---|---|---|
| + + + Low + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +April 13, 2026 | +0 days | +Admin User (admin) | + + ++ + 20 + + | + +136 | +
| Component | + + +Version | + + +
|---|---|
| qs | + + +6.13.0 | + + +
| File Path | +
|---|
| juice-shop/node_modules/qs/package.json | +
+ + +CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
+ + +qs: qs's arrayLimit bypass in comma parsing allows denial of service
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 6.14.2Summary
+The
+arrayLimitoption in qs does not enforce limits for comma-separated values whencomma: trueis enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass addressed in GHSA-6rw7-vpxm-498p (CVE-2025-15284).Details
+When the
+commaoption is set totrue(not the default, but configurable in applications), qs allows parsing comma-separated strings as arrays (e.g.,?param=a,b,cbecomes['a', 'b', 'c']). However, the limit check forarrayLimit(default: 20) and the optional throwOnLimitExceeded occur after the comma-handling logic inparseArrayValue, enabling a bypass. This permits creation of arbitrarily large arrays from a single parameter, leading to excessive memory allocation.Vulnerable code (lib/parse.js: lines ~40-50):
++ +if (val && typeof val === 'string' && options.comma && val.indexOf(',') > -1) { + return val.split(','); +} + +if (options.throwOnLimitExceeded && currentArrayLength >= options.arrayLimit) { + throw new RangeError('Array limit exceeded. Only ' + options.arrayLimit + ' element' + (options.arrayLimit === 1 ? '' : 's') + ' allowed in an array.'); +} + +return val; +The
+split(',')returns the array immediately, skipping the subsequent limit check. Downstream merging viautils.combinedoes not prevent allocation, even if it marks overflows for sparse arrays.This discrepancy allows attackers to send a single parameter with millions of commas (e.g.,?param=,,,,,,,,...), allocating massive arrays in memory without triggering limits. It bypasses the intent ofarrayLimit, which is enforced correctly for indexed (a[0]=) and bracket (a[]=) notations (the latter fixed in v6.14.1 per GHSA-6rw7-vpxm-498p).PoC
+Test 1 - Basic bypass:
++ +npm install qs ++ +const qs = require('qs'); + +const payload = 'a=' + ','.repeat(25); // 26 elements after split (bypasses arrayLimit: 5) +const options = { comma: true, arrayLimit: 5, throwOnLimitExceeded: true }; + +try { + const result = qs.parse(payload, options); + console.log(result.a.length); // Outputs: 26 (bypass successful) +} catch (e) { + console.log('Limit enforced:', e.message); // Not thrown +} +Configuration:
+
+-comma: true
+-arrayLimit: 5
+-throwOnLimitExceeded: trueExpected: Throws "Array limit exceeded" error.
+
+Actual: Parses successfully, creating an array of length 26.Impact
+Denial of Service (DoS) via memory exhaustion.
+ + + + + +6.14.2
+ + + + + + + +fixed
+ + + + + + +https://access.redhat.com/security/cve/CVE-2026-2391
+https://github.com/ljharb/qs
+https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482
+https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883
+https://nvd.nist.gov/vuln/detail/CVE-2026-2391
+https://www.cve.org/CVERecord?id=CVE-2026-2391
Ensure JavaScript source files are loaded from only trusted sources, and the sources can't be controlled by end users of the application.
", + "otherinfo": "", + "reference": "", + "cweid": "829", + "wascid": "15", + "sourceid": "4" + }, + { + "pluginid": "2", + "alertRef": "2", + "alert": "Private IP Disclosure", + "name": "Private IP Disclosure", + "riskcode": "1", + "confidence": "2", + "riskdesc": "Low (Medium)", + "desc": "A private IP (such as 10.x.x.x, 172.x.x.x, 192.168.x.x) or an Amazon EC2 private hostname (for example, ip-10-0-56-78) has been found in the HTTP response body. This information might be helpful for further attacks targeting internal systems.
", + "instances":[ + { + "id": "166", + "uri": "http://localhost:3000/rest/admin/application-configuration", + "nodeName": "http:\/\/localhost:3000\/rest\/admin\/application-configuration", + "method": "GET", + "param": "", + "attack": "", + "evidence": "192.168.99.100:3000", + "otherinfo": "192.168.99.100:3000\n192.168.99.100:4200\n" + } + ], + "count": "1", + "systemic": false, + "solution": "Remove the private IP address from the HTTP response body. For comments, use JSP/ASP/PHP comment instead of HTML/JavaScript comment which can be seen by client browsers.
", + "otherinfo": "192.168.99.100:3000
192.168.99.100:4200
", + "reference": "https://datatracker.ietf.org/doc/html/rfc1918
", + "cweid": "497", + "wascid": "13", + "sourceid": "115" + }, + { + "pluginid": "10096", + "alertRef": "10096", + "alert": "Timestamp Disclosure - Unix", + "name": "Timestamp Disclosure - Unix", + "riskcode": "1", + "confidence": "1", + "riskdesc": "Low (Low)", + "desc": "A timestamp was disclosed by the application/web server. - Unix
", + "instances":[ + { + "id": "19", + "uri": "http://localhost:3000", + "nodeName": "http:\/\/localhost:3000", + "method": "GET", + "param": "", + "attack": "", + "evidence": "1650485437", + "otherinfo": "1650485437, which evaluates to: 2022-04-20 20:10:37." + }, + { + "id": "22", + "uri": "http://localhost:3000", + "nodeName": "http:\/\/localhost:3000", + "method": "GET", + "param": "", + "attack": "", + "evidence": "2038834951", + "otherinfo": "2038834951, which evaluates to: 2034-08-10 15:02:31." + }, + { + "id": "18", + "uri": "http://localhost:3000/sitemap.xml", + "nodeName": "http:\/\/localhost:3000\/sitemap.xml", + "method": "GET", + "param": "", + "attack": "", + "evidence": "1650485437", + "otherinfo": "1650485437, which evaluates to: 2022-04-20 20:10:37." + }, + { + "id": "24", + "uri": "http://localhost:3000/sitemap.xml", + "nodeName": "http:\/\/localhost:3000\/sitemap.xml", + "method": "GET", + "param": "", + "attack": "", + "evidence": "1981395349", + "otherinfo": "1981395349, which evaluates to: 2032-10-14 19:35:49." + }, + { + "id": "21", + "uri": "http://localhost:3000/sitemap.xml", + "nodeName": "http:\/\/localhost:3000\/sitemap.xml", + "method": "GET", + "param": "", + "attack": "", + "evidence": "2038834951", + "otherinfo": "2038834951, which evaluates to: 2034-08-10 15:02:31." + } + ], + "count": "5", + "systemic": true, + "solution": "Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.
", + "otherinfo": "1650485437, which evaluates to: 2022-04-20 20:10:37.
", + "reference": "https://cwe.mitre.org/data/definitions/200.html
", + "cweid": "497", + "wascid": "13", + "sourceid": "9" + }, + { + "pluginid": "10021", + "alertRef": "10021", + "alert": "X-Content-Type-Options Header Missing", + "name": "X-Content-Type-Options Header Missing", + "riskcode": "1", + "confidence": "2", + "riskdesc": "Low (Medium)", + "desc": "The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.
", + "instances":[ + { + "id": "173", + "uri": "http://localhost:3000/socket.io/?EIO=4&transport=polling&t=PpDMJu-.0&sid=KESNBZKUxCkvVf4SAAAA", + "nodeName": "http:\/\/localhost:3000\/socket.io\/ (EIO,sid,t,transport)", + "method": "GET", + "param": "x-content-type-options", + "attack": "", + "evidence": "", + "otherinfo": "This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.\nAt \"High\" threshold this scan rule will not alert on client or server error responses." + }, + { + "id": "162", + "uri": "http://localhost:3000/socket.io/?EIO=4&transport=polling&t=PpDMJsY", + "nodeName": "http:\/\/localhost:3000\/socket.io\/ (EIO,t,transport)", + "method": "GET", + "param": "x-content-type-options", + "attack": "", + "evidence": "", + "otherinfo": "This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.\nAt \"High\" threshold this scan rule will not alert on client or server error responses." + }, + { + "id": "187", + "uri": "http://localhost:3000/socket.io/?EIO=4&transport=polling&t=PpDMJu-&sid=KESNBZKUxCkvVf4SAAAA", + "nodeName": "http:\/\/localhost:3000\/socket.io\/ (EIO,sid,t,transport)(40)", + "method": "POST", + "param": "x-content-type-options", + "attack": "", + "evidence": "", + "otherinfo": "This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.\nAt \"High\" threshold this scan rule will not alert on client or server error responses." + }, + { + "id": "221", + "uri": "http://localhost:3000/socket.io/?EIO=4&transport=polling&t=PpDMJv-&sid=KESNBZKUxCkvVf4SAAAA", + "nodeName": "http:\/\/localhost:3000\/socket.io\/ (EIO,sid,t,transport)(42[\"notification received\",\"8d2072c6b0a4...)", + "method": "POST", + "param": "x-content-type-options", + "attack": "", + "evidence": "", + "otherinfo": "This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.\nAt \"High\" threshold this scan rule will not alert on client or server error responses." + }, + { + "id": "229", + "uri": "http://localhost:3000/socket.io/?EIO=4&transport=polling&t=PpDMJwV&sid=KESNBZKUxCkvVf4SAAAA", + "nodeName": "http:\/\/localhost:3000\/socket.io\/ (EIO,sid,t,transport)(42[\"notification received\",\"9c297196ecf8...)", + "method": "POST", + "param": "x-content-type-options", + "attack": "", + "evidence": "", + "otherinfo": "This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.\nAt \"High\" threshold this scan rule will not alert on client or server error responses." + } + ], + "count": "5", + "systemic": true, + "solution": "Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages.
If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.
", + "otherinfo": "This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.
At \"High\" threshold this scan rule will not alert on client or server error responses.
", + "reference": "https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/compatibility/gg622941(v=vs.85)
https://owasp.org/www-community/Security_Headers
", + "cweid": "693", + "wascid": "15", + "sourceid": "125" + }, + { + "pluginid": "10111", + "alertRef": "10111", + "alert": "Authentication Request Identified", + "name": "Authentication Request Identified", + "riskcode": "0", + "confidence": "3", + "riskdesc": "Informational (High)", + "desc": "The given request has been identified as an authentication request. The 'Other Info' field contains a set of key=value lines which identify any relevant fields. If the request is in a context which has an Authentication Method set to \"Auto-Detect\" then this rule will change the authentication to match the request identified.
", + "instances":[ + { + "id": "0", + "uri": "http://localhost:3000/rest/user/login", + "nodeName": "http:\/\/localhost:3000\/rest\/user\/login ()({email,password})", + "method": "POST", + "param": "email", + "attack": "", + "evidence": "password", + "otherinfo": "userParam=email\nuserValue=admin@juice-sh.op\npasswordParam=password" + } + ], + "count": "1", + "systemic": false, + "solution": "This is an informational alert rather than a vulnerability and so there is nothing to fix.
", + "otherinfo": "userParam=email
userValue=admin@juice-sh.op
passwordParam=password
", + "reference": "https://www.zaproxy.org/docs/desktop/addons/authentication-helper/auth-req-id/
", + "cweid": "-1", + "wascid": "-1", + "sourceid": "13" + }, + { + "pluginid": "10109", + "alertRef": "10109", + "alert": "Modern Web Application", + "name": "Modern Web Application", + "riskcode": "0", + "confidence": "2", + "riskdesc": "Informational (Medium)", + "desc": "The application appears to be a modern web application. If you need to explore it automatically then the Ajax Spider may well be more effective than the standard one.
", + "instances":[ + { + "id": "16", + "uri": "http://localhost:3000", + "nodeName": "http:\/\/localhost:3000", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "No links have been found while there are scripts, which is an indication that this is a modern web application." + }, + { + "id": "61", + "uri": "http://localhost:3000/", + "nodeName": "http:\/\/localhost:3000\/", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "No links have been found while there are scripts, which is an indication that this is a modern web application." + }, + { + "id": "93", + "uri": "http://localhost:3000/juice-shop/node_modules/express/lib/router/index.js:328:13", + "nodeName": "http:\/\/localhost:3000\/juice-shop\/node_modules\/express\/lib\/router\/index.js:328:13", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "No links have been found while there are scripts, which is an indication that this is a modern web application." + }, + { + "id": "87", + "uri": "http://localhost:3000/juice-shop/node_modules/express/lib/router/index.js:376:14", + "nodeName": "http:\/\/localhost:3000\/juice-shop\/node_modules\/express\/lib\/router\/index.js:376:14", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "No links have been found while there are scripts, which is an indication that this is a modern web application." + }, + { + "id": "15", + "uri": "http://localhost:3000/sitemap.xml", + "nodeName": "http:\/\/localhost:3000\/sitemap.xml", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "No links have been found while there are scripts, which is an indication that this is a modern web application." + } + ], + "count": "5", + "systemic": true, + "solution": "This is an informational alert and so no changes are required.
", + "otherinfo": "No links have been found while there are scripts, which is an indication that this is a modern web application.
", + "reference": "", + "cweid": "-1", + "wascid": "-1", + "sourceid": "9" + }, + { + "pluginid": "10112", + "alertRef": "10112", + "alert": "Session Management Response Identified", + "name": "Session Management Response Identified", + "riskcode": "0", + "confidence": "2", + "riskdesc": "Informational (Medium)", + "desc": "The given response has been identified as containing a session management token. The 'Other Info' field contains a set of header tokens that can be used in the Header Based Session Management Method. If the request is in a context which has a Session Management Method set to \"Auto-Detect\" then this rule will change the session management to use the tokens identified.
", + "instances":[ + { + "id": "2", + "uri": "http://localhost:3000/rest/user/login", + "nodeName": "http:\/\/localhost:3000\/rest\/user\/login ()({email,password})", + "method": "POST", + "param": "authentication.token", + "attack": "", + "evidence": "authentication.token", + "otherinfo": "json:authentication.token" + }, + { + "id": "241", + "uri": "http://localhost:3000/rest/continue-code", + "nodeName": "http:\/\/localhost:3000\/rest\/continue-code", + "method": "GET", + "param": "continueCode", + "attack": "", + "evidence": "continueCode", + "otherinfo": "json:continueCode" + } + ], + "count": "2", + "systemic": false, + "solution": "This is an informational alert rather than a vulnerability and so there is nothing to fix.
", + "otherinfo": "json:authentication.token
", + "reference": "https://www.zaproxy.org/docs/desktop/addons/authentication-helper/session-mgmt-id/
", + "cweid": "-1", + "wascid": "-1", + "sourceid": "13" + }, + { + "pluginid": "10104", + "alertRef": "10104", + "alert": "User Agent Fuzzer", + "name": "User Agent Fuzzer", + "riskcode": "0", + "confidence": "2", + "riskdesc": "Informational (Medium)", + "desc": "Check for differences in response based on fuzzed User Agent (eg. mobile sites, access as a Search Engine Crawler). Compares the response statuscode and the hashcode of the response body with the original response.
", + "instances":[ + { + "id": "891", + "uri": "http://localhost:3000/socket.io/?EIO=4&transport=polling&t=PpDMQCF&sid=ndu9dUzrTreIpCJvAAA1", + "nodeName": "http:\/\/localhost:3000\/socket.io\/ (EIO,sid,t,transport)", + "method": "GET", + "param": "Header User-Agent", + "attack": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)", + "evidence": "", + "otherinfo": "" + }, + { + "id": "892", + "uri": "http://localhost:3000/socket.io/?EIO=4&transport=websocket&sid=ndu9dUzrTreIpCJvAAA1", + "nodeName": "http:\/\/localhost:3000\/socket.io\/ (EIO,sid,transport)", + "method": "GET", + "param": "Header User-Agent", + "attack": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)", + "evidence": "", + "otherinfo": "" + }, + { + "id": "890", + "uri": "http://localhost:3000/socket.io/?EIO=4&transport=polling&t=PpDMPs9", + "nodeName": "http:\/\/localhost:3000\/socket.io\/ (EIO,t,transport)", + "method": "GET", + "param": "Header User-Agent", + "attack": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)", + "evidence": "", + "otherinfo": "" + } + ], + "count": "3", + "systemic": true, + "solution": "", + "otherinfo": "", + "reference": "https://owasp.org/wstg
", + "cweid": "0", + "wascid": "0", + "sourceid": "1702" + } + ] + } + ], + "sequences":[ + ] + +} diff --git a/labs/lab5/zap/zap-report-noauth.json b/labs/lab5/zap/zap-report-noauth.json new file mode 100644 index 00000000..3b58c89c --- /dev/null +++ b/labs/lab5/zap/zap-report-noauth.json @@ -0,0 +1,855 @@ +{ + "@programName": "ZAP", + "@version": "2.17.0", + "@generated": "Sun, 8 Mar 2026 12:07:04", + "created": "2026-03-08T12:07:04.506801668Z", + "insights":[ + { + "level": "Low", + "reason": "Warning", + "site": "", + "key": "insight.log.warn", + "description": "ZAP warnings logged - see the zap.log file for details", + "statistic": "1" + }, + { + "level": "Info", + "reason": "Informational", + "site": "http://localhost:3000", + "key": "insight.code.2xx", + "description": "Percentage of responses with status code 2xx", + "statistic": "91" + }, + { + "level": "Info", + "reason": "Informational", + "site": "http://localhost:3000", + "key": "insight.code.4xx", + "description": "Percentage of responses with status code 4xx", + "statistic": "8" + }, + { + "level": "Info", + "reason": "Informational", + "site": "http://localhost:3000", + "key": "insight.endpoint.ctype.application/javascript", + "description": "Percentage of endpoints with content type application/javascript", + "statistic": "5" + }, + { + "level": "Info", + "reason": "Informational", + "site": "http://localhost:3000", + "key": "insight.endpoint.ctype.application/octet-stream", + "description": "Percentage of endpoints with content type application/octet-stream", + "statistic": "6" + }, + { + "level": "Info", + "reason": "Informational", + "site": "http://localhost:3000", + "key": "insight.endpoint.ctype.image/x-icon", + "description": "Percentage of endpoints with content type image/x-icon", + "statistic": "1" + }, + { + "level": "Info", + "reason": "Informational", + "site": "http://localhost:3000", + "key": "insight.endpoint.ctype.text/css", + "description": "Percentage of endpoints with content type text/css", + "statistic": "1" + }, + { + "level": "Info", + "reason": "Informational", + "site": "http://localhost:3000", + "key": "insight.endpoint.ctype.text/html", + "description": "Percentage of endpoints with content type text/html", + "statistic": "79" + }, + { + "level": "Info", + "reason": "Informational", + "site": "http://localhost:3000", + "key": "insight.endpoint.ctype.text/markdown", + "description": "Percentage of endpoints with content type text/markdown", + "statistic": "4" + }, + { + "level": "Info", + "reason": "Informational", + "site": "http://localhost:3000", + "key": "insight.endpoint.ctype.text/plain", + "description": "Percentage of endpoints with content type text/plain", + "statistic": "1" + }, + { + "level": "Info", + "reason": "Informational", + "site": "http://localhost:3000", + "key": "insight.endpoint.method.GET", + "description": "Percentage of endpoints with method GET", + "statistic": "100" + }, + { + "level": "Info", + "reason": "Informational", + "site": "http://localhost:3000", + "key": "insight.endpoint.total", + "description": "Count of total endpoints", + "statistic": "72" + }, + { + "level": "Info", + "reason": "Informational", + "site": "http://localhost:3000", + "key": "insight.response.slow", + "description": "Percentage of slow responses", + "statistic": "41" + } + ], + "site":[ + { + "@name": "http://localhost:3000", + "@host": "localhost", + "@port": "3000", + "@ssl": "false", + "alerts": [ + { + "pluginid": "10038", + "alertRef": "10038-1", + "alert": "Content Security Policy (CSP) Header Not Set", + "name": "Content Security Policy (CSP) Header Not Set", + "riskcode": "2", + "confidence": "3", + "riskdesc": "Medium (High)", + "desc": "Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page \u2014 covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.
", + "instances":[ + { + "id": "7", + "uri": "http://localhost:3000", + "nodeName": "http:\/\/localhost:3000", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "61", + "uri": "http://localhost:3000/ftp", + "nodeName": "http:\/\/localhost:3000\/ftp", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "63", + "uri": "http://localhost:3000/ftp/encrypt.pyc", + "nodeName": "http:\/\/localhost:3000\/ftp\/encrypt.pyc", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "62", + "uri": "http://localhost:3000/ftp/package-lock.json.bak", + "nodeName": "http:\/\/localhost:3000\/ftp\/package-lock.json.bak", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "6", + "uri": "http://localhost:3000/sitemap.xml", + "nodeName": "http:\/\/localhost:3000\/sitemap.xml", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "" + } + ], + "count": "5", + "systemic": true, + "solution": "Ensure that your web server, application server, load balancer, etc. is configured to set the Content-Security-Policy header.
", + "otherinfo": "", + "reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP
https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html
https://www.w3.org/TR/CSP/
https://w3c.github.io/webappsec-csp/
https://web.dev/articles/csp
https://caniuse.com/#feat=contentsecuritypolicy
https://content-security-policy.com/
", + "cweid": "693", + "wascid": "15", + "sourceid": "9" + }, + { + "pluginid": "10098", + "alertRef": "10098", + "alert": "Cross-Domain Misconfiguration", + "name": "Cross-Domain Misconfiguration", + "riskcode": "2", + "confidence": "2", + "riskdesc": "Medium (Medium)", + "desc": "Web browser data loading may be possible, due to a Cross Origin Resource Sharing (CORS) misconfiguration on the web server.
", + "instances":[ + { + "id": "5", + "uri": "http://localhost:3000/polyfills.js", + "nodeName": "http:\/\/localhost:3000\/polyfills.js", + "method": "GET", + "param": "", + "attack": "", + "evidence": "Access-Control-Allow-Origin: *", + "otherinfo": "The CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing." + }, + { + "id": "1", + "uri": "http://localhost:3000/robots.txt", + "nodeName": "http:\/\/localhost:3000\/robots.txt", + "method": "GET", + "param": "", + "attack": "", + "evidence": "Access-Control-Allow-Origin: *", + "otherinfo": "The CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing." + }, + { + "id": "2", + "uri": "http://localhost:3000/runtime.js", + "nodeName": "http:\/\/localhost:3000\/runtime.js", + "method": "GET", + "param": "", + "attack": "", + "evidence": "Access-Control-Allow-Origin: *", + "otherinfo": "The CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing." + }, + { + "id": "4", + "uri": "http://localhost:3000/styles.css", + "nodeName": "http:\/\/localhost:3000\/styles.css", + "method": "GET", + "param": "", + "attack": "", + "evidence": "Access-Control-Allow-Origin: *", + "otherinfo": "The CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing." + } + ], + "count": "4", + "systemic": true, + "solution": "Ensure that sensitive data is not available in an unauthenticated manner (using IP address white-listing, for instance).
Configure the \"Access-Control-Allow-Origin\" HTTP header to a more restrictive set of domains, or remove all CORS headers entirely, to allow the web browser to enforce the Same Origin Policy (SOP) in a more restrictive manner.
", + "otherinfo": "The CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing.
", + "reference": "https://vulncat.fortify.com/en/detail?category=HTML5&subcategory=Overly%20Permissive%20CORS%20Policy
", + "cweid": "264", + "wascid": "14", + "sourceid": "20" + }, + { + "pluginid": "10017", + "alertRef": "10017", + "alert": "Cross-Domain JavaScript Source File Inclusion", + "name": "Cross-Domain JavaScript Source File Inclusion", + "riskcode": "1", + "confidence": "2", + "riskdesc": "Low (Medium)", + "desc": "The page includes one or more script files from a third-party domain.
", + "instances":[ + { + "id": "10", + "uri": "http://localhost:3000", + "nodeName": "http:\/\/localhost:3000", + "method": "GET", + "param": "//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "13", + "uri": "http://localhost:3000", + "nodeName": "http:\/\/localhost:3000", + "method": "GET", + "param": "//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "79", + "uri": "http://localhost:3000/", + "nodeName": "http:\/\/localhost:3000\/", + "method": "GET", + "param": "//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "12", + "uri": "http://localhost:3000/sitemap.xml", + "nodeName": "http:\/\/localhost:3000\/sitemap.xml", + "method": "GET", + "param": "//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "15", + "uri": "http://localhost:3000/sitemap.xml", + "nodeName": "http:\/\/localhost:3000\/sitemap.xml", + "method": "GET", + "param": "//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js", + "attack": "", + "evidence": "", + "otherinfo": "" + } + ], + "count": "5", + "systemic": true, + "solution": "Ensure JavaScript source files are loaded from only trusted sources, and the sources can't be controlled by end users of the application.
", + "otherinfo": "", + "reference": "", + "cweid": "829", + "wascid": "15", + "sourceid": "9" + }, + { + "pluginid": "90004", + "alertRef": "90004-2", + "alert": "Cross-Origin-Embedder-Policy Header Missing or Invalid", + "name": "Cross-Origin-Embedder-Policy Header Missing or Invalid", + "riskcode": "1", + "confidence": "2", + "riskdesc": "Low (Medium)", + "desc": "Cross-Origin-Embedder-Policy header is a response header that prevents a document from loading any cross-origin resources that don't explicitly grant the document permission (using CORP or CORS).
", + "instances":[ + { + "id": "45", + "uri": "http://localhost:3000", + "nodeName": "http:\/\/localhost:3000", + "method": "GET", + "param": "Cross-Origin-Embedder-Policy", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "92", + "uri": "http://localhost:3000/", + "nodeName": "http:\/\/localhost:3000\/", + "method": "GET", + "param": "Cross-Origin-Embedder-Policy", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "81", + "uri": "http://localhost:3000/ftp", + "nodeName": "http:\/\/localhost:3000\/ftp", + "method": "GET", + "param": "Cross-Origin-Embedder-Policy", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "97", + "uri": "http://localhost:3000/juice-shop/node_modules/express/lib/router/index.js:376:14", + "nodeName": "http:\/\/localhost:3000\/juice-shop\/node_modules\/express\/lib\/router\/index.js:376:14", + "method": "GET", + "param": "Cross-Origin-Embedder-Policy", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "46", + "uri": "http://localhost:3000/sitemap.xml", + "nodeName": "http:\/\/localhost:3000\/sitemap.xml", + "method": "GET", + "param": "Cross-Origin-Embedder-Policy", + "attack": "", + "evidence": "", + "otherinfo": "" + } + ], + "count": "5", + "systemic": true, + "solution": "Ensure that the application/web server sets the Cross-Origin-Embedder-Policy header appropriately, and that it sets the Cross-Origin-Embedder-Policy header to 'require-corp' for documents.
If possible, ensure that the end user uses a standards-compliant and modern web browser that supports the Cross-Origin-Embedder-Policy header (https://caniuse.com/mdn-http_headers_cross-origin-embedder-policy).
", + "otherinfo": "", + "reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Embedder-Policy
", + "cweid": "693", + "wascid": "14", + "sourceid": "1" + }, + { + "pluginid": "90004", + "alertRef": "90004-3", + "alert": "Cross-Origin-Opener-Policy Header Missing or Invalid", + "name": "Cross-Origin-Opener-Policy Header Missing or Invalid", + "riskcode": "1", + "confidence": "2", + "riskdesc": "Low (Medium)", + "desc": "Cross-Origin-Opener-Policy header is a response header that allows a site to control if others included documents share the same browsing context. Sharing the same browsing context with untrusted documents might lead to data leak.
", + "instances":[ + { + "id": "48", + "uri": "http://localhost:3000", + "nodeName": "http:\/\/localhost:3000", + "method": "GET", + "param": "Cross-Origin-Opener-Policy", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "93", + "uri": "http://localhost:3000/", + "nodeName": "http:\/\/localhost:3000\/", + "method": "GET", + "param": "Cross-Origin-Opener-Policy", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "82", + "uri": "http://localhost:3000/ftp", + "nodeName": "http:\/\/localhost:3000\/ftp", + "method": "GET", + "param": "Cross-Origin-Opener-Policy", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "98", + "uri": "http://localhost:3000/juice-shop/node_modules/express/lib/router/index.js:376:14", + "nodeName": "http:\/\/localhost:3000\/juice-shop\/node_modules\/express\/lib\/router\/index.js:376:14", + "method": "GET", + "param": "Cross-Origin-Opener-Policy", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "49", + "uri": "http://localhost:3000/sitemap.xml", + "nodeName": "http:\/\/localhost:3000\/sitemap.xml", + "method": "GET", + "param": "Cross-Origin-Opener-Policy", + "attack": "", + "evidence": "", + "otherinfo": "" + } + ], + "count": "5", + "systemic": true, + "solution": "Ensure that the application/web server sets the Cross-Origin-Opener-Policy header appropriately, and that it sets the Cross-Origin-Opener-Policy header to 'same-origin' for documents.
'same-origin-allow-popups' is considered as less secured and should be avoided.
If possible, ensure that the end user uses a standards-compliant and modern web browser that supports the Cross-Origin-Opener-Policy header (https://caniuse.com/mdn-http_headers_cross-origin-opener-policy).
", + "otherinfo": "", + "reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Opener-Policy
", + "cweid": "693", + "wascid": "14", + "sourceid": "1" + }, + { + "pluginid": "10110", + "alertRef": "10110", + "alert": "Dangerous JS Functions", + "name": "Dangerous JS Functions", + "riskcode": "1", + "confidence": "1", + "riskdesc": "Low (Low)", + "desc": "A dangerous JS function seems to be in use that would leave the site vulnerable.
", + "instances":[ + { + "id": "58", + "uri": "http://localhost:3000/main.js", + "nodeName": "http:\/\/localhost:3000\/main.js", + "method": "GET", + "param": "", + "attack": "", + "evidence": "bypassSecurityTrustHtml(", + "otherinfo": "" + }, + { + "id": "108", + "uri": "http://localhost:3000/vendor.js", + "nodeName": "http:\/\/localhost:3000\/vendor.js", + "method": "GET", + "param": "", + "attack": "", + "evidence": "bypassSecurityTrustHtml(", + "otherinfo": "" + } + ], + "count": "2", + "systemic": false, + "solution": "See the references for security advice on the use of these functions.
", + "otherinfo": "", + "reference": "https://v17.angular.io/guide/security
", + "cweid": "749", + "wascid": "-1", + "sourceid": "21" + }, + { + "pluginid": "10063", + "alertRef": "10063-2", + "alert": "Deprecated Feature Policy Header Set", + "name": "Deprecated Feature Policy Header Set", + "riskcode": "1", + "confidence": "2", + "riskdesc": "Low (Medium)", + "desc": "The header has now been renamed to Permissions-Policy.
", + "instances":[ + { + "id": "41", + "uri": "http://localhost:3000", + "nodeName": "http:\/\/localhost:3000", + "method": "GET", + "param": "", + "attack": "", + "evidence": "Feature-Policy", + "otherinfo": "" + }, + { + "id": "59", + "uri": "http://localhost:3000/main.js", + "nodeName": "http:\/\/localhost:3000\/main.js", + "method": "GET", + "param": "", + "attack": "", + "evidence": "Feature-Policy", + "otherinfo": "" + }, + { + "id": "55", + "uri": "http://localhost:3000/polyfills.js", + "nodeName": "http:\/\/localhost:3000\/polyfills.js", + "method": "GET", + "param": "", + "attack": "", + "evidence": "Feature-Policy", + "otherinfo": "" + }, + { + "id": "53", + "uri": "http://localhost:3000/runtime.js", + "nodeName": "http:\/\/localhost:3000\/runtime.js", + "method": "GET", + "param": "", + "attack": "", + "evidence": "Feature-Policy", + "otherinfo": "" + }, + { + "id": "43", + "uri": "http://localhost:3000/sitemap.xml", + "nodeName": "http:\/\/localhost:3000\/sitemap.xml", + "method": "GET", + "param": "", + "attack": "", + "evidence": "Feature-Policy", + "otherinfo": "" + } + ], + "count": "5", + "systemic": true, + "solution": "Ensure that your web server, application server, load balancer, etc. is configured to set the Permissions-Policy header instead of the Feature-Policy header.
", + "otherinfo": "", + "reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy
https://scotthelme.co.uk/goodbye-feature-policy-and-hello-permissions-policy/
", + "cweid": "16", + "wascid": "15", + "sourceid": "1" + }, + { + "pluginid": "10096", + "alertRef": "10096", + "alert": "Timestamp Disclosure - Unix", + "name": "Timestamp Disclosure - Unix", + "riskcode": "1", + "confidence": "1", + "riskdesc": "Low (Low)", + "desc": "A timestamp was disclosed by the application/web server. - Unix
", + "instances":[ + { + "id": "21", + "uri": "http://localhost:3000/styles.css", + "nodeName": "http:\/\/localhost:3000\/styles.css", + "method": "GET", + "param": "", + "attack": "", + "evidence": "1680327869", + "otherinfo": "1680327869, which evaluates to: 2023-04-01 05:44:29." + }, + { + "id": "18", + "uri": "http://localhost:3000/styles.css", + "nodeName": "http:\/\/localhost:3000\/styles.css", + "method": "GET", + "param": "", + "attack": "", + "evidence": "1701244813", + "otherinfo": "1701244813, which evaluates to: 2023-11-29 08:00:13." + }, + { + "id": "20", + "uri": "http://localhost:3000/styles.css", + "nodeName": "http:\/\/localhost:3000\/styles.css", + "method": "GET", + "param": "", + "attack": "", + "evidence": "1839622642", + "otherinfo": "1839622642, which evaluates to: 2028-04-17 22:17:22." + }, + { + "id": "22", + "uri": "http://localhost:3000/styles.css", + "nodeName": "http:\/\/localhost:3000\/styles.css", + "method": "GET", + "param": "", + "attack": "", + "evidence": "1863874346", + "otherinfo": "1863874346, which evaluates to: 2029-01-23 14:52:26." + }, + { + "id": "19", + "uri": "http://localhost:3000/styles.css", + "nodeName": "http:\/\/localhost:3000\/styles.css", + "method": "GET", + "param": "", + "attack": "", + "evidence": "2033195021", + "otherinfo": "2033195021, which evaluates to: 2034-06-06 08:23:41." + } + ], + "count": "5", + "systemic": true, + "solution": "Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.
", + "otherinfo": "1680327869, which evaluates to: 2023-04-01 05:44:29.
", + "reference": "https://cwe.mitre.org/data/definitions/200.html
", + "cweid": "497", + "wascid": "13", + "sourceid": "22" + }, + { + "pluginid": "10109", + "alertRef": "10109", + "alert": "Modern Web Application", + "name": "Modern Web Application", + "riskcode": "0", + "confidence": "2", + "riskdesc": "Informational (Medium)", + "desc": "The application appears to be a modern web application. If you need to explore it automatically then the Ajax Spider may well be more effective than the standard one.
", + "instances":[ + { + "id": "34", + "uri": "http://localhost:3000", + "nodeName": "http:\/\/localhost:3000", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "No links have been found while there are scripts, which is an indication that this is a modern web application." + }, + { + "id": "91", + "uri": "http://localhost:3000/", + "nodeName": "http:\/\/localhost:3000\/", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "No links have been found while there are scripts, which is an indication that this is a modern web application." + }, + { + "id": "95", + "uri": "http://localhost:3000/juice-shop/node_modules/express/lib/router/index.js:365:14", + "nodeName": "http:\/\/localhost:3000\/juice-shop\/node_modules\/express\/lib\/router\/index.js:365:14", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "No links have been found while there are scripts, which is an indication that this is a modern web application." + }, + { + "id": "94", + "uri": "http://localhost:3000/juice-shop/node_modules/express/lib/router/index.js:376:14", + "nodeName": "http:\/\/localhost:3000\/juice-shop\/node_modules\/express\/lib\/router\/index.js:376:14", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "No links have been found while there are scripts, which is an indication that this is a modern web application." + }, + { + "id": "35", + "uri": "http://localhost:3000/sitemap.xml", + "nodeName": "http:\/\/localhost:3000\/sitemap.xml", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "No links have been found while there are scripts, which is an indication that this is a modern web application." + } + ], + "count": "5", + "systemic": true, + "solution": "This is an informational alert and so no changes are required.
", + "otherinfo": "No links have been found while there are scripts, which is an indication that this is a modern web application.
", + "reference": "", + "cweid": "-1", + "wascid": "-1", + "sourceid": "9" + }, + { + "pluginid": "10049", + "alertRef": "10049-1", + "alert": "Non-Storable Content", + "name": "Non-Storable Content", + "riskcode": "0", + "confidence": "2", + "riskdesc": "Informational (Medium)", + "desc": "The response contents are not storable by caching components such as proxy servers. If the response does not contain sensitive, personal or user-specific information, it may benefit from being stored and cached, to improve performance.
", + "instances":[ + { + "id": "71", + "uri": "http://localhost:3000/ftp/encrypt.pyc", + "nodeName": "http:\/\/localhost:3000\/ftp\/encrypt.pyc", + "method": "GET", + "param": "", + "attack": "", + "evidence": "403", + "otherinfo": "" + }, + { + "id": "70", + "uri": "http://localhost:3000/ftp/package-lock.json.bak", + "nodeName": "http:\/\/localhost:3000\/ftp\/package-lock.json.bak", + "method": "GET", + "param": "", + "attack": "", + "evidence": "403", + "otherinfo": "" + } + ], + "count": "2", + "systemic": true, + "solution": "The content may be marked as storable by ensuring that the following conditions are satisfied:
The request method must be understood by the cache and defined as being cacheable (\"GET\", \"HEAD\", and \"POST\" are currently defined as cacheable)
The response status code must be understood by the cache (one of the 1XX, 2XX, 3XX, 4XX, or 5XX response classes are generally understood)
The \"no-store\" cache directive must not appear in the request or response header fields
For caching by \"shared\" caches such as \"proxy\" caches, the \"private\" response directive must not appear in the response
For caching by \"shared\" caches such as \"proxy\" caches, the \"Authorization\" header field must not appear in the request, unless the response explicitly allows it (using one of the \"must-revalidate\", \"public\", or \"s-maxage\" Cache-Control response directives)
In addition to the conditions above, at least one of the following conditions must also be satisfied by the response:
It must contain an \"Expires\" header field
It must contain a \"max-age\" response directive
For \"shared\" caches such as \"proxy\" caches, it must contain a \"s-maxage\" response directive
It must contain a \"Cache Control Extension\" that allows it to be cached
It must have a status code that is defined as cacheable by default (200, 203, 204, 206, 300, 301, 404, 405, 410, 414, 501).
", + "otherinfo": "", + "reference": "https://datatracker.ietf.org/doc/html/rfc7234
https://datatracker.ietf.org/doc/html/rfc7231
https://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html
", + "cweid": "524", + "wascid": "13", + "sourceid": "44" + }, + { + "pluginid": "10049", + "alertRef": "10049-3", + "alert": "Storable and Cacheable Content", + "name": "Storable and Cacheable Content", + "riskcode": "0", + "confidence": "2", + "riskdesc": "Informational (Medium)", + "desc": "The response contents are storable by caching components such as proxy servers, and may be retrieved directly from the cache, rather than from the origin server by the caching servers, in response to similar requests from other users. If the response data is sensitive, personal or user-specific, this may result in sensitive information being leaked. In some cases, this may even result in a user gaining complete control of the session of another user, depending on the configuration of the caching components in use in their environment. This is primarily an issue where \"shared\" caching servers such as \"proxy\" caches are configured on the local network. This configuration is typically found in corporate or educational environments, for instance.
", + "instances":[ + { + "id": "3", + "uri": "http://localhost:3000/robots.txt", + "nodeName": "http:\/\/localhost:3000\/robots.txt", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "In the absence of an explicitly specified caching lifetime directive in the response, a liberal lifetime heuristic of 1 year was assumed. This is permitted by rfc7234." + } + ], + "count": "1", + "systemic": true, + "solution": "Validate that the response does not contain sensitive, personal or user-specific information. If it does, consider the use of the following HTTP response headers, to limit, or prevent the content being stored and retrieved from the cache by another user:
Cache-Control: no-cache, no-store, must-revalidate, private
Pragma: no-cache
Expires: 0
This configuration directs both HTTP 1.0 and HTTP 1.1 compliant caching servers to not store the response, and to not retrieve the response (without validation) from the cache, in response to a similar request.
", + "otherinfo": "In the absence of an explicitly specified caching lifetime directive in the response, a liberal lifetime heuristic of 1 year was assumed. This is permitted by rfc7234.
", + "reference": "https://datatracker.ietf.org/doc/html/rfc7234
https://datatracker.ietf.org/doc/html/rfc7231
https://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html
", + "cweid": "524", + "wascid": "13", + "sourceid": "6" + }, + { + "pluginid": "10049", + "alertRef": "10049-2", + "alert": "Storable but Non-Cacheable Content", + "name": "Storable but Non-Cacheable Content", + "riskcode": "0", + "confidence": "2", + "riskdesc": "Informational (Medium)", + "desc": "The response contents are storable by caching components such as proxy servers, but will not be retrieved directly from the cache, without validating the request upstream, in response to similar requests from other users.
", + "instances":[ + { + "id": "40", + "uri": "http://localhost:3000", + "nodeName": "http:\/\/localhost:3000", + "method": "GET", + "param": "", + "attack": "", + "evidence": "max-age=0", + "otherinfo": "" + }, + { + "id": "51", + "uri": "http://localhost:3000/assets/public/favicon_js.ico", + "nodeName": "http:\/\/localhost:3000\/assets\/public\/favicon_js.ico", + "method": "GET", + "param": "", + "attack": "", + "evidence": "max-age=0", + "otherinfo": "" + }, + { + "id": "54", + "uri": "http://localhost:3000/polyfills.js", + "nodeName": "http:\/\/localhost:3000\/polyfills.js", + "method": "GET", + "param": "", + "attack": "", + "evidence": "max-age=0", + "otherinfo": "" + }, + { + "id": "52", + "uri": "http://localhost:3000/runtime.js", + "nodeName": "http:\/\/localhost:3000\/runtime.js", + "method": "GET", + "param": "", + "attack": "", + "evidence": "max-age=0", + "otherinfo": "" + }, + { + "id": "39", + "uri": "http://localhost:3000/sitemap.xml", + "nodeName": "http:\/\/localhost:3000\/sitemap.xml", + "method": "GET", + "param": "", + "attack": "", + "evidence": "max-age=0", + "otherinfo": "" + } + ], + "count": "5", + "systemic": true, + "solution": "", + "otherinfo": "", + "reference": "https://datatracker.ietf.org/doc/html/rfc7234
https://datatracker.ietf.org/doc/html/rfc7231
https://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html
", + "cweid": "524", + "wascid": "13", + "sourceid": "1" + } + ] + } + ], + "sequences":[ + ] + +} diff --git a/labs/lab5/zap/zap.yaml b/labs/lab5/zap/zap.yaml new file mode 100644 index 00000000..d1e52088 --- /dev/null +++ b/labs/lab5/zap/zap.yaml @@ -0,0 +1,40 @@ +env: + contexts: + - excludePaths: [] + name: baseline + urls: + - http://localhost:3000 + parameters: + failOnError: true + progressToStdout: false +jobs: +- parameters: + enableTags: false + maxAlertsPerRule: 10 + type: passiveScan-config +- parameters: + maxDuration: 1 + url: http://localhost:3000 + type: spider +- parameters: + maxDuration: 0 + type: passiveScan-wait +- parameters: + format: Long + summaryFile: /home/zap/zap_out.json + rules: [] + type: outputSummary +- parameters: + reportDescription: '' + reportDir: /zap/wrk/ + reportFile: report-noauth.html + reportTitle: ZAP Scanning Report + template: traditional-html + type: report +- parameters: + reportDescription: '' + reportDir: /zap/wrk/ + reportFile: zap-report-noauth.json + reportTitle: ZAP Scanning Report + template: traditional-json + type: report diff --git a/labs/lab6/analysis/ansible-analysis.txt b/labs/lab6/analysis/ansible-analysis.txt new file mode 100644 index 00000000..cea010d9 --- /dev/null +++ b/labs/lab6/analysis/ansible-analysis.txt @@ -0,0 +1,5 @@ +=== Ansible Security Analysis (KICS) === +KICS Ansible findings: 10 + HIGH severity: 9 + MEDIUM severity: 0 + LOW severity: 1 diff --git a/labs/lab6/analysis/checkov-terraform-report.txt b/labs/lab6/analysis/checkov-terraform-report.txt new file mode 100644 index 00000000..e09aeaf8 --- /dev/null +++ b/labs/lab6/analysis/checkov-terraform-report.txt @@ -0,0 +1,516 @@ + + _ _ + ___| |__ ___ ___| | _______ __ + / __| '_ \ / _ \/ __| |/ / _ \ \ / / + | (__| | | | __/ (__| < (_) \ V / + \___|_| |_|\___|\___|_|\_\___/ \_/ + +By Prisma Cloud | version: 3.2.508 + +terraform scan results: + +Passed checks: 48, Failed checks: 78, Skipped checks: 0 + +Check: CKV_AWS_211: "Ensure RDS uses a modern CaCert" + PASSED for resource: aws_db_instance.unencrypted_db + File: /database.tf:5-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-rds-uses-a-modern-cacert +Check: CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs" + PASSED for resource: aws_db_instance.unencrypted_db + File: /database.tf:5-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354 +Check: CKV_AWS_250: "Ensure that RDS PostgreSQL instances use a non vulnerable version with the log_fdw extension (https://aws.amazon.com/security/security-bulletins/AWS-2022-004/)" + PASSED for resource: aws_db_instance.unencrypted_db + File: /database.tf:5-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-rds-postgresql-instances-use-a-non-vulnerable-version-of-log-fdw-extension +Check: CKV_AWS_388: "Ensure AWS Aurora PostgreSQL is not exposed to local file read vulnerability" + PASSED for resource: aws_db_instance.unencrypted_db + File: /database.tf:5-37 +Check: CKV_AWS_133: "Ensure that RDS instances has backup policy" + PASSED for resource: aws_db_instance.weak_db + File: /database.tf:40-69 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-rds-instances-have-backup-policy +Check: CKV_AWS_211: "Ensure RDS uses a modern CaCert" + PASSED for resource: aws_db_instance.weak_db + File: /database.tf:40-69 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-rds-uses-a-modern-cacert +Check: CKV_AWS_16: "Ensure all data stored in the RDS is securely encrypted at rest" + PASSED for resource: aws_db_instance.weak_db + File: /database.tf:40-69 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-4 +Check: CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs" + PASSED for resource: aws_db_instance.weak_db + File: /database.tf:40-69 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354 +Check: CKV_AWS_17: "Ensure all data stored in RDS is not publicly accessible" + PASSED for resource: aws_db_instance.weak_db + File: /database.tf:40-69 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/public-policies/public-2 +Check: CKV_AWS_388: "Ensure AWS Aurora PostgreSQL is not exposed to local file read vulnerability" + PASSED for resource: aws_db_instance.weak_db + File: /database.tf:40-69 +Check: CKV_AWS_274: "Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy" + PASSED for resource: aws_iam_role.app_role + File: /iam.tf:22-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-274 +Check: CKV_AWS_61: "Ensure AWS IAM policy does not allow assume role permission across all services" + PASSED for resource: aws_iam_role.app_role + File: /iam.tf:22-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-iam-45 +Check: CKV_AWS_60: "Ensure IAM role allows only specific services or principals to assume it" + PASSED for resource: aws_iam_role.app_role + File: /iam.tf:22-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-iam-44 +Check: CKV_AWS_62: "Ensure IAM policies that allow full "*-*" administrative privileges are not created" + PASSED for resource: aws_iam_role_policy.s3_full_access + File: /iam.tf:39-55 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-iam-45 +Check: CKV_AWS_287: "Ensure IAM policies does not allow credentials exposure" + PASSED for resource: aws_iam_role_policy.s3_full_access + File: /iam.tf:39-55 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-287 +Check: CKV_AWS_286: "Ensure IAM policies does not allow privilege escalation" + PASSED for resource: aws_iam_role_policy.s3_full_access + File: /iam.tf:39-55 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-286 +Check: CKV_AWS_63: "Ensure no IAM policies documents allow "*" as a statement's actions" + PASSED for resource: aws_iam_role_policy.s3_full_access + File: /iam.tf:39-55 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/iam-48 +Check: CKV_AWS_62: "Ensure IAM policies that allow full "*-*" administrative privileges are not created" + PASSED for resource: aws_iam_user_policy.service_policy + File: /iam.tf:67-85 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-iam-45 +Check: CKV_AWS_286: "Ensure IAM policies does not allow privilege escalation" + PASSED for resource: aws_iam_user_policy.service_policy + File: /iam.tf:67-85 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-286 +Check: CKV_AWS_63: "Ensure no IAM policies documents allow "*" as a statement's actions" + PASSED for resource: aws_iam_user_policy.service_policy + File: /iam.tf:67-85 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/iam-48 +Check: CKV_AWS_348: "Ensure IAM root user does not have Access keys" + PASSED for resource: aws_iam_access_key.service_key + File: /iam.tf:88-90 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-348 +Check: CKV_AWS_62: "Ensure IAM policies that allow full "*-*" administrative privileges are not created" + PASSED for resource: aws_iam_policy.privilege_escalation + File: /iam.tf:104-125 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-iam-45 +Check: CKV_AWS_287: "Ensure IAM policies does not allow credentials exposure" + PASSED for resource: aws_iam_policy.privilege_escalation + File: /iam.tf:104-125 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-287 +Check: CKV_AWS_288: "Ensure IAM policies does not allow data exfiltration" + PASSED for resource: aws_iam_policy.privilege_escalation + File: /iam.tf:104-125 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-288 +Check: CKV_AWS_63: "Ensure no IAM policies documents allow "*" as a statement's actions" + PASSED for resource: aws_iam_policy.privilege_escalation + File: /iam.tf:104-125 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/iam-48 +Check: CKV_AWS_290: "Ensure IAM policies does not allow write access without constraints" + PASSED for resource: aws_iam_policy.privilege_escalation + File: /iam.tf:104-125 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290 +Check: CKV_AWS_93: "Ensure S3 bucket policy does not lockout all but root user. (Prevent lockouts needing root account fixes)" + PASSED for resource: aws_s3_bucket.public_data + File: /main.tf:13-21 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc-aws-s3-24 +Check: CKV_AWS_93: "Ensure S3 bucket policy does not lockout all but root user. (Prevent lockouts needing root account fixes)" + PASSED for resource: aws_s3_bucket.unencrypted_data + File: /main.tf:24-33 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc-aws-s3-24 +Check: CKV_AWS_260: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 80" + PASSED for resource: aws_security_group.ssh_open + File: /security_groups.tf:31-62 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-groups-do-not-allow-ingress-from-00000-to-port-80 +Check: CKV_AWS_277: "Ensure no security groups allow ingress from 0.0.0.0:0 to port -1" + PASSED for resource: aws_security_group.ssh_open + File: /security_groups.tf:31-62 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-group-does-not-allow-all-traffic-on-all-ports +Check: CKV_AWS_24: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22" + PASSED for resource: aws_security_group.database_exposed + File: /security_groups.tf:65-92 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-1-port-security +Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389" + PASSED for resource: aws_security_group.database_exposed + File: /security_groups.tf:65-92 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2 +Check: CKV_AWS_260: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 80" + PASSED for resource: aws_security_group.database_exposed + File: /security_groups.tf:65-92 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-groups-do-not-allow-ingress-from-00000-to-port-80 +Check: CKV_AWS_277: "Ensure no security groups allow ingress from 0.0.0.0:0 to port -1" + PASSED for resource: aws_security_group.database_exposed + File: /security_groups.tf:65-92 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-group-does-not-allow-all-traffic-on-all-ports +Check: CKV2_AWS_16: "Ensure that Auto Scaling is enabled on your DynamoDB tables" + PASSED for resource: aws_dynamodb_table.unencrypted_table + File: /database.tf:72-92 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-auto-scaling-is-enabled-on-your-dynamodb-tables +Check: CKV2_AWS_56: "Ensure AWS Managed IAMFullAccess IAM policy is not used." + PASSED for resource: aws_iam_role.app_role + File: /iam.tf:22-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-2-56 +Check: CKV2_AWS_22: "Ensure an IAM User does not have access to the console" + PASSED for resource: aws_iam_user.service_account + File: /iam.tf:58-65 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-an-iam-user-does-not-have-access-to-the-console-group +Check: CKV2_AWS_69: "Ensure AWS RDS database instance configured with encryption in transit" + PASSED for resource: aws_db_instance.unencrypted_db + File: /database.tf:5-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/bc-aws-2-69 +Check: CKV2_AWS_69: "Ensure AWS RDS database instance configured with encryption in transit" + PASSED for resource: aws_db_instance.weak_db + File: /database.tf:40-69 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/bc-aws-2-69 +Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource" + PASSED for resource: aws_security_group.database_exposed + File: /security_groups.tf:65-92 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis +Check: CKV_AWS_20: "S3 Bucket has an ACL defined which allows public READ access." + PASSED for resource: aws_s3_bucket.unencrypted_data + File: /main.tf:24-33 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-1-acl-read-permissions-everyone +Check: CKV_AWS_57: "S3 Bucket has an ACL defined which allows public WRITE access." + PASSED for resource: aws_s3_bucket.public_data + File: /main.tf:13-21 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-2-acl-write-permissions-everyone +Check: CKV_AWS_57: "S3 Bucket has an ACL defined which allows public WRITE access." + PASSED for resource: aws_s3_bucket.unencrypted_data + File: /main.tf:24-33 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-2-acl-write-permissions-everyone +Check: CKV2_AWS_40: "Ensure AWS IAM policy does not allow full IAM privileges" + PASSED for resource: aws_iam_role_policy.s3_full_access + File: /iam.tf:39-55 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-2-40 +Check: CKV2_AWS_40: "Ensure AWS IAM policy does not allow full IAM privileges" + PASSED for resource: aws_iam_user_policy.service_policy + File: /iam.tf:67-85 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-2-40 +Check: CKV2_AWS_40: "Ensure AWS IAM policy does not allow full IAM privileges" + PASSED for resource: aws_iam_policy.privilege_escalation + File: /iam.tf:104-125 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-2-40 +Check: CKV_AWS_19: "Ensure all data stored in the S3 bucket is securely encrypted at rest" + PASSED for resource: aws_s3_bucket.public_data + File: /main.tf:13-21 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-14-data-encrypted-at-rest +Check: CKV_AWS_19: "Ensure all data stored in the S3 bucket is securely encrypted at rest" + PASSED for resource: aws_s3_bucket.unencrypted_data + File: /main.tf:24-33 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-14-data-encrypted-at-rest +Check: CKV_AWS_133: "Ensure that RDS instances has backup policy" + FAILED for resource: aws_db_instance.unencrypted_db + File: /database.tf:5-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-rds-instances-have-backup-policy +Check: CKV_AWS_129: "Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled" + FAILED for resource: aws_db_instance.unencrypted_db + File: /database.tf:5-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-that-respective-logs-of-amazon-relational-database-service-amazon-rds-are-enabled +Check: CKV_AWS_226: "Ensure DB instance gets all minor upgrades automatically" + FAILED for resource: aws_db_instance.unencrypted_db + File: /database.tf:5-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-db-instance-gets-all-minor-upgrades-automatically +Check: CKV_AWS_16: "Ensure all data stored in the RDS is securely encrypted at rest" + FAILED for resource: aws_db_instance.unencrypted_db + File: /database.tf:5-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-4 +Check: CKV_AWS_118: "Ensure that enhanced monitoring is enabled for Amazon RDS instances" + FAILED for resource: aws_db_instance.unencrypted_db + File: /database.tf:5-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/ensure-that-enhanced-monitoring-is-enabled-for-amazon-rds-instances +Check: CKV_AWS_161: "Ensure RDS database has IAM authentication enabled" + FAILED for resource: aws_db_instance.unencrypted_db + File: /database.tf:5-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-rds-database-has-iam-authentication-enabled +Check: CKV_AWS_293: "Ensure that AWS database instances have deletion protection enabled" + FAILED for resource: aws_db_instance.unencrypted_db + File: /database.tf:5-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-293 +Check: CKV_AWS_353: "Ensure that RDS instances have performance insights enabled" + FAILED for resource: aws_db_instance.unencrypted_db + File: /database.tf:5-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-353 +Check: CKV_AWS_157: "Ensure that RDS instances have Multi-AZ enabled" + FAILED for resource: aws_db_instance.unencrypted_db + File: /database.tf:5-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-73 +Check: CKV_AWS_17: "Ensure all data stored in RDS is not publicly accessible" + FAILED for resource: aws_db_instance.unencrypted_db + File: /database.tf:5-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/public-policies/public-2 +Check: CKV_AWS_129: "Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled" + FAILED for resource: aws_db_instance.weak_db + File: /database.tf:40-69 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-that-respective-logs-of-amazon-relational-database-service-amazon-rds-are-enabled +Check: CKV_AWS_226: "Ensure DB instance gets all minor upgrades automatically" + FAILED for resource: aws_db_instance.weak_db + File: /database.tf:40-69 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-db-instance-gets-all-minor-upgrades-automatically +Check: CKV_AWS_118: "Ensure that enhanced monitoring is enabled for Amazon RDS instances" + FAILED for resource: aws_db_instance.weak_db + File: /database.tf:40-69 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/ensure-that-enhanced-monitoring-is-enabled-for-amazon-rds-instances +Check: CKV_AWS_161: "Ensure RDS database has IAM authentication enabled" + FAILED for resource: aws_db_instance.weak_db + File: /database.tf:40-69 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-rds-database-has-iam-authentication-enabled +Check: CKV_AWS_293: "Ensure that AWS database instances have deletion protection enabled" + FAILED for resource: aws_db_instance.weak_db + File: /database.tf:40-69 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-293 +Check: CKV_AWS_157: "Ensure that RDS instances have Multi-AZ enabled" + FAILED for resource: aws_db_instance.weak_db + File: /database.tf:40-69 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-73 +Check: CKV_AWS_119: "Ensure DynamoDB Tables are encrypted using a KMS Customer Managed CMK" + FAILED for resource: aws_dynamodb_table.unencrypted_table + File: /database.tf:72-92 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-52 +Check: CKV_AWS_28: "Ensure DynamoDB point in time recovery (backup) is enabled" + FAILED for resource: aws_dynamodb_table.unencrypted_table + File: /database.tf:72-92 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-6 +Check: CKV_AWS_62: "Ensure IAM policies that allow full "*-*" administrative privileges are not created" + FAILED for resource: aws_iam_policy.admin_policy + File: /iam.tf:5-19 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-iam-45 +Check: CKV_AWS_287: "Ensure IAM policies does not allow credentials exposure" + FAILED for resource: aws_iam_policy.admin_policy + File: /iam.tf:5-19 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-287 +Check: CKV_AWS_288: "Ensure IAM policies does not allow data exfiltration" + FAILED for resource: aws_iam_policy.admin_policy + File: /iam.tf:5-19 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-288 +Check: CKV_AWS_289: "Ensure IAM policies does not allow permissions management / resource exposure without constraints" + FAILED for resource: aws_iam_policy.admin_policy + File: /iam.tf:5-19 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-289 +Check: CKV_AWS_286: "Ensure IAM policies does not allow privilege escalation" + FAILED for resource: aws_iam_policy.admin_policy + File: /iam.tf:5-19 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-286 +Check: CKV_AWS_63: "Ensure no IAM policies documents allow "*" as a statement's actions" + FAILED for resource: aws_iam_policy.admin_policy + File: /iam.tf:5-19 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/iam-48 +Check: CKV_AWS_355: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions" + FAILED for resource: aws_iam_policy.admin_policy + File: /iam.tf:5-19 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355 +Check: CKV_AWS_290: "Ensure IAM policies does not allow write access without constraints" + FAILED for resource: aws_iam_policy.admin_policy + File: /iam.tf:5-19 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290 +Check: CKV_AWS_288: "Ensure IAM policies does not allow data exfiltration" + FAILED for resource: aws_iam_role_policy.s3_full_access + File: /iam.tf:39-55 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-288 +Check: CKV_AWS_289: "Ensure IAM policies does not allow permissions management / resource exposure without constraints" + FAILED for resource: aws_iam_role_policy.s3_full_access + File: /iam.tf:39-55 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-289 +Check: CKV_AWS_355: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions" + FAILED for resource: aws_iam_role_policy.s3_full_access + File: /iam.tf:39-55 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355 +Check: CKV_AWS_290: "Ensure IAM policies does not allow write access without constraints" + FAILED for resource: aws_iam_role_policy.s3_full_access + File: /iam.tf:39-55 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290 +Check: CKV_AWS_273: "Ensure access is controlled through SSO and not AWS IAM defined users" + FAILED for resource: aws_iam_user.service_account + File: /iam.tf:58-65 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-273 +Check: CKV_AWS_287: "Ensure IAM policies does not allow credentials exposure" + FAILED for resource: aws_iam_user_policy.service_policy + File: /iam.tf:67-85 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-287 +Check: CKV_AWS_288: "Ensure IAM policies does not allow data exfiltration" + FAILED for resource: aws_iam_user_policy.service_policy + File: /iam.tf:67-85 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-288 +Check: CKV_AWS_289: "Ensure IAM policies does not allow permissions management / resource exposure without constraints" + FAILED for resource: aws_iam_user_policy.service_policy + File: /iam.tf:67-85 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-289 +Check: CKV_AWS_40: "Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.)" + FAILED for resource: aws_iam_user_policy.service_policy + File: /iam.tf:67-85 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/iam-16-iam-policy-privileges-1 +Check: CKV_AWS_355: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions" + FAILED for resource: aws_iam_user_policy.service_policy + File: /iam.tf:67-85 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355 +Check: CKV_AWS_290: "Ensure IAM policies does not allow write access without constraints" + FAILED for resource: aws_iam_user_policy.service_policy + File: /iam.tf:67-85 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290 +Check: CKV_AWS_289: "Ensure IAM policies does not allow permissions management / resource exposure without constraints" + FAILED for resource: aws_iam_policy.privilege_escalation + File: /iam.tf:104-125 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-289 +Check: CKV_AWS_286: "Ensure IAM policies does not allow privilege escalation" + FAILED for resource: aws_iam_policy.privilege_escalation + File: /iam.tf:104-125 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-286 +Check: CKV_AWS_355: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions" + FAILED for resource: aws_iam_policy.privilege_escalation + File: /iam.tf:104-125 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355 +Check: CKV_AWS_41: "Ensure no hard coded AWS access key and secret key exists in provider" + FAILED for resource: aws.default + File: /main.tf:5-10 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/secrets-policies/bc-aws-secrets-5 +Check: CKV_AWS_53: "Ensure S3 bucket has block public ACLS enabled" + FAILED for resource: aws_s3_bucket_public_access_block.bad_config + File: /main.tf:36-43 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc-aws-s3-19 +Check: CKV_AWS_54: "Ensure S3 bucket has block public policy enabled" + FAILED for resource: aws_s3_bucket_public_access_block.bad_config + File: /main.tf:36-43 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc-aws-s3-20 +Check: CKV_AWS_55: "Ensure S3 bucket has ignore public ACLs enabled" + FAILED for resource: aws_s3_bucket_public_access_block.bad_config + File: /main.tf:36-43 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc-aws-s3-21 +Check: CKV_AWS_56: "Ensure S3 bucket has 'restrict_public_buckets' enabled" + FAILED for resource: aws_s3_bucket_public_access_block.bad_config + File: /main.tf:36-43 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc-aws-s3-22 +Check: CKV_AWS_23: "Ensure every security group and rule has a description" + FAILED for resource: aws_security_group.allow_all + File: /security_groups.tf:5-28 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31 +Check: CKV_AWS_382: "Ensure no security groups allow egress from 0.0.0.0:0 to port -1" + FAILED for resource: aws_security_group.allow_all + File: /security_groups.tf:5-28 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/bc-aws-382 +Check: CKV_AWS_24: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22" + FAILED for resource: aws_security_group.allow_all + File: /security_groups.tf:5-28 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-1-port-security +Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389" + FAILED for resource: aws_security_group.allow_all + File: /security_groups.tf:5-28 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2 +Check: CKV_AWS_260: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 80" + FAILED for resource: aws_security_group.allow_all + File: /security_groups.tf:5-28 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-groups-do-not-allow-ingress-from-00000-to-port-80 +Check: CKV_AWS_277: "Ensure no security groups allow ingress from 0.0.0.0:0 to port -1" + FAILED for resource: aws_security_group.allow_all + File: /security_groups.tf:5-28 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-group-does-not-allow-all-traffic-on-all-ports +Check: CKV_AWS_23: "Ensure every security group and rule has a description" + FAILED for resource: aws_security_group.ssh_open + File: /security_groups.tf:31-62 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31 +Check: CKV_AWS_382: "Ensure no security groups allow egress from 0.0.0.0:0 to port -1" + FAILED for resource: aws_security_group.ssh_open + File: /security_groups.tf:31-62 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/bc-aws-382 +Check: CKV_AWS_24: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22" + FAILED for resource: aws_security_group.ssh_open + File: /security_groups.tf:31-62 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-1-port-security +Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389" + FAILED for resource: aws_security_group.ssh_open + File: /security_groups.tf:31-62 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2 +Check: CKV_AWS_23: "Ensure every security group and rule has a description" + FAILED for resource: aws_security_group.database_exposed + File: /security_groups.tf:65-92 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31 +Check: CKV_AWS_382: "Ensure no security groups allow egress from 0.0.0.0:0 to port -1" + FAILED for resource: aws_security_group.database_exposed + File: /security_groups.tf:65-92 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/bc-aws-382 +Check: CKV2_AWS_30: "Ensure Postgres RDS as aws_db_instance has Query Logging enabled" + FAILED for resource: aws_db_instance.unencrypted_db + File: /database.tf:5-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-postgres-rds-has-query-logging-enabled +Check: CKV2_AWS_60: "Ensure RDS instance with copy tags to snapshots is enabled" + FAILED for resource: aws_db_instance.unencrypted_db + File: /database.tf:5-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60 +Check: CKV2_AWS_60: "Ensure RDS instance with copy tags to snapshots is enabled" + FAILED for resource: aws_db_instance.weak_db + File: /database.tf:40-69 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60 +Check: CKV2_AWS_62: "Ensure S3 buckets should have event notifications enabled" + FAILED for resource: aws_s3_bucket.public_data + File: /main.tf:13-21 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-62 +Check: CKV2_AWS_62: "Ensure S3 buckets should have event notifications enabled" + FAILED for resource: aws_s3_bucket.unencrypted_data + File: /main.tf:24-33 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-62 +Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource" + FAILED for resource: aws_security_group.allow_all + File: /security_groups.tf:5-28 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis +Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource" + FAILED for resource: aws_security_group.ssh_open + File: /security_groups.tf:31-62 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis +Check: CKV2_AWS_61: "Ensure that an S3 bucket has a lifecycle configuration" + FAILED for resource: aws_s3_bucket.public_data + File: /main.tf:13-21 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-61 +Check: CKV2_AWS_61: "Ensure that an S3 bucket has a lifecycle configuration" + FAILED for resource: aws_s3_bucket.unencrypted_data + File: /main.tf:24-33 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-61 +Check: CKV_AWS_21: "Ensure all data stored in the S3 bucket have versioning enabled" + FAILED for resource: aws_s3_bucket.public_data + File: /main.tf:13-21 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-16-enable-versioning +Check: CKV_AWS_21: "Ensure all data stored in the S3 bucket have versioning enabled" + FAILED for resource: aws_s3_bucket.unencrypted_data + File: /main.tf:24-33 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-16-enable-versioning +Check: CKV_AWS_20: "S3 Bucket has an ACL defined which allows public READ access." + FAILED for resource: aws_s3_bucket.public_data + File: /main.tf:13-21 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-1-acl-read-permissions-everyone +Check: CKV_AWS_18: "Ensure the S3 bucket has access logging enabled" + FAILED for resource: aws_s3_bucket.public_data + File: /main.tf:13-21 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-13-enable-logging +Check: CKV_AWS_18: "Ensure the S3 bucket has access logging enabled" + FAILED for resource: aws_s3_bucket.unencrypted_data + File: /main.tf:24-33 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-13-enable-logging +Check: CKV_AWS_144: "Ensure that S3 bucket has cross-region replication enabled" + FAILED for resource: aws_s3_bucket.public_data + File: /main.tf:13-21 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-bucket-has-cross-region-replication-enabled +Check: CKV_AWS_144: "Ensure that S3 bucket has cross-region replication enabled" + FAILED for resource: aws_s3_bucket.unencrypted_data + File: /main.tf:24-33 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-bucket-has-cross-region-replication-enabled +Check: CKV_AWS_145: "Ensure that S3 buckets are encrypted with KMS by default" + FAILED for resource: aws_s3_bucket.public_data + File: /main.tf:13-21 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-buckets-are-encrypted-with-kms-by-default +Check: CKV_AWS_145: "Ensure that S3 buckets are encrypted with KMS by default" + FAILED for resource: aws_s3_bucket.unencrypted_data + File: /main.tf:24-33 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-buckets-are-encrypted-with-kms-by-default +Check: CKV2_AWS_6: "Ensure that S3 bucket has a Public Access block" + FAILED for resource: aws_s3_bucket.public_data + File: /main.tf:13-21 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/s3-bucket-should-have-public-access-blocks-defaults-to-false-if-the-public-access-block-is-not-attached +Check: CKV2_AWS_6: "Ensure that S3 bucket has a Public Access block" + FAILED for resource: aws_s3_bucket.unencrypted_data + File: /main.tf:24-33 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/s3-bucket-should-have-public-access-blocks-defaults-to-false-if-the-public-access-block-is-not-attached +Check: CKV2_AWS_40: "Ensure AWS IAM policy does not allow full IAM privileges" + FAILED for resource: aws_iam_policy.admin_policy + File: /iam.tf:5-19 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-2-40 + diff --git a/labs/lab6/analysis/checkov-terraform-results.json b/labs/lab6/analysis/checkov-terraform-results.json new file mode 100644 index 00000000..fc8208e8 --- /dev/null +++ b/labs/lab6/analysis/checkov-terraform-results.json @@ -0,0 +1,17139 @@ +{ + "check_type": "terraform", + "results": { + "passed_checks": [ + { + "check_id": "CKV_AWS_211", + "bc_check_id": "BC_AWS_GENERAL_118", + "check_name": "Ensure RDS uses a modern CaCert", + "check_result": { + "result": "PASSED", + "evaluated_keys": [ + "ca_cert_identifier" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_db_instance\" \"unencrypted_db\" {\n" + ], + [ + 6, + " identifier = \"mydb-unencrypted\"\n" + ], + [ + 7, + " engine = \"postgres\"\n" + ], + [ + 8, + " engine_version = \"13.7\"\n" + ], + [ + 9, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 10, + " allocated_storage = 20\n" + ], + [ + 11, + " \n" + ], + [ + 12, + " username = \"admin\"\n" + ], + [ + 13, + " password = \"SuperSecretPassword123!\" # SECURITY ISSUE #9 - Hardcoded password!\n" + ], + [ + 14, + " \n" + ], + [ + 15, + " storage_encrypted = false # No encryption!\n" + ], + [ + 16, + " \n" + ], + [ + 17, + " publicly_accessible = true # SECURITY ISSUE #10 - Public access!\n" + ], + [ + 18, + " \n" + ], + [ + 19, + " skip_final_snapshot = true\n" + ], + [ + 20, + " \n" + ], + [ + 21, + " # No backup configuration\n" + ], + [ + 22, + " backup_retention_period = 0 # SECURITY ISSUE #11 - No backups!\n" + ], + [ + 23, + " \n" + ], + [ + 24, + " # Missing monitoring\n" + ], + [ + 25, + " enabled_cloudwatch_logs_exports = []\n" + ], + [ + 26, + " \n" + ], + [ + 27, + " # No deletion protection\n" + ], + [ + 28, + " deletion_protection = false # SECURITY ISSUE #12\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " # Using default security group\n" + ], + [ + 31, + " vpc_security_group_ids = [aws_security_group.database_exposed.id]\n" + ], + [ + 32, + " \n" + ], + [ + 33, + " tags = {\n" + ], + [ + 34, + " Name = \"Unencrypted Database\"\n" + ], + [ + 35, + " # Missing required tags\n" + ], + [ + 36, + " }\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 5, + 37 + ], + "resource": "aws_db_instance.unencrypted_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.RDSCACertIsRecent", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-rds-uses-a-modern-cacert", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_354", + "bc_check_id": "BC_AWS_GENERAL_254", + "check_name": "Ensure RDS Performance Insights are encrypted using KMS CMKs", + "check_result": { + "result": "PASSED", + "evaluated_keys": [ + "performance_insights_kms_key_id" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_db_instance\" \"unencrypted_db\" {\n" + ], + [ + 6, + " identifier = \"mydb-unencrypted\"\n" + ], + [ + 7, + " engine = \"postgres\"\n" + ], + [ + 8, + " engine_version = \"13.7\"\n" + ], + [ + 9, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 10, + " allocated_storage = 20\n" + ], + [ + 11, + " \n" + ], + [ + 12, + " username = \"admin\"\n" + ], + [ + 13, + " password = \"SuperSecretPassword123!\" # SECURITY ISSUE #9 - Hardcoded password!\n" + ], + [ + 14, + " \n" + ], + [ + 15, + " storage_encrypted = false # No encryption!\n" + ], + [ + 16, + " \n" + ], + [ + 17, + " publicly_accessible = true # SECURITY ISSUE #10 - Public access!\n" + ], + [ + 18, + " \n" + ], + [ + 19, + " skip_final_snapshot = true\n" + ], + [ + 20, + " \n" + ], + [ + 21, + " # No backup configuration\n" + ], + [ + 22, + " backup_retention_period = 0 # SECURITY ISSUE #11 - No backups!\n" + ], + [ + 23, + " \n" + ], + [ + 24, + " # Missing monitoring\n" + ], + [ + 25, + " enabled_cloudwatch_logs_exports = []\n" + ], + [ + 26, + " \n" + ], + [ + 27, + " # No deletion protection\n" + ], + [ + 28, + " deletion_protection = false # SECURITY ISSUE #12\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " # Using default security group\n" + ], + [ + 31, + " vpc_security_group_ids = [aws_security_group.database_exposed.id]\n" + ], + [ + 32, + " \n" + ], + [ + 33, + " tags = {\n" + ], + [ + 34, + " Name = \"Unencrypted Database\"\n" + ], + [ + 35, + " # Missing required tags\n" + ], + [ + 36, + " }\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 5, + 37 + ], + "resource": "aws_db_instance.unencrypted_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.RDSInstancePerfInsightsEncryptionWithCMK", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_250", + "bc_check_id": "BC_AWS_GENERAL_130", + "check_name": "Ensure that RDS PostgreSQL instances use a non vulnerable version with the log_fdw extension (https://aws.amazon.com/security/security-bulletins/AWS-2022-004/)", + "check_result": { + "result": "PASSED", + "evaluated_keys": [ + "engine", + "engine_version" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_db_instance\" \"unencrypted_db\" {\n" + ], + [ + 6, + " identifier = \"mydb-unencrypted\"\n" + ], + [ + 7, + " engine = \"postgres\"\n" + ], + [ + 8, + " engine_version = \"13.7\"\n" + ], + [ + 9, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 10, + " allocated_storage = 20\n" + ], + [ + 11, + " \n" + ], + [ + 12, + " username = \"admin\"\n" + ], + [ + 13, + " password = \"SuperSecretPassword123!\" # SECURITY ISSUE #9 - Hardcoded password!\n" + ], + [ + 14, + " \n" + ], + [ + 15, + " storage_encrypted = false # No encryption!\n" + ], + [ + 16, + " \n" + ], + [ + 17, + " publicly_accessible = true # SECURITY ISSUE #10 - Public access!\n" + ], + [ + 18, + " \n" + ], + [ + 19, + " skip_final_snapshot = true\n" + ], + [ + 20, + " \n" + ], + [ + 21, + " # No backup configuration\n" + ], + [ + 22, + " backup_retention_period = 0 # SECURITY ISSUE #11 - No backups!\n" + ], + [ + 23, + " \n" + ], + [ + 24, + " # Missing monitoring\n" + ], + [ + 25, + " enabled_cloudwatch_logs_exports = []\n" + ], + [ + 26, + " \n" + ], + [ + 27, + " # No deletion protection\n" + ], + [ + 28, + " deletion_protection = false # SECURITY ISSUE #12\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " # Using default security group\n" + ], + [ + 31, + " vpc_security_group_ids = [aws_security_group.database_exposed.id]\n" + ], + [ + 32, + " \n" + ], + [ + 33, + " tags = {\n" + ], + [ + 34, + " Name = \"Unencrypted Database\"\n" + ], + [ + 35, + " # Missing required tags\n" + ], + [ + 36, + " }\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 5, + 37 + ], + "resource": "aws_db_instance.unencrypted_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.RDSPostgreSQLLogFDWExtension", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-rds-postgresql-instances-use-a-non-vulnerable-version-of-log-fdw-extension", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_388", + "bc_check_id": null, + "check_name": "Ensure AWS Aurora PostgreSQL is not exposed to local file read vulnerability", + "check_result": { + "result": "PASSED", + "evaluated_keys": [] + }, + "code_block": [ + [ + 5, + "resource \"aws_db_instance\" \"unencrypted_db\" {\n" + ], + [ + 6, + " identifier = \"mydb-unencrypted\"\n" + ], + [ + 7, + " engine = \"postgres\"\n" + ], + [ + 8, + " engine_version = \"13.7\"\n" + ], + [ + 9, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 10, + " allocated_storage = 20\n" + ], + [ + 11, + " \n" + ], + [ + 12, + " username = \"admin\"\n" + ], + [ + 13, + " password = \"SuperSecretPassword123!\" # SECURITY ISSUE #9 - Hardcoded password!\n" + ], + [ + 14, + " \n" + ], + [ + 15, + " storage_encrypted = false # No encryption!\n" + ], + [ + 16, + " \n" + ], + [ + 17, + " publicly_accessible = true # SECURITY ISSUE #10 - Public access!\n" + ], + [ + 18, + " \n" + ], + [ + 19, + " skip_final_snapshot = true\n" + ], + [ + 20, + " \n" + ], + [ + 21, + " # No backup configuration\n" + ], + [ + 22, + " backup_retention_period = 0 # SECURITY ISSUE #11 - No backups!\n" + ], + [ + 23, + " \n" + ], + [ + 24, + " # Missing monitoring\n" + ], + [ + 25, + " enabled_cloudwatch_logs_exports = []\n" + ], + [ + 26, + " \n" + ], + [ + 27, + " # No deletion protection\n" + ], + [ + 28, + " deletion_protection = false # SECURITY ISSUE #12\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " # Using default security group\n" + ], + [ + 31, + " vpc_security_group_ids = [aws_security_group.database_exposed.id]\n" + ], + [ + 32, + " \n" + ], + [ + 33, + " tags = {\n" + ], + [ + 34, + " Name = \"Unencrypted Database\"\n" + ], + [ + 35, + " # Missing required tags\n" + ], + [ + 36, + " }\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 5, + 37 + ], + "resource": "aws_db_instance.unencrypted_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.UnpatchedAuroraPostgresDB", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": {}, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": null, + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_133", + "bc_check_id": "BC_AWS_GENERAL_46", + "check_name": "Ensure that RDS instances has backup policy", + "check_result": { + "result": "PASSED", + "evaluated_keys": [ + "backup_retention_period" + ] + }, + "code_block": [ + [ + 40, + "resource \"aws_db_instance\" \"weak_db\" {\n" + ], + [ + 41, + " identifier = \"mydb-weak\"\n" + ], + [ + 42, + " engine = \"mysql\"\n" + ], + [ + 43, + " engine_version = \"5.7.38\" # Old version with known vulnerabilities\n" + ], + [ + 44, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 45, + " allocated_storage = 20\n" + ], + [ + 46, + " \n" + ], + [ + 47, + " username = \"root\" # Using default admin username\n" + ], + [ + 48, + " password = \"password123\" # Weak password!\n" + ], + [ + 49, + " \n" + ], + [ + 50, + " storage_encrypted = true\n" + ], + [ + 51, + " kms_key_id = \"\" # Empty KMS key - using default key\n" + ], + [ + 52, + " \n" + ], + [ + 53, + " publicly_accessible = false\n" + ], + [ + 54, + " \n" + ], + [ + 55, + " # Multi-AZ disabled\n" + ], + [ + 56, + " multi_az = false # SECURITY ISSUE #14 - No high availability\n" + ], + [ + 57, + " \n" + ], + [ + 58, + " # Auto minor version upgrade disabled\n" + ], + [ + 59, + " auto_minor_version_upgrade = false # SECURITY ISSUE #15\n" + ], + [ + 60, + " \n" + ], + [ + 61, + " # No performance insights\n" + ], + [ + 62, + " performance_insights_enabled = false\n" + ], + [ + 63, + " \n" + ], + [ + 64, + " skip_final_snapshot = true\n" + ], + [ + 65, + " \n" + ], + [ + 66, + " tags = {\n" + ], + [ + 67, + " Name = \"Weak Database\"\n" + ], + [ + 68, + " }\n" + ], + [ + 69, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 40, + 69 + ], + "resource": "aws_db_instance.weak_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.DBInstanceBackupRetentionPeriod", + "fixed_definition": null, + "entity_tags": { + "Name": "Weak Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-rds-instances-have-backup-policy", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_211", + "bc_check_id": "BC_AWS_GENERAL_118", + "check_name": "Ensure RDS uses a modern CaCert", + "check_result": { + "result": "PASSED", + "evaluated_keys": [ + "ca_cert_identifier" + ] + }, + "code_block": [ + [ + 40, + "resource \"aws_db_instance\" \"weak_db\" {\n" + ], + [ + 41, + " identifier = \"mydb-weak\"\n" + ], + [ + 42, + " engine = \"mysql\"\n" + ], + [ + 43, + " engine_version = \"5.7.38\" # Old version with known vulnerabilities\n" + ], + [ + 44, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 45, + " allocated_storage = 20\n" + ], + [ + 46, + " \n" + ], + [ + 47, + " username = \"root\" # Using default admin username\n" + ], + [ + 48, + " password = \"password123\" # Weak password!\n" + ], + [ + 49, + " \n" + ], + [ + 50, + " storage_encrypted = true\n" + ], + [ + 51, + " kms_key_id = \"\" # Empty KMS key - using default key\n" + ], + [ + 52, + " \n" + ], + [ + 53, + " publicly_accessible = false\n" + ], + [ + 54, + " \n" + ], + [ + 55, + " # Multi-AZ disabled\n" + ], + [ + 56, + " multi_az = false # SECURITY ISSUE #14 - No high availability\n" + ], + [ + 57, + " \n" + ], + [ + 58, + " # Auto minor version upgrade disabled\n" + ], + [ + 59, + " auto_minor_version_upgrade = false # SECURITY ISSUE #15\n" + ], + [ + 60, + " \n" + ], + [ + 61, + " # No performance insights\n" + ], + [ + 62, + " performance_insights_enabled = false\n" + ], + [ + 63, + " \n" + ], + [ + 64, + " skip_final_snapshot = true\n" + ], + [ + 65, + " \n" + ], + [ + 66, + " tags = {\n" + ], + [ + 67, + " Name = \"Weak Database\"\n" + ], + [ + 68, + " }\n" + ], + [ + 69, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 40, + 69 + ], + "resource": "aws_db_instance.weak_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.RDSCACertIsRecent", + "fixed_definition": null, + "entity_tags": { + "Name": "Weak Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-rds-uses-a-modern-cacert", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_16", + "bc_check_id": "BC_AWS_GENERAL_4", + "check_name": "Ensure all data stored in the RDS is securely encrypted at rest", + "check_result": { + "result": "PASSED", + "evaluated_keys": [ + "storage_encrypted" + ] + }, + "code_block": [ + [ + 40, + "resource \"aws_db_instance\" \"weak_db\" {\n" + ], + [ + 41, + " identifier = \"mydb-weak\"\n" + ], + [ + 42, + " engine = \"mysql\"\n" + ], + [ + 43, + " engine_version = \"5.7.38\" # Old version with known vulnerabilities\n" + ], + [ + 44, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 45, + " allocated_storage = 20\n" + ], + [ + 46, + " \n" + ], + [ + 47, + " username = \"root\" # Using default admin username\n" + ], + [ + 48, + " password = \"password123\" # Weak password!\n" + ], + [ + 49, + " \n" + ], + [ + 50, + " storage_encrypted = true\n" + ], + [ + 51, + " kms_key_id = \"\" # Empty KMS key - using default key\n" + ], + [ + 52, + " \n" + ], + [ + 53, + " publicly_accessible = false\n" + ], + [ + 54, + " \n" + ], + [ + 55, + " # Multi-AZ disabled\n" + ], + [ + 56, + " multi_az = false # SECURITY ISSUE #14 - No high availability\n" + ], + [ + 57, + " \n" + ], + [ + 58, + " # Auto minor version upgrade disabled\n" + ], + [ + 59, + " auto_minor_version_upgrade = false # SECURITY ISSUE #15\n" + ], + [ + 60, + " \n" + ], + [ + 61, + " # No performance insights\n" + ], + [ + 62, + " performance_insights_enabled = false\n" + ], + [ + 63, + " \n" + ], + [ + 64, + " skip_final_snapshot = true\n" + ], + [ + 65, + " \n" + ], + [ + 66, + " tags = {\n" + ], + [ + 67, + " Name = \"Weak Database\"\n" + ], + [ + 68, + " }\n" + ], + [ + 69, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 40, + 69 + ], + "resource": "aws_db_instance.weak_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.RDSEncryption", + "fixed_definition": null, + "entity_tags": { + "Name": "Weak Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-4", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_354", + "bc_check_id": "BC_AWS_GENERAL_254", + "check_name": "Ensure RDS Performance Insights are encrypted using KMS CMKs", + "check_result": { + "result": "PASSED", + "evaluated_keys": [ + "performance_insights_kms_key_id" + ] + }, + "code_block": [ + [ + 40, + "resource \"aws_db_instance\" \"weak_db\" {\n" + ], + [ + 41, + " identifier = \"mydb-weak\"\n" + ], + [ + 42, + " engine = \"mysql\"\n" + ], + [ + 43, + " engine_version = \"5.7.38\" # Old version with known vulnerabilities\n" + ], + [ + 44, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 45, + " allocated_storage = 20\n" + ], + [ + 46, + " \n" + ], + [ + 47, + " username = \"root\" # Using default admin username\n" + ], + [ + 48, + " password = \"password123\" # Weak password!\n" + ], + [ + 49, + " \n" + ], + [ + 50, + " storage_encrypted = true\n" + ], + [ + 51, + " kms_key_id = \"\" # Empty KMS key - using default key\n" + ], + [ + 52, + " \n" + ], + [ + 53, + " publicly_accessible = false\n" + ], + [ + 54, + " \n" + ], + [ + 55, + " # Multi-AZ disabled\n" + ], + [ + 56, + " multi_az = false # SECURITY ISSUE #14 - No high availability\n" + ], + [ + 57, + " \n" + ], + [ + 58, + " # Auto minor version upgrade disabled\n" + ], + [ + 59, + " auto_minor_version_upgrade = false # SECURITY ISSUE #15\n" + ], + [ + 60, + " \n" + ], + [ + 61, + " # No performance insights\n" + ], + [ + 62, + " performance_insights_enabled = false\n" + ], + [ + 63, + " \n" + ], + [ + 64, + " skip_final_snapshot = true\n" + ], + [ + 65, + " \n" + ], + [ + 66, + " tags = {\n" + ], + [ + 67, + " Name = \"Weak Database\"\n" + ], + [ + 68, + " }\n" + ], + [ + 69, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 40, + 69 + ], + "resource": "aws_db_instance.weak_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.RDSInstancePerfInsightsEncryptionWithCMK", + "fixed_definition": null, + "entity_tags": { + "Name": "Weak Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_17", + "bc_check_id": "BC_AWS_PUBLIC_2", + "check_name": "Ensure all data stored in RDS is not publicly accessible", + "check_result": { + "result": "PASSED", + "evaluated_keys": [ + "publicly_accessible" + ] + }, + "code_block": [ + [ + 40, + "resource \"aws_db_instance\" \"weak_db\" {\n" + ], + [ + 41, + " identifier = \"mydb-weak\"\n" + ], + [ + 42, + " engine = \"mysql\"\n" + ], + [ + 43, + " engine_version = \"5.7.38\" # Old version with known vulnerabilities\n" + ], + [ + 44, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 45, + " allocated_storage = 20\n" + ], + [ + 46, + " \n" + ], + [ + 47, + " username = \"root\" # Using default admin username\n" + ], + [ + 48, + " password = \"password123\" # Weak password!\n" + ], + [ + 49, + " \n" + ], + [ + 50, + " storage_encrypted = true\n" + ], + [ + 51, + " kms_key_id = \"\" # Empty KMS key - using default key\n" + ], + [ + 52, + " \n" + ], + [ + 53, + " publicly_accessible = false\n" + ], + [ + 54, + " \n" + ], + [ + 55, + " # Multi-AZ disabled\n" + ], + [ + 56, + " multi_az = false # SECURITY ISSUE #14 - No high availability\n" + ], + [ + 57, + " \n" + ], + [ + 58, + " # Auto minor version upgrade disabled\n" + ], + [ + 59, + " auto_minor_version_upgrade = false # SECURITY ISSUE #15\n" + ], + [ + 60, + " \n" + ], + [ + 61, + " # No performance insights\n" + ], + [ + 62, + " performance_insights_enabled = false\n" + ], + [ + 63, + " \n" + ], + [ + 64, + " skip_final_snapshot = true\n" + ], + [ + 65, + " \n" + ], + [ + 66, + " tags = {\n" + ], + [ + 67, + " Name = \"Weak Database\"\n" + ], + [ + 68, + " }\n" + ], + [ + 69, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 40, + 69 + ], + "resource": "aws_db_instance.weak_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.RDSPubliclyAccessible", + "fixed_definition": null, + "entity_tags": { + "Name": "Weak Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/public-policies/public-2", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_388", + "bc_check_id": null, + "check_name": "Ensure AWS Aurora PostgreSQL is not exposed to local file read vulnerability", + "check_result": { + "result": "PASSED", + "evaluated_keys": [] + }, + "code_block": [ + [ + 40, + "resource \"aws_db_instance\" \"weak_db\" {\n" + ], + [ + 41, + " identifier = \"mydb-weak\"\n" + ], + [ + 42, + " engine = \"mysql\"\n" + ], + [ + 43, + " engine_version = \"5.7.38\" # Old version with known vulnerabilities\n" + ], + [ + 44, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 45, + " allocated_storage = 20\n" + ], + [ + 46, + " \n" + ], + [ + 47, + " username = \"root\" # Using default admin username\n" + ], + [ + 48, + " password = \"password123\" # Weak password!\n" + ], + [ + 49, + " \n" + ], + [ + 50, + " storage_encrypted = true\n" + ], + [ + 51, + " kms_key_id = \"\" # Empty KMS key - using default key\n" + ], + [ + 52, + " \n" + ], + [ + 53, + " publicly_accessible = false\n" + ], + [ + 54, + " \n" + ], + [ + 55, + " # Multi-AZ disabled\n" + ], + [ + 56, + " multi_az = false # SECURITY ISSUE #14 - No high availability\n" + ], + [ + 57, + " \n" + ], + [ + 58, + " # Auto minor version upgrade disabled\n" + ], + [ + 59, + " auto_minor_version_upgrade = false # SECURITY ISSUE #15\n" + ], + [ + 60, + " \n" + ], + [ + 61, + " # No performance insights\n" + ], + [ + 62, + " performance_insights_enabled = false\n" + ], + [ + 63, + " \n" + ], + [ + 64, + " skip_final_snapshot = true\n" + ], + [ + 65, + " \n" + ], + [ + 66, + " tags = {\n" + ], + [ + 67, + " Name = \"Weak Database\"\n" + ], + [ + 68, + " }\n" + ], + [ + 69, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 40, + 69 + ], + "resource": "aws_db_instance.weak_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.UnpatchedAuroraPostgresDB", + "fixed_definition": null, + "entity_tags": { + "Name": "Weak Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": {}, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": null, + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_274", + "bc_check_id": "BC_AWS_IAM_78", + "check_name": "Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy", + "check_result": { + "result": "PASSED", + "evaluated_keys": [] + }, + "code_block": [ + [ + 22, + "resource \"aws_iam_role\" \"app_role\" {\n" + ], + [ + 23, + " name = \"application-role\"\n" + ], + [ + 24, + "\n" + ], + [ + 25, + " assume_role_policy = jsonencode({\n" + ], + [ + 26, + " Version = \"2012-10-17\"\n" + ], + [ + 27, + " Statement = [\n" + ], + [ + 28, + " {\n" + ], + [ + 29, + " Action = \"sts:AssumeRole\"\n" + ], + [ + 30, + " Effect = \"Allow\"\n" + ], + [ + 31, + " Principal = {\n" + ], + [ + 32, + " Service = \"ec2.amazonaws.com\"\n" + ], + [ + 33, + " }\n" + ], + [ + 34, + " }\n" + ], + [ + 35, + " ]\n" + ], + [ + 36, + " })\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 22, + 37 + ], + "resource": "aws_iam_role.app_role", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMManagedAdminPolicy", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-274", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_61", + "bc_check_id": "BC_AWS_IAM_45", + "check_name": "Ensure AWS IAM policy does not allow assume role permission across all services", + "check_result": { + "result": "PASSED", + "evaluated_keys": [ + "assume_role_policy" + ] + }, + "code_block": [ + [ + 22, + "resource \"aws_iam_role\" \"app_role\" {\n" + ], + [ + 23, + " name = \"application-role\"\n" + ], + [ + 24, + "\n" + ], + [ + 25, + " assume_role_policy = jsonencode({\n" + ], + [ + 26, + " Version = \"2012-10-17\"\n" + ], + [ + 27, + " Statement = [\n" + ], + [ + 28, + " {\n" + ], + [ + 29, + " Action = \"sts:AssumeRole\"\n" + ], + [ + 30, + " Effect = \"Allow\"\n" + ], + [ + 31, + " Principal = {\n" + ], + [ + 32, + " Service = \"ec2.amazonaws.com\"\n" + ], + [ + 33, + " }\n" + ], + [ + 34, + " }\n" + ], + [ + 35, + " ]\n" + ], + [ + 36, + " })\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 22, + 37 + ], + "resource": "aws_iam_role.app_role", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMRoleAllowAssumeFromAccount", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-iam-45", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_60", + "bc_check_id": "BC_AWS_IAM_44", + "check_name": "Ensure IAM role allows only specific services or principals to assume it", + "check_result": { + "result": "PASSED", + "evaluated_keys": [ + "assume_role_policy" + ] + }, + "code_block": [ + [ + 22, + "resource \"aws_iam_role\" \"app_role\" {\n" + ], + [ + 23, + " name = \"application-role\"\n" + ], + [ + 24, + "\n" + ], + [ + 25, + " assume_role_policy = jsonencode({\n" + ], + [ + 26, + " Version = \"2012-10-17\"\n" + ], + [ + 27, + " Statement = [\n" + ], + [ + 28, + " {\n" + ], + [ + 29, + " Action = \"sts:AssumeRole\"\n" + ], + [ + 30, + " Effect = \"Allow\"\n" + ], + [ + 31, + " Principal = {\n" + ], + [ + 32, + " Service = \"ec2.amazonaws.com\"\n" + ], + [ + 33, + " }\n" + ], + [ + 34, + " }\n" + ], + [ + 35, + " ]\n" + ], + [ + 36, + " })\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 22, + 37 + ], + "resource": "aws_iam_role.app_role", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMRoleAllowsPublicAssume", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-iam-44", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_62", + "bc_check_id": "BC_AWS_IAM_47", + "check_name": "Ensure IAM policies that allow full \"*-*\" administrative privileges are not created", + "check_result": { + "result": "PASSED", + "evaluated_keys": [ + "policy", + "inline_policy" + ] + }, + "code_block": [ + [ + 39, + "resource \"aws_iam_role_policy\" \"s3_full_access\" {\n" + ], + [ + 40, + " name = \"s3-full-access\"\n" + ], + [ + 41, + " role = aws_iam_role.app_role.id\n" + ], + [ + 42, + "\n" + ], + [ + 43, + " policy = jsonencode({\n" + ], + [ + 44, + " Version = \"2012-10-17\"\n" + ], + [ + 45, + " Statement = [\n" + ], + [ + 46, + " {\n" + ], + [ + 47, + " Effect = \"Allow\"\n" + ], + [ + 48, + " Action = [\n" + ], + [ + 49, + " \"s3:*\" # All S3 actions!\n" + ], + [ + 50, + " ]\n" + ], + [ + 51, + " Resource = \"*\" # On all buckets!\n" + ], + [ + 52, + " }\n" + ], + [ + 53, + " ]\n" + ], + [ + 54, + " })\n" + ], + [ + 55, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 39, + 55 + ], + "resource": "aws_iam_role_policy.s3_full_access", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMAdminPolicyDocument", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-iam-45", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_287", + "bc_check_id": "BC_AWS_IAM_82", + "check_name": "Ensure IAM policies does not allow credentials exposure", + "check_result": { + "result": "PASSED", + "evaluated_keys": [] + }, + "code_block": [ + [ + 39, + "resource \"aws_iam_role_policy\" \"s3_full_access\" {\n" + ], + [ + 40, + " name = \"s3-full-access\"\n" + ], + [ + 41, + " role = aws_iam_role.app_role.id\n" + ], + [ + 42, + "\n" + ], + [ + 43, + " policy = jsonencode({\n" + ], + [ + 44, + " Version = \"2012-10-17\"\n" + ], + [ + 45, + " Statement = [\n" + ], + [ + 46, + " {\n" + ], + [ + 47, + " Effect = \"Allow\"\n" + ], + [ + 48, + " Action = [\n" + ], + [ + 49, + " \"s3:*\" # All S3 actions!\n" + ], + [ + 50, + " ]\n" + ], + [ + 51, + " Resource = \"*\" # On all buckets!\n" + ], + [ + 52, + " }\n" + ], + [ + 53, + " ]\n" + ], + [ + 54, + " })\n" + ], + [ + 55, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 39, + 55 + ], + "resource": "aws_iam_role_policy.s3_full_access", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMCredentialsExposure", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-287", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_286", + "bc_check_id": "BC_AWS_IAM_81", + "check_name": "Ensure IAM policies does not allow privilege escalation", + "check_result": { + "result": "PASSED", + "evaluated_keys": [] + }, + "code_block": [ + [ + 39, + "resource \"aws_iam_role_policy\" \"s3_full_access\" {\n" + ], + [ + 40, + " name = \"s3-full-access\"\n" + ], + [ + 41, + " role = aws_iam_role.app_role.id\n" + ], + [ + 42, + "\n" + ], + [ + 43, + " policy = jsonencode({\n" + ], + [ + 44, + " Version = \"2012-10-17\"\n" + ], + [ + 45, + " Statement = [\n" + ], + [ + 46, + " {\n" + ], + [ + 47, + " Effect = \"Allow\"\n" + ], + [ + 48, + " Action = [\n" + ], + [ + 49, + " \"s3:*\" # All S3 actions!\n" + ], + [ + 50, + " ]\n" + ], + [ + 51, + " Resource = \"*\" # On all buckets!\n" + ], + [ + 52, + " }\n" + ], + [ + 53, + " ]\n" + ], + [ + 54, + " })\n" + ], + [ + 55, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 39, + 55 + ], + "resource": "aws_iam_role_policy.s3_full_access", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMPrivilegeEscalation", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-286", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_63", + "bc_check_id": "BC_AWS_IAM_48", + "check_name": "Ensure no IAM policies documents allow \"*\" as a statement's actions", + "check_result": { + "result": "PASSED", + "evaluated_keys": [ + "policy", + "inline_policy" + ] + }, + "code_block": [ + [ + 39, + "resource \"aws_iam_role_policy\" \"s3_full_access\" {\n" + ], + [ + 40, + " name = \"s3-full-access\"\n" + ], + [ + 41, + " role = aws_iam_role.app_role.id\n" + ], + [ + 42, + "\n" + ], + [ + 43, + " policy = jsonencode({\n" + ], + [ + 44, + " Version = \"2012-10-17\"\n" + ], + [ + 45, + " Statement = [\n" + ], + [ + 46, + " {\n" + ], + [ + 47, + " Effect = \"Allow\"\n" + ], + [ + 48, + " Action = [\n" + ], + [ + 49, + " \"s3:*\" # All S3 actions!\n" + ], + [ + 50, + " ]\n" + ], + [ + 51, + " Resource = \"*\" # On all buckets!\n" + ], + [ + 52, + " }\n" + ], + [ + 53, + " ]\n" + ], + [ + 54, + " })\n" + ], + [ + 55, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 39, + 55 + ], + "resource": "aws_iam_role_policy.s3_full_access", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMStarActionPolicyDocument", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/iam-48", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_62", + "bc_check_id": "BC_AWS_IAM_47", + "check_name": "Ensure IAM policies that allow full \"*-*\" administrative privileges are not created", + "check_result": { + "result": "PASSED", + "evaluated_keys": [ + "policy", + "inline_policy" + ] + }, + "code_block": [ + [ + 67, + "resource \"aws_iam_user_policy\" \"service_policy\" {\n" + ], + [ + 68, + " name = \"service-inline-policy\"\n" + ], + [ + 69, + " user = aws_iam_user.service_account.name\n" + ], + [ + 70, + "\n" + ], + [ + 71, + " policy = jsonencode({\n" + ], + [ + 72, + " Version = \"2012-10-17\"\n" + ], + [ + 73, + " Statement = [\n" + ], + [ + 74, + " {\n" + ], + [ + 75, + " Effect = \"Allow\"\n" + ], + [ + 76, + " Action = [\n" + ], + [ + 77, + " \"ec2:*\", # Full EC2 access\n" + ], + [ + 78, + " \"s3:*\", # Full S3 access\n" + ], + [ + 79, + " \"rds:*\" # Full RDS access\n" + ], + [ + 80, + " ]\n" + ], + [ + 81, + " Resource = \"*\"\n" + ], + [ + 82, + " }\n" + ], + [ + 83, + " ]\n" + ], + [ + 84, + " })\n" + ], + [ + 85, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 67, + 85 + ], + "resource": "aws_iam_user_policy.service_policy", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMAdminPolicyDocument", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-iam-45", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf", + "breadcrumbs": { + "user": [ + { + "type": "resource", + "name": "aws_iam_user.service_account", + "path": "/tf/iam.tf", + "module_connection": false + } + ] + } + }, + { + "check_id": "CKV_AWS_286", + "bc_check_id": "BC_AWS_IAM_81", + "check_name": "Ensure IAM policies does not allow privilege escalation", + "check_result": { + "result": "PASSED", + "evaluated_keys": [] + }, + "code_block": [ + [ + 67, + "resource \"aws_iam_user_policy\" \"service_policy\" {\n" + ], + [ + 68, + " name = \"service-inline-policy\"\n" + ], + [ + 69, + " user = aws_iam_user.service_account.name\n" + ], + [ + 70, + "\n" + ], + [ + 71, + " policy = jsonencode({\n" + ], + [ + 72, + " Version = \"2012-10-17\"\n" + ], + [ + 73, + " Statement = [\n" + ], + [ + 74, + " {\n" + ], + [ + 75, + " Effect = \"Allow\"\n" + ], + [ + 76, + " Action = [\n" + ], + [ + 77, + " \"ec2:*\", # Full EC2 access\n" + ], + [ + 78, + " \"s3:*\", # Full S3 access\n" + ], + [ + 79, + " \"rds:*\" # Full RDS access\n" + ], + [ + 80, + " ]\n" + ], + [ + 81, + " Resource = \"*\"\n" + ], + [ + 82, + " }\n" + ], + [ + 83, + " ]\n" + ], + [ + 84, + " })\n" + ], + [ + 85, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 67, + 85 + ], + "resource": "aws_iam_user_policy.service_policy", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMPrivilegeEscalation", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-286", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf", + "breadcrumbs": { + "user": [ + { + "type": "resource", + "name": "aws_iam_user.service_account", + "path": "/tf/iam.tf", + "module_connection": false + } + ] + } + }, + { + "check_id": "CKV_AWS_63", + "bc_check_id": "BC_AWS_IAM_48", + "check_name": "Ensure no IAM policies documents allow \"*\" as a statement's actions", + "check_result": { + "result": "PASSED", + "evaluated_keys": [ + "policy", + "inline_policy" + ] + }, + "code_block": [ + [ + 67, + "resource \"aws_iam_user_policy\" \"service_policy\" {\n" + ], + [ + 68, + " name = \"service-inline-policy\"\n" + ], + [ + 69, + " user = aws_iam_user.service_account.name\n" + ], + [ + 70, + "\n" + ], + [ + 71, + " policy = jsonencode({\n" + ], + [ + 72, + " Version = \"2012-10-17\"\n" + ], + [ + 73, + " Statement = [\n" + ], + [ + 74, + " {\n" + ], + [ + 75, + " Effect = \"Allow\"\n" + ], + [ + 76, + " Action = [\n" + ], + [ + 77, + " \"ec2:*\", # Full EC2 access\n" + ], + [ + 78, + " \"s3:*\", # Full S3 access\n" + ], + [ + 79, + " \"rds:*\" # Full RDS access\n" + ], + [ + 80, + " ]\n" + ], + [ + 81, + " Resource = \"*\"\n" + ], + [ + 82, + " }\n" + ], + [ + 83, + " ]\n" + ], + [ + 84, + " })\n" + ], + [ + 85, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 67, + 85 + ], + "resource": "aws_iam_user_policy.service_policy", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMStarActionPolicyDocument", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/iam-48", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf", + "breadcrumbs": { + "user": [ + { + "type": "resource", + "name": "aws_iam_user.service_account", + "path": "/tf/iam.tf", + "module_connection": false + } + ] + } + }, + { + "check_id": "CKV_AWS_348", + "bc_check_id": "BC_AWS_IAM_87", + "check_name": "Ensure IAM root user does not have Access keys", + "check_result": { + "result": "PASSED", + "evaluated_keys": [ + "user" + ] + }, + "code_block": [ + [ + 88, + "resource \"aws_iam_access_key\" \"service_key\" {\n" + ], + [ + 89, + " user = aws_iam_user.service_account.name\n" + ], + [ + 90, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 88, + 90 + ], + "resource": "aws_iam_access_key.service_key", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMUserRootAccessKeys", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-348", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf", + "breadcrumbs": { + "user": [ + { + "type": "resource", + "name": "aws_iam_user.service_account", + "path": "/tf/iam.tf", + "module_connection": false + } + ] + } + }, + { + "check_id": "CKV_AWS_62", + "bc_check_id": "BC_AWS_IAM_47", + "check_name": "Ensure IAM policies that allow full \"*-*\" administrative privileges are not created", + "check_result": { + "result": "PASSED", + "evaluated_keys": [ + "policy", + "inline_policy" + ] + }, + "code_block": [ + [ + 104, + "resource \"aws_iam_policy\" \"privilege_escalation\" {\n" + ], + [ + 105, + " name = \"potential-privilege-escalation\"\n" + ], + [ + 106, + " description = \"Policy that allows privilege escalation\"\n" + ], + [ + 107, + "\n" + ], + [ + 108, + " policy = jsonencode({\n" + ], + [ + 109, + " Version = \"2012-10-17\"\n" + ], + [ + 110, + " Statement = [\n" + ], + [ + 111, + " {\n" + ], + [ + 112, + " Effect = \"Allow\"\n" + ], + [ + 113, + " Action = [\n" + ], + [ + 114, + " \"iam:CreatePolicy\",\n" + ], + [ + 115, + " \"iam:CreateUser\",\n" + ], + [ + 116, + " \"iam:AttachUserPolicy\",\n" + ], + [ + 117, + " \"iam:AttachRolePolicy\",\n" + ], + [ + 118, + " \"iam:PutUserPolicy\",\n" + ], + [ + 119, + " \"iam:PutRolePolicy\"\n" + ], + [ + 120, + " ]\n" + ], + [ + 121, + " Resource = \"*\"\n" + ], + [ + 122, + " }\n" + ], + [ + 123, + " ]\n" + ], + [ + 124, + " })\n" + ], + [ + 125, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 104, + 125 + ], + "resource": "aws_iam_policy.privilege_escalation", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMAdminPolicyDocument", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-iam-45", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_287", + "bc_check_id": "BC_AWS_IAM_82", + "check_name": "Ensure IAM policies does not allow credentials exposure", + "check_result": { + "result": "PASSED", + "evaluated_keys": [] + }, + "code_block": [ + [ + 104, + "resource \"aws_iam_policy\" \"privilege_escalation\" {\n" + ], + [ + 105, + " name = \"potential-privilege-escalation\"\n" + ], + [ + 106, + " description = \"Policy that allows privilege escalation\"\n" + ], + [ + 107, + "\n" + ], + [ + 108, + " policy = jsonencode({\n" + ], + [ + 109, + " Version = \"2012-10-17\"\n" + ], + [ + 110, + " Statement = [\n" + ], + [ + 111, + " {\n" + ], + [ + 112, + " Effect = \"Allow\"\n" + ], + [ + 113, + " Action = [\n" + ], + [ + 114, + " \"iam:CreatePolicy\",\n" + ], + [ + 115, + " \"iam:CreateUser\",\n" + ], + [ + 116, + " \"iam:AttachUserPolicy\",\n" + ], + [ + 117, + " \"iam:AttachRolePolicy\",\n" + ], + [ + 118, + " \"iam:PutUserPolicy\",\n" + ], + [ + 119, + " \"iam:PutRolePolicy\"\n" + ], + [ + 120, + " ]\n" + ], + [ + 121, + " Resource = \"*\"\n" + ], + [ + 122, + " }\n" + ], + [ + 123, + " ]\n" + ], + [ + 124, + " })\n" + ], + [ + 125, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 104, + 125 + ], + "resource": "aws_iam_policy.privilege_escalation", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMCredentialsExposure", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-287", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_288", + "bc_check_id": "BC_AWS_IAM_83", + "check_name": "Ensure IAM policies does not allow data exfiltration", + "check_result": { + "result": "PASSED", + "evaluated_keys": [] + }, + "code_block": [ + [ + 104, + "resource \"aws_iam_policy\" \"privilege_escalation\" {\n" + ], + [ + 105, + " name = \"potential-privilege-escalation\"\n" + ], + [ + 106, + " description = \"Policy that allows privilege escalation\"\n" + ], + [ + 107, + "\n" + ], + [ + 108, + " policy = jsonencode({\n" + ], + [ + 109, + " Version = \"2012-10-17\"\n" + ], + [ + 110, + " Statement = [\n" + ], + [ + 111, + " {\n" + ], + [ + 112, + " Effect = \"Allow\"\n" + ], + [ + 113, + " Action = [\n" + ], + [ + 114, + " \"iam:CreatePolicy\",\n" + ], + [ + 115, + " \"iam:CreateUser\",\n" + ], + [ + 116, + " \"iam:AttachUserPolicy\",\n" + ], + [ + 117, + " \"iam:AttachRolePolicy\",\n" + ], + [ + 118, + " \"iam:PutUserPolicy\",\n" + ], + [ + 119, + " \"iam:PutRolePolicy\"\n" + ], + [ + 120, + " ]\n" + ], + [ + 121, + " Resource = \"*\"\n" + ], + [ + 122, + " }\n" + ], + [ + 123, + " ]\n" + ], + [ + 124, + " })\n" + ], + [ + 125, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 104, + 125 + ], + "resource": "aws_iam_policy.privilege_escalation", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMDataExfiltration", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-288", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_63", + "bc_check_id": "BC_AWS_IAM_48", + "check_name": "Ensure no IAM policies documents allow \"*\" as a statement's actions", + "check_result": { + "result": "PASSED", + "evaluated_keys": [ + "policy", + "inline_policy" + ] + }, + "code_block": [ + [ + 104, + "resource \"aws_iam_policy\" \"privilege_escalation\" {\n" + ], + [ + 105, + " name = \"potential-privilege-escalation\"\n" + ], + [ + 106, + " description = \"Policy that allows privilege escalation\"\n" + ], + [ + 107, + "\n" + ], + [ + 108, + " policy = jsonencode({\n" + ], + [ + 109, + " Version = \"2012-10-17\"\n" + ], + [ + 110, + " Statement = [\n" + ], + [ + 111, + " {\n" + ], + [ + 112, + " Effect = \"Allow\"\n" + ], + [ + 113, + " Action = [\n" + ], + [ + 114, + " \"iam:CreatePolicy\",\n" + ], + [ + 115, + " \"iam:CreateUser\",\n" + ], + [ + 116, + " \"iam:AttachUserPolicy\",\n" + ], + [ + 117, + " \"iam:AttachRolePolicy\",\n" + ], + [ + 118, + " \"iam:PutUserPolicy\",\n" + ], + [ + 119, + " \"iam:PutRolePolicy\"\n" + ], + [ + 120, + " ]\n" + ], + [ + 121, + " Resource = \"*\"\n" + ], + [ + 122, + " }\n" + ], + [ + 123, + " ]\n" + ], + [ + 124, + " })\n" + ], + [ + 125, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 104, + 125 + ], + "resource": "aws_iam_policy.privilege_escalation", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMStarActionPolicyDocument", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/iam-48", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_290", + "bc_check_id": "BC_AWS_IAM_85", + "check_name": "Ensure IAM policies does not allow write access without constraints", + "check_result": { + "result": "PASSED", + "evaluated_keys": [] + }, + "code_block": [ + [ + 104, + "resource \"aws_iam_policy\" \"privilege_escalation\" {\n" + ], + [ + 105, + " name = \"potential-privilege-escalation\"\n" + ], + [ + 106, + " description = \"Policy that allows privilege escalation\"\n" + ], + [ + 107, + "\n" + ], + [ + 108, + " policy = jsonencode({\n" + ], + [ + 109, + " Version = \"2012-10-17\"\n" + ], + [ + 110, + " Statement = [\n" + ], + [ + 111, + " {\n" + ], + [ + 112, + " Effect = \"Allow\"\n" + ], + [ + 113, + " Action = [\n" + ], + [ + 114, + " \"iam:CreatePolicy\",\n" + ], + [ + 115, + " \"iam:CreateUser\",\n" + ], + [ + 116, + " \"iam:AttachUserPolicy\",\n" + ], + [ + 117, + " \"iam:AttachRolePolicy\",\n" + ], + [ + 118, + " \"iam:PutUserPolicy\",\n" + ], + [ + 119, + " \"iam:PutRolePolicy\"\n" + ], + [ + 120, + " ]\n" + ], + [ + 121, + " Resource = \"*\"\n" + ], + [ + 122, + " }\n" + ], + [ + 123, + " ]\n" + ], + [ + 124, + " })\n" + ], + [ + 125, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 104, + 125 + ], + "resource": "aws_iam_policy.privilege_escalation", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMWriteAccess", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_93", + "bc_check_id": "BC_AWS_S3_24", + "check_name": "Ensure S3 bucket policy does not lockout all but root user. (Prevent lockouts needing root account fixes)", + "check_result": { + "result": "PASSED", + "evaluated_keys": [ + "policy" + ] + }, + "code_block": [ + [ + 13, + "resource \"aws_s3_bucket\" \"public_data\" {\n" + ], + [ + 14, + " bucket = \"my-public-bucket-lab6\"\n" + ], + [ + 15, + " acl = \"public-read\" # Public access enabled!\n" + ], + [ + 16, + "\n" + ], + [ + 17, + " tags = {\n" + ], + [ + 18, + " Name = \"Public Data Bucket\"\n" + ], + [ + 19, + " # Missing required tags: Environment, Owner, CostCenter\n" + ], + [ + 20, + " }\n" + ], + [ + 21, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 13, + 21 + ], + "resource": "aws_s3_bucket.public_data", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.S3ProtectAgainstPolicyLockout", + "fixed_definition": null, + "entity_tags": { + "Name": "Public Data Bucket" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc-aws-s3-24", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV_AWS_93", + "bc_check_id": "BC_AWS_S3_24", + "check_name": "Ensure S3 bucket policy does not lockout all but root user. (Prevent lockouts needing root account fixes)", + "check_result": { + "result": "PASSED", + "evaluated_keys": [ + "policy" + ] + }, + "code_block": [ + [ + 24, + "resource \"aws_s3_bucket\" \"unencrypted_data\" {\n" + ], + [ + 25, + " bucket = \"my-unencrypted-bucket-lab6\"\n" + ], + [ + 26, + " acl = \"private\"\n" + ], + [ + 27, + " \n" + ], + [ + 28, + " # No server_side_encryption_configuration!\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " versioning {\n" + ], + [ + 31, + " enabled = false # Versioning disabled\n" + ], + [ + 32, + " }\n" + ], + [ + 33, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 24, + 33 + ], + "resource": "aws_s3_bucket.unencrypted_data", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.S3ProtectAgainstPolicyLockout", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc-aws-s3-24", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV_AWS_260", + "bc_check_id": "BC_AWS_NETWORKING_67", + "check_name": "Ensure no security groups allow ingress from 0.0.0.0:0 to port 80", + "check_result": { + "result": "PASSED", + "evaluated_keys": [] + }, + "code_block": [ + [ + 31, + "resource \"aws_security_group\" \"ssh_open\" {\n" + ], + [ + 32, + " name = \"ssh-from-anywhere\"\n" + ], + [ + 33, + " description = \"SSH access from anywhere\"\n" + ], + [ + 34, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 35, + "\n" + ], + [ + 36, + " ingress {\n" + ], + [ + 37, + " description = \"SSH from anywhere\"\n" + ], + [ + 38, + " from_port = 22\n" + ], + [ + 39, + " to_port = 22\n" + ], + [ + 40, + " protocol = \"tcp\"\n" + ], + [ + 41, + " cidr_blocks = [\"0.0.0.0/0\"] # SSH from anywhere!\n" + ], + [ + 42, + " }\n" + ], + [ + 43, + "\n" + ], + [ + 44, + " ingress {\n" + ], + [ + 45, + " description = \"RDP from anywhere\"\n" + ], + [ + 46, + " from_port = 3389\n" + ], + [ + 47, + " to_port = 3389\n" + ], + [ + 48, + " protocol = \"tcp\"\n" + ], + [ + 49, + " cidr_blocks = [\"0.0.0.0/0\"] # RDP from anywhere!\n" + ], + [ + 50, + " }\n" + ], + [ + 51, + "\n" + ], + [ + 52, + " egress {\n" + ], + [ + 53, + " from_port = 0\n" + ], + [ + 54, + " to_port = 0\n" + ], + [ + 55, + " protocol = \"-1\"\n" + ], + [ + 56, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 57, + " }\n" + ], + [ + 58, + "\n" + ], + [ + 59, + " tags = {\n" + ], + [ + 60, + " Name = \"SSH Open Security Group\"\n" + ], + [ + 61, + " }\n" + ], + [ + 62, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 31, + 62 + ], + "resource": "aws_security_group.ssh_open", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.SecurityGroupUnrestrictedIngress80", + "fixed_definition": null, + "entity_tags": { + "Name": "SSH Open Security Group" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-groups-do-not-allow-ingress-from-00000-to-port-80", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV_AWS_277", + "bc_check_id": "BC_AWS_NETWORKING_78", + "check_name": "Ensure no security groups allow ingress from 0.0.0.0:0 to port -1", + "check_result": { + "result": "PASSED", + "evaluated_keys": [] + }, + "code_block": [ + [ + 31, + "resource \"aws_security_group\" \"ssh_open\" {\n" + ], + [ + 32, + " name = \"ssh-from-anywhere\"\n" + ], + [ + 33, + " description = \"SSH access from anywhere\"\n" + ], + [ + 34, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 35, + "\n" + ], + [ + 36, + " ingress {\n" + ], + [ + 37, + " description = \"SSH from anywhere\"\n" + ], + [ + 38, + " from_port = 22\n" + ], + [ + 39, + " to_port = 22\n" + ], + [ + 40, + " protocol = \"tcp\"\n" + ], + [ + 41, + " cidr_blocks = [\"0.0.0.0/0\"] # SSH from anywhere!\n" + ], + [ + 42, + " }\n" + ], + [ + 43, + "\n" + ], + [ + 44, + " ingress {\n" + ], + [ + 45, + " description = \"RDP from anywhere\"\n" + ], + [ + 46, + " from_port = 3389\n" + ], + [ + 47, + " to_port = 3389\n" + ], + [ + 48, + " protocol = \"tcp\"\n" + ], + [ + 49, + " cidr_blocks = [\"0.0.0.0/0\"] # RDP from anywhere!\n" + ], + [ + 50, + " }\n" + ], + [ + 51, + "\n" + ], + [ + 52, + " egress {\n" + ], + [ + 53, + " from_port = 0\n" + ], + [ + 54, + " to_port = 0\n" + ], + [ + 55, + " protocol = \"-1\"\n" + ], + [ + 56, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 57, + " }\n" + ], + [ + 58, + "\n" + ], + [ + 59, + " tags = {\n" + ], + [ + 60, + " Name = \"SSH Open Security Group\"\n" + ], + [ + 61, + " }\n" + ], + [ + 62, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 31, + 62 + ], + "resource": "aws_security_group.ssh_open", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.SecurityGroupUnrestrictedIngressAny", + "fixed_definition": null, + "entity_tags": { + "Name": "SSH Open Security Group" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-group-does-not-allow-all-traffic-on-all-ports", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV_AWS_24", + "bc_check_id": "BC_AWS_NETWORKING_1", + "check_name": "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22", + "check_result": { + "result": "PASSED", + "evaluated_keys": [] + }, + "code_block": [ + [ + 65, + "resource \"aws_security_group\" \"database_exposed\" {\n" + ], + [ + 66, + " name = \"database-public\"\n" + ], + [ + 67, + " description = \"Database accessible from internet\"\n" + ], + [ + 68, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 69, + "\n" + ], + [ + 70, + " ingress {\n" + ], + [ + 71, + " description = \"MySQL from anywhere\"\n" + ], + [ + 72, + " from_port = 3306\n" + ], + [ + 73, + " to_port = 3306\n" + ], + [ + 74, + " protocol = \"tcp\"\n" + ], + [ + 75, + " cidr_blocks = [\"0.0.0.0/0\"] # Database exposed!\n" + ], + [ + 76, + " }\n" + ], + [ + 77, + "\n" + ], + [ + 78, + " ingress {\n" + ], + [ + 79, + " description = \"PostgreSQL from anywhere\"\n" + ], + [ + 80, + " from_port = 5432\n" + ], + [ + 81, + " to_port = 5432\n" + ], + [ + 82, + " protocol = \"tcp\"\n" + ], + [ + 83, + " cidr_blocks = [\"0.0.0.0/0\"] # Database exposed!\n" + ], + [ + 84, + " }\n" + ], + [ + 85, + "\n" + ], + [ + 86, + " egress {\n" + ], + [ + 87, + " from_port = 0\n" + ], + [ + 88, + " to_port = 0\n" + ], + [ + 89, + " protocol = \"-1\"\n" + ], + [ + 90, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 91, + " }\n" + ], + [ + 92, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 65, + 92 + ], + "resource": "aws_security_group.database_exposed", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.SecurityGroupUnrestrictedIngress22", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-1-port-security", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV_AWS_25", + "bc_check_id": "BC_AWS_NETWORKING_2", + "check_name": "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389", + "check_result": { + "result": "PASSED", + "evaluated_keys": [] + }, + "code_block": [ + [ + 65, + "resource \"aws_security_group\" \"database_exposed\" {\n" + ], + [ + 66, + " name = \"database-public\"\n" + ], + [ + 67, + " description = \"Database accessible from internet\"\n" + ], + [ + 68, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 69, + "\n" + ], + [ + 70, + " ingress {\n" + ], + [ + 71, + " description = \"MySQL from anywhere\"\n" + ], + [ + 72, + " from_port = 3306\n" + ], + [ + 73, + " to_port = 3306\n" + ], + [ + 74, + " protocol = \"tcp\"\n" + ], + [ + 75, + " cidr_blocks = [\"0.0.0.0/0\"] # Database exposed!\n" + ], + [ + 76, + " }\n" + ], + [ + 77, + "\n" + ], + [ + 78, + " ingress {\n" + ], + [ + 79, + " description = \"PostgreSQL from anywhere\"\n" + ], + [ + 80, + " from_port = 5432\n" + ], + [ + 81, + " to_port = 5432\n" + ], + [ + 82, + " protocol = \"tcp\"\n" + ], + [ + 83, + " cidr_blocks = [\"0.0.0.0/0\"] # Database exposed!\n" + ], + [ + 84, + " }\n" + ], + [ + 85, + "\n" + ], + [ + 86, + " egress {\n" + ], + [ + 87, + " from_port = 0\n" + ], + [ + 88, + " to_port = 0\n" + ], + [ + 89, + " protocol = \"-1\"\n" + ], + [ + 90, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 91, + " }\n" + ], + [ + 92, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 65, + 92 + ], + "resource": "aws_security_group.database_exposed", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.SecurityGroupUnrestrictedIngress3389", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV_AWS_260", + "bc_check_id": "BC_AWS_NETWORKING_67", + "check_name": "Ensure no security groups allow ingress from 0.0.0.0:0 to port 80", + "check_result": { + "result": "PASSED", + "evaluated_keys": [] + }, + "code_block": [ + [ + 65, + "resource \"aws_security_group\" \"database_exposed\" {\n" + ], + [ + 66, + " name = \"database-public\"\n" + ], + [ + 67, + " description = \"Database accessible from internet\"\n" + ], + [ + 68, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 69, + "\n" + ], + [ + 70, + " ingress {\n" + ], + [ + 71, + " description = \"MySQL from anywhere\"\n" + ], + [ + 72, + " from_port = 3306\n" + ], + [ + 73, + " to_port = 3306\n" + ], + [ + 74, + " protocol = \"tcp\"\n" + ], + [ + 75, + " cidr_blocks = [\"0.0.0.0/0\"] # Database exposed!\n" + ], + [ + 76, + " }\n" + ], + [ + 77, + "\n" + ], + [ + 78, + " ingress {\n" + ], + [ + 79, + " description = \"PostgreSQL from anywhere\"\n" + ], + [ + 80, + " from_port = 5432\n" + ], + [ + 81, + " to_port = 5432\n" + ], + [ + 82, + " protocol = \"tcp\"\n" + ], + [ + 83, + " cidr_blocks = [\"0.0.0.0/0\"] # Database exposed!\n" + ], + [ + 84, + " }\n" + ], + [ + 85, + "\n" + ], + [ + 86, + " egress {\n" + ], + [ + 87, + " from_port = 0\n" + ], + [ + 88, + " to_port = 0\n" + ], + [ + 89, + " protocol = \"-1\"\n" + ], + [ + 90, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 91, + " }\n" + ], + [ + 92, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 65, + 92 + ], + "resource": "aws_security_group.database_exposed", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.SecurityGroupUnrestrictedIngress80", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-groups-do-not-allow-ingress-from-00000-to-port-80", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV_AWS_277", + "bc_check_id": "BC_AWS_NETWORKING_78", + "check_name": "Ensure no security groups allow ingress from 0.0.0.0:0 to port -1", + "check_result": { + "result": "PASSED", + "evaluated_keys": [] + }, + "code_block": [ + [ + 65, + "resource \"aws_security_group\" \"database_exposed\" {\n" + ], + [ + 66, + " name = \"database-public\"\n" + ], + [ + 67, + " description = \"Database accessible from internet\"\n" + ], + [ + 68, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 69, + "\n" + ], + [ + 70, + " ingress {\n" + ], + [ + 71, + " description = \"MySQL from anywhere\"\n" + ], + [ + 72, + " from_port = 3306\n" + ], + [ + 73, + " to_port = 3306\n" + ], + [ + 74, + " protocol = \"tcp\"\n" + ], + [ + 75, + " cidr_blocks = [\"0.0.0.0/0\"] # Database exposed!\n" + ], + [ + 76, + " }\n" + ], + [ + 77, + "\n" + ], + [ + 78, + " ingress {\n" + ], + [ + 79, + " description = \"PostgreSQL from anywhere\"\n" + ], + [ + 80, + " from_port = 5432\n" + ], + [ + 81, + " to_port = 5432\n" + ], + [ + 82, + " protocol = \"tcp\"\n" + ], + [ + 83, + " cidr_blocks = [\"0.0.0.0/0\"] # Database exposed!\n" + ], + [ + 84, + " }\n" + ], + [ + 85, + "\n" + ], + [ + 86, + " egress {\n" + ], + [ + 87, + " from_port = 0\n" + ], + [ + 88, + " to_port = 0\n" + ], + [ + 89, + " protocol = \"-1\"\n" + ], + [ + 90, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 91, + " }\n" + ], + [ + 92, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 65, + 92 + ], + "resource": "aws_security_group.database_exposed", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.SecurityGroupUnrestrictedIngressAny", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-group-does-not-allow-all-traffic-on-all-ports", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV2_AWS_16", + "bc_check_id": "BC_AWS_GENERAL_44", + "check_name": "Ensure that Auto Scaling is enabled on your DynamoDB tables", + "check_result": { + "result": "PASSED", + "entity": { + "aws_dynamodb_table": { + "unencrypted_table": { + "__end_line__": 92, + "__start_line__": 72, + "attribute": [ + { + "name": [ + "id" + ], + "type": [ + "S" + ] + } + ], + "billing_mode": [ + "PAY_PER_REQUEST" + ], + "hash_key": [ + "id" + ], + "name": [ + "my-table" + ], + "point_in_time_recovery": [ + { + "enabled": [ + false + ] + } + ], + "tags": [ + { + "Name": "Unencrypted DynamoDB Table" + } + ], + "__address__": "aws_dynamodb_table.unencrypted_table" + } + } + }, + "evaluated_keys": [ + "resource_type", + "service_namespace", + "billing_mode" + ] + }, + "code_block": [ + [ + 72, + "resource \"aws_dynamodb_table\" \"unencrypted_table\" {\n" + ], + [ + 73, + " name = \"my-table\"\n" + ], + [ + 74, + " billing_mode = \"PAY_PER_REQUEST\"\n" + ], + [ + 75, + " hash_key = \"id\"\n" + ], + [ + 76, + "\n" + ], + [ + 77, + " attribute {\n" + ], + [ + 78, + " name = \"id\"\n" + ], + [ + 79, + " type = \"S\"\n" + ], + [ + 80, + " }\n" + ], + [ + 81, + "\n" + ], + [ + 82, + " # No server_side_encryption configuration!\n" + ], + [ + 83, + " \n" + ], + [ + 84, + " # No point-in-time recovery\n" + ], + [ + 85, + " point_in_time_recovery {\n" + ], + [ + 86, + " enabled = false # SECURITY ISSUE #17\n" + ], + [ + 87, + " }\n" + ], + [ + 88, + "\n" + ], + [ + 89, + " tags = {\n" + ], + [ + 90, + " Name = \"Unencrypted DynamoDB Table\"\n" + ], + [ + 91, + " }\n" + ], + [ + 92, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 72, + 92 + ], + "resource": "aws_dynamodb_table.unencrypted_table", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted DynamoDB Table" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-auto-scaling-is-enabled-on-your-dynamodb-tables", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV2_AWS_56", + "bc_check_id": "BC_AWS_IAM_75", + "check_name": "Ensure AWS Managed IAMFullAccess IAM policy is not used.", + "check_result": { + "result": "PASSED", + "entity": { + "aws_iam_role": { + "app_role": { + "__end_line__": 37, + "__start_line__": 22, + "assume_role_policy": [ + { + "Version": "2012-10-17", + "Statement": [ + { + "Action": "sts:AssumeRole", + "Effect": "Allow", + "Principal": { + "Service": "ec2.amazonaws.com" + } + } + ] + } + ], + "name": [ + "application-role" + ], + "__address__": "aws_iam_role.app_role" + } + } + }, + "evaluated_keys": [ + "managed_policy_arn", + "managed_policy_arns/*", + "name", + "arn", + "policy_arn" + ] + }, + "code_block": [ + [ + 22, + "resource \"aws_iam_role\" \"app_role\" {\n" + ], + [ + 23, + " name = \"application-role\"\n" + ], + [ + 24, + "\n" + ], + [ + 25, + " assume_role_policy = jsonencode({\n" + ], + [ + 26, + " Version = \"2012-10-17\"\n" + ], + [ + 27, + " Statement = [\n" + ], + [ + 28, + " {\n" + ], + [ + 29, + " Action = \"sts:AssumeRole\"\n" + ], + [ + 30, + " Effect = \"Allow\"\n" + ], + [ + 31, + " Principal = {\n" + ], + [ + 32, + " Service = \"ec2.amazonaws.com\"\n" + ], + [ + 33, + " }\n" + ], + [ + 34, + " }\n" + ], + [ + 35, + " ]\n" + ], + [ + 36, + " })\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 22, + 37 + ], + "resource": "aws_iam_role.app_role", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-2-56", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV2_AWS_22", + "bc_check_id": "BC_AWS_IAM_67", + "check_name": "Ensure an IAM User does not have access to the console", + "check_result": { + "result": "PASSED", + "entity": { + "aws_iam_user": { + "service_account": { + "__end_line__": 65, + "__start_line__": 58, + "name": [ + "service-account" + ], + "path": [ + "/system/" + ], + "tags": [ + { + "Name": "Service Account" + } + ], + "__address__": "aws_iam_user.service_account" + } + } + }, + "evaluated_keys": [ + "resource_type" + ] + }, + "code_block": [ + [ + 58, + "resource \"aws_iam_user\" \"service_account\" {\n" + ], + [ + 59, + " name = \"service-account\"\n" + ], + [ + 60, + " path = \"/system/\"\n" + ], + [ + 61, + "\n" + ], + [ + 62, + " tags = {\n" + ], + [ + 63, + " Name = \"Service Account\"\n" + ], + [ + 64, + " }\n" + ], + [ + 65, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 58, + 65 + ], + "resource": "aws_iam_user.service_account", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": { + "Name": "Service Account" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-an-iam-user-does-not-have-access-to-the-console-group", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV2_AWS_69", + "bc_check_id": "BC_AWS_NETWORKING_93", + "check_name": "Ensure AWS RDS database instance configured with encryption in transit", + "check_result": { + "result": "PASSED", + "entity": { + "aws_db_instance": { + "unencrypted_db": { + "__end_line__": 37, + "__start_line__": 5, + "allocated_storage": [ + 20 + ], + "backup_retention_period": [ + 0 + ], + "deletion_protection": [ + false + ], + "enabled_cloudwatch_logs_exports": [ + [] + ], + "engine": [ + "postgres" + ], + "engine_version": [ + "13.7" + ], + "identifier": [ + "mydb-unencrypted" + ], + "instance_class": [ + "db.t3.micro" + ], + "password": [ + "SuperSecretPassword123!" + ], + "publicly_accessible": [ + true + ], + "skip_final_snapshot": [ + true + ], + "storage_encrypted": [ + false + ], + "tags": [ + { + "Name": "Unencrypted Database" + } + ], + "username": [ + "admin" + ], + "vpc_security_group_ids": [ + [ + "aws_security_group.database_exposed.id" + ] + ], + "__address__": "aws_db_instance.unencrypted_db" + } + } + }, + "evaluated_keys": [ + "parameter[?(@/name=='db2comm')]/value", + "resource_type", + "family", + "parameter[?(@/name=='rds/force_ssl')]/value", + "parameter[?(@/name=='require_secure_transport')]/value" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_db_instance\" \"unencrypted_db\" {\n" + ], + [ + 6, + " identifier = \"mydb-unencrypted\"\n" + ], + [ + 7, + " engine = \"postgres\"\n" + ], + [ + 8, + " engine_version = \"13.7\"\n" + ], + [ + 9, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 10, + " allocated_storage = 20\n" + ], + [ + 11, + " \n" + ], + [ + 12, + " username = \"admin\"\n" + ], + [ + 13, + " password = \"SuperSecretPassword123!\" # SECURITY ISSUE #9 - Hardcoded password!\n" + ], + [ + 14, + " \n" + ], + [ + 15, + " storage_encrypted = false # No encryption!\n" + ], + [ + 16, + " \n" + ], + [ + 17, + " publicly_accessible = true # SECURITY ISSUE #10 - Public access!\n" + ], + [ + 18, + " \n" + ], + [ + 19, + " skip_final_snapshot = true\n" + ], + [ + 20, + " \n" + ], + [ + 21, + " # No backup configuration\n" + ], + [ + 22, + " backup_retention_period = 0 # SECURITY ISSUE #11 - No backups!\n" + ], + [ + 23, + " \n" + ], + [ + 24, + " # Missing monitoring\n" + ], + [ + 25, + " enabled_cloudwatch_logs_exports = []\n" + ], + [ + 26, + " \n" + ], + [ + 27, + " # No deletion protection\n" + ], + [ + 28, + " deletion_protection = false # SECURITY ISSUE #12\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " # Using default security group\n" + ], + [ + 31, + " vpc_security_group_ids = [aws_security_group.database_exposed.id]\n" + ], + [ + 32, + " \n" + ], + [ + 33, + " tags = {\n" + ], + [ + 34, + " Name = \"Unencrypted Database\"\n" + ], + [ + 35, + " # Missing required tags\n" + ], + [ + 36, + " }\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 5, + 37 + ], + "resource": "aws_db_instance.unencrypted_db", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/bc-aws-2-69", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV2_AWS_69", + "bc_check_id": "BC_AWS_NETWORKING_93", + "check_name": "Ensure AWS RDS database instance configured with encryption in transit", + "check_result": { + "result": "PASSED", + "entity": { + "aws_db_instance": { + "weak_db": { + "__end_line__": 69, + "__start_line__": 40, + "allocated_storage": [ + 20 + ], + "auto_minor_version_upgrade": [ + false + ], + "engine": [ + "mysql" + ], + "engine_version": [ + "5.7.38" + ], + "identifier": [ + "mydb-weak" + ], + "instance_class": [ + "db.t3.micro" + ], + "kms_key_id": [ + "" + ], + "multi_az": [ + false + ], + "password": [ + "password123" + ], + "performance_insights_enabled": [ + false + ], + "publicly_accessible": [ + false + ], + "skip_final_snapshot": [ + true + ], + "storage_encrypted": [ + true + ], + "tags": [ + { + "Name": "Weak Database" + } + ], + "username": [ + "root" + ], + "__address__": "aws_db_instance.weak_db" + } + } + }, + "evaluated_keys": [ + "parameter[?(@/name=='db2comm')]/value", + "resource_type", + "family", + "parameter[?(@/name=='rds/force_ssl')]/value", + "parameter[?(@/name=='require_secure_transport')]/value" + ] + }, + "code_block": [ + [ + 40, + "resource \"aws_db_instance\" \"weak_db\" {\n" + ], + [ + 41, + " identifier = \"mydb-weak\"\n" + ], + [ + 42, + " engine = \"mysql\"\n" + ], + [ + 43, + " engine_version = \"5.7.38\" # Old version with known vulnerabilities\n" + ], + [ + 44, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 45, + " allocated_storage = 20\n" + ], + [ + 46, + " \n" + ], + [ + 47, + " username = \"root\" # Using default admin username\n" + ], + [ + 48, + " password = \"password123\" # Weak password!\n" + ], + [ + 49, + " \n" + ], + [ + 50, + " storage_encrypted = true\n" + ], + [ + 51, + " kms_key_id = \"\" # Empty KMS key - using default key\n" + ], + [ + 52, + " \n" + ], + [ + 53, + " publicly_accessible = false\n" + ], + [ + 54, + " \n" + ], + [ + 55, + " # Multi-AZ disabled\n" + ], + [ + 56, + " multi_az = false # SECURITY ISSUE #14 - No high availability\n" + ], + [ + 57, + " \n" + ], + [ + 58, + " # Auto minor version upgrade disabled\n" + ], + [ + 59, + " auto_minor_version_upgrade = false # SECURITY ISSUE #15\n" + ], + [ + 60, + " \n" + ], + [ + 61, + " # No performance insights\n" + ], + [ + 62, + " performance_insights_enabled = false\n" + ], + [ + 63, + " \n" + ], + [ + 64, + " skip_final_snapshot = true\n" + ], + [ + 65, + " \n" + ], + [ + 66, + " tags = {\n" + ], + [ + 67, + " Name = \"Weak Database\"\n" + ], + [ + 68, + " }\n" + ], + [ + 69, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 40, + 69 + ], + "resource": "aws_db_instance.weak_db", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": { + "Name": "Weak Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/bc-aws-2-69", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_19", + "bc_check_id": "BC_AWS_S3_14", + "check_name": "Ensure all data stored in the S3 bucket is securely encrypted at rest", + "check_result": { + "result": "PASSED", + "entity": { + "aws_s3_bucket": { + "public_data": { + "__end_line__": 21, + "__start_line__": 13, + "acl": [ + "public-read" + ], + "bucket": [ + "my-public-bucket-lab6" + ], + "tags": [ + { + "Name": "Public Data Bucket" + } + ], + "__address__": "aws_s3_bucket.public_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "resource_type", + "server_side_encryption_configuration/rule/apply_server_side_encryption_by_default/sse_algorithm", + "rule/apply_server_side_encryption_by_default/sse_algorithm" + ] + }, + "code_block": [ + [ + 13, + "resource \"aws_s3_bucket\" \"public_data\" {\n" + ], + [ + 14, + " bucket = \"my-public-bucket-lab6\"\n" + ], + [ + 15, + " acl = \"public-read\" # Public access enabled!\n" + ], + [ + 16, + "\n" + ], + [ + 17, + " tags = {\n" + ], + [ + 18, + " Name = \"Public Data Bucket\"\n" + ], + [ + 19, + " # Missing required tags: Environment, Owner, CostCenter\n" + ], + [ + 20, + " }\n" + ], + [ + 21, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 13, + 21 + ], + "resource": "aws_s3_bucket.public_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": { + "Name": "Public Data Bucket" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-14-data-encrypted-at-rest", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV_AWS_19", + "bc_check_id": "BC_AWS_S3_14", + "check_name": "Ensure all data stored in the S3 bucket is securely encrypted at rest", + "check_result": { + "result": "PASSED", + "entity": { + "aws_s3_bucket": { + "unencrypted_data": { + "__end_line__": 33, + "__start_line__": 24, + "acl": [ + "private" + ], + "bucket": [ + "my-unencrypted-bucket-lab6" + ], + "versioning": [ + { + "enabled": [ + false + ] + } + ], + "__address__": "aws_s3_bucket.unencrypted_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "resource_type", + "server_side_encryption_configuration/rule/apply_server_side_encryption_by_default/sse_algorithm", + "rule/apply_server_side_encryption_by_default/sse_algorithm" + ] + }, + "code_block": [ + [ + 24, + "resource \"aws_s3_bucket\" \"unencrypted_data\" {\n" + ], + [ + 25, + " bucket = \"my-unencrypted-bucket-lab6\"\n" + ], + [ + 26, + " acl = \"private\"\n" + ], + [ + 27, + " \n" + ], + [ + 28, + " # No server_side_encryption_configuration!\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " versioning {\n" + ], + [ + 31, + " enabled = false # Versioning disabled\n" + ], + [ + 32, + " }\n" + ], + [ + 33, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 24, + 33 + ], + "resource": "aws_s3_bucket.unencrypted_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-14-data-encrypted-at-rest", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV_AWS_20", + "bc_check_id": "BC_AWS_S3_1", + "check_name": "S3 Bucket has an ACL defined which allows public READ access.", + "check_result": { + "result": "PASSED", + "entity": { + "aws_s3_bucket": { + "unencrypted_data": { + "__end_line__": 33, + "__start_line__": 24, + "acl": [ + "private" + ], + "bucket": [ + "my-unencrypted-bucket-lab6" + ], + "versioning": [ + { + "enabled": [ + false + ] + } + ], + "__address__": "aws_s3_bucket.unencrypted_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "acl", + "resource_type", + "access_control_policy/grant", + "access_control_policy/grant/*/grantee/uri", + "access_control_policy" + ] + }, + "code_block": [ + [ + 24, + "resource \"aws_s3_bucket\" \"unencrypted_data\" {\n" + ], + [ + 25, + " bucket = \"my-unencrypted-bucket-lab6\"\n" + ], + [ + 26, + " acl = \"private\"\n" + ], + [ + 27, + " \n" + ], + [ + 28, + " # No server_side_encryption_configuration!\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " versioning {\n" + ], + [ + 31, + " enabled = false # Versioning disabled\n" + ], + [ + 32, + " }\n" + ], + [ + 33, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 24, + 33 + ], + "resource": "aws_s3_bucket.unencrypted_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-1-acl-read-permissions-everyone", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV2_AWS_40", + "bc_check_id": "BC_AWS_IAM_73", + "check_name": "Ensure AWS IAM policy does not allow full IAM privileges", + "check_result": { + "result": "PASSED", + "entity": { + "aws_iam_role_policy": { + "s3_full_access": { + "__end_line__": 55, + "__start_line__": 39, + "name": [ + "s3-full-access" + ], + "policy": [ + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "s3:*" + ], + "Resource": "*" + } + ] + } + ], + "role": [ + "aws_iam_role.app_role.id" + ], + "__address__": "aws_iam_role_policy.s3_full_access" + } + } + }, + "evaluated_keys": [ + "policy/Statement[?(@/Effect == Allow)]/Action[*]", + "statement[?(@/effect == Allow)]/actions[*]", + "inline_policy/Statement[?(@/Effect == Allow)]/Action[*]" + ] + }, + "code_block": [ + [ + 39, + "resource \"aws_iam_role_policy\" \"s3_full_access\" {\n" + ], + [ + 40, + " name = \"s3-full-access\"\n" + ], + [ + 41, + " role = aws_iam_role.app_role.id\n" + ], + [ + 42, + "\n" + ], + [ + 43, + " policy = jsonencode({\n" + ], + [ + 44, + " Version = \"2012-10-17\"\n" + ], + [ + 45, + " Statement = [\n" + ], + [ + 46, + " {\n" + ], + [ + 47, + " Effect = \"Allow\"\n" + ], + [ + 48, + " Action = [\n" + ], + [ + 49, + " \"s3:*\" # All S3 actions!\n" + ], + [ + 50, + " ]\n" + ], + [ + 51, + " Resource = \"*\" # On all buckets!\n" + ], + [ + 52, + " }\n" + ], + [ + 53, + " ]\n" + ], + [ + 54, + " })\n" + ], + [ + 55, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 39, + 55 + ], + "resource": "aws_iam_role_policy.s3_full_access", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-2-40", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV2_AWS_40", + "bc_check_id": "BC_AWS_IAM_73", + "check_name": "Ensure AWS IAM policy does not allow full IAM privileges", + "check_result": { + "result": "PASSED", + "entity": { + "aws_iam_user_policy": { + "service_policy": { + "__end_line__": 85, + "__start_line__": 67, + "name": [ + "service-inline-policy" + ], + "policy": [ + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "ec2:*", + "s3:*", + "rds:*" + ], + "Resource": "*" + } + ] + } + ], + "user": [ + "service-account" + ], + "__address__": "aws_iam_user_policy.service_policy" + } + } + }, + "evaluated_keys": [ + "policy/Statement[?(@/Effect == Allow)]/Action[*]", + "statement[?(@/effect == Allow)]/actions[*]", + "inline_policy/Statement[?(@/Effect == Allow)]/Action[*]" + ] + }, + "code_block": [ + [ + 67, + "resource \"aws_iam_user_policy\" \"service_policy\" {\n" + ], + [ + 68, + " name = \"service-inline-policy\"\n" + ], + [ + 69, + " user = aws_iam_user.service_account.name\n" + ], + [ + 70, + "\n" + ], + [ + 71, + " policy = jsonencode({\n" + ], + [ + 72, + " Version = \"2012-10-17\"\n" + ], + [ + 73, + " Statement = [\n" + ], + [ + 74, + " {\n" + ], + [ + 75, + " Effect = \"Allow\"\n" + ], + [ + 76, + " Action = [\n" + ], + [ + 77, + " \"ec2:*\", # Full EC2 access\n" + ], + [ + 78, + " \"s3:*\", # Full S3 access\n" + ], + [ + 79, + " \"rds:*\" # Full RDS access\n" + ], + [ + 80, + " ]\n" + ], + [ + 81, + " Resource = \"*\"\n" + ], + [ + 82, + " }\n" + ], + [ + 83, + " ]\n" + ], + [ + 84, + " })\n" + ], + [ + 85, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 67, + 85 + ], + "resource": "aws_iam_user_policy.service_policy", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-2-40", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf", + "breadcrumbs": { + "user": [ + { + "type": "resource", + "name": "aws_iam_user.service_account", + "path": "/tf/iam.tf", + "module_connection": false + } + ] + } + }, + { + "check_id": "CKV2_AWS_40", + "bc_check_id": "BC_AWS_IAM_73", + "check_name": "Ensure AWS IAM policy does not allow full IAM privileges", + "check_result": { + "result": "PASSED", + "entity": { + "aws_iam_policy": { + "privilege_escalation": { + "__end_line__": 125, + "__start_line__": 104, + "description": [ + "Policy that allows privilege escalation" + ], + "name": [ + "potential-privilege-escalation" + ], + "policy": [ + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "iam:CreatePolicy", + "iam:CreateUser", + "iam:AttachUserPolicy", + "iam:AttachRolePolicy", + "iam:PutUserPolicy", + "iam:PutRolePolicy" + ], + "Resource": "*" + } + ] + } + ], + "__address__": "aws_iam_policy.privilege_escalation" + } + } + }, + "evaluated_keys": [ + "policy/Statement[?(@/Effect == Allow)]/Action[*]", + "statement[?(@/effect == Allow)]/actions[*]", + "inline_policy/Statement[?(@/Effect == Allow)]/Action[*]" + ] + }, + "code_block": [ + [ + 104, + "resource \"aws_iam_policy\" \"privilege_escalation\" {\n" + ], + [ + 105, + " name = \"potential-privilege-escalation\"\n" + ], + [ + 106, + " description = \"Policy that allows privilege escalation\"\n" + ], + [ + 107, + "\n" + ], + [ + 108, + " policy = jsonencode({\n" + ], + [ + 109, + " Version = \"2012-10-17\"\n" + ], + [ + 110, + " Statement = [\n" + ], + [ + 111, + " {\n" + ], + [ + 112, + " Effect = \"Allow\"\n" + ], + [ + 113, + " Action = [\n" + ], + [ + 114, + " \"iam:CreatePolicy\",\n" + ], + [ + 115, + " \"iam:CreateUser\",\n" + ], + [ + 116, + " \"iam:AttachUserPolicy\",\n" + ], + [ + 117, + " \"iam:AttachRolePolicy\",\n" + ], + [ + 118, + " \"iam:PutUserPolicy\",\n" + ], + [ + 119, + " \"iam:PutRolePolicy\"\n" + ], + [ + 120, + " ]\n" + ], + [ + 121, + " Resource = \"*\"\n" + ], + [ + 122, + " }\n" + ], + [ + 123, + " ]\n" + ], + [ + 124, + " })\n" + ], + [ + 125, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 104, + 125 + ], + "resource": "aws_iam_policy.privilege_escalation", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-2-40", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV2_AWS_5", + "bc_check_id": "BC_AWS_NETWORKING_51", + "check_name": "Ensure that Security Groups are attached to another resource", + "check_result": { + "result": "PASSED", + "entity": { + "aws_security_group": { + "database_exposed": { + "__end_line__": 92, + "__start_line__": 65, + "description": [ + "Database accessible from internet" + ], + "egress": [ + { + "cidr_blocks": [ + [ + "0.0.0.0/0" + ] + ], + "from_port": [ + 0 + ], + "protocol": [ + "-1" + ], + "to_port": [ + 0 + ] + } + ], + "ingress": [ + { + "cidr_blocks": [ + [ + "0.0.0.0/0" + ] + ], + "description": [ + "MySQL from anywhere" + ], + "from_port": [ + 3306 + ], + "protocol": [ + "tcp" + ], + "to_port": [ + 3306 + ] + }, + { + "cidr_blocks": [ + [ + "0.0.0.0/0" + ] + ], + "description": [ + "PostgreSQL from anywhere" + ], + "from_port": [ + 5432 + ], + "protocol": [ + "tcp" + ], + "to_port": [ + 5432 + ] + } + ], + "name": [ + "database-public" + ], + "vpc_id": [ + "vpc-12345678" + ], + "__address__": "aws_security_group.database_exposed" + } + } + }, + "evaluated_keys": [ + "resource_type", + "networking" + ] + }, + "code_block": [ + [ + 65, + "resource \"aws_security_group\" \"database_exposed\" {\n" + ], + [ + 66, + " name = \"database-public\"\n" + ], + [ + 67, + " description = \"Database accessible from internet\"\n" + ], + [ + 68, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 69, + "\n" + ], + [ + 70, + " ingress {\n" + ], + [ + 71, + " description = \"MySQL from anywhere\"\n" + ], + [ + 72, + " from_port = 3306\n" + ], + [ + 73, + " to_port = 3306\n" + ], + [ + 74, + " protocol = \"tcp\"\n" + ], + [ + 75, + " cidr_blocks = [\"0.0.0.0/0\"] # Database exposed!\n" + ], + [ + 76, + " }\n" + ], + [ + 77, + "\n" + ], + [ + 78, + " ingress {\n" + ], + [ + 79, + " description = \"PostgreSQL from anywhere\"\n" + ], + [ + 80, + " from_port = 5432\n" + ], + [ + 81, + " to_port = 5432\n" + ], + [ + 82, + " protocol = \"tcp\"\n" + ], + [ + 83, + " cidr_blocks = [\"0.0.0.0/0\"] # Database exposed!\n" + ], + [ + 84, + " }\n" + ], + [ + 85, + "\n" + ], + [ + 86, + " egress {\n" + ], + [ + 87, + " from_port = 0\n" + ], + [ + 88, + " to_port = 0\n" + ], + [ + 89, + " protocol = \"-1\"\n" + ], + [ + 90, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 91, + " }\n" + ], + [ + 92, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 65, + 92 + ], + "resource": "aws_security_group.database_exposed", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": { + "code_block": [ + [ + 5, + "resource \"aws_db_instance\" \"unencrypted_db\" {\n" + ], + [ + 6, + " identifier = \"mydb-unencrypted\"\n" + ], + [ + 7, + " engine = \"postgres\"\n" + ], + [ + 8, + " engine_version = \"13.7\"\n" + ], + [ + 9, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 10, + " allocated_storage = 20\n" + ], + [ + 11, + " \n" + ], + [ + 12, + " username = \"admin\"\n" + ], + [ + 13, + " password = \"SuperSecretPassword123!\" # SECURITY ISSUE #9 - Hardcoded password!\n" + ], + [ + 14, + " \n" + ], + [ + 15, + " storage_encrypted = false # No encryption!\n" + ], + [ + 16, + " \n" + ], + [ + 17, + " publicly_accessible = true # SECURITY ISSUE #10 - Public access!\n" + ], + [ + 18, + " \n" + ], + [ + 19, + " skip_final_snapshot = true\n" + ], + [ + 20, + " \n" + ], + [ + 21, + " # No backup configuration\n" + ], + [ + 22, + " backup_retention_period = 0 # SECURITY ISSUE #11 - No backups!\n" + ], + [ + 23, + " \n" + ], + [ + 24, + " # Missing monitoring\n" + ], + [ + 25, + " enabled_cloudwatch_logs_exports = []\n" + ], + [ + 26, + " \n" + ], + [ + 27, + " # No deletion protection\n" + ], + [ + 28, + " deletion_protection = false # SECURITY ISSUE #12\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " # Using default security group\n" + ], + [ + 31, + " vpc_security_group_ids = [aws_security_group.database_exposed.id]\n" + ], + [ + 32, + " \n" + ], + [ + 33, + " tags = {\n" + ], + [ + 34, + " Name = \"Unencrypted Database\"\n" + ], + [ + 35, + " # Missing required tags\n" + ], + [ + 36, + " }\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_line_range": [ + 5, + 37 + ], + "resource": "aws_db_instance.unencrypted_db", + "entity_tags": { + "Name": "Unencrypted Database" + }, + "evaluations": null, + "file_abs_path": "/tf/database.tf", + "resource_address": null + }, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV_AWS_57", + "bc_check_id": "BC_AWS_S3_2", + "check_name": "S3 Bucket has an ACL defined which allows public WRITE access.", + "check_result": { + "result": "PASSED", + "entity": { + "aws_s3_bucket": { + "public_data": { + "__end_line__": 21, + "__start_line__": 13, + "acl": [ + "public-read" + ], + "bucket": [ + "my-public-bucket-lab6" + ], + "tags": [ + { + "Name": "Public Data Bucket" + } + ], + "__address__": "aws_s3_bucket.public_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "acl", + "resource_type", + "access_control_policy/grant/*/permission", + "access_control_policy/grant", + "access_control_policy/grant/*/grantee/uri", + "access_control_policy" + ] + }, + "code_block": [ + [ + 13, + "resource \"aws_s3_bucket\" \"public_data\" {\n" + ], + [ + 14, + " bucket = \"my-public-bucket-lab6\"\n" + ], + [ + 15, + " acl = \"public-read\" # Public access enabled!\n" + ], + [ + 16, + "\n" + ], + [ + 17, + " tags = {\n" + ], + [ + 18, + " Name = \"Public Data Bucket\"\n" + ], + [ + 19, + " # Missing required tags: Environment, Owner, CostCenter\n" + ], + [ + 20, + " }\n" + ], + [ + 21, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 13, + 21 + ], + "resource": "aws_s3_bucket.public_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": { + "Name": "Public Data Bucket" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-2-acl-write-permissions-everyone", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV_AWS_57", + "bc_check_id": "BC_AWS_S3_2", + "check_name": "S3 Bucket has an ACL defined which allows public WRITE access.", + "check_result": { + "result": "PASSED", + "entity": { + "aws_s3_bucket": { + "unencrypted_data": { + "__end_line__": 33, + "__start_line__": 24, + "acl": [ + "private" + ], + "bucket": [ + "my-unencrypted-bucket-lab6" + ], + "versioning": [ + { + "enabled": [ + false + ] + } + ], + "__address__": "aws_s3_bucket.unencrypted_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "acl", + "resource_type", + "access_control_policy/grant/*/permission", + "access_control_policy/grant", + "access_control_policy/grant/*/grantee/uri", + "access_control_policy" + ] + }, + "code_block": [ + [ + 24, + "resource \"aws_s3_bucket\" \"unencrypted_data\" {\n" + ], + [ + 25, + " bucket = \"my-unencrypted-bucket-lab6\"\n" + ], + [ + 26, + " acl = \"private\"\n" + ], + [ + 27, + " \n" + ], + [ + 28, + " # No server_side_encryption_configuration!\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " versioning {\n" + ], + [ + 31, + " enabled = false # Versioning disabled\n" + ], + [ + 32, + " }\n" + ], + [ + 33, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 24, + 33 + ], + "resource": "aws_s3_bucket.unencrypted_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-2-acl-write-permissions-everyone", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + } + ], + "failed_checks": [ + { + "check_id": "CKV_AWS_133", + "bc_check_id": "BC_AWS_GENERAL_46", + "check_name": "Ensure that RDS instances has backup policy", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "backup_retention_period" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_db_instance\" \"unencrypted_db\" {\n" + ], + [ + 6, + " identifier = \"mydb-unencrypted\"\n" + ], + [ + 7, + " engine = \"postgres\"\n" + ], + [ + 8, + " engine_version = \"13.7\"\n" + ], + [ + 9, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 10, + " allocated_storage = 20\n" + ], + [ + 11, + " \n" + ], + [ + 12, + " username = \"admin\"\n" + ], + [ + 13, + " password = \"SuperSecretPassword123!\" # SECURITY ISSUE #9 - Hardcoded password!\n" + ], + [ + 14, + " \n" + ], + [ + 15, + " storage_encrypted = false # No encryption!\n" + ], + [ + 16, + " \n" + ], + [ + 17, + " publicly_accessible = true # SECURITY ISSUE #10 - Public access!\n" + ], + [ + 18, + " \n" + ], + [ + 19, + " skip_final_snapshot = true\n" + ], + [ + 20, + " \n" + ], + [ + 21, + " # No backup configuration\n" + ], + [ + 22, + " backup_retention_period = 0 # SECURITY ISSUE #11 - No backups!\n" + ], + [ + 23, + " \n" + ], + [ + 24, + " # Missing monitoring\n" + ], + [ + 25, + " enabled_cloudwatch_logs_exports = []\n" + ], + [ + 26, + " \n" + ], + [ + 27, + " # No deletion protection\n" + ], + [ + 28, + " deletion_protection = false # SECURITY ISSUE #12\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " # Using default security group\n" + ], + [ + 31, + " vpc_security_group_ids = [aws_security_group.database_exposed.id]\n" + ], + [ + 32, + " \n" + ], + [ + 33, + " tags = {\n" + ], + [ + 34, + " Name = \"Unencrypted Database\"\n" + ], + [ + 35, + " # Missing required tags\n" + ], + [ + 36, + " }\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 5, + 37 + ], + "resource": "aws_db_instance.unencrypted_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.DBInstanceBackupRetentionPeriod", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-rds-instances-have-backup-policy", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_129", + "bc_check_id": "BC_AWS_IAM_60", + "check_name": "Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "enabled_cloudwatch_logs_exports/[0]" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_db_instance\" \"unencrypted_db\" {\n" + ], + [ + 6, + " identifier = \"mydb-unencrypted\"\n" + ], + [ + 7, + " engine = \"postgres\"\n" + ], + [ + 8, + " engine_version = \"13.7\"\n" + ], + [ + 9, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 10, + " allocated_storage = 20\n" + ], + [ + 11, + " \n" + ], + [ + 12, + " username = \"admin\"\n" + ], + [ + 13, + " password = \"SuperSecretPassword123!\" # SECURITY ISSUE #9 - Hardcoded password!\n" + ], + [ + 14, + " \n" + ], + [ + 15, + " storage_encrypted = false # No encryption!\n" + ], + [ + 16, + " \n" + ], + [ + 17, + " publicly_accessible = true # SECURITY ISSUE #10 - Public access!\n" + ], + [ + 18, + " \n" + ], + [ + 19, + " skip_final_snapshot = true\n" + ], + [ + 20, + " \n" + ], + [ + 21, + " # No backup configuration\n" + ], + [ + 22, + " backup_retention_period = 0 # SECURITY ISSUE #11 - No backups!\n" + ], + [ + 23, + " \n" + ], + [ + 24, + " # Missing monitoring\n" + ], + [ + 25, + " enabled_cloudwatch_logs_exports = []\n" + ], + [ + 26, + " \n" + ], + [ + 27, + " # No deletion protection\n" + ], + [ + 28, + " deletion_protection = false # SECURITY ISSUE #12\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " # Using default security group\n" + ], + [ + 31, + " vpc_security_group_ids = [aws_security_group.database_exposed.id]\n" + ], + [ + 32, + " \n" + ], + [ + 33, + " tags = {\n" + ], + [ + 34, + " Name = \"Unencrypted Database\"\n" + ], + [ + 35, + " # Missing required tags\n" + ], + [ + 36, + " }\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 5, + 37 + ], + "resource": "aws_db_instance.unencrypted_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.DBInstanceLogging", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-that-respective-logs-of-amazon-relational-database-service-amazon-rds-are-enabled", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_226", + "bc_check_id": "BC_AWS_GENERAL_121", + "check_name": "Ensure DB instance gets all minor upgrades automatically", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "auto_minor_version_upgrade" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_db_instance\" \"unencrypted_db\" {\n" + ], + [ + 6, + " identifier = \"mydb-unencrypted\"\n" + ], + [ + 7, + " engine = \"postgres\"\n" + ], + [ + 8, + " engine_version = \"13.7\"\n" + ], + [ + 9, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 10, + " allocated_storage = 20\n" + ], + [ + 11, + " \n" + ], + [ + 12, + " username = \"admin\"\n" + ], + [ + 13, + " password = \"SuperSecretPassword123!\" # SECURITY ISSUE #9 - Hardcoded password!\n" + ], + [ + 14, + " \n" + ], + [ + 15, + " storage_encrypted = false # No encryption!\n" + ], + [ + 16, + " \n" + ], + [ + 17, + " publicly_accessible = true # SECURITY ISSUE #10 - Public access!\n" + ], + [ + 18, + " \n" + ], + [ + 19, + " skip_final_snapshot = true\n" + ], + [ + 20, + " \n" + ], + [ + 21, + " # No backup configuration\n" + ], + [ + 22, + " backup_retention_period = 0 # SECURITY ISSUE #11 - No backups!\n" + ], + [ + 23, + " \n" + ], + [ + 24, + " # Missing monitoring\n" + ], + [ + 25, + " enabled_cloudwatch_logs_exports = []\n" + ], + [ + 26, + " \n" + ], + [ + 27, + " # No deletion protection\n" + ], + [ + 28, + " deletion_protection = false # SECURITY ISSUE #12\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " # Using default security group\n" + ], + [ + 31, + " vpc_security_group_ids = [aws_security_group.database_exposed.id]\n" + ], + [ + 32, + " \n" + ], + [ + 33, + " tags = {\n" + ], + [ + 34, + " Name = \"Unencrypted Database\"\n" + ], + [ + 35, + " # Missing required tags\n" + ], + [ + 36, + " }\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 5, + 37 + ], + "resource": "aws_db_instance.unencrypted_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.DBInstanceMinorUpgrade", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-db-instance-gets-all-minor-upgrades-automatically", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_16", + "bc_check_id": "BC_AWS_GENERAL_4", + "check_name": "Ensure all data stored in the RDS is securely encrypted at rest", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "storage_encrypted" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_db_instance\" \"unencrypted_db\" {\n" + ], + [ + 6, + " identifier = \"mydb-unencrypted\"\n" + ], + [ + 7, + " engine = \"postgres\"\n" + ], + [ + 8, + " engine_version = \"13.7\"\n" + ], + [ + 9, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 10, + " allocated_storage = 20\n" + ], + [ + 11, + " \n" + ], + [ + 12, + " username = \"admin\"\n" + ], + [ + 13, + " password = \"SuperSecretPassword123!\" # SECURITY ISSUE #9 - Hardcoded password!\n" + ], + [ + 14, + " \n" + ], + [ + 15, + " storage_encrypted = false # No encryption!\n" + ], + [ + 16, + " \n" + ], + [ + 17, + " publicly_accessible = true # SECURITY ISSUE #10 - Public access!\n" + ], + [ + 18, + " \n" + ], + [ + 19, + " skip_final_snapshot = true\n" + ], + [ + 20, + " \n" + ], + [ + 21, + " # No backup configuration\n" + ], + [ + 22, + " backup_retention_period = 0 # SECURITY ISSUE #11 - No backups!\n" + ], + [ + 23, + " \n" + ], + [ + 24, + " # Missing monitoring\n" + ], + [ + 25, + " enabled_cloudwatch_logs_exports = []\n" + ], + [ + 26, + " \n" + ], + [ + 27, + " # No deletion protection\n" + ], + [ + 28, + " deletion_protection = false # SECURITY ISSUE #12\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " # Using default security group\n" + ], + [ + 31, + " vpc_security_group_ids = [aws_security_group.database_exposed.id]\n" + ], + [ + 32, + " \n" + ], + [ + 33, + " tags = {\n" + ], + [ + 34, + " Name = \"Unencrypted Database\"\n" + ], + [ + 35, + " # Missing required tags\n" + ], + [ + 36, + " }\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 5, + 37 + ], + "resource": "aws_db_instance.unencrypted_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.RDSEncryption", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-4", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_118", + "bc_check_id": "BC_AWS_LOGGING_28", + "check_name": "Ensure that enhanced monitoring is enabled for Amazon RDS instances", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "monitoring_interval" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_db_instance\" \"unencrypted_db\" {\n" + ], + [ + 6, + " identifier = \"mydb-unencrypted\"\n" + ], + [ + 7, + " engine = \"postgres\"\n" + ], + [ + 8, + " engine_version = \"13.7\"\n" + ], + [ + 9, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 10, + " allocated_storage = 20\n" + ], + [ + 11, + " \n" + ], + [ + 12, + " username = \"admin\"\n" + ], + [ + 13, + " password = \"SuperSecretPassword123!\" # SECURITY ISSUE #9 - Hardcoded password!\n" + ], + [ + 14, + " \n" + ], + [ + 15, + " storage_encrypted = false # No encryption!\n" + ], + [ + 16, + " \n" + ], + [ + 17, + " publicly_accessible = true # SECURITY ISSUE #10 - Public access!\n" + ], + [ + 18, + " \n" + ], + [ + 19, + " skip_final_snapshot = true\n" + ], + [ + 20, + " \n" + ], + [ + 21, + " # No backup configuration\n" + ], + [ + 22, + " backup_retention_period = 0 # SECURITY ISSUE #11 - No backups!\n" + ], + [ + 23, + " \n" + ], + [ + 24, + " # Missing monitoring\n" + ], + [ + 25, + " enabled_cloudwatch_logs_exports = []\n" + ], + [ + 26, + " \n" + ], + [ + 27, + " # No deletion protection\n" + ], + [ + 28, + " deletion_protection = false # SECURITY ISSUE #12\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " # Using default security group\n" + ], + [ + 31, + " vpc_security_group_ids = [aws_security_group.database_exposed.id]\n" + ], + [ + 32, + " \n" + ], + [ + 33, + " tags = {\n" + ], + [ + 34, + " Name = \"Unencrypted Database\"\n" + ], + [ + 35, + " # Missing required tags\n" + ], + [ + 36, + " }\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 5, + 37 + ], + "resource": "aws_db_instance.unencrypted_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.RDSEnhancedMonitorEnabled", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/ensure-that-enhanced-monitoring-is-enabled-for-amazon-rds-instances", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_161", + "bc_check_id": "BC_AWS_IAM_65", + "check_name": "Ensure RDS database has IAM authentication enabled", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "iam_database_authentication_enabled" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_db_instance\" \"unencrypted_db\" {\n" + ], + [ + 6, + " identifier = \"mydb-unencrypted\"\n" + ], + [ + 7, + " engine = \"postgres\"\n" + ], + [ + 8, + " engine_version = \"13.7\"\n" + ], + [ + 9, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 10, + " allocated_storage = 20\n" + ], + [ + 11, + " \n" + ], + [ + 12, + " username = \"admin\"\n" + ], + [ + 13, + " password = \"SuperSecretPassword123!\" # SECURITY ISSUE #9 - Hardcoded password!\n" + ], + [ + 14, + " \n" + ], + [ + 15, + " storage_encrypted = false # No encryption!\n" + ], + [ + 16, + " \n" + ], + [ + 17, + " publicly_accessible = true # SECURITY ISSUE #10 - Public access!\n" + ], + [ + 18, + " \n" + ], + [ + 19, + " skip_final_snapshot = true\n" + ], + [ + 20, + " \n" + ], + [ + 21, + " # No backup configuration\n" + ], + [ + 22, + " backup_retention_period = 0 # SECURITY ISSUE #11 - No backups!\n" + ], + [ + 23, + " \n" + ], + [ + 24, + " # Missing monitoring\n" + ], + [ + 25, + " enabled_cloudwatch_logs_exports = []\n" + ], + [ + 26, + " \n" + ], + [ + 27, + " # No deletion protection\n" + ], + [ + 28, + " deletion_protection = false # SECURITY ISSUE #12\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " # Using default security group\n" + ], + [ + 31, + " vpc_security_group_ids = [aws_security_group.database_exposed.id]\n" + ], + [ + 32, + " \n" + ], + [ + 33, + " tags = {\n" + ], + [ + 34, + " Name = \"Unencrypted Database\"\n" + ], + [ + 35, + " # Missing required tags\n" + ], + [ + 36, + " }\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 5, + 37 + ], + "resource": "aws_db_instance.unencrypted_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.RDSIAMAuthentication", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-rds-database-has-iam-authentication-enabled", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_293", + "bc_check_id": "BC_AWS_GENERAL_208", + "check_name": "Ensure that AWS database instances have deletion protection enabled", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "deletion_protection" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_db_instance\" \"unencrypted_db\" {\n" + ], + [ + 6, + " identifier = \"mydb-unencrypted\"\n" + ], + [ + 7, + " engine = \"postgres\"\n" + ], + [ + 8, + " engine_version = \"13.7\"\n" + ], + [ + 9, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 10, + " allocated_storage = 20\n" + ], + [ + 11, + " \n" + ], + [ + 12, + " username = \"admin\"\n" + ], + [ + 13, + " password = \"SuperSecretPassword123!\" # SECURITY ISSUE #9 - Hardcoded password!\n" + ], + [ + 14, + " \n" + ], + [ + 15, + " storage_encrypted = false # No encryption!\n" + ], + [ + 16, + " \n" + ], + [ + 17, + " publicly_accessible = true # SECURITY ISSUE #10 - Public access!\n" + ], + [ + 18, + " \n" + ], + [ + 19, + " skip_final_snapshot = true\n" + ], + [ + 20, + " \n" + ], + [ + 21, + " # No backup configuration\n" + ], + [ + 22, + " backup_retention_period = 0 # SECURITY ISSUE #11 - No backups!\n" + ], + [ + 23, + " \n" + ], + [ + 24, + " # Missing monitoring\n" + ], + [ + 25, + " enabled_cloudwatch_logs_exports = []\n" + ], + [ + 26, + " \n" + ], + [ + 27, + " # No deletion protection\n" + ], + [ + 28, + " deletion_protection = false # SECURITY ISSUE #12\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " # Using default security group\n" + ], + [ + 31, + " vpc_security_group_ids = [aws_security_group.database_exposed.id]\n" + ], + [ + 32, + " \n" + ], + [ + 33, + " tags = {\n" + ], + [ + 34, + " Name = \"Unencrypted Database\"\n" + ], + [ + 35, + " # Missing required tags\n" + ], + [ + 36, + " }\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 5, + 37 + ], + "resource": "aws_db_instance.unencrypted_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.RDSInstanceDeletionProtection", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-293", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_353", + "bc_check_id": "BC_AWS_LOGGING_47", + "check_name": "Ensure that RDS instances have performance insights enabled", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "performance_insights_enabled" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_db_instance\" \"unencrypted_db\" {\n" + ], + [ + 6, + " identifier = \"mydb-unencrypted\"\n" + ], + [ + 7, + " engine = \"postgres\"\n" + ], + [ + 8, + " engine_version = \"13.7\"\n" + ], + [ + 9, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 10, + " allocated_storage = 20\n" + ], + [ + 11, + " \n" + ], + [ + 12, + " username = \"admin\"\n" + ], + [ + 13, + " password = \"SuperSecretPassword123!\" # SECURITY ISSUE #9 - Hardcoded password!\n" + ], + [ + 14, + " \n" + ], + [ + 15, + " storage_encrypted = false # No encryption!\n" + ], + [ + 16, + " \n" + ], + [ + 17, + " publicly_accessible = true # SECURITY ISSUE #10 - Public access!\n" + ], + [ + 18, + " \n" + ], + [ + 19, + " skip_final_snapshot = true\n" + ], + [ + 20, + " \n" + ], + [ + 21, + " # No backup configuration\n" + ], + [ + 22, + " backup_retention_period = 0 # SECURITY ISSUE #11 - No backups!\n" + ], + [ + 23, + " \n" + ], + [ + 24, + " # Missing monitoring\n" + ], + [ + 25, + " enabled_cloudwatch_logs_exports = []\n" + ], + [ + 26, + " \n" + ], + [ + 27, + " # No deletion protection\n" + ], + [ + 28, + " deletion_protection = false # SECURITY ISSUE #12\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " # Using default security group\n" + ], + [ + 31, + " vpc_security_group_ids = [aws_security_group.database_exposed.id]\n" + ], + [ + 32, + " \n" + ], + [ + 33, + " tags = {\n" + ], + [ + 34, + " Name = \"Unencrypted Database\"\n" + ], + [ + 35, + " # Missing required tags\n" + ], + [ + 36, + " }\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 5, + 37 + ], + "resource": "aws_db_instance.unencrypted_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.RDSInstancePerformanceInsights", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-353", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_157", + "bc_check_id": "BC_AWS_GENERAL_73", + "check_name": "Ensure that RDS instances have Multi-AZ enabled", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "multi_az" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_db_instance\" \"unencrypted_db\" {\n" + ], + [ + 6, + " identifier = \"mydb-unencrypted\"\n" + ], + [ + 7, + " engine = \"postgres\"\n" + ], + [ + 8, + " engine_version = \"13.7\"\n" + ], + [ + 9, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 10, + " allocated_storage = 20\n" + ], + [ + 11, + " \n" + ], + [ + 12, + " username = \"admin\"\n" + ], + [ + 13, + " password = \"SuperSecretPassword123!\" # SECURITY ISSUE #9 - Hardcoded password!\n" + ], + [ + 14, + " \n" + ], + [ + 15, + " storage_encrypted = false # No encryption!\n" + ], + [ + 16, + " \n" + ], + [ + 17, + " publicly_accessible = true # SECURITY ISSUE #10 - Public access!\n" + ], + [ + 18, + " \n" + ], + [ + 19, + " skip_final_snapshot = true\n" + ], + [ + 20, + " \n" + ], + [ + 21, + " # No backup configuration\n" + ], + [ + 22, + " backup_retention_period = 0 # SECURITY ISSUE #11 - No backups!\n" + ], + [ + 23, + " \n" + ], + [ + 24, + " # Missing monitoring\n" + ], + [ + 25, + " enabled_cloudwatch_logs_exports = []\n" + ], + [ + 26, + " \n" + ], + [ + 27, + " # No deletion protection\n" + ], + [ + 28, + " deletion_protection = false # SECURITY ISSUE #12\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " # Using default security group\n" + ], + [ + 31, + " vpc_security_group_ids = [aws_security_group.database_exposed.id]\n" + ], + [ + 32, + " \n" + ], + [ + 33, + " tags = {\n" + ], + [ + 34, + " Name = \"Unencrypted Database\"\n" + ], + [ + 35, + " # Missing required tags\n" + ], + [ + 36, + " }\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 5, + 37 + ], + "resource": "aws_db_instance.unencrypted_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.RDSMultiAZEnabled", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-73", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_17", + "bc_check_id": "BC_AWS_PUBLIC_2", + "check_name": "Ensure all data stored in RDS is not publicly accessible", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "publicly_accessible" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_db_instance\" \"unencrypted_db\" {\n" + ], + [ + 6, + " identifier = \"mydb-unencrypted\"\n" + ], + [ + 7, + " engine = \"postgres\"\n" + ], + [ + 8, + " engine_version = \"13.7\"\n" + ], + [ + 9, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 10, + " allocated_storage = 20\n" + ], + [ + 11, + " \n" + ], + [ + 12, + " username = \"admin\"\n" + ], + [ + 13, + " password = \"SuperSecretPassword123!\" # SECURITY ISSUE #9 - Hardcoded password!\n" + ], + [ + 14, + " \n" + ], + [ + 15, + " storage_encrypted = false # No encryption!\n" + ], + [ + 16, + " \n" + ], + [ + 17, + " publicly_accessible = true # SECURITY ISSUE #10 - Public access!\n" + ], + [ + 18, + " \n" + ], + [ + 19, + " skip_final_snapshot = true\n" + ], + [ + 20, + " \n" + ], + [ + 21, + " # No backup configuration\n" + ], + [ + 22, + " backup_retention_period = 0 # SECURITY ISSUE #11 - No backups!\n" + ], + [ + 23, + " \n" + ], + [ + 24, + " # Missing monitoring\n" + ], + [ + 25, + " enabled_cloudwatch_logs_exports = []\n" + ], + [ + 26, + " \n" + ], + [ + 27, + " # No deletion protection\n" + ], + [ + 28, + " deletion_protection = false # SECURITY ISSUE #12\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " # Using default security group\n" + ], + [ + 31, + " vpc_security_group_ids = [aws_security_group.database_exposed.id]\n" + ], + [ + 32, + " \n" + ], + [ + 33, + " tags = {\n" + ], + [ + 34, + " Name = \"Unencrypted Database\"\n" + ], + [ + 35, + " # Missing required tags\n" + ], + [ + 36, + " }\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 5, + 37 + ], + "resource": "aws_db_instance.unencrypted_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.RDSPubliclyAccessible", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/public-policies/public-2", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_129", + "bc_check_id": "BC_AWS_IAM_60", + "check_name": "Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "enabled_cloudwatch_logs_exports/[0]" + ] + }, + "code_block": [ + [ + 40, + "resource \"aws_db_instance\" \"weak_db\" {\n" + ], + [ + 41, + " identifier = \"mydb-weak\"\n" + ], + [ + 42, + " engine = \"mysql\"\n" + ], + [ + 43, + " engine_version = \"5.7.38\" # Old version with known vulnerabilities\n" + ], + [ + 44, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 45, + " allocated_storage = 20\n" + ], + [ + 46, + " \n" + ], + [ + 47, + " username = \"root\" # Using default admin username\n" + ], + [ + 48, + " password = \"password123\" # Weak password!\n" + ], + [ + 49, + " \n" + ], + [ + 50, + " storage_encrypted = true\n" + ], + [ + 51, + " kms_key_id = \"\" # Empty KMS key - using default key\n" + ], + [ + 52, + " \n" + ], + [ + 53, + " publicly_accessible = false\n" + ], + [ + 54, + " \n" + ], + [ + 55, + " # Multi-AZ disabled\n" + ], + [ + 56, + " multi_az = false # SECURITY ISSUE #14 - No high availability\n" + ], + [ + 57, + " \n" + ], + [ + 58, + " # Auto minor version upgrade disabled\n" + ], + [ + 59, + " auto_minor_version_upgrade = false # SECURITY ISSUE #15\n" + ], + [ + 60, + " \n" + ], + [ + 61, + " # No performance insights\n" + ], + [ + 62, + " performance_insights_enabled = false\n" + ], + [ + 63, + " \n" + ], + [ + 64, + " skip_final_snapshot = true\n" + ], + [ + 65, + " \n" + ], + [ + 66, + " tags = {\n" + ], + [ + 67, + " Name = \"Weak Database\"\n" + ], + [ + 68, + " }\n" + ], + [ + 69, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 40, + 69 + ], + "resource": "aws_db_instance.weak_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.DBInstanceLogging", + "fixed_definition": null, + "entity_tags": { + "Name": "Weak Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-that-respective-logs-of-amazon-relational-database-service-amazon-rds-are-enabled", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_226", + "bc_check_id": "BC_AWS_GENERAL_121", + "check_name": "Ensure DB instance gets all minor upgrades automatically", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "auto_minor_version_upgrade" + ] + }, + "code_block": [ + [ + 40, + "resource \"aws_db_instance\" \"weak_db\" {\n" + ], + [ + 41, + " identifier = \"mydb-weak\"\n" + ], + [ + 42, + " engine = \"mysql\"\n" + ], + [ + 43, + " engine_version = \"5.7.38\" # Old version with known vulnerabilities\n" + ], + [ + 44, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 45, + " allocated_storage = 20\n" + ], + [ + 46, + " \n" + ], + [ + 47, + " username = \"root\" # Using default admin username\n" + ], + [ + 48, + " password = \"password123\" # Weak password!\n" + ], + [ + 49, + " \n" + ], + [ + 50, + " storage_encrypted = true\n" + ], + [ + 51, + " kms_key_id = \"\" # Empty KMS key - using default key\n" + ], + [ + 52, + " \n" + ], + [ + 53, + " publicly_accessible = false\n" + ], + [ + 54, + " \n" + ], + [ + 55, + " # Multi-AZ disabled\n" + ], + [ + 56, + " multi_az = false # SECURITY ISSUE #14 - No high availability\n" + ], + [ + 57, + " \n" + ], + [ + 58, + " # Auto minor version upgrade disabled\n" + ], + [ + 59, + " auto_minor_version_upgrade = false # SECURITY ISSUE #15\n" + ], + [ + 60, + " \n" + ], + [ + 61, + " # No performance insights\n" + ], + [ + 62, + " performance_insights_enabled = false\n" + ], + [ + 63, + " \n" + ], + [ + 64, + " skip_final_snapshot = true\n" + ], + [ + 65, + " \n" + ], + [ + 66, + " tags = {\n" + ], + [ + 67, + " Name = \"Weak Database\"\n" + ], + [ + 68, + " }\n" + ], + [ + 69, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 40, + 69 + ], + "resource": "aws_db_instance.weak_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.DBInstanceMinorUpgrade", + "fixed_definition": null, + "entity_tags": { + "Name": "Weak Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-db-instance-gets-all-minor-upgrades-automatically", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_118", + "bc_check_id": "BC_AWS_LOGGING_28", + "check_name": "Ensure that enhanced monitoring is enabled for Amazon RDS instances", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "monitoring_interval" + ] + }, + "code_block": [ + [ + 40, + "resource \"aws_db_instance\" \"weak_db\" {\n" + ], + [ + 41, + " identifier = \"mydb-weak\"\n" + ], + [ + 42, + " engine = \"mysql\"\n" + ], + [ + 43, + " engine_version = \"5.7.38\" # Old version with known vulnerabilities\n" + ], + [ + 44, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 45, + " allocated_storage = 20\n" + ], + [ + 46, + " \n" + ], + [ + 47, + " username = \"root\" # Using default admin username\n" + ], + [ + 48, + " password = \"password123\" # Weak password!\n" + ], + [ + 49, + " \n" + ], + [ + 50, + " storage_encrypted = true\n" + ], + [ + 51, + " kms_key_id = \"\" # Empty KMS key - using default key\n" + ], + [ + 52, + " \n" + ], + [ + 53, + " publicly_accessible = false\n" + ], + [ + 54, + " \n" + ], + [ + 55, + " # Multi-AZ disabled\n" + ], + [ + 56, + " multi_az = false # SECURITY ISSUE #14 - No high availability\n" + ], + [ + 57, + " \n" + ], + [ + 58, + " # Auto minor version upgrade disabled\n" + ], + [ + 59, + " auto_minor_version_upgrade = false # SECURITY ISSUE #15\n" + ], + [ + 60, + " \n" + ], + [ + 61, + " # No performance insights\n" + ], + [ + 62, + " performance_insights_enabled = false\n" + ], + [ + 63, + " \n" + ], + [ + 64, + " skip_final_snapshot = true\n" + ], + [ + 65, + " \n" + ], + [ + 66, + " tags = {\n" + ], + [ + 67, + " Name = \"Weak Database\"\n" + ], + [ + 68, + " }\n" + ], + [ + 69, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 40, + 69 + ], + "resource": "aws_db_instance.weak_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.RDSEnhancedMonitorEnabled", + "fixed_definition": null, + "entity_tags": { + "Name": "Weak Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/ensure-that-enhanced-monitoring-is-enabled-for-amazon-rds-instances", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_161", + "bc_check_id": "BC_AWS_IAM_65", + "check_name": "Ensure RDS database has IAM authentication enabled", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "iam_database_authentication_enabled" + ] + }, + "code_block": [ + [ + 40, + "resource \"aws_db_instance\" \"weak_db\" {\n" + ], + [ + 41, + " identifier = \"mydb-weak\"\n" + ], + [ + 42, + " engine = \"mysql\"\n" + ], + [ + 43, + " engine_version = \"5.7.38\" # Old version with known vulnerabilities\n" + ], + [ + 44, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 45, + " allocated_storage = 20\n" + ], + [ + 46, + " \n" + ], + [ + 47, + " username = \"root\" # Using default admin username\n" + ], + [ + 48, + " password = \"password123\" # Weak password!\n" + ], + [ + 49, + " \n" + ], + [ + 50, + " storage_encrypted = true\n" + ], + [ + 51, + " kms_key_id = \"\" # Empty KMS key - using default key\n" + ], + [ + 52, + " \n" + ], + [ + 53, + " publicly_accessible = false\n" + ], + [ + 54, + " \n" + ], + [ + 55, + " # Multi-AZ disabled\n" + ], + [ + 56, + " multi_az = false # SECURITY ISSUE #14 - No high availability\n" + ], + [ + 57, + " \n" + ], + [ + 58, + " # Auto minor version upgrade disabled\n" + ], + [ + 59, + " auto_minor_version_upgrade = false # SECURITY ISSUE #15\n" + ], + [ + 60, + " \n" + ], + [ + 61, + " # No performance insights\n" + ], + [ + 62, + " performance_insights_enabled = false\n" + ], + [ + 63, + " \n" + ], + [ + 64, + " skip_final_snapshot = true\n" + ], + [ + 65, + " \n" + ], + [ + 66, + " tags = {\n" + ], + [ + 67, + " Name = \"Weak Database\"\n" + ], + [ + 68, + " }\n" + ], + [ + 69, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 40, + 69 + ], + "resource": "aws_db_instance.weak_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.RDSIAMAuthentication", + "fixed_definition": null, + "entity_tags": { + "Name": "Weak Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-rds-database-has-iam-authentication-enabled", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_293", + "bc_check_id": "BC_AWS_GENERAL_208", + "check_name": "Ensure that AWS database instances have deletion protection enabled", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "deletion_protection" + ] + }, + "code_block": [ + [ + 40, + "resource \"aws_db_instance\" \"weak_db\" {\n" + ], + [ + 41, + " identifier = \"mydb-weak\"\n" + ], + [ + 42, + " engine = \"mysql\"\n" + ], + [ + 43, + " engine_version = \"5.7.38\" # Old version with known vulnerabilities\n" + ], + [ + 44, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 45, + " allocated_storage = 20\n" + ], + [ + 46, + " \n" + ], + [ + 47, + " username = \"root\" # Using default admin username\n" + ], + [ + 48, + " password = \"password123\" # Weak password!\n" + ], + [ + 49, + " \n" + ], + [ + 50, + " storage_encrypted = true\n" + ], + [ + 51, + " kms_key_id = \"\" # Empty KMS key - using default key\n" + ], + [ + 52, + " \n" + ], + [ + 53, + " publicly_accessible = false\n" + ], + [ + 54, + " \n" + ], + [ + 55, + " # Multi-AZ disabled\n" + ], + [ + 56, + " multi_az = false # SECURITY ISSUE #14 - No high availability\n" + ], + [ + 57, + " \n" + ], + [ + 58, + " # Auto minor version upgrade disabled\n" + ], + [ + 59, + " auto_minor_version_upgrade = false # SECURITY ISSUE #15\n" + ], + [ + 60, + " \n" + ], + [ + 61, + " # No performance insights\n" + ], + [ + 62, + " performance_insights_enabled = false\n" + ], + [ + 63, + " \n" + ], + [ + 64, + " skip_final_snapshot = true\n" + ], + [ + 65, + " \n" + ], + [ + 66, + " tags = {\n" + ], + [ + 67, + " Name = \"Weak Database\"\n" + ], + [ + 68, + " }\n" + ], + [ + 69, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 40, + 69 + ], + "resource": "aws_db_instance.weak_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.RDSInstanceDeletionProtection", + "fixed_definition": null, + "entity_tags": { + "Name": "Weak Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-293", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_157", + "bc_check_id": "BC_AWS_GENERAL_73", + "check_name": "Ensure that RDS instances have Multi-AZ enabled", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "multi_az" + ] + }, + "code_block": [ + [ + 40, + "resource \"aws_db_instance\" \"weak_db\" {\n" + ], + [ + 41, + " identifier = \"mydb-weak\"\n" + ], + [ + 42, + " engine = \"mysql\"\n" + ], + [ + 43, + " engine_version = \"5.7.38\" # Old version with known vulnerabilities\n" + ], + [ + 44, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 45, + " allocated_storage = 20\n" + ], + [ + 46, + " \n" + ], + [ + 47, + " username = \"root\" # Using default admin username\n" + ], + [ + 48, + " password = \"password123\" # Weak password!\n" + ], + [ + 49, + " \n" + ], + [ + 50, + " storage_encrypted = true\n" + ], + [ + 51, + " kms_key_id = \"\" # Empty KMS key - using default key\n" + ], + [ + 52, + " \n" + ], + [ + 53, + " publicly_accessible = false\n" + ], + [ + 54, + " \n" + ], + [ + 55, + " # Multi-AZ disabled\n" + ], + [ + 56, + " multi_az = false # SECURITY ISSUE #14 - No high availability\n" + ], + [ + 57, + " \n" + ], + [ + 58, + " # Auto minor version upgrade disabled\n" + ], + [ + 59, + " auto_minor_version_upgrade = false # SECURITY ISSUE #15\n" + ], + [ + 60, + " \n" + ], + [ + 61, + " # No performance insights\n" + ], + [ + 62, + " performance_insights_enabled = false\n" + ], + [ + 63, + " \n" + ], + [ + 64, + " skip_final_snapshot = true\n" + ], + [ + 65, + " \n" + ], + [ + 66, + " tags = {\n" + ], + [ + 67, + " Name = \"Weak Database\"\n" + ], + [ + 68, + " }\n" + ], + [ + 69, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 40, + 69 + ], + "resource": "aws_db_instance.weak_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.RDSMultiAZEnabled", + "fixed_definition": null, + "entity_tags": { + "Name": "Weak Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-73", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_119", + "bc_check_id": "BC_AWS_GENERAL_52", + "check_name": "Ensure DynamoDB Tables are encrypted using a KMS Customer Managed CMK", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "server_side_encryption/[0]/enabled", + "server_side_encryption/[0]/kms_key_arn" + ] + }, + "code_block": [ + [ + 72, + "resource \"aws_dynamodb_table\" \"unencrypted_table\" {\n" + ], + [ + 73, + " name = \"my-table\"\n" + ], + [ + 74, + " billing_mode = \"PAY_PER_REQUEST\"\n" + ], + [ + 75, + " hash_key = \"id\"\n" + ], + [ + 76, + "\n" + ], + [ + 77, + " attribute {\n" + ], + [ + 78, + " name = \"id\"\n" + ], + [ + 79, + " type = \"S\"\n" + ], + [ + 80, + " }\n" + ], + [ + 81, + "\n" + ], + [ + 82, + " # No server_side_encryption configuration!\n" + ], + [ + 83, + " \n" + ], + [ + 84, + " # No point-in-time recovery\n" + ], + [ + 85, + " point_in_time_recovery {\n" + ], + [ + 86, + " enabled = false # SECURITY ISSUE #17\n" + ], + [ + 87, + " }\n" + ], + [ + 88, + "\n" + ], + [ + 89, + " tags = {\n" + ], + [ + 90, + " Name = \"Unencrypted DynamoDB Table\"\n" + ], + [ + 91, + " }\n" + ], + [ + 92, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 72, + 92 + ], + "resource": "aws_dynamodb_table.unencrypted_table", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.DynamoDBTablesEncrypted", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted DynamoDB Table" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-52", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_28", + "bc_check_id": "BC_AWS_GENERAL_6", + "check_name": "Ensure DynamoDB point in time recovery (backup) is enabled", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "point_in_time_recovery/[0]/enabled" + ] + }, + "code_block": [ + [ + 72, + "resource \"aws_dynamodb_table\" \"unencrypted_table\" {\n" + ], + [ + 73, + " name = \"my-table\"\n" + ], + [ + 74, + " billing_mode = \"PAY_PER_REQUEST\"\n" + ], + [ + 75, + " hash_key = \"id\"\n" + ], + [ + 76, + "\n" + ], + [ + 77, + " attribute {\n" + ], + [ + 78, + " name = \"id\"\n" + ], + [ + 79, + " type = \"S\"\n" + ], + [ + 80, + " }\n" + ], + [ + 81, + "\n" + ], + [ + 82, + " # No server_side_encryption configuration!\n" + ], + [ + 83, + " \n" + ], + [ + 84, + " # No point-in-time recovery\n" + ], + [ + 85, + " point_in_time_recovery {\n" + ], + [ + 86, + " enabled = false # SECURITY ISSUE #17\n" + ], + [ + 87, + " }\n" + ], + [ + 88, + "\n" + ], + [ + 89, + " tags = {\n" + ], + [ + 90, + " Name = \"Unencrypted DynamoDB Table\"\n" + ], + [ + 91, + " }\n" + ], + [ + 92, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 72, + 92 + ], + "resource": "aws_dynamodb_table.unencrypted_table", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.DynamodbRecovery", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted DynamoDB Table" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-6", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_62", + "bc_check_id": "BC_AWS_IAM_47", + "check_name": "Ensure IAM policies that allow full \"*-*\" administrative privileges are not created", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy", + "inline_policy" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_iam_policy\" \"admin_policy\" {\n" + ], + [ + 6, + " name = \"overly-permissive-policy\"\n" + ], + [ + 7, + " description = \"Policy with wildcard permissions\"\n" + ], + [ + 8, + "\n" + ], + [ + 9, + " policy = jsonencode({\n" + ], + [ + 10, + " Version = \"2012-10-17\"\n" + ], + [ + 11, + " Statement = [\n" + ], + [ + 12, + " {\n" + ], + [ + 13, + " Effect = \"Allow\"\n" + ], + [ + 14, + " Action = \"*\" # All actions allowed!\n" + ], + [ + 15, + " Resource = \"*\" # On all resources!\n" + ], + [ + 16, + " }\n" + ], + [ + 17, + " ]\n" + ], + [ + 18, + " })\n" + ], + [ + 19, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 5, + 19 + ], + "resource": "aws_iam_policy.admin_policy", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMAdminPolicyDocument", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-iam-45", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_287", + "bc_check_id": "BC_AWS_IAM_82", + "check_name": "Ensure IAM policies does not allow credentials exposure", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy/Statement/[0]/Action" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_iam_policy\" \"admin_policy\" {\n" + ], + [ + 6, + " name = \"overly-permissive-policy\"\n" + ], + [ + 7, + " description = \"Policy with wildcard permissions\"\n" + ], + [ + 8, + "\n" + ], + [ + 9, + " policy = jsonencode({\n" + ], + [ + 10, + " Version = \"2012-10-17\"\n" + ], + [ + 11, + " Statement = [\n" + ], + [ + 12, + " {\n" + ], + [ + 13, + " Effect = \"Allow\"\n" + ], + [ + 14, + " Action = \"*\" # All actions allowed!\n" + ], + [ + 15, + " Resource = \"*\" # On all resources!\n" + ], + [ + 16, + " }\n" + ], + [ + 17, + " ]\n" + ], + [ + 18, + " })\n" + ], + [ + 19, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 5, + 19 + ], + "resource": "aws_iam_policy.admin_policy", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMCredentialsExposure", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-287", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_288", + "bc_check_id": "BC_AWS_IAM_83", + "check_name": "Ensure IAM policies does not allow data exfiltration", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy/Statement/[0]/Action" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_iam_policy\" \"admin_policy\" {\n" + ], + [ + 6, + " name = \"overly-permissive-policy\"\n" + ], + [ + 7, + " description = \"Policy with wildcard permissions\"\n" + ], + [ + 8, + "\n" + ], + [ + 9, + " policy = jsonencode({\n" + ], + [ + 10, + " Version = \"2012-10-17\"\n" + ], + [ + 11, + " Statement = [\n" + ], + [ + 12, + " {\n" + ], + [ + 13, + " Effect = \"Allow\"\n" + ], + [ + 14, + " Action = \"*\" # All actions allowed!\n" + ], + [ + 15, + " Resource = \"*\" # On all resources!\n" + ], + [ + 16, + " }\n" + ], + [ + 17, + " ]\n" + ], + [ + 18, + " })\n" + ], + [ + 19, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 5, + 19 + ], + "resource": "aws_iam_policy.admin_policy", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMDataExfiltration", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-288", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_289", + "bc_check_id": "BC_AWS_IAM_84", + "check_name": "Ensure IAM policies does not allow permissions management / resource exposure without constraints", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy/Statement/[0]/Action" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_iam_policy\" \"admin_policy\" {\n" + ], + [ + 6, + " name = \"overly-permissive-policy\"\n" + ], + [ + 7, + " description = \"Policy with wildcard permissions\"\n" + ], + [ + 8, + "\n" + ], + [ + 9, + " policy = jsonencode({\n" + ], + [ + 10, + " Version = \"2012-10-17\"\n" + ], + [ + 11, + " Statement = [\n" + ], + [ + 12, + " {\n" + ], + [ + 13, + " Effect = \"Allow\"\n" + ], + [ + 14, + " Action = \"*\" # All actions allowed!\n" + ], + [ + 15, + " Resource = \"*\" # On all resources!\n" + ], + [ + 16, + " }\n" + ], + [ + 17, + " ]\n" + ], + [ + 18, + " })\n" + ], + [ + 19, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 5, + 19 + ], + "resource": "aws_iam_policy.admin_policy", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMPermissionsManagement", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-289", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_286", + "bc_check_id": "BC_AWS_IAM_81", + "check_name": "Ensure IAM policies does not allow privilege escalation", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy/Statement/[0]/Action" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_iam_policy\" \"admin_policy\" {\n" + ], + [ + 6, + " name = \"overly-permissive-policy\"\n" + ], + [ + 7, + " description = \"Policy with wildcard permissions\"\n" + ], + [ + 8, + "\n" + ], + [ + 9, + " policy = jsonencode({\n" + ], + [ + 10, + " Version = \"2012-10-17\"\n" + ], + [ + 11, + " Statement = [\n" + ], + [ + 12, + " {\n" + ], + [ + 13, + " Effect = \"Allow\"\n" + ], + [ + 14, + " Action = \"*\" # All actions allowed!\n" + ], + [ + 15, + " Resource = \"*\" # On all resources!\n" + ], + [ + 16, + " }\n" + ], + [ + 17, + " ]\n" + ], + [ + 18, + " })\n" + ], + [ + 19, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 5, + 19 + ], + "resource": "aws_iam_policy.admin_policy", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMPrivilegeEscalation", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-286", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_63", + "bc_check_id": "BC_AWS_IAM_48", + "check_name": "Ensure no IAM policies documents allow \"*\" as a statement's actions", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy", + "inline_policy" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_iam_policy\" \"admin_policy\" {\n" + ], + [ + 6, + " name = \"overly-permissive-policy\"\n" + ], + [ + 7, + " description = \"Policy with wildcard permissions\"\n" + ], + [ + 8, + "\n" + ], + [ + 9, + " policy = jsonencode({\n" + ], + [ + 10, + " Version = \"2012-10-17\"\n" + ], + [ + 11, + " Statement = [\n" + ], + [ + 12, + " {\n" + ], + [ + 13, + " Effect = \"Allow\"\n" + ], + [ + 14, + " Action = \"*\" # All actions allowed!\n" + ], + [ + 15, + " Resource = \"*\" # On all resources!\n" + ], + [ + 16, + " }\n" + ], + [ + 17, + " ]\n" + ], + [ + 18, + " })\n" + ], + [ + 19, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 5, + 19 + ], + "resource": "aws_iam_policy.admin_policy", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMStarActionPolicyDocument", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/iam-48", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_355", + "bc_check_id": "BC_AWS_IAM_88", + "check_name": "Ensure no IAM policies documents allow \"*\" as a statement's resource for restrictable actions", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy/Statement/[0]/Action" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_iam_policy\" \"admin_policy\" {\n" + ], + [ + 6, + " name = \"overly-permissive-policy\"\n" + ], + [ + 7, + " description = \"Policy with wildcard permissions\"\n" + ], + [ + 8, + "\n" + ], + [ + 9, + " policy = jsonencode({\n" + ], + [ + 10, + " Version = \"2012-10-17\"\n" + ], + [ + 11, + " Statement = [\n" + ], + [ + 12, + " {\n" + ], + [ + 13, + " Effect = \"Allow\"\n" + ], + [ + 14, + " Action = \"*\" # All actions allowed!\n" + ], + [ + 15, + " Resource = \"*\" # On all resources!\n" + ], + [ + 16, + " }\n" + ], + [ + 17, + " ]\n" + ], + [ + 18, + " })\n" + ], + [ + 19, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 5, + 19 + ], + "resource": "aws_iam_policy.admin_policy", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMStarResourcePolicyDocument", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_290", + "bc_check_id": "BC_AWS_IAM_85", + "check_name": "Ensure IAM policies does not allow write access without constraints", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy/Statement/[0]/Action" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_iam_policy\" \"admin_policy\" {\n" + ], + [ + 6, + " name = \"overly-permissive-policy\"\n" + ], + [ + 7, + " description = \"Policy with wildcard permissions\"\n" + ], + [ + 8, + "\n" + ], + [ + 9, + " policy = jsonencode({\n" + ], + [ + 10, + " Version = \"2012-10-17\"\n" + ], + [ + 11, + " Statement = [\n" + ], + [ + 12, + " {\n" + ], + [ + 13, + " Effect = \"Allow\"\n" + ], + [ + 14, + " Action = \"*\" # All actions allowed!\n" + ], + [ + 15, + " Resource = \"*\" # On all resources!\n" + ], + [ + 16, + " }\n" + ], + [ + 17, + " ]\n" + ], + [ + 18, + " })\n" + ], + [ + 19, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 5, + 19 + ], + "resource": "aws_iam_policy.admin_policy", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMWriteAccess", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_288", + "bc_check_id": "BC_AWS_IAM_83", + "check_name": "Ensure IAM policies does not allow data exfiltration", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy/Statement/[0]/Action" + ] + }, + "code_block": [ + [ + 39, + "resource \"aws_iam_role_policy\" \"s3_full_access\" {\n" + ], + [ + 40, + " name = \"s3-full-access\"\n" + ], + [ + 41, + " role = aws_iam_role.app_role.id\n" + ], + [ + 42, + "\n" + ], + [ + 43, + " policy = jsonencode({\n" + ], + [ + 44, + " Version = \"2012-10-17\"\n" + ], + [ + 45, + " Statement = [\n" + ], + [ + 46, + " {\n" + ], + [ + 47, + " Effect = \"Allow\"\n" + ], + [ + 48, + " Action = [\n" + ], + [ + 49, + " \"s3:*\" # All S3 actions!\n" + ], + [ + 50, + " ]\n" + ], + [ + 51, + " Resource = \"*\" # On all buckets!\n" + ], + [ + 52, + " }\n" + ], + [ + 53, + " ]\n" + ], + [ + 54, + " })\n" + ], + [ + 55, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 39, + 55 + ], + "resource": "aws_iam_role_policy.s3_full_access", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMDataExfiltration", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-288", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_289", + "bc_check_id": "BC_AWS_IAM_84", + "check_name": "Ensure IAM policies does not allow permissions management / resource exposure without constraints", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy/Statement/[0]/Action" + ] + }, + "code_block": [ + [ + 39, + "resource \"aws_iam_role_policy\" \"s3_full_access\" {\n" + ], + [ + 40, + " name = \"s3-full-access\"\n" + ], + [ + 41, + " role = aws_iam_role.app_role.id\n" + ], + [ + 42, + "\n" + ], + [ + 43, + " policy = jsonencode({\n" + ], + [ + 44, + " Version = \"2012-10-17\"\n" + ], + [ + 45, + " Statement = [\n" + ], + [ + 46, + " {\n" + ], + [ + 47, + " Effect = \"Allow\"\n" + ], + [ + 48, + " Action = [\n" + ], + [ + 49, + " \"s3:*\" # All S3 actions!\n" + ], + [ + 50, + " ]\n" + ], + [ + 51, + " Resource = \"*\" # On all buckets!\n" + ], + [ + 52, + " }\n" + ], + [ + 53, + " ]\n" + ], + [ + 54, + " })\n" + ], + [ + 55, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 39, + 55 + ], + "resource": "aws_iam_role_policy.s3_full_access", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMPermissionsManagement", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-289", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_355", + "bc_check_id": "BC_AWS_IAM_88", + "check_name": "Ensure no IAM policies documents allow \"*\" as a statement's resource for restrictable actions", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy/Statement/[0]/Action" + ] + }, + "code_block": [ + [ + 39, + "resource \"aws_iam_role_policy\" \"s3_full_access\" {\n" + ], + [ + 40, + " name = \"s3-full-access\"\n" + ], + [ + 41, + " role = aws_iam_role.app_role.id\n" + ], + [ + 42, + "\n" + ], + [ + 43, + " policy = jsonencode({\n" + ], + [ + 44, + " Version = \"2012-10-17\"\n" + ], + [ + 45, + " Statement = [\n" + ], + [ + 46, + " {\n" + ], + [ + 47, + " Effect = \"Allow\"\n" + ], + [ + 48, + " Action = [\n" + ], + [ + 49, + " \"s3:*\" # All S3 actions!\n" + ], + [ + 50, + " ]\n" + ], + [ + 51, + " Resource = \"*\" # On all buckets!\n" + ], + [ + 52, + " }\n" + ], + [ + 53, + " ]\n" + ], + [ + 54, + " })\n" + ], + [ + 55, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 39, + 55 + ], + "resource": "aws_iam_role_policy.s3_full_access", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMStarResourcePolicyDocument", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_290", + "bc_check_id": "BC_AWS_IAM_85", + "check_name": "Ensure IAM policies does not allow write access without constraints", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy/Statement/[0]/Action" + ] + }, + "code_block": [ + [ + 39, + "resource \"aws_iam_role_policy\" \"s3_full_access\" {\n" + ], + [ + 40, + " name = \"s3-full-access\"\n" + ], + [ + 41, + " role = aws_iam_role.app_role.id\n" + ], + [ + 42, + "\n" + ], + [ + 43, + " policy = jsonencode({\n" + ], + [ + 44, + " Version = \"2012-10-17\"\n" + ], + [ + 45, + " Statement = [\n" + ], + [ + 46, + " {\n" + ], + [ + 47, + " Effect = \"Allow\"\n" + ], + [ + 48, + " Action = [\n" + ], + [ + 49, + " \"s3:*\" # All S3 actions!\n" + ], + [ + 50, + " ]\n" + ], + [ + 51, + " Resource = \"*\" # On all buckets!\n" + ], + [ + 52, + " }\n" + ], + [ + 53, + " ]\n" + ], + [ + 54, + " })\n" + ], + [ + 55, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 39, + 55 + ], + "resource": "aws_iam_role_policy.s3_full_access", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMWriteAccess", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_273", + "bc_check_id": "BC_AWS_IAM_77", + "check_name": "Ensure access is controlled through SSO and not AWS IAM defined users", + "check_result": { + "result": "FAILED", + "evaluated_keys": [] + }, + "code_block": [ + [ + 58, + "resource \"aws_iam_user\" \"service_account\" {\n" + ], + [ + 59, + " name = \"service-account\"\n" + ], + [ + 60, + " path = \"/system/\"\n" + ], + [ + 61, + "\n" + ], + [ + 62, + " tags = {\n" + ], + [ + 63, + " Name = \"Service Account\"\n" + ], + [ + 64, + " }\n" + ], + [ + 65, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 58, + 65 + ], + "resource": "aws_iam_user.service_account", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMUserNotUsedForAccess", + "fixed_definition": null, + "entity_tags": { + "Name": "Service Account" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-273", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_287", + "bc_check_id": "BC_AWS_IAM_82", + "check_name": "Ensure IAM policies does not allow credentials exposure", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy/Statement/[0]/Action" + ] + }, + "code_block": [ + [ + 67, + "resource \"aws_iam_user_policy\" \"service_policy\" {\n" + ], + [ + 68, + " name = \"service-inline-policy\"\n" + ], + [ + 69, + " user = aws_iam_user.service_account.name\n" + ], + [ + 70, + "\n" + ], + [ + 71, + " policy = jsonencode({\n" + ], + [ + 72, + " Version = \"2012-10-17\"\n" + ], + [ + 73, + " Statement = [\n" + ], + [ + 74, + " {\n" + ], + [ + 75, + " Effect = \"Allow\"\n" + ], + [ + 76, + " Action = [\n" + ], + [ + 77, + " \"ec2:*\", # Full EC2 access\n" + ], + [ + 78, + " \"s3:*\", # Full S3 access\n" + ], + [ + 79, + " \"rds:*\" # Full RDS access\n" + ], + [ + 80, + " ]\n" + ], + [ + 81, + " Resource = \"*\"\n" + ], + [ + 82, + " }\n" + ], + [ + 83, + " ]\n" + ], + [ + 84, + " })\n" + ], + [ + 85, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 67, + 85 + ], + "resource": "aws_iam_user_policy.service_policy", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMCredentialsExposure", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-287", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf", + "breadcrumbs": { + "user": [ + { + "type": "resource", + "name": "aws_iam_user.service_account", + "path": "/tf/iam.tf", + "module_connection": false + } + ] + } + }, + { + "check_id": "CKV_AWS_288", + "bc_check_id": "BC_AWS_IAM_83", + "check_name": "Ensure IAM policies does not allow data exfiltration", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy/Statement/[0]/Action" + ] + }, + "code_block": [ + [ + 67, + "resource \"aws_iam_user_policy\" \"service_policy\" {\n" + ], + [ + 68, + " name = \"service-inline-policy\"\n" + ], + [ + 69, + " user = aws_iam_user.service_account.name\n" + ], + [ + 70, + "\n" + ], + [ + 71, + " policy = jsonencode({\n" + ], + [ + 72, + " Version = \"2012-10-17\"\n" + ], + [ + 73, + " Statement = [\n" + ], + [ + 74, + " {\n" + ], + [ + 75, + " Effect = \"Allow\"\n" + ], + [ + 76, + " Action = [\n" + ], + [ + 77, + " \"ec2:*\", # Full EC2 access\n" + ], + [ + 78, + " \"s3:*\", # Full S3 access\n" + ], + [ + 79, + " \"rds:*\" # Full RDS access\n" + ], + [ + 80, + " ]\n" + ], + [ + 81, + " Resource = \"*\"\n" + ], + [ + 82, + " }\n" + ], + [ + 83, + " ]\n" + ], + [ + 84, + " })\n" + ], + [ + 85, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 67, + 85 + ], + "resource": "aws_iam_user_policy.service_policy", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMDataExfiltration", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-288", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf", + "breadcrumbs": { + "user": [ + { + "type": "resource", + "name": "aws_iam_user.service_account", + "path": "/tf/iam.tf", + "module_connection": false + } + ] + } + }, + { + "check_id": "CKV_AWS_289", + "bc_check_id": "BC_AWS_IAM_84", + "check_name": "Ensure IAM policies does not allow permissions management / resource exposure without constraints", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy/Statement/[0]/Action" + ] + }, + "code_block": [ + [ + 67, + "resource \"aws_iam_user_policy\" \"service_policy\" {\n" + ], + [ + 68, + " name = \"service-inline-policy\"\n" + ], + [ + 69, + " user = aws_iam_user.service_account.name\n" + ], + [ + 70, + "\n" + ], + [ + 71, + " policy = jsonencode({\n" + ], + [ + 72, + " Version = \"2012-10-17\"\n" + ], + [ + 73, + " Statement = [\n" + ], + [ + 74, + " {\n" + ], + [ + 75, + " Effect = \"Allow\"\n" + ], + [ + 76, + " Action = [\n" + ], + [ + 77, + " \"ec2:*\", # Full EC2 access\n" + ], + [ + 78, + " \"s3:*\", # Full S3 access\n" + ], + [ + 79, + " \"rds:*\" # Full RDS access\n" + ], + [ + 80, + " ]\n" + ], + [ + 81, + " Resource = \"*\"\n" + ], + [ + 82, + " }\n" + ], + [ + 83, + " ]\n" + ], + [ + 84, + " })\n" + ], + [ + 85, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 67, + 85 + ], + "resource": "aws_iam_user_policy.service_policy", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMPermissionsManagement", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-289", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf", + "breadcrumbs": { + "user": [ + { + "type": "resource", + "name": "aws_iam_user.service_account", + "path": "/tf/iam.tf", + "module_connection": false + } + ] + } + }, + { + "check_id": "CKV_AWS_40", + "bc_check_id": "BC_AWS_IAM_16", + "check_name": "Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.)", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "user" + ] + }, + "code_block": [ + [ + 67, + "resource \"aws_iam_user_policy\" \"service_policy\" {\n" + ], + [ + 68, + " name = \"service-inline-policy\"\n" + ], + [ + 69, + " user = aws_iam_user.service_account.name\n" + ], + [ + 70, + "\n" + ], + [ + 71, + " policy = jsonencode({\n" + ], + [ + 72, + " Version = \"2012-10-17\"\n" + ], + [ + 73, + " Statement = [\n" + ], + [ + 74, + " {\n" + ], + [ + 75, + " Effect = \"Allow\"\n" + ], + [ + 76, + " Action = [\n" + ], + [ + 77, + " \"ec2:*\", # Full EC2 access\n" + ], + [ + 78, + " \"s3:*\", # Full S3 access\n" + ], + [ + 79, + " \"rds:*\" # Full RDS access\n" + ], + [ + 80, + " ]\n" + ], + [ + 81, + " Resource = \"*\"\n" + ], + [ + 82, + " }\n" + ], + [ + 83, + " ]\n" + ], + [ + 84, + " })\n" + ], + [ + 85, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 67, + 85 + ], + "resource": "aws_iam_user_policy.service_policy", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMPolicyAttachedToGroupOrRoles", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/iam-16-iam-policy-privileges-1", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf", + "breadcrumbs": { + "user": [ + { + "type": "resource", + "name": "aws_iam_user.service_account", + "path": "/tf/iam.tf", + "module_connection": false + } + ] + } + }, + { + "check_id": "CKV_AWS_355", + "bc_check_id": "BC_AWS_IAM_88", + "check_name": "Ensure no IAM policies documents allow \"*\" as a statement's resource for restrictable actions", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy/Statement/[0]/Action" + ] + }, + "code_block": [ + [ + 67, + "resource \"aws_iam_user_policy\" \"service_policy\" {\n" + ], + [ + 68, + " name = \"service-inline-policy\"\n" + ], + [ + 69, + " user = aws_iam_user.service_account.name\n" + ], + [ + 70, + "\n" + ], + [ + 71, + " policy = jsonencode({\n" + ], + [ + 72, + " Version = \"2012-10-17\"\n" + ], + [ + 73, + " Statement = [\n" + ], + [ + 74, + " {\n" + ], + [ + 75, + " Effect = \"Allow\"\n" + ], + [ + 76, + " Action = [\n" + ], + [ + 77, + " \"ec2:*\", # Full EC2 access\n" + ], + [ + 78, + " \"s3:*\", # Full S3 access\n" + ], + [ + 79, + " \"rds:*\" # Full RDS access\n" + ], + [ + 80, + " ]\n" + ], + [ + 81, + " Resource = \"*\"\n" + ], + [ + 82, + " }\n" + ], + [ + 83, + " ]\n" + ], + [ + 84, + " })\n" + ], + [ + 85, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 67, + 85 + ], + "resource": "aws_iam_user_policy.service_policy", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMStarResourcePolicyDocument", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf", + "breadcrumbs": { + "user": [ + { + "type": "resource", + "name": "aws_iam_user.service_account", + "path": "/tf/iam.tf", + "module_connection": false + } + ] + } + }, + { + "check_id": "CKV_AWS_290", + "bc_check_id": "BC_AWS_IAM_85", + "check_name": "Ensure IAM policies does not allow write access without constraints", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy/Statement/[0]/Action" + ] + }, + "code_block": [ + [ + 67, + "resource \"aws_iam_user_policy\" \"service_policy\" {\n" + ], + [ + 68, + " name = \"service-inline-policy\"\n" + ], + [ + 69, + " user = aws_iam_user.service_account.name\n" + ], + [ + 70, + "\n" + ], + [ + 71, + " policy = jsonencode({\n" + ], + [ + 72, + " Version = \"2012-10-17\"\n" + ], + [ + 73, + " Statement = [\n" + ], + [ + 74, + " {\n" + ], + [ + 75, + " Effect = \"Allow\"\n" + ], + [ + 76, + " Action = [\n" + ], + [ + 77, + " \"ec2:*\", # Full EC2 access\n" + ], + [ + 78, + " \"s3:*\", # Full S3 access\n" + ], + [ + 79, + " \"rds:*\" # Full RDS access\n" + ], + [ + 80, + " ]\n" + ], + [ + 81, + " Resource = \"*\"\n" + ], + [ + 82, + " }\n" + ], + [ + 83, + " ]\n" + ], + [ + 84, + " })\n" + ], + [ + 85, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 67, + 85 + ], + "resource": "aws_iam_user_policy.service_policy", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMWriteAccess", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf", + "breadcrumbs": { + "user": [ + { + "type": "resource", + "name": "aws_iam_user.service_account", + "path": "/tf/iam.tf", + "module_connection": false + } + ] + } + }, + { + "check_id": "CKV_AWS_289", + "bc_check_id": "BC_AWS_IAM_84", + "check_name": "Ensure IAM policies does not allow permissions management / resource exposure without constraints", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy/Statement/[0]/Action" + ] + }, + "code_block": [ + [ + 104, + "resource \"aws_iam_policy\" \"privilege_escalation\" {\n" + ], + [ + 105, + " name = \"potential-privilege-escalation\"\n" + ], + [ + 106, + " description = \"Policy that allows privilege escalation\"\n" + ], + [ + 107, + "\n" + ], + [ + 108, + " policy = jsonencode({\n" + ], + [ + 109, + " Version = \"2012-10-17\"\n" + ], + [ + 110, + " Statement = [\n" + ], + [ + 111, + " {\n" + ], + [ + 112, + " Effect = \"Allow\"\n" + ], + [ + 113, + " Action = [\n" + ], + [ + 114, + " \"iam:CreatePolicy\",\n" + ], + [ + 115, + " \"iam:CreateUser\",\n" + ], + [ + 116, + " \"iam:AttachUserPolicy\",\n" + ], + [ + 117, + " \"iam:AttachRolePolicy\",\n" + ], + [ + 118, + " \"iam:PutUserPolicy\",\n" + ], + [ + 119, + " \"iam:PutRolePolicy\"\n" + ], + [ + 120, + " ]\n" + ], + [ + 121, + " Resource = \"*\"\n" + ], + [ + 122, + " }\n" + ], + [ + 123, + " ]\n" + ], + [ + 124, + " })\n" + ], + [ + 125, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 104, + 125 + ], + "resource": "aws_iam_policy.privilege_escalation", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMPermissionsManagement", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-289", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_286", + "bc_check_id": "BC_AWS_IAM_81", + "check_name": "Ensure IAM policies does not allow privilege escalation", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy/Statement/[0]/Action" + ] + }, + "code_block": [ + [ + 104, + "resource \"aws_iam_policy\" \"privilege_escalation\" {\n" + ], + [ + 105, + " name = \"potential-privilege-escalation\"\n" + ], + [ + 106, + " description = \"Policy that allows privilege escalation\"\n" + ], + [ + 107, + "\n" + ], + [ + 108, + " policy = jsonencode({\n" + ], + [ + 109, + " Version = \"2012-10-17\"\n" + ], + [ + 110, + " Statement = [\n" + ], + [ + 111, + " {\n" + ], + [ + 112, + " Effect = \"Allow\"\n" + ], + [ + 113, + " Action = [\n" + ], + [ + 114, + " \"iam:CreatePolicy\",\n" + ], + [ + 115, + " \"iam:CreateUser\",\n" + ], + [ + 116, + " \"iam:AttachUserPolicy\",\n" + ], + [ + 117, + " \"iam:AttachRolePolicy\",\n" + ], + [ + 118, + " \"iam:PutUserPolicy\",\n" + ], + [ + 119, + " \"iam:PutRolePolicy\"\n" + ], + [ + 120, + " ]\n" + ], + [ + 121, + " Resource = \"*\"\n" + ], + [ + 122, + " }\n" + ], + [ + 123, + " ]\n" + ], + [ + 124, + " })\n" + ], + [ + 125, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 104, + 125 + ], + "resource": "aws_iam_policy.privilege_escalation", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMPrivilegeEscalation", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-286", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_355", + "bc_check_id": "BC_AWS_IAM_88", + "check_name": "Ensure no IAM policies documents allow \"*\" as a statement's resource for restrictable actions", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy/Statement/[0]/Action" + ] + }, + "code_block": [ + [ + 104, + "resource \"aws_iam_policy\" \"privilege_escalation\" {\n" + ], + [ + 105, + " name = \"potential-privilege-escalation\"\n" + ], + [ + 106, + " description = \"Policy that allows privilege escalation\"\n" + ], + [ + 107, + "\n" + ], + [ + 108, + " policy = jsonencode({\n" + ], + [ + 109, + " Version = \"2012-10-17\"\n" + ], + [ + 110, + " Statement = [\n" + ], + [ + 111, + " {\n" + ], + [ + 112, + " Effect = \"Allow\"\n" + ], + [ + 113, + " Action = [\n" + ], + [ + 114, + " \"iam:CreatePolicy\",\n" + ], + [ + 115, + " \"iam:CreateUser\",\n" + ], + [ + 116, + " \"iam:AttachUserPolicy\",\n" + ], + [ + 117, + " \"iam:AttachRolePolicy\",\n" + ], + [ + 118, + " \"iam:PutUserPolicy\",\n" + ], + [ + 119, + " \"iam:PutRolePolicy\"\n" + ], + [ + 120, + " ]\n" + ], + [ + 121, + " Resource = \"*\"\n" + ], + [ + 122, + " }\n" + ], + [ + 123, + " ]\n" + ], + [ + 124, + " })\n" + ], + [ + 125, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 104, + 125 + ], + "resource": "aws_iam_policy.privilege_escalation", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMStarResourcePolicyDocument", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_53", + "bc_check_id": "BC_AWS_S3_19", + "check_name": "Ensure S3 bucket has block public ACLS enabled", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "block_public_acls" + ] + }, + "code_block": [ + [ + 36, + "resource \"aws_s3_bucket_public_access_block\" \"bad_config\" {\n" + ], + [ + 37, + " bucket = aws_s3_bucket.public_data.id\n" + ], + [ + 38, + "\n" + ], + [ + 39, + " block_public_acls = false # Should be true\n" + ], + [ + 40, + " block_public_policy = false # Should be true\n" + ], + [ + 41, + " ignore_public_acls = false # Should be true\n" + ], + [ + 42, + " restrict_public_buckets = false # Should be true\n" + ], + [ + 43, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 36, + 43 + ], + "resource": "aws_s3_bucket_public_access_block.bad_config", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.S3BlockPublicACLs", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc-aws-s3-19", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV_AWS_54", + "bc_check_id": "BC_AWS_S3_20", + "check_name": "Ensure S3 bucket has block public policy enabled", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "block_public_policy" + ] + }, + "code_block": [ + [ + 36, + "resource \"aws_s3_bucket_public_access_block\" \"bad_config\" {\n" + ], + [ + 37, + " bucket = aws_s3_bucket.public_data.id\n" + ], + [ + 38, + "\n" + ], + [ + 39, + " block_public_acls = false # Should be true\n" + ], + [ + 40, + " block_public_policy = false # Should be true\n" + ], + [ + 41, + " ignore_public_acls = false # Should be true\n" + ], + [ + 42, + " restrict_public_buckets = false # Should be true\n" + ], + [ + 43, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 36, + 43 + ], + "resource": "aws_s3_bucket_public_access_block.bad_config", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.S3BlockPublicPolicy", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc-aws-s3-20", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV_AWS_55", + "bc_check_id": "BC_AWS_S3_21", + "check_name": "Ensure S3 bucket has ignore public ACLs enabled", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "ignore_public_acls" + ] + }, + "code_block": [ + [ + 36, + "resource \"aws_s3_bucket_public_access_block\" \"bad_config\" {\n" + ], + [ + 37, + " bucket = aws_s3_bucket.public_data.id\n" + ], + [ + 38, + "\n" + ], + [ + 39, + " block_public_acls = false # Should be true\n" + ], + [ + 40, + " block_public_policy = false # Should be true\n" + ], + [ + 41, + " ignore_public_acls = false # Should be true\n" + ], + [ + 42, + " restrict_public_buckets = false # Should be true\n" + ], + [ + 43, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 36, + 43 + ], + "resource": "aws_s3_bucket_public_access_block.bad_config", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.S3IgnorePublicACLs", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc-aws-s3-21", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV_AWS_56", + "bc_check_id": "BC_AWS_S3_22", + "check_name": "Ensure S3 bucket has 'restrict_public_buckets' enabled", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "restrict_public_buckets" + ] + }, + "code_block": [ + [ + 36, + "resource \"aws_s3_bucket_public_access_block\" \"bad_config\" {\n" + ], + [ + 37, + " bucket = aws_s3_bucket.public_data.id\n" + ], + [ + 38, + "\n" + ], + [ + 39, + " block_public_acls = false # Should be true\n" + ], + [ + 40, + " block_public_policy = false # Should be true\n" + ], + [ + 41, + " ignore_public_acls = false # Should be true\n" + ], + [ + 42, + " restrict_public_buckets = false # Should be true\n" + ], + [ + 43, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 36, + 43 + ], + "resource": "aws_s3_bucket_public_access_block.bad_config", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.S3RestrictPublicBuckets", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc-aws-s3-22", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV_AWS_41", + "bc_check_id": "BC_AWS_SECRETS_5", + "check_name": "Ensure no hard coded AWS access key and secret key exists in provider", + "check_result": { + "result": "FAILED", + "evaluated_keys": [] + }, + "code_block": [ + [ + 5, + "provider \"aws\" {\n" + ], + [ + 6, + " region = \"us-east-1\"\n" + ], + [ + 7, + " # Hardcoded credentials - SECURITY ISSUE #1\n" + ], + [ + 8, + " access_key = \"AKIAI**********\"\n" + ], + [ + 9, + " secret_key = \"wJalrX**********\"\n" + ], + [ + 10, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 5, + 10 + ], + "resource": "aws.default", + "evaluations": null, + "check_class": "checkov.terraform.checks.provider.aws.credentials", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/secrets-policies/bc-aws-secrets-5", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV_AWS_23", + "bc_check_id": "BC_AWS_NETWORKING_31", + "check_name": "Ensure every security group and rule has a description", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "description", + "egress/[0]" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_security_group\" \"allow_all\" {\n" + ], + [ + 6, + " name = \"allow-all-traffic\"\n" + ], + [ + 7, + " description = \"Allow all inbound traffic from anywhere\"\n" + ], + [ + 8, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 9, + "\n" + ], + [ + 10, + " ingress {\n" + ], + [ + 11, + " description = \"Allow all traffic\"\n" + ], + [ + 12, + " from_port = 0\n" + ], + [ + 13, + " to_port = 65535\n" + ], + [ + 14, + " protocol = \"-1\" # All protocols\n" + ], + [ + 15, + " cidr_blocks = [\"0.0.0.0/0\"] # From anywhere!\n" + ], + [ + 16, + " }\n" + ], + [ + 17, + "\n" + ], + [ + 18, + " egress {\n" + ], + [ + 19, + " from_port = 0\n" + ], + [ + 20, + " to_port = 0\n" + ], + [ + 21, + " protocol = \"-1\"\n" + ], + [ + 22, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 23, + " }\n" + ], + [ + 24, + "\n" + ], + [ + 25, + " tags = {\n" + ], + [ + 26, + " Name = \"Allow All Security Group\"\n" + ], + [ + 27, + " }\n" + ], + [ + 28, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 5, + 28 + ], + "resource": "aws_security_group.allow_all", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.SecurityGroupRuleDescription", + "fixed_definition": null, + "entity_tags": { + "Name": "Allow All Security Group" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV_AWS_382", + "bc_check_id": "BC_AWS_IAM_93", + "check_name": "Ensure no security groups allow egress from 0.0.0.0:0 to port -1", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "egress/[0]/from_port", + "egress/[0]/to_port", + "egress/[0]/cidr_blocks", + "egress/[0]/ipv6_cidr_blocks" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_security_group\" \"allow_all\" {\n" + ], + [ + 6, + " name = \"allow-all-traffic\"\n" + ], + [ + 7, + " description = \"Allow all inbound traffic from anywhere\"\n" + ], + [ + 8, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 9, + "\n" + ], + [ + 10, + " ingress {\n" + ], + [ + 11, + " description = \"Allow all traffic\"\n" + ], + [ + 12, + " from_port = 0\n" + ], + [ + 13, + " to_port = 65535\n" + ], + [ + 14, + " protocol = \"-1\" # All protocols\n" + ], + [ + 15, + " cidr_blocks = [\"0.0.0.0/0\"] # From anywhere!\n" + ], + [ + 16, + " }\n" + ], + [ + 17, + "\n" + ], + [ + 18, + " egress {\n" + ], + [ + 19, + " from_port = 0\n" + ], + [ + 20, + " to_port = 0\n" + ], + [ + 21, + " protocol = \"-1\"\n" + ], + [ + 22, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 23, + " }\n" + ], + [ + 24, + "\n" + ], + [ + 25, + " tags = {\n" + ], + [ + 26, + " Name = \"Allow All Security Group\"\n" + ], + [ + 27, + " }\n" + ], + [ + 28, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 5, + 28 + ], + "resource": "aws_security_group.allow_all", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.SecurityGroupUnrestrictedEgressAny", + "fixed_definition": null, + "entity_tags": { + "Name": "Allow All Security Group" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/bc-aws-382", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV_AWS_24", + "bc_check_id": "BC_AWS_NETWORKING_1", + "check_name": "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "ingress/[0]/from_port", + "ingress/[0]/to_port", + "ingress/[0]/cidr_blocks", + "ingress/[0]/ipv6_cidr_blocks" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_security_group\" \"allow_all\" {\n" + ], + [ + 6, + " name = \"allow-all-traffic\"\n" + ], + [ + 7, + " description = \"Allow all inbound traffic from anywhere\"\n" + ], + [ + 8, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 9, + "\n" + ], + [ + 10, + " ingress {\n" + ], + [ + 11, + " description = \"Allow all traffic\"\n" + ], + [ + 12, + " from_port = 0\n" + ], + [ + 13, + " to_port = 65535\n" + ], + [ + 14, + " protocol = \"-1\" # All protocols\n" + ], + [ + 15, + " cidr_blocks = [\"0.0.0.0/0\"] # From anywhere!\n" + ], + [ + 16, + " }\n" + ], + [ + 17, + "\n" + ], + [ + 18, + " egress {\n" + ], + [ + 19, + " from_port = 0\n" + ], + [ + 20, + " to_port = 0\n" + ], + [ + 21, + " protocol = \"-1\"\n" + ], + [ + 22, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 23, + " }\n" + ], + [ + 24, + "\n" + ], + [ + 25, + " tags = {\n" + ], + [ + 26, + " Name = \"Allow All Security Group\"\n" + ], + [ + 27, + " }\n" + ], + [ + 28, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 5, + 28 + ], + "resource": "aws_security_group.allow_all", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.SecurityGroupUnrestrictedIngress22", + "fixed_definition": null, + "entity_tags": { + "Name": "Allow All Security Group" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-1-port-security", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV_AWS_25", + "bc_check_id": "BC_AWS_NETWORKING_2", + "check_name": "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "ingress/[0]/from_port", + "ingress/[0]/to_port", + "ingress/[0]/cidr_blocks", + "ingress/[0]/ipv6_cidr_blocks" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_security_group\" \"allow_all\" {\n" + ], + [ + 6, + " name = \"allow-all-traffic\"\n" + ], + [ + 7, + " description = \"Allow all inbound traffic from anywhere\"\n" + ], + [ + 8, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 9, + "\n" + ], + [ + 10, + " ingress {\n" + ], + [ + 11, + " description = \"Allow all traffic\"\n" + ], + [ + 12, + " from_port = 0\n" + ], + [ + 13, + " to_port = 65535\n" + ], + [ + 14, + " protocol = \"-1\" # All protocols\n" + ], + [ + 15, + " cidr_blocks = [\"0.0.0.0/0\"] # From anywhere!\n" + ], + [ + 16, + " }\n" + ], + [ + 17, + "\n" + ], + [ + 18, + " egress {\n" + ], + [ + 19, + " from_port = 0\n" + ], + [ + 20, + " to_port = 0\n" + ], + [ + 21, + " protocol = \"-1\"\n" + ], + [ + 22, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 23, + " }\n" + ], + [ + 24, + "\n" + ], + [ + 25, + " tags = {\n" + ], + [ + 26, + " Name = \"Allow All Security Group\"\n" + ], + [ + 27, + " }\n" + ], + [ + 28, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 5, + 28 + ], + "resource": "aws_security_group.allow_all", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.SecurityGroupUnrestrictedIngress3389", + "fixed_definition": null, + "entity_tags": { + "Name": "Allow All Security Group" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV_AWS_260", + "bc_check_id": "BC_AWS_NETWORKING_67", + "check_name": "Ensure no security groups allow ingress from 0.0.0.0:0 to port 80", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "ingress/[0]/from_port", + "ingress/[0]/to_port", + "ingress/[0]/cidr_blocks", + "ingress/[0]/ipv6_cidr_blocks" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_security_group\" \"allow_all\" {\n" + ], + [ + 6, + " name = \"allow-all-traffic\"\n" + ], + [ + 7, + " description = \"Allow all inbound traffic from anywhere\"\n" + ], + [ + 8, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 9, + "\n" + ], + [ + 10, + " ingress {\n" + ], + [ + 11, + " description = \"Allow all traffic\"\n" + ], + [ + 12, + " from_port = 0\n" + ], + [ + 13, + " to_port = 65535\n" + ], + [ + 14, + " protocol = \"-1\" # All protocols\n" + ], + [ + 15, + " cidr_blocks = [\"0.0.0.0/0\"] # From anywhere!\n" + ], + [ + 16, + " }\n" + ], + [ + 17, + "\n" + ], + [ + 18, + " egress {\n" + ], + [ + 19, + " from_port = 0\n" + ], + [ + 20, + " to_port = 0\n" + ], + [ + 21, + " protocol = \"-1\"\n" + ], + [ + 22, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 23, + " }\n" + ], + [ + 24, + "\n" + ], + [ + 25, + " tags = {\n" + ], + [ + 26, + " Name = \"Allow All Security Group\"\n" + ], + [ + 27, + " }\n" + ], + [ + 28, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 5, + 28 + ], + "resource": "aws_security_group.allow_all", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.SecurityGroupUnrestrictedIngress80", + "fixed_definition": null, + "entity_tags": { + "Name": "Allow All Security Group" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-groups-do-not-allow-ingress-from-00000-to-port-80", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV_AWS_277", + "bc_check_id": "BC_AWS_NETWORKING_78", + "check_name": "Ensure no security groups allow ingress from 0.0.0.0:0 to port -1", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "ingress/[0]/from_port", + "ingress/[0]/to_port", + "ingress/[0]/cidr_blocks", + "ingress/[0]/ipv6_cidr_blocks" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_security_group\" \"allow_all\" {\n" + ], + [ + 6, + " name = \"allow-all-traffic\"\n" + ], + [ + 7, + " description = \"Allow all inbound traffic from anywhere\"\n" + ], + [ + 8, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 9, + "\n" + ], + [ + 10, + " ingress {\n" + ], + [ + 11, + " description = \"Allow all traffic\"\n" + ], + [ + 12, + " from_port = 0\n" + ], + [ + 13, + " to_port = 65535\n" + ], + [ + 14, + " protocol = \"-1\" # All protocols\n" + ], + [ + 15, + " cidr_blocks = [\"0.0.0.0/0\"] # From anywhere!\n" + ], + [ + 16, + " }\n" + ], + [ + 17, + "\n" + ], + [ + 18, + " egress {\n" + ], + [ + 19, + " from_port = 0\n" + ], + [ + 20, + " to_port = 0\n" + ], + [ + 21, + " protocol = \"-1\"\n" + ], + [ + 22, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 23, + " }\n" + ], + [ + 24, + "\n" + ], + [ + 25, + " tags = {\n" + ], + [ + 26, + " Name = \"Allow All Security Group\"\n" + ], + [ + 27, + " }\n" + ], + [ + 28, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 5, + 28 + ], + "resource": "aws_security_group.allow_all", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.SecurityGroupUnrestrictedIngressAny", + "fixed_definition": null, + "entity_tags": { + "Name": "Allow All Security Group" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-group-does-not-allow-all-traffic-on-all-ports", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV_AWS_23", + "bc_check_id": "BC_AWS_NETWORKING_31", + "check_name": "Ensure every security group and rule has a description", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "description", + "egress/[0]" + ] + }, + "code_block": [ + [ + 31, + "resource \"aws_security_group\" \"ssh_open\" {\n" + ], + [ + 32, + " name = \"ssh-from-anywhere\"\n" + ], + [ + 33, + " description = \"SSH access from anywhere\"\n" + ], + [ + 34, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 35, + "\n" + ], + [ + 36, + " ingress {\n" + ], + [ + 37, + " description = \"SSH from anywhere\"\n" + ], + [ + 38, + " from_port = 22\n" + ], + [ + 39, + " to_port = 22\n" + ], + [ + 40, + " protocol = \"tcp\"\n" + ], + [ + 41, + " cidr_blocks = [\"0.0.0.0/0\"] # SSH from anywhere!\n" + ], + [ + 42, + " }\n" + ], + [ + 43, + "\n" + ], + [ + 44, + " ingress {\n" + ], + [ + 45, + " description = \"RDP from anywhere\"\n" + ], + [ + 46, + " from_port = 3389\n" + ], + [ + 47, + " to_port = 3389\n" + ], + [ + 48, + " protocol = \"tcp\"\n" + ], + [ + 49, + " cidr_blocks = [\"0.0.0.0/0\"] # RDP from anywhere!\n" + ], + [ + 50, + " }\n" + ], + [ + 51, + "\n" + ], + [ + 52, + " egress {\n" + ], + [ + 53, + " from_port = 0\n" + ], + [ + 54, + " to_port = 0\n" + ], + [ + 55, + " protocol = \"-1\"\n" + ], + [ + 56, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 57, + " }\n" + ], + [ + 58, + "\n" + ], + [ + 59, + " tags = {\n" + ], + [ + 60, + " Name = \"SSH Open Security Group\"\n" + ], + [ + 61, + " }\n" + ], + [ + 62, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 31, + 62 + ], + "resource": "aws_security_group.ssh_open", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.SecurityGroupRuleDescription", + "fixed_definition": null, + "entity_tags": { + "Name": "SSH Open Security Group" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV_AWS_382", + "bc_check_id": "BC_AWS_IAM_93", + "check_name": "Ensure no security groups allow egress from 0.0.0.0:0 to port -1", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "egress/[0]/from_port", + "egress/[0]/to_port", + "egress/[0]/cidr_blocks", + "egress/[0]/ipv6_cidr_blocks" + ] + }, + "code_block": [ + [ + 31, + "resource \"aws_security_group\" \"ssh_open\" {\n" + ], + [ + 32, + " name = \"ssh-from-anywhere\"\n" + ], + [ + 33, + " description = \"SSH access from anywhere\"\n" + ], + [ + 34, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 35, + "\n" + ], + [ + 36, + " ingress {\n" + ], + [ + 37, + " description = \"SSH from anywhere\"\n" + ], + [ + 38, + " from_port = 22\n" + ], + [ + 39, + " to_port = 22\n" + ], + [ + 40, + " protocol = \"tcp\"\n" + ], + [ + 41, + " cidr_blocks = [\"0.0.0.0/0\"] # SSH from anywhere!\n" + ], + [ + 42, + " }\n" + ], + [ + 43, + "\n" + ], + [ + 44, + " ingress {\n" + ], + [ + 45, + " description = \"RDP from anywhere\"\n" + ], + [ + 46, + " from_port = 3389\n" + ], + [ + 47, + " to_port = 3389\n" + ], + [ + 48, + " protocol = \"tcp\"\n" + ], + [ + 49, + " cidr_blocks = [\"0.0.0.0/0\"] # RDP from anywhere!\n" + ], + [ + 50, + " }\n" + ], + [ + 51, + "\n" + ], + [ + 52, + " egress {\n" + ], + [ + 53, + " from_port = 0\n" + ], + [ + 54, + " to_port = 0\n" + ], + [ + 55, + " protocol = \"-1\"\n" + ], + [ + 56, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 57, + " }\n" + ], + [ + 58, + "\n" + ], + [ + 59, + " tags = {\n" + ], + [ + 60, + " Name = \"SSH Open Security Group\"\n" + ], + [ + 61, + " }\n" + ], + [ + 62, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 31, + 62 + ], + "resource": "aws_security_group.ssh_open", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.SecurityGroupUnrestrictedEgressAny", + "fixed_definition": null, + "entity_tags": { + "Name": "SSH Open Security Group" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/bc-aws-382", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV_AWS_24", + "bc_check_id": "BC_AWS_NETWORKING_1", + "check_name": "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "ingress/[0]/from_port", + "ingress/[0]/to_port", + "ingress/[0]/cidr_blocks", + "ingress/[0]/ipv6_cidr_blocks" + ] + }, + "code_block": [ + [ + 31, + "resource \"aws_security_group\" \"ssh_open\" {\n" + ], + [ + 32, + " name = \"ssh-from-anywhere\"\n" + ], + [ + 33, + " description = \"SSH access from anywhere\"\n" + ], + [ + 34, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 35, + "\n" + ], + [ + 36, + " ingress {\n" + ], + [ + 37, + " description = \"SSH from anywhere\"\n" + ], + [ + 38, + " from_port = 22\n" + ], + [ + 39, + " to_port = 22\n" + ], + [ + 40, + " protocol = \"tcp\"\n" + ], + [ + 41, + " cidr_blocks = [\"0.0.0.0/0\"] # SSH from anywhere!\n" + ], + [ + 42, + " }\n" + ], + [ + 43, + "\n" + ], + [ + 44, + " ingress {\n" + ], + [ + 45, + " description = \"RDP from anywhere\"\n" + ], + [ + 46, + " from_port = 3389\n" + ], + [ + 47, + " to_port = 3389\n" + ], + [ + 48, + " protocol = \"tcp\"\n" + ], + [ + 49, + " cidr_blocks = [\"0.0.0.0/0\"] # RDP from anywhere!\n" + ], + [ + 50, + " }\n" + ], + [ + 51, + "\n" + ], + [ + 52, + " egress {\n" + ], + [ + 53, + " from_port = 0\n" + ], + [ + 54, + " to_port = 0\n" + ], + [ + 55, + " protocol = \"-1\"\n" + ], + [ + 56, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 57, + " }\n" + ], + [ + 58, + "\n" + ], + [ + 59, + " tags = {\n" + ], + [ + 60, + " Name = \"SSH Open Security Group\"\n" + ], + [ + 61, + " }\n" + ], + [ + 62, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 31, + 62 + ], + "resource": "aws_security_group.ssh_open", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.SecurityGroupUnrestrictedIngress22", + "fixed_definition": null, + "entity_tags": { + "Name": "SSH Open Security Group" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-1-port-security", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV_AWS_25", + "bc_check_id": "BC_AWS_NETWORKING_2", + "check_name": "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "ingress/[1]/from_port", + "ingress/[1]/to_port", + "ingress/[1]/cidr_blocks", + "ingress/[1]/ipv6_cidr_blocks" + ] + }, + "code_block": [ + [ + 31, + "resource \"aws_security_group\" \"ssh_open\" {\n" + ], + [ + 32, + " name = \"ssh-from-anywhere\"\n" + ], + [ + 33, + " description = \"SSH access from anywhere\"\n" + ], + [ + 34, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 35, + "\n" + ], + [ + 36, + " ingress {\n" + ], + [ + 37, + " description = \"SSH from anywhere\"\n" + ], + [ + 38, + " from_port = 22\n" + ], + [ + 39, + " to_port = 22\n" + ], + [ + 40, + " protocol = \"tcp\"\n" + ], + [ + 41, + " cidr_blocks = [\"0.0.0.0/0\"] # SSH from anywhere!\n" + ], + [ + 42, + " }\n" + ], + [ + 43, + "\n" + ], + [ + 44, + " ingress {\n" + ], + [ + 45, + " description = \"RDP from anywhere\"\n" + ], + [ + 46, + " from_port = 3389\n" + ], + [ + 47, + " to_port = 3389\n" + ], + [ + 48, + " protocol = \"tcp\"\n" + ], + [ + 49, + " cidr_blocks = [\"0.0.0.0/0\"] # RDP from anywhere!\n" + ], + [ + 50, + " }\n" + ], + [ + 51, + "\n" + ], + [ + 52, + " egress {\n" + ], + [ + 53, + " from_port = 0\n" + ], + [ + 54, + " to_port = 0\n" + ], + [ + 55, + " protocol = \"-1\"\n" + ], + [ + 56, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 57, + " }\n" + ], + [ + 58, + "\n" + ], + [ + 59, + " tags = {\n" + ], + [ + 60, + " Name = \"SSH Open Security Group\"\n" + ], + [ + 61, + " }\n" + ], + [ + 62, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 31, + 62 + ], + "resource": "aws_security_group.ssh_open", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.SecurityGroupUnrestrictedIngress3389", + "fixed_definition": null, + "entity_tags": { + "Name": "SSH Open Security Group" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV_AWS_23", + "bc_check_id": "BC_AWS_NETWORKING_31", + "check_name": "Ensure every security group and rule has a description", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "description", + "egress/[0]" + ] + }, + "code_block": [ + [ + 65, + "resource \"aws_security_group\" \"database_exposed\" {\n" + ], + [ + 66, + " name = \"database-public\"\n" + ], + [ + 67, + " description = \"Database accessible from internet\"\n" + ], + [ + 68, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 69, + "\n" + ], + [ + 70, + " ingress {\n" + ], + [ + 71, + " description = \"MySQL from anywhere\"\n" + ], + [ + 72, + " from_port = 3306\n" + ], + [ + 73, + " to_port = 3306\n" + ], + [ + 74, + " protocol = \"tcp\"\n" + ], + [ + 75, + " cidr_blocks = [\"0.0.0.0/0\"] # Database exposed!\n" + ], + [ + 76, + " }\n" + ], + [ + 77, + "\n" + ], + [ + 78, + " ingress {\n" + ], + [ + 79, + " description = \"PostgreSQL from anywhere\"\n" + ], + [ + 80, + " from_port = 5432\n" + ], + [ + 81, + " to_port = 5432\n" + ], + [ + 82, + " protocol = \"tcp\"\n" + ], + [ + 83, + " cidr_blocks = [\"0.0.0.0/0\"] # Database exposed!\n" + ], + [ + 84, + " }\n" + ], + [ + 85, + "\n" + ], + [ + 86, + " egress {\n" + ], + [ + 87, + " from_port = 0\n" + ], + [ + 88, + " to_port = 0\n" + ], + [ + 89, + " protocol = \"-1\"\n" + ], + [ + 90, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 91, + " }\n" + ], + [ + 92, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 65, + 92 + ], + "resource": "aws_security_group.database_exposed", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.SecurityGroupRuleDescription", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV_AWS_382", + "bc_check_id": "BC_AWS_IAM_93", + "check_name": "Ensure no security groups allow egress from 0.0.0.0:0 to port -1", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "egress/[0]/from_port", + "egress/[0]/to_port", + "egress/[0]/cidr_blocks", + "egress/[0]/ipv6_cidr_blocks" + ] + }, + "code_block": [ + [ + 65, + "resource \"aws_security_group\" \"database_exposed\" {\n" + ], + [ + 66, + " name = \"database-public\"\n" + ], + [ + 67, + " description = \"Database accessible from internet\"\n" + ], + [ + 68, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 69, + "\n" + ], + [ + 70, + " ingress {\n" + ], + [ + 71, + " description = \"MySQL from anywhere\"\n" + ], + [ + 72, + " from_port = 3306\n" + ], + [ + 73, + " to_port = 3306\n" + ], + [ + 74, + " protocol = \"tcp\"\n" + ], + [ + 75, + " cidr_blocks = [\"0.0.0.0/0\"] # Database exposed!\n" + ], + [ + 76, + " }\n" + ], + [ + 77, + "\n" + ], + [ + 78, + " ingress {\n" + ], + [ + 79, + " description = \"PostgreSQL from anywhere\"\n" + ], + [ + 80, + " from_port = 5432\n" + ], + [ + 81, + " to_port = 5432\n" + ], + [ + 82, + " protocol = \"tcp\"\n" + ], + [ + 83, + " cidr_blocks = [\"0.0.0.0/0\"] # Database exposed!\n" + ], + [ + 84, + " }\n" + ], + [ + 85, + "\n" + ], + [ + 86, + " egress {\n" + ], + [ + 87, + " from_port = 0\n" + ], + [ + 88, + " to_port = 0\n" + ], + [ + 89, + " protocol = \"-1\"\n" + ], + [ + 90, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 91, + " }\n" + ], + [ + 92, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 65, + 92 + ], + "resource": "aws_security_group.database_exposed", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.SecurityGroupUnrestrictedEgressAny", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/bc-aws-382", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV2_AWS_30", + "bc_check_id": "BC_AWS_LOGGING_32", + "check_name": "Ensure Postgres RDS as aws_db_instance has Query Logging enabled", + "check_result": { + "result": "FAILED", + "entity": { + "aws_db_instance": { + "unencrypted_db": { + "__end_line__": 37, + "__start_line__": 5, + "allocated_storage": [ + 20 + ], + "backup_retention_period": [ + 0 + ], + "deletion_protection": [ + false + ], + "enabled_cloudwatch_logs_exports": [ + [] + ], + "engine": [ + "postgres" + ], + "engine_version": [ + "13.7" + ], + "identifier": [ + "mydb-unencrypted" + ], + "instance_class": [ + "db.t3.micro" + ], + "password": [ + "SuperSecretPassword123!" + ], + "publicly_accessible": [ + true + ], + "skip_final_snapshot": [ + true + ], + "storage_encrypted": [ + false + ], + "tags": [ + { + "Name": "Unencrypted Database" + } + ], + "username": [ + "admin" + ], + "vpc_security_group_ids": [ + [ + "aws_security_group.database_exposed.id" + ] + ], + "__address__": "aws_db_instance.unencrypted_db" + } + } + }, + "evaluated_keys": [ + "resource_type", + "engine", + "parameter/*/name" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_db_instance\" \"unencrypted_db\" {\n" + ], + [ + 6, + " identifier = \"mydb-unencrypted\"\n" + ], + [ + 7, + " engine = \"postgres\"\n" + ], + [ + 8, + " engine_version = \"13.7\"\n" + ], + [ + 9, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 10, + " allocated_storage = 20\n" + ], + [ + 11, + " \n" + ], + [ + 12, + " username = \"admin\"\n" + ], + [ + 13, + " password = \"SuperSecretPassword123!\" # SECURITY ISSUE #9 - Hardcoded password!\n" + ], + [ + 14, + " \n" + ], + [ + 15, + " storage_encrypted = false # No encryption!\n" + ], + [ + 16, + " \n" + ], + [ + 17, + " publicly_accessible = true # SECURITY ISSUE #10 - Public access!\n" + ], + [ + 18, + " \n" + ], + [ + 19, + " skip_final_snapshot = true\n" + ], + [ + 20, + " \n" + ], + [ + 21, + " # No backup configuration\n" + ], + [ + 22, + " backup_retention_period = 0 # SECURITY ISSUE #11 - No backups!\n" + ], + [ + 23, + " \n" + ], + [ + 24, + " # Missing monitoring\n" + ], + [ + 25, + " enabled_cloudwatch_logs_exports = []\n" + ], + [ + 26, + " \n" + ], + [ + 27, + " # No deletion protection\n" + ], + [ + 28, + " deletion_protection = false # SECURITY ISSUE #12\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " # Using default security group\n" + ], + [ + 31, + " vpc_security_group_ids = [aws_security_group.database_exposed.id]\n" + ], + [ + 32, + " \n" + ], + [ + 33, + " tags = {\n" + ], + [ + 34, + " Name = \"Unencrypted Database\"\n" + ], + [ + 35, + " # Missing required tags\n" + ], + [ + 36, + " }\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 5, + 37 + ], + "resource": "aws_db_instance.unencrypted_db", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-postgres-rds-has-query-logging-enabled", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV2_AWS_60", + "bc_check_id": "BC_AWS_GENERAL_195", + "check_name": "Ensure RDS instance with copy tags to snapshots is enabled", + "check_result": { + "result": "FAILED", + "entity": { + "aws_db_instance": { + "unencrypted_db": { + "__end_line__": 37, + "__start_line__": 5, + "allocated_storage": [ + 20 + ], + "backup_retention_period": [ + 0 + ], + "deletion_protection": [ + false + ], + "enabled_cloudwatch_logs_exports": [ + [] + ], + "engine": [ + "postgres" + ], + "engine_version": [ + "13.7" + ], + "identifier": [ + "mydb-unencrypted" + ], + "instance_class": [ + "db.t3.micro" + ], + "password": [ + "SuperSecretPassword123!" + ], + "publicly_accessible": [ + true + ], + "skip_final_snapshot": [ + true + ], + "storage_encrypted": [ + false + ], + "tags": [ + { + "Name": "Unencrypted Database" + } + ], + "username": [ + "admin" + ], + "vpc_security_group_ids": [ + [ + "aws_security_group.database_exposed.id" + ] + ], + "__address__": "aws_db_instance.unencrypted_db" + } + } + }, + "evaluated_keys": [ + "copy_tags_to_snapshot", + "engine" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_db_instance\" \"unencrypted_db\" {\n" + ], + [ + 6, + " identifier = \"mydb-unencrypted\"\n" + ], + [ + 7, + " engine = \"postgres\"\n" + ], + [ + 8, + " engine_version = \"13.7\"\n" + ], + [ + 9, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 10, + " allocated_storage = 20\n" + ], + [ + 11, + " \n" + ], + [ + 12, + " username = \"admin\"\n" + ], + [ + 13, + " password = \"SuperSecretPassword123!\" # SECURITY ISSUE #9 - Hardcoded password!\n" + ], + [ + 14, + " \n" + ], + [ + 15, + " storage_encrypted = false # No encryption!\n" + ], + [ + 16, + " \n" + ], + [ + 17, + " publicly_accessible = true # SECURITY ISSUE #10 - Public access!\n" + ], + [ + 18, + " \n" + ], + [ + 19, + " skip_final_snapshot = true\n" + ], + [ + 20, + " \n" + ], + [ + 21, + " # No backup configuration\n" + ], + [ + 22, + " backup_retention_period = 0 # SECURITY ISSUE #11 - No backups!\n" + ], + [ + 23, + " \n" + ], + [ + 24, + " # Missing monitoring\n" + ], + [ + 25, + " enabled_cloudwatch_logs_exports = []\n" + ], + [ + 26, + " \n" + ], + [ + 27, + " # No deletion protection\n" + ], + [ + 28, + " deletion_protection = false # SECURITY ISSUE #12\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " # Using default security group\n" + ], + [ + 31, + " vpc_security_group_ids = [aws_security_group.database_exposed.id]\n" + ], + [ + 32, + " \n" + ], + [ + 33, + " tags = {\n" + ], + [ + 34, + " Name = \"Unencrypted Database\"\n" + ], + [ + 35, + " # Missing required tags\n" + ], + [ + 36, + " }\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 5, + 37 + ], + "resource": "aws_db_instance.unencrypted_db", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV2_AWS_60", + "bc_check_id": "BC_AWS_GENERAL_195", + "check_name": "Ensure RDS instance with copy tags to snapshots is enabled", + "check_result": { + "result": "FAILED", + "entity": { + "aws_db_instance": { + "weak_db": { + "__end_line__": 69, + "__start_line__": 40, + "allocated_storage": [ + 20 + ], + "auto_minor_version_upgrade": [ + false + ], + "engine": [ + "mysql" + ], + "engine_version": [ + "5.7.38" + ], + "identifier": [ + "mydb-weak" + ], + "instance_class": [ + "db.t3.micro" + ], + "kms_key_id": [ + "" + ], + "multi_az": [ + false + ], + "password": [ + "password123" + ], + "performance_insights_enabled": [ + false + ], + "publicly_accessible": [ + false + ], + "skip_final_snapshot": [ + true + ], + "storage_encrypted": [ + true + ], + "tags": [ + { + "Name": "Weak Database" + } + ], + "username": [ + "root" + ], + "__address__": "aws_db_instance.weak_db" + } + } + }, + "evaluated_keys": [ + "copy_tags_to_snapshot", + "engine" + ] + }, + "code_block": [ + [ + 40, + "resource \"aws_db_instance\" \"weak_db\" {\n" + ], + [ + 41, + " identifier = \"mydb-weak\"\n" + ], + [ + 42, + " engine = \"mysql\"\n" + ], + [ + 43, + " engine_version = \"5.7.38\" # Old version with known vulnerabilities\n" + ], + [ + 44, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 45, + " allocated_storage = 20\n" + ], + [ + 46, + " \n" + ], + [ + 47, + " username = \"root\" # Using default admin username\n" + ], + [ + 48, + " password = \"password123\" # Weak password!\n" + ], + [ + 49, + " \n" + ], + [ + 50, + " storage_encrypted = true\n" + ], + [ + 51, + " kms_key_id = \"\" # Empty KMS key - using default key\n" + ], + [ + 52, + " \n" + ], + [ + 53, + " publicly_accessible = false\n" + ], + [ + 54, + " \n" + ], + [ + 55, + " # Multi-AZ disabled\n" + ], + [ + 56, + " multi_az = false # SECURITY ISSUE #14 - No high availability\n" + ], + [ + 57, + " \n" + ], + [ + 58, + " # Auto minor version upgrade disabled\n" + ], + [ + 59, + " auto_minor_version_upgrade = false # SECURITY ISSUE #15\n" + ], + [ + 60, + " \n" + ], + [ + 61, + " # No performance insights\n" + ], + [ + 62, + " performance_insights_enabled = false\n" + ], + [ + 63, + " \n" + ], + [ + 64, + " skip_final_snapshot = true\n" + ], + [ + 65, + " \n" + ], + [ + 66, + " tags = {\n" + ], + [ + 67, + " Name = \"Weak Database\"\n" + ], + [ + 68, + " }\n" + ], + [ + 69, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 40, + 69 + ], + "resource": "aws_db_instance.weak_db", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": { + "Name": "Weak Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV2_AWS_62", + "bc_check_id": "BC_AWS_LOGGING_36", + "check_name": "Ensure S3 buckets should have event notifications enabled", + "check_result": { + "result": "FAILED", + "entity": { + "aws_s3_bucket": { + "public_data": { + "__end_line__": 21, + "__start_line__": 13, + "acl": [ + "public-read" + ], + "bucket": [ + "my-public-bucket-lab6" + ], + "tags": [ + { + "Name": "Public Data Bucket" + } + ], + "__address__": "aws_s3_bucket.public_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "resource_type" + ] + }, + "code_block": [ + [ + 13, + "resource \"aws_s3_bucket\" \"public_data\" {\n" + ], + [ + 14, + " bucket = \"my-public-bucket-lab6\"\n" + ], + [ + 15, + " acl = \"public-read\" # Public access enabled!\n" + ], + [ + 16, + "\n" + ], + [ + 17, + " tags = {\n" + ], + [ + 18, + " Name = \"Public Data Bucket\"\n" + ], + [ + 19, + " # Missing required tags: Environment, Owner, CostCenter\n" + ], + [ + 20, + " }\n" + ], + [ + 21, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 13, + 21 + ], + "resource": "aws_s3_bucket.public_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": { + "Name": "Public Data Bucket" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-62", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV2_AWS_62", + "bc_check_id": "BC_AWS_LOGGING_36", + "check_name": "Ensure S3 buckets should have event notifications enabled", + "check_result": { + "result": "FAILED", + "entity": { + "aws_s3_bucket": { + "unencrypted_data": { + "__end_line__": 33, + "__start_line__": 24, + "acl": [ + "private" + ], + "bucket": [ + "my-unencrypted-bucket-lab6" + ], + "versioning": [ + { + "enabled": [ + false + ] + } + ], + "__address__": "aws_s3_bucket.unencrypted_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "resource_type" + ] + }, + "code_block": [ + [ + 24, + "resource \"aws_s3_bucket\" \"unencrypted_data\" {\n" + ], + [ + 25, + " bucket = \"my-unencrypted-bucket-lab6\"\n" + ], + [ + 26, + " acl = \"private\"\n" + ], + [ + 27, + " \n" + ], + [ + 28, + " # No server_side_encryption_configuration!\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " versioning {\n" + ], + [ + 31, + " enabled = false # Versioning disabled\n" + ], + [ + 32, + " }\n" + ], + [ + 33, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 24, + 33 + ], + "resource": "aws_s3_bucket.unencrypted_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-62", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV_AWS_18", + "bc_check_id": "BC_AWS_S3_13", + "check_name": "Ensure the S3 bucket has access logging enabled", + "check_result": { + "result": "FAILED", + "entity": { + "aws_s3_bucket": { + "public_data": { + "__end_line__": 21, + "__start_line__": 13, + "acl": [ + "public-read" + ], + "bucket": [ + "my-public-bucket-lab6" + ], + "tags": [ + { + "Name": "Public Data Bucket" + } + ], + "__address__": "aws_s3_bucket.public_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "resource_type", + "logging" + ] + }, + "code_block": [ + [ + 13, + "resource \"aws_s3_bucket\" \"public_data\" {\n" + ], + [ + 14, + " bucket = \"my-public-bucket-lab6\"\n" + ], + [ + 15, + " acl = \"public-read\" # Public access enabled!\n" + ], + [ + 16, + "\n" + ], + [ + 17, + " tags = {\n" + ], + [ + 18, + " Name = \"Public Data Bucket\"\n" + ], + [ + 19, + " # Missing required tags: Environment, Owner, CostCenter\n" + ], + [ + 20, + " }\n" + ], + [ + 21, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 13, + 21 + ], + "resource": "aws_s3_bucket.public_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": { + "Name": "Public Data Bucket" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-13-enable-logging", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV_AWS_18", + "bc_check_id": "BC_AWS_S3_13", + "check_name": "Ensure the S3 bucket has access logging enabled", + "check_result": { + "result": "FAILED", + "entity": { + "aws_s3_bucket": { + "unencrypted_data": { + "__end_line__": 33, + "__start_line__": 24, + "acl": [ + "private" + ], + "bucket": [ + "my-unencrypted-bucket-lab6" + ], + "versioning": [ + { + "enabled": [ + false + ] + } + ], + "__address__": "aws_s3_bucket.unencrypted_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "resource_type", + "logging" + ] + }, + "code_block": [ + [ + 24, + "resource \"aws_s3_bucket\" \"unencrypted_data\" {\n" + ], + [ + 25, + " bucket = \"my-unencrypted-bucket-lab6\"\n" + ], + [ + 26, + " acl = \"private\"\n" + ], + [ + 27, + " \n" + ], + [ + 28, + " # No server_side_encryption_configuration!\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " versioning {\n" + ], + [ + 31, + " enabled = false # Versioning disabled\n" + ], + [ + 32, + " }\n" + ], + [ + 33, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 24, + 33 + ], + "resource": "aws_s3_bucket.unencrypted_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-13-enable-logging", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV2_AWS_61", + "bc_check_id": "BC_AWS_LOGGING_35", + "check_name": "Ensure that an S3 bucket has a lifecycle configuration", + "check_result": { + "result": "FAILED", + "entity": { + "aws_s3_bucket": { + "public_data": { + "__end_line__": 21, + "__start_line__": 13, + "acl": [ + "public-read" + ], + "bucket": [ + "my-public-bucket-lab6" + ], + "tags": [ + { + "Name": "Public Data Bucket" + } + ], + "__address__": "aws_s3_bucket.public_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "resource_type", + "lifecycle_rule" + ] + }, + "code_block": [ + [ + 13, + "resource \"aws_s3_bucket\" \"public_data\" {\n" + ], + [ + 14, + " bucket = \"my-public-bucket-lab6\"\n" + ], + [ + 15, + " acl = \"public-read\" # Public access enabled!\n" + ], + [ + 16, + "\n" + ], + [ + 17, + " tags = {\n" + ], + [ + 18, + " Name = \"Public Data Bucket\"\n" + ], + [ + 19, + " # Missing required tags: Environment, Owner, CostCenter\n" + ], + [ + 20, + " }\n" + ], + [ + 21, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 13, + 21 + ], + "resource": "aws_s3_bucket.public_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": { + "Name": "Public Data Bucket" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-61", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV2_AWS_61", + "bc_check_id": "BC_AWS_LOGGING_35", + "check_name": "Ensure that an S3 bucket has a lifecycle configuration", + "check_result": { + "result": "FAILED", + "entity": { + "aws_s3_bucket": { + "unencrypted_data": { + "__end_line__": 33, + "__start_line__": 24, + "acl": [ + "private" + ], + "bucket": [ + "my-unencrypted-bucket-lab6" + ], + "versioning": [ + { + "enabled": [ + false + ] + } + ], + "__address__": "aws_s3_bucket.unencrypted_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "resource_type", + "lifecycle_rule" + ] + }, + "code_block": [ + [ + 24, + "resource \"aws_s3_bucket\" \"unencrypted_data\" {\n" + ], + [ + 25, + " bucket = \"my-unencrypted-bucket-lab6\"\n" + ], + [ + 26, + " acl = \"private\"\n" + ], + [ + 27, + " \n" + ], + [ + 28, + " # No server_side_encryption_configuration!\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " versioning {\n" + ], + [ + 31, + " enabled = false # Versioning disabled\n" + ], + [ + 32, + " }\n" + ], + [ + 33, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 24, + 33 + ], + "resource": "aws_s3_bucket.unencrypted_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-61", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV_AWS_144", + "bc_check_id": "BC_AWS_GENERAL_72", + "check_name": "Ensure that S3 bucket has cross-region replication enabled", + "check_result": { + "result": "FAILED", + "entity": { + "aws_s3_bucket": { + "public_data": { + "__end_line__": 21, + "__start_line__": 13, + "acl": [ + "public-read" + ], + "bucket": [ + "my-public-bucket-lab6" + ], + "tags": [ + { + "Name": "Public Data Bucket" + } + ], + "__address__": "aws_s3_bucket.public_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "resource_type", + "rule/*/status", + "replication_configuration/rules/*/status" + ] + }, + "code_block": [ + [ + 13, + "resource \"aws_s3_bucket\" \"public_data\" {\n" + ], + [ + 14, + " bucket = \"my-public-bucket-lab6\"\n" + ], + [ + 15, + " acl = \"public-read\" # Public access enabled!\n" + ], + [ + 16, + "\n" + ], + [ + 17, + " tags = {\n" + ], + [ + 18, + " Name = \"Public Data Bucket\"\n" + ], + [ + 19, + " # Missing required tags: Environment, Owner, CostCenter\n" + ], + [ + 20, + " }\n" + ], + [ + 21, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 13, + 21 + ], + "resource": "aws_s3_bucket.public_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": { + "Name": "Public Data Bucket" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-bucket-has-cross-region-replication-enabled", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV_AWS_144", + "bc_check_id": "BC_AWS_GENERAL_72", + "check_name": "Ensure that S3 bucket has cross-region replication enabled", + "check_result": { + "result": "FAILED", + "entity": { + "aws_s3_bucket": { + "unencrypted_data": { + "__end_line__": 33, + "__start_line__": 24, + "acl": [ + "private" + ], + "bucket": [ + "my-unencrypted-bucket-lab6" + ], + "versioning": [ + { + "enabled": [ + false + ] + } + ], + "__address__": "aws_s3_bucket.unencrypted_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "resource_type", + "rule/*/status", + "replication_configuration/rules/*/status" + ] + }, + "code_block": [ + [ + 24, + "resource \"aws_s3_bucket\" \"unencrypted_data\" {\n" + ], + [ + 25, + " bucket = \"my-unencrypted-bucket-lab6\"\n" + ], + [ + 26, + " acl = \"private\"\n" + ], + [ + 27, + " \n" + ], + [ + 28, + " # No server_side_encryption_configuration!\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " versioning {\n" + ], + [ + 31, + " enabled = false # Versioning disabled\n" + ], + [ + 32, + " }\n" + ], + [ + 33, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 24, + 33 + ], + "resource": "aws_s3_bucket.unencrypted_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-bucket-has-cross-region-replication-enabled", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV_AWS_20", + "bc_check_id": "BC_AWS_S3_1", + "check_name": "S3 Bucket has an ACL defined which allows public READ access.", + "check_result": { + "result": "FAILED", + "entity": { + "aws_s3_bucket": { + "public_data": { + "__end_line__": 21, + "__start_line__": 13, + "acl": [ + "public-read" + ], + "bucket": [ + "my-public-bucket-lab6" + ], + "tags": [ + { + "Name": "Public Data Bucket" + } + ], + "__address__": "aws_s3_bucket.public_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "acl", + "resource_type", + "access_control_policy/grant", + "access_control_policy/grant/*/grantee/uri", + "access_control_policy" + ] + }, + "code_block": [ + [ + 13, + "resource \"aws_s3_bucket\" \"public_data\" {\n" + ], + [ + 14, + " bucket = \"my-public-bucket-lab6\"\n" + ], + [ + 15, + " acl = \"public-read\" # Public access enabled!\n" + ], + [ + 16, + "\n" + ], + [ + 17, + " tags = {\n" + ], + [ + 18, + " Name = \"Public Data Bucket\"\n" + ], + [ + 19, + " # Missing required tags: Environment, Owner, CostCenter\n" + ], + [ + 20, + " }\n" + ], + [ + 21, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 13, + 21 + ], + "resource": "aws_s3_bucket.public_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": { + "Name": "Public Data Bucket" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-1-acl-read-permissions-everyone", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV2_AWS_6", + "bc_check_id": "BC_AWS_NETWORKING_52", + "check_name": "Ensure that S3 bucket has a Public Access block", + "check_result": { + "result": "FAILED", + "entity": { + "aws_s3_bucket": { + "public_data": { + "__end_line__": 21, + "__start_line__": 13, + "acl": [ + "public-read" + ], + "bucket": [ + "my-public-bucket-lab6" + ], + "tags": [ + { + "Name": "Public Data Bucket" + } + ], + "__address__": "aws_s3_bucket.public_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "resource_type", + "block_public_acls", + "block_public_policy" + ] + }, + "code_block": [ + [ + 13, + "resource \"aws_s3_bucket\" \"public_data\" {\n" + ], + [ + 14, + " bucket = \"my-public-bucket-lab6\"\n" + ], + [ + 15, + " acl = \"public-read\" # Public access enabled!\n" + ], + [ + 16, + "\n" + ], + [ + 17, + " tags = {\n" + ], + [ + 18, + " Name = \"Public Data Bucket\"\n" + ], + [ + 19, + " # Missing required tags: Environment, Owner, CostCenter\n" + ], + [ + 20, + " }\n" + ], + [ + 21, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 13, + 21 + ], + "resource": "aws_s3_bucket.public_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": { + "Name": "Public Data Bucket" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": { + "code_block": [ + [ + 36, + "resource \"aws_s3_bucket_public_access_block\" \"bad_config\" {\n" + ], + [ + 37, + " bucket = aws_s3_bucket.public_data.id\n" + ], + [ + 38, + "\n" + ], + [ + 39, + " block_public_acls = false # Should be true\n" + ], + [ + 40, + " block_public_policy = false # Should be true\n" + ], + [ + 41, + " ignore_public_acls = false # Should be true\n" + ], + [ + 42, + " restrict_public_buckets = false # Should be true\n" + ], + [ + 43, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_line_range": [ + 36, + 43 + ], + "resource": "aws_s3_bucket_public_access_block.bad_config", + "entity_tags": {}, + "evaluations": null, + "file_abs_path": "/tf/main.tf", + "resource_address": null + }, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/s3-bucket-should-have-public-access-blocks-defaults-to-false-if-the-public-access-block-is-not-attached", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV2_AWS_6", + "bc_check_id": "BC_AWS_NETWORKING_52", + "check_name": "Ensure that S3 bucket has a Public Access block", + "check_result": { + "result": "FAILED", + "entity": { + "aws_s3_bucket": { + "unencrypted_data": { + "__end_line__": 33, + "__start_line__": 24, + "acl": [ + "private" + ], + "bucket": [ + "my-unencrypted-bucket-lab6" + ], + "versioning": [ + { + "enabled": [ + false + ] + } + ], + "__address__": "aws_s3_bucket.unencrypted_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "resource_type", + "block_public_acls", + "block_public_policy" + ] + }, + "code_block": [ + [ + 24, + "resource \"aws_s3_bucket\" \"unencrypted_data\" {\n" + ], + [ + 25, + " bucket = \"my-unencrypted-bucket-lab6\"\n" + ], + [ + 26, + " acl = \"private\"\n" + ], + [ + 27, + " \n" + ], + [ + 28, + " # No server_side_encryption_configuration!\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " versioning {\n" + ], + [ + 31, + " enabled = false # Versioning disabled\n" + ], + [ + 32, + " }\n" + ], + [ + 33, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 24, + 33 + ], + "resource": "aws_s3_bucket.unencrypted_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/s3-bucket-should-have-public-access-blocks-defaults-to-false-if-the-public-access-block-is-not-attached", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV2_AWS_40", + "bc_check_id": "BC_AWS_IAM_73", + "check_name": "Ensure AWS IAM policy does not allow full IAM privileges", + "check_result": { + "result": "FAILED", + "entity": { + "aws_iam_policy": { + "admin_policy": { + "__end_line__": 19, + "__start_line__": 5, + "description": [ + "Policy with wildcard permissions" + ], + "name": [ + "overly-permissive-policy" + ], + "policy": [ + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": "*", + "Resource": "*" + } + ] + } + ], + "__address__": "aws_iam_policy.admin_policy" + } + } + }, + "evaluated_keys": [ + "policy/Statement[?(@/Effect == Allow)]/Action[*]", + "statement[?(@/effect == Allow)]/actions[*]", + "inline_policy/Statement[?(@/Effect == Allow)]/Action[*]" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_iam_policy\" \"admin_policy\" {\n" + ], + [ + 6, + " name = \"overly-permissive-policy\"\n" + ], + [ + 7, + " description = \"Policy with wildcard permissions\"\n" + ], + [ + 8, + "\n" + ], + [ + 9, + " policy = jsonencode({\n" + ], + [ + 10, + " Version = \"2012-10-17\"\n" + ], + [ + 11, + " Statement = [\n" + ], + [ + 12, + " {\n" + ], + [ + 13, + " Effect = \"Allow\"\n" + ], + [ + 14, + " Action = \"*\" # All actions allowed!\n" + ], + [ + 15, + " Resource = \"*\" # On all resources!\n" + ], + [ + 16, + " }\n" + ], + [ + 17, + " ]\n" + ], + [ + 18, + " })\n" + ], + [ + 19, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 5, + 19 + ], + "resource": "aws_iam_policy.admin_policy", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-2-40", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_21", + "bc_check_id": "BC_AWS_S3_16", + "check_name": "Ensure all data stored in the S3 bucket have versioning enabled", + "check_result": { + "result": "FAILED", + "entity": { + "aws_s3_bucket": { + "public_data": { + "__end_line__": 21, + "__start_line__": 13, + "acl": [ + "public-read" + ], + "bucket": [ + "my-public-bucket-lab6" + ], + "tags": [ + { + "Name": "Public Data Bucket" + } + ], + "__address__": "aws_s3_bucket.public_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "resource_type", + "versioning_configuration/status", + "versioning/enabled" + ] + }, + "code_block": [ + [ + 13, + "resource \"aws_s3_bucket\" \"public_data\" {\n" + ], + [ + 14, + " bucket = \"my-public-bucket-lab6\"\n" + ], + [ + 15, + " acl = \"public-read\" # Public access enabled!\n" + ], + [ + 16, + "\n" + ], + [ + 17, + " tags = {\n" + ], + [ + 18, + " Name = \"Public Data Bucket\"\n" + ], + [ + 19, + " # Missing required tags: Environment, Owner, CostCenter\n" + ], + [ + 20, + " }\n" + ], + [ + 21, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 13, + 21 + ], + "resource": "aws_s3_bucket.public_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": { + "Name": "Public Data Bucket" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-16-enable-versioning", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV_AWS_21", + "bc_check_id": "BC_AWS_S3_16", + "check_name": "Ensure all data stored in the S3 bucket have versioning enabled", + "check_result": { + "result": "FAILED", + "entity": { + "aws_s3_bucket": { + "unencrypted_data": { + "__end_line__": 33, + "__start_line__": 24, + "acl": [ + "private" + ], + "bucket": [ + "my-unencrypted-bucket-lab6" + ], + "versioning": [ + { + "enabled": [ + false + ] + } + ], + "__address__": "aws_s3_bucket.unencrypted_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "resource_type", + "versioning_configuration/status", + "versioning/enabled" + ] + }, + "code_block": [ + [ + 24, + "resource \"aws_s3_bucket\" \"unencrypted_data\" {\n" + ], + [ + 25, + " bucket = \"my-unencrypted-bucket-lab6\"\n" + ], + [ + 26, + " acl = \"private\"\n" + ], + [ + 27, + " \n" + ], + [ + 28, + " # No server_side_encryption_configuration!\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " versioning {\n" + ], + [ + 31, + " enabled = false # Versioning disabled\n" + ], + [ + 32, + " }\n" + ], + [ + 33, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 24, + 33 + ], + "resource": "aws_s3_bucket.unencrypted_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-16-enable-versioning", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV2_AWS_5", + "bc_check_id": "BC_AWS_NETWORKING_51", + "check_name": "Ensure that Security Groups are attached to another resource", + "check_result": { + "result": "FAILED", + "entity": { + "aws_security_group": { + "allow_all": { + "__end_line__": 28, + "__start_line__": 5, + "description": [ + "Allow all inbound traffic from anywhere" + ], + "egress": [ + { + "cidr_blocks": [ + [ + "0.0.0.0/0" + ] + ], + "from_port": [ + 0 + ], + "protocol": [ + "-1" + ], + "to_port": [ + 0 + ] + } + ], + "ingress": [ + { + "cidr_blocks": [ + [ + "0.0.0.0/0" + ] + ], + "description": [ + "Allow all traffic" + ], + "from_port": [ + 0 + ], + "protocol": [ + "-1" + ], + "to_port": [ + 65535 + ] + } + ], + "name": [ + "allow-all-traffic" + ], + "tags": [ + { + "Name": "Allow All Security Group" + } + ], + "vpc_id": [ + "vpc-12345678" + ], + "__address__": "aws_security_group.allow_all" + } + } + }, + "evaluated_keys": [ + "resource_type", + "networking" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_security_group\" \"allow_all\" {\n" + ], + [ + 6, + " name = \"allow-all-traffic\"\n" + ], + [ + 7, + " description = \"Allow all inbound traffic from anywhere\"\n" + ], + [ + 8, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 9, + "\n" + ], + [ + 10, + " ingress {\n" + ], + [ + 11, + " description = \"Allow all traffic\"\n" + ], + [ + 12, + " from_port = 0\n" + ], + [ + 13, + " to_port = 65535\n" + ], + [ + 14, + " protocol = \"-1\" # All protocols\n" + ], + [ + 15, + " cidr_blocks = [\"0.0.0.0/0\"] # From anywhere!\n" + ], + [ + 16, + " }\n" + ], + [ + 17, + "\n" + ], + [ + 18, + " egress {\n" + ], + [ + 19, + " from_port = 0\n" + ], + [ + 20, + " to_port = 0\n" + ], + [ + 21, + " protocol = \"-1\"\n" + ], + [ + 22, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 23, + " }\n" + ], + [ + 24, + "\n" + ], + [ + 25, + " tags = {\n" + ], + [ + 26, + " Name = \"Allow All Security Group\"\n" + ], + [ + 27, + " }\n" + ], + [ + 28, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 5, + 28 + ], + "resource": "aws_security_group.allow_all", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": { + "Name": "Allow All Security Group" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV2_AWS_5", + "bc_check_id": "BC_AWS_NETWORKING_51", + "check_name": "Ensure that Security Groups are attached to another resource", + "check_result": { + "result": "FAILED", + "entity": { + "aws_security_group": { + "ssh_open": { + "__end_line__": 62, + "__start_line__": 31, + "description": [ + "SSH access from anywhere" + ], + "egress": [ + { + "cidr_blocks": [ + [ + "0.0.0.0/0" + ] + ], + "from_port": [ + 0 + ], + "protocol": [ + "-1" + ], + "to_port": [ + 0 + ] + } + ], + "ingress": [ + { + "cidr_blocks": [ + [ + "0.0.0.0/0" + ] + ], + "description": [ + "SSH from anywhere" + ], + "from_port": [ + 22 + ], + "protocol": [ + "tcp" + ], + "to_port": [ + 22 + ] + }, + { + "cidr_blocks": [ + [ + "0.0.0.0/0" + ] + ], + "description": [ + "RDP from anywhere" + ], + "from_port": [ + 3389 + ], + "protocol": [ + "tcp" + ], + "to_port": [ + 3389 + ] + } + ], + "name": [ + "ssh-from-anywhere" + ], + "tags": [ + { + "Name": "SSH Open Security Group" + } + ], + "vpc_id": [ + "vpc-12345678" + ], + "__address__": "aws_security_group.ssh_open" + } + } + }, + "evaluated_keys": [ + "resource_type", + "networking" + ] + }, + "code_block": [ + [ + 31, + "resource \"aws_security_group\" \"ssh_open\" {\n" + ], + [ + 32, + " name = \"ssh-from-anywhere\"\n" + ], + [ + 33, + " description = \"SSH access from anywhere\"\n" + ], + [ + 34, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 35, + "\n" + ], + [ + 36, + " ingress {\n" + ], + [ + 37, + " description = \"SSH from anywhere\"\n" + ], + [ + 38, + " from_port = 22\n" + ], + [ + 39, + " to_port = 22\n" + ], + [ + 40, + " protocol = \"tcp\"\n" + ], + [ + 41, + " cidr_blocks = [\"0.0.0.0/0\"] # SSH from anywhere!\n" + ], + [ + 42, + " }\n" + ], + [ + 43, + "\n" + ], + [ + 44, + " ingress {\n" + ], + [ + 45, + " description = \"RDP from anywhere\"\n" + ], + [ + 46, + " from_port = 3389\n" + ], + [ + 47, + " to_port = 3389\n" + ], + [ + 48, + " protocol = \"tcp\"\n" + ], + [ + 49, + " cidr_blocks = [\"0.0.0.0/0\"] # RDP from anywhere!\n" + ], + [ + 50, + " }\n" + ], + [ + 51, + "\n" + ], + [ + 52, + " egress {\n" + ], + [ + 53, + " from_port = 0\n" + ], + [ + 54, + " to_port = 0\n" + ], + [ + 55, + " protocol = \"-1\"\n" + ], + [ + 56, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 57, + " }\n" + ], + [ + 58, + "\n" + ], + [ + 59, + " tags = {\n" + ], + [ + 60, + " Name = \"SSH Open Security Group\"\n" + ], + [ + 61, + " }\n" + ], + [ + 62, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 31, + 62 + ], + "resource": "aws_security_group.ssh_open", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": { + "Name": "SSH Open Security Group" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV_AWS_145", + "bc_check_id": "BC_AWS_GENERAL_56", + "check_name": "Ensure that S3 buckets are encrypted with KMS by default", + "check_result": { + "result": "FAILED", + "entity": { + "aws_s3_bucket": { + "public_data": { + "__end_line__": 21, + "__start_line__": 13, + "acl": [ + "public-read" + ], + "bucket": [ + "my-public-bucket-lab6" + ], + "tags": [ + { + "Name": "Public Data Bucket" + } + ], + "__address__": "aws_s3_bucket.public_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "resource_type", + "server_side_encryption_configuration/rule/apply_server_side_encryption_by_default/sse_algorithm", + "rule/apply_server_side_encryption_by_default/sse_algorithm" + ] + }, + "code_block": [ + [ + 13, + "resource \"aws_s3_bucket\" \"public_data\" {\n" + ], + [ + 14, + " bucket = \"my-public-bucket-lab6\"\n" + ], + [ + 15, + " acl = \"public-read\" # Public access enabled!\n" + ], + [ + 16, + "\n" + ], + [ + 17, + " tags = {\n" + ], + [ + 18, + " Name = \"Public Data Bucket\"\n" + ], + [ + 19, + " # Missing required tags: Environment, Owner, CostCenter\n" + ], + [ + 20, + " }\n" + ], + [ + 21, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 13, + 21 + ], + "resource": "aws_s3_bucket.public_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": { + "Name": "Public Data Bucket" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-buckets-are-encrypted-with-kms-by-default", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV_AWS_145", + "bc_check_id": "BC_AWS_GENERAL_56", + "check_name": "Ensure that S3 buckets are encrypted with KMS by default", + "check_result": { + "result": "FAILED", + "entity": { + "aws_s3_bucket": { + "unencrypted_data": { + "__end_line__": 33, + "__start_line__": 24, + "acl": [ + "private" + ], + "bucket": [ + "my-unencrypted-bucket-lab6" + ], + "versioning": [ + { + "enabled": [ + false + ] + } + ], + "__address__": "aws_s3_bucket.unencrypted_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "resource_type", + "server_side_encryption_configuration/rule/apply_server_side_encryption_by_default/sse_algorithm", + "rule/apply_server_side_encryption_by_default/sse_algorithm" + ] + }, + "code_block": [ + [ + 24, + "resource \"aws_s3_bucket\" \"unencrypted_data\" {\n" + ], + [ + 25, + " bucket = \"my-unencrypted-bucket-lab6\"\n" + ], + [ + 26, + " acl = \"private\"\n" + ], + [ + 27, + " \n" + ], + [ + 28, + " # No server_side_encryption_configuration!\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " versioning {\n" + ], + [ + 31, + " enabled = false # Versioning disabled\n" + ], + [ + 32, + " }\n" + ], + [ + 33, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 24, + 33 + ], + "resource": "aws_s3_bucket.unencrypted_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-buckets-are-encrypted-with-kms-by-default", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + } + ], + "skipped_checks": [], + "parsing_errors": [] + }, + "summary": { + "passed": 48, + "failed": 78, + "skipped": 0, + "parsing_errors": 0, + "resource_count": 16, + "checkov_version": "3.2.508" + }, + "url": "Add an api key '--bc-api-key