Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(queries): align queries cross different platforms #5539

Merged
merged 17 commits into from
Aug 23, 2022
Merged

fix(queries): align queries cross different platforms #5539

merged 17 commits into from
Aug 23, 2022

Conversation

roi-orca
Copy link
Contributor

@roi-orca roi-orca commented Jun 28, 2022 •
edited
Loading

align queries cross different platforms

References:
#5460
#5446

Proposed Changes
align queries cross different platforms

Queries:

  1. API Gateway without WAF
  2. CloudTrail Log File Validation Disabled
  3. CloudTrail Log Files Not Encrypted With CMK
  4. DB Instance Publicly Accessible
  5. Hardcoded AWS Access Key In Lambda
  6. IAM Password Without Number
  7. S3 Bucket Logging Disabled
  8. SQL Analysis Services Port 2383 (TCP) Is Publicly Accessible
  9. Stack Notifications Disabled
  10. Azure Container Registry With No Locks
  11. Public Storage Account
  12. Redis Cache Allows Non SSL Connections
  13. COS Node Image Not Used
  14. Google Compute Subnetwork with Private Google Access Disabled
  15. High Google KMS Crypto Key Rotation Period
  16. High KMS Rotation Period
  17. Serial Ports Are Enabled For VM Instances
  18. SSH Access Is Not Restricted
  19. Using Default Service Account
  20. Cloudfront Logging Disabled
  21. Cloudfront Without WAF
  22. CodeBuild Not Encrypted
  23. DB Security Group With Public Scope
  24. ECS Service Admin Role is Present
  25. User Data Contains Encoded Private Key
  26. Authentication Without MFA
  27. CA Certificate Identifier Is Outdated
  28. ElasticSearch Without Slow Logs
  29. Hardcoded AWS Access Key
  30. SQS with SSE disabled
  31. AKS Network Policy Misconfigured
  32. CosmosDB Account IP Range Filter Not Set
  33. Role Definition Allows Custom Role Creation
  34. Unrestricted SQL Server Access

I submit this contribution under the Apache-2.0 license.

@rafaela-soares rafaela-soares added the community Community contribution label Jun 28, 2022
rafaela-soares
rafaela-soares suggested changes Jun 30, 2022
View reviewed changes
Copy link
Contributor

@rafaela-soares rafaela-soares left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi, @roi-orca!

Thank you so much for continuing to improve the KICS queries metadata! 🚀

I suggest the following:

assets/queries/ansible/aws/db_instance_publicly_accessible/metadata.json Outdated Show resolved Hide resolved
assets/queries/ansible/aws/hardcoded_aws_access_key_in_lambda/metadata.json Outdated Show resolved Hide resolved
assets/queries/ansible/aws/db_instance_publicly_accessible/metadata.json Outdated Show resolved Hide resolved
assets/queries/ansible/aws/stack_notifications_disabled/metadata.json Outdated Show resolved Hide resolved
assets/queries/ansible/azure/azure_container_registry_with_no_locks/metadata.json Outdated Show resolved Hide resolved
assets/queries/cloudFormation/aws/user_data_contains_encoded_private_key/metadata.json Outdated Show resolved Hide resolved
assets/queries/terraform/aws/hardcoded_aws_access_key/metadata.json Outdated Show resolved Hide resolved
assets/queries/terraform/aws/sqs_with_sse_disabled/metadata.json Outdated Show resolved Hide resolved
assets/queries/terraform/gcp/vm_serial_ports_are_enabled_for_vm_instances/metadata.json Outdated Show resolved Hide resolved
...ries/ansible/gcp/google_compute_subnetwork_with_private_google_access_disabled/metadata.json Outdated Show resolved Hide resolved
@roi-orca roi-orca requested a review from rafaela-soares July 3, 2022 11:19
rafaela-soares
rafaela-soares reviewed Jul 5, 2022
View reviewed changes
Copy link
Contributor

@rafaela-soares rafaela-soares left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 🚀

I will only wait for our security team to confirm the severity and category alignment.

@roi-orca
Copy link
Contributor Author

roi-orca commented Jul 7, 2022

@rjegoncalves can you please review the changes?

@roi-orca
Copy link
Contributor Author

@rafaela-soares any update on this?

@rafaela-soares
Copy link
Contributor

@rafaela-soares any update on this?

Hello, @roi-orca! The PR is already being reviewed. Sorry for the delay. We will update you, as soon as possible 😊

rafaela-soares
rafaela-soares suggested changes Jul 12, 2022
View reviewed changes
Copy link
Contributor

@rafaela-soares rafaela-soares left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hello, @roi-orca!

Our security team took the opportunity to analyze the queries of your PR. Some suggestions are not related to what you changed, but they will improve the queries.

Please, take a look at the suggestion and let me know what you think about it 😊

Note that the suggestions apply to all platforms that have the query.

assets/queries/ansible/aws/cloudtrail_log_file_validation_disabled/metadata.json Outdated Show resolved Hide resolved
assets/queries/ansible/aws/cloudtrail_log_files_not_encrypted_with_cmk/metadata.json Outdated Show resolved Hide resolved
assets/queries/ansible/aws/s3_bucket_logging_disabled/metadata.json Outdated Show resolved Hide resolved
assets/queries/cloudFormation/aws/stack_notifications_disabled/metadata.json Outdated Show resolved Hide resolved
assets/queries/ansible/gcp/cos_node_image_not_used/metadata.json Outdated Show resolved Hide resolved
assets/queries/terraform/azure/cosmosdb_account_ip_range_filter_not_set/metadata.json Outdated Show resolved Hide resolved
assets/queries/cloudFormation/aws/ecs_service_admin_role_is_present/metadata.json Outdated Show resolved Hide resolved
...ries/cloudFormation/aws/ecs_service_admin_role_is_present/test/positive_expected_result.json Outdated Show resolved Hide resolved
...ries/cloudFormation/aws/ecs_service_admin_role_is_present/test/positive_expected_result.json Outdated Show resolved Hide resolved
assets/queries/ansible/azure/public_storage_account/metadata.json Outdated Show resolved Hide resolved
@roi-orca
Copy link
Contributor Author

Hi @rafaela-soares,
Regarding the comments of This description could have more details about the impact
Do you mean how actually the issue should be resolved in the platform?

@rafaela-soares
Copy link
Contributor

Hi @rafaela-soares, Regarding the comments of This description could have more details about the impact Do you mean how actually the issue should be resolved in the platform?

Hi, @roi-orca! We mean how the vulnerability can impact the environment or the user. For example, regarding the query DB Instance Publicly Accessible, the fact that the db is public will make the attack surface bigger and more susceptible to attacks.

@gabriel-cx
Copy link
Contributor

Hello, @roi-orca!
Feel free to ping me if you need something from our side in order to close this PR! ⛵
If you prefer, we can close it in our side.

@rafaela-soares rafaela-soares added the query New query feature label Aug 19, 2022
cxMiguelSilva
cxMiguelSilva previously approved these changes Aug 22, 2022
View reviewed changes
Copy link
Collaborator

@cxMiguelSilva cxMiguelSilva left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

cxMiguelSilva
cxMiguelSilva previously approved these changes Aug 22, 2022
View reviewed changes
cxMiguelSilva
cxMiguelSilva previously approved these changes Aug 22, 2022
View reviewed changes
@rafaela-soares rafaela-soares merged commit 2e0602d into Checkmarx:master Aug 23, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@cxMiguelSilva cxMiguelSilva cxMiguelSilva approved these changes

@rafaela-soares rafaela-soares rafaela-soares approved these changes

@rjegoncalves rjegoncalves Awaiting requested review from rjegoncalves

Assignees
No one assigned
Labels
community Community contribution query New query feature
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@roi-orca @rafaela-soares @gabriel-cx @cxMiguelSilva