AutoFix PR

[elangosenthilnathan]

Qwiet AI AutoFix

This PR was created automatically by the Qwiet AI AutoFix tool.
As long as it is open, subsequent scans and generated fixes to this same branch will be added to it as new commits.

Each commit fixes one vulnerability.

Some manual intervention might be required before merging this PR.

Project Information

• Name: gabe-java-demo-1727227054
• Branch: master
• Pull Request Language: java

Fixes

• For finding 24: "Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.checkCookie"

  • On file src/main/java/io/shiftleft/controller/CustomerController.java

• For finding 23: "Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.saveSettings"

  • On file src/main/java/io/shiftleft/controller/CustomerController.java

[github-actions]

Checking analysis of application shiftleft-java-demo against 4 build rules.

Using sl version 0.9.2780 (5c5b6948d244e0f162f6d33bbd5eae8d288817e1).

Checking findings on scan 10.

Results per rule:

• No critical or high SAST findings: FAIL
  (12 matched vulnerabilities; configured threshold is 0).

  First 5 findings:

  ID	CVSS	Rating	Title
  98	9.0	critical	Remote Code Execution: Code Injection Through Attacker-controlled Data via foo in SearchController.doGetSearch
  99	9.0	critical	Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.checkCookie
  100	9.0	critical	Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.saveSettings
  77	8.0	high	Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via foo in SearchController.doGetSearch
  78	8.0	high	Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via customerId in CustomerController.debug

  Severity rating	Count
  Critical	3
  High	9
  Medium	0
  Low	0

  Category	Count
  Cross-Site Scripting	8
  Directory Traversal	2
  Remote Code Execution	1
  Deserialization	1

  OWASP 2021 Category	Count
  A03-Injection	9
  A01-Broken-Access-Control	2
  A08-Software-And-Data-Integrity-Failures	1

• Allow 0 secrets: pass
  (0 matched vulnerabilities; configured threshold is 0).

• No reachable SCA findings: FAIL
  (43 matched vulnerabilities; configured threshold is 0).

  First 10 findings:

  ID	CVSS	Rating	CVE	Title
  316	10.0	critical	GMS-2022-559	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in org.springframework:spring-core.
  240	9.8	critical	CVE-2018-8014	The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insec…
  249	9.8	critical	CVE-2020-1938	When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as ha…
  253	9.8	critical	CVE-2017-5651	In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing.…
  301	9.8	critical	CVE-2018-1270	Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over …
  309	9.8	critical	CVE-2018-1275	Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over …
  318	9.8	critical	CVE-2016-1000027	Pivotal Spring Framework before 6.0.0 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. De…
  239	9.1	critical	CVE-2017-5648	While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.R…
  315	8.8	high	CVE-2020-5421	In Spring Framework the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessioni…
  267	8.6	high	CVE-2022-25762	If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apac…

  Severity rating	Count
  Critical	8
  High	35
  Medium	0
  Low	0

• No critical or high container findings: FAIL
  (53 matched vulnerabilities; configured threshold is 0).

  First 10 findings:

  ID	CVSS	Rating	CVE	Title
  357	9.0	critical	CVE-2021-30139	pkg:pkg/alpine/apk-tools@2.12.3-r0
  359	9.0	critical	CVE-2021-36159	pkg:pkg/alpine/apk-tools@2.12.3-r0
  386	9.0	critical	CVE-2022-28391	CVE-2022-28391 affecting package busybox for versions less than 1.35.0-2. A patched version of the package is available.
  402	9.0	critical	CVE-2021-3711	In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this fu…
  425	9.0	critical	CVE-2021-3711	In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this fu…
  449	9.0	critical	CVE-2022-28391	CVE-2022-28391 affecting package busybox for versions less than 1.35.0-2. A patched version of the package is available.
  454	9.0	critical	CVE-2022-37434	zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applicat…
  361	7.0	high	CVE-2021-28831	decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fa…
  367	7.0	high	CVE-2021-42378	CVE-2021-42378 affecting package busybox for versions less than 1.35.0-1. An upgraded version of the package is available that resolves this issue.
  369	7.0	high	CVE-2021-42379	CVE-2021-42379 affecting package busybox for versions less than 1.35.0-1. An upgraded version of the package is available that resolves this issue.

  Severity rating	Count
  Critical	7
  High	46
  Medium	0
  Low	0

3 rules failed.

[github-actions]

Checking analysis of application shiftleft-java-demo against 4 build rules.

Using sl version 0.9.2780 (5c5b6948d244e0f162f6d33bbd5eae8d288817e1).

Checking findings on scan 12.

Results per rule:

• No critical or high SAST findings: FAIL
  (12 matched vulnerabilities; configured threshold is 0).

  First 5 findings:

  ID	CVSS	Rating	Title
  1_98	9.0	critical	Remote Code Execution: Code Injection Through Attacker-controlled Data via foo in SearchController.doGetSearch
  1_99	9.0	critical	Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.checkCookie
  1_100	9.0	critical	Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.saveSettings
  1_77	8.0	high	Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via foo in SearchController.doGetSearch
  1_78	8.0	high	Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via customerId in CustomerController.debug

  Severity rating	Count
  Critical	3
  High	9
  Medium	0
  Low	0

  Category	Count
  Cross-Site Scripting	8
  Directory Traversal	2
  Remote Code Execution	1
  Deserialization	1

  OWASP 2021 Category	Count
  A03-Injection	9
  A01-Broken-Access-Control	2
  A08-Software-And-Data-Integrity-Failures	1

• Allow 0 secrets: FAIL
  (1 matched vulnerability; configured threshold is 0).

  Finding:

  ID	CVSS	Rating	Title
  2_1	5.5	medium	Secret Keyword

  Severity rating	Count
  Critical	0
  High	0
  Medium	1
  Low	0

• No reachable SCA findings: FAIL
  (43 matched vulnerabilities; configured threshold is 0).

  First 10 findings:

  ID	CVSS	Rating	CVE	Title
  1_316	10.0	critical	GMS-2022-559	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in org.springframework:spring-core.
  1_240	9.8	critical	CVE-2018-8014	The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are ins…
  1_249	9.8	critical	CVE-2020-1938	When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as …
  1_253	9.8	critical	CVE-2017-5651	In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processin…
  1_301	9.8	critical	CVE-2018-1270	Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP ove…
  1_309	9.8	critical	CVE-2018-1275	Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP ove…
  1_318	9.8	critical	CVE-2016-1000027	Pivotal Spring Framework before 6.0.0 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. …
  1_239	9.1	critical	CVE-2017-5648	While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0…
  1_315	8.8	high	CVE-2020-5421	In Spring Framework the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessio…
  1_267	8.6	high	CVE-2022-25762	If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Ap…

  Severity rating	Count
  Critical	8
  High	35
  Medium	0
  Low	0

• No critical or high container findings: FAIL
  (53 matched vulnerabilities; configured threshold is 0).

  First 10 findings:

  ID	CVSS	Rating	CVE	Title
  1_357	9.0	critical	CVE-2021-30139	pkg:pkg/alpine/apk-tools@2.12.3-r0
  1_359	9.0	critical	CVE-2021-36159	pkg:pkg/alpine/apk-tools@2.12.3-r0
  1_386	9.0	critical	CVE-2022-28391	CVE-2022-28391 affecting package busybox for versions less than 1.35.0-2. A patched version of the package is available.
  1_402	9.0	critical	CVE-2021-3711	In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this …
  1_425	9.0	critical	CVE-2021-3711	In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this …
  1_449	9.0	critical	CVE-2022-28391	CVE-2022-28391 affecting package busybox for versions less than 1.35.0-2. A patched version of the package is available.
  1_454	9.0	critical	CVE-2022-37434	zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applic…
  1_361	7.0	high	CVE-2021-28831	decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation …
  1_367	7.0	high	CVE-2021-42378	CVE-2021-42378 affecting package busybox for versions less than 1.35.0-1. An upgraded version of the package is available that resolves this issue.
  1_369	7.0	high	CVE-2021-42379	CVE-2021-42379 affecting package busybox for versions less than 1.35.0-1. An upgraded version of the package is available that resolves this issue.

  Severity rating	Count
  Critical	7
  High	46
  Medium	0
  Low	0

4 rules failed.