Rules - Roslyn Security Guard

Request validation is disabled

Request validation is disabled. Request validation allows the filtering of some XSS patterns submitted to the application.

Controller method is vulnerable to CSRF

The annotation [ValidateAntiForgeryToken] is missing.

Hardcoded password

The password configuration to this API appears to be hardcoded. It is suggest to externalized configuration such as password to avoid leakage of secret information.

Potential SQL injection

The dynamic value passed in the SQL query should be validated.

Weak cipher mode

The ciphertext produced is susceptible to alteration by an adversary. This mean that the cipher provides no way to detect that the data has been tampered with. If the ciphertext can be controlled by an attacker, it could be altered without detection. The use of AES in CBC mode with a HMAC is recommended guaranteeing integrity and confidentiality.

ECB mode is weak

ECB mode will produce the same result for identical blocks (ie: 16 bytes for AES). An attacker could be able to guess the encrypted message. The use of AES in CBC mode with a HMAC is recommended guaranteeing integrity and confidentiality.

CBC mode is weak

This specific mode of CBC with PKCS5Padding is susceptible to padding oracle attacks. An adversary could potentially decrypt the message if the system exposed the difference between plaintext with invalid padding or valid padding.

Weak cipher algorithm

DES/3DES is not considered a strong cipher for modern applications. Currently, NIST recommends the usage of AES block ciphers instead of DES/3DES.

OutputCache annotation is disabling authorization checks

Having the annotation [OutputCache] will disable the annotation [Authorize] for the requests following the first one.

Path traversal

The file path passed to this API is susceptible to Path traversal attacks. With a malicious relative path, an attacker could reach a secret file.

Potential SQL injection with WebControls

The dynamic value passed in the SQL query should be validated.

View state mac is disabled (Future)

View state mac is disabled. The view state could be altered by an attacker. (This feature cannot be disabled in the recent version of ASP.net)

Potential XPath injection with XmlDocument

The dynamic value passed to the XPath query should be validated

Certificate Validation has been disabled

Certificate Validation has been disabled. The communication could be intercepted.

Weak random generator

The random numbers generated could be predicted.

Weak hashing function

MD5/SHA1 is no longer considered a strong hashing algorithim for password storage and signature generation.

XML parsing vulnerable to XXE

The XML parser is configured incorrectly. The operation could be vulnerable to XML eXternal Entity (XXE) processing.

The cookie is missing security flag Secure

It is recommended to specify the Secure flag to new cookie.

The cookie is missing security flag HttpOnly

It is recommended to specify the HttpOnly flag to new cookie.

Potential SQL injection with SqlUtility

The dynamic value passed in the SQL query should be validated.

Potential XSS vulnerability

The endpoint returns a variable from the client input that has not been encoded.

Potential SQL injection with MsSQL Data Provider

The dynamic value passed in the SQL query should be validated.

Potential command injection with Process.Start

The dynamic value passed to the command execution should be validated.

Potential SQL injection with LINQ API

The dynamic value passed in the SQL query should be validated.

Potential SQL injection with Odbc API

The dynamic value passed in the SQL query should be validated.

Event validation is disabled

Event validation is disabled. The integrity of client-side control will not be validated on postback.

View state is not encrypted (Future)

View state is not encrypted. Controls may leak sensitive data that could be read client-side.

Potential SQL injection with OleDb API

The dynamic value passed in the SQL query should be validated.

Request validation has been disabled (Future)

Request validation, which provided additionnal protection against Cross-Site Scripting (XSS), has been disabled.

* The analysis of configuration files can be done, but Roslyn does not currently allow the reporting of error in static files.