Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove WAF issue #147

Closed
0xdabbad00 opened this issue Mar 23, 2023 · 0 comments · Fixed by #261
Closed

Remove WAF issue #147

0xdabbad00 opened this issue Mar 23, 2023 · 0 comments · Fixed by #261
Labels
question Further information is requested

Comments

@0xdabbad00
Copy link
Contributor

The original project upon which cloudvulndb is based (https://github.com/SummitRoute/csp_security_mistakes) had specifically excluded WAF issues, stating "I'm not including WAF bypasses as WAFs are inherently bypassable." An exception had been made for https://www.cloudvulndb.org/aws-waf-sql-injection as the issue is interesting and is a WAF implementation mistake, as opposed to a rule bypass, to warrant including.

However, since then https://github.com/wiz-sec/open-cvdb/blob/main/vulnerabilities/azure-waf-bypass.yaml was added, and more recently a PR for another WAF bypass has been submitted. I believe that WAF bypasses should not be included, because of the inherent ease with which they can be found and with it not being a significantly "cloud" issue. Similarly, if AWS Inspector does not identify a library that is vulnerable or AWS GuardDuty Malware Protection does not identify some malware, I would not include that here, as again those are inherently bypassable.

My view is therefore that we should remove the existing issue https://github.com/wiz-sec/open-cvdb/blob/main/vulnerabilities/azure-waf-bypass.yaml
I am open to removing https://github.com/wiz-sec/open-cvdb/blob/main/vulnerabilities/aws-waf-sql-injection.yaml if it means making this clear.

My belief is that by narrowing what we allow, we will be able to focus on ensuring more timely and better coverage of the types of issues we do want to allow. I also believe this is better for consumers of this repository who could become frustrated by the inclusion of some issues that aren't in the same spirit for what this was created for.

@korniko98 korniko98 added the question Further information is requested label Apr 20, 2023
@korniko98 korniko98 linked a pull request Dec 26, 2023 that will close this issue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
question Further information is requested
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants