You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The original project upon which cloudvulndb is based (https://github.com/SummitRoute/csp_security_mistakes) had specifically excluded WAF issues, stating "I'm not including WAF bypasses as WAFs are inherently bypassable." An exception had been made for https://www.cloudvulndb.org/aws-waf-sql-injection as the issue is interesting and is a WAF implementation mistake, as opposed to a rule bypass, to warrant including.
However, since then https://github.com/wiz-sec/open-cvdb/blob/main/vulnerabilities/azure-waf-bypass.yaml was added, and more recently a PR for another WAF bypass has been submitted. I believe that WAF bypasses should not be included, because of the inherent ease with which they can be found and with it not being a significantly "cloud" issue. Similarly, if AWS Inspector does not identify a library that is vulnerable or AWS GuardDuty Malware Protection does not identify some malware, I would not include that here, as again those are inherently bypassable.
My belief is that by narrowing what we allow, we will be able to focus on ensuring more timely and better coverage of the types of issues we do want to allow. I also believe this is better for consumers of this repository who could become frustrated by the inclusion of some issues that aren't in the same spirit for what this was created for.
The text was updated successfully, but these errors were encountered:
The original project upon which cloudvulndb is based (https://github.com/SummitRoute/csp_security_mistakes) had specifically excluded WAF issues, stating "I'm not including WAF bypasses as WAFs are inherently bypassable." An exception had been made for https://www.cloudvulndb.org/aws-waf-sql-injection as the issue is interesting and is a WAF implementation mistake, as opposed to a rule bypass, to warrant including.
However, since then https://github.com/wiz-sec/open-cvdb/blob/main/vulnerabilities/azure-waf-bypass.yaml was added, and more recently a PR for another WAF bypass has been submitted. I believe that WAF bypasses should not be included, because of the inherent ease with which they can be found and with it not being a significantly "cloud" issue. Similarly, if AWS Inspector does not identify a library that is vulnerable or AWS GuardDuty Malware Protection does not identify some malware, I would not include that here, as again those are inherently bypassable.
My view is therefore that we should remove the existing issue https://github.com/wiz-sec/open-cvdb/blob/main/vulnerabilities/azure-waf-bypass.yaml
I am open to removing https://github.com/wiz-sec/open-cvdb/blob/main/vulnerabilities/aws-waf-sql-injection.yaml if it means making this clear.
My belief is that by narrowing what we allow, we will be able to focus on ensuring more timely and better coverage of the types of issues we do want to allow. I also believe this is better for consumers of this repository who could become frustrated by the inclusion of some issues that aren't in the same spirit for what this was created for.
The text was updated successfully, but these errors were encountered: