mcp-server-semgrep
Version:
MCP Server for Semgrep Integration - static code analysis with AI
52 lines (51 loc) • 2.1 kB
YAML
rules:
- id: disallow-old-tls-versions1
message: >-
Detects direct creations of $HTTPS servers that don't disallow SSL v2, SSL v3, and TLS v1. These protocols
are deprecated due to
POODLE, man in the middle attacks, and other vulnerabilities.
severity: WARNING
metadata:
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: 'A03:2017 - Sensitive Data Exposure'
references:
- https://us-cert.cisa.gov/ncas/alerts/TA14-290A
- https://stackoverflow.com/questions/40434934/how-to-disable-the-ssl-3-0-and-tls-1-0-in-nodejs
- https://nodejs.org/api/https.html#https_https_createserver_options_requestlistener
subcategory:
- vuln
technology:
- node.js
vulnerability: Insecure Transport
languages:
- javascript
- typescript
patterns:
- pattern-either:
- pattern-inside: |
$CONST = require('crypto');
...
- pattern-inside: |
$CONST = require('constants');
...
- pattern-inside: |
$HTTPS = require('https');
...
- pattern: |
$HTTPS.createServer(...).$FUNC(...);
- pattern-not: |
$HTTPS.createServer({secureOptions: $CONST.SSL_OP_NO_TLSv1 | $CONST.SSL_OP_NO_SSLv3 | $CONST.SSL_OP_NO_SSLv2 }, ...).$FUNC(...);
- pattern-not: |
$HTTPS.createServer({secureOptions: $CONST.SSL_OP_NO_TLSv1 | $CONST.SSL_OP_NO_SSLv2 |$CONST.SSL_OP_NO_SSLv3 }, ...).$FUNC(...);
- pattern-not: |
$HTTPS.createServer({secureOptions: $CONST.SSL_OP_NO_SSLv2 |$CONST.SSL_OP_NO_SSLv3 |$CONST.SSL_OP_NO_TLSv1 }, ...).$FUNC(...);
- pattern-not: |
$HTTPS.createServer({secureOptions: $CONST.SSL_OP_NO_SSLv2 |$CONST.SSL_OP_NO_TLSv1 | $CONST.SSL_OP_NO_SSLv3}, ...).$FUNC(...);
- pattern-not: |
$HTTPS.createServer({secureOptions:$CONST.SSL_OP_NO_SSLv3 | $CONST.SSL_OP_NO_SSLv2 |$CONST.SSL_OP_NO_TLSv1}, ...).$FUNC(...);
- pattern-not: |
$HTTPS.createServer({secureOptions:$CONST.SSL_OP_NO_SSLv3 | $CONST.SSL_OP_NO_TLSv1| $CONST.SSL_OP_NO_SSLv2}, ...).$FUNC(...);