mcp-server-semgrep/semgrep-rules/stats/cwe_to_metacategory.yml

MCP Server for Semgrep Integration - static code analysis with AI

Cryptography:
  - "CWE-523: Unprotected Transport of Credentials"
  - "CWE-319: Cleartext Transmission of Sensitive Information"
  - "CWE-326: Inadequate Encryption Strength"
  - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
  - "CWE-329: Not Using a Random IV with CBC Mode"
  - "CWE-330: Use of Insufficiently Random Values"
  - "CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)"
  # Putting here for now because don't want to have multiple
  # entries for Crypto, even though they may not all be Tier 1
  # vuln classes we want to support
  - "CWE-345: Insufficient Verification of Data Authenticity"
  - "CWE-780: Use of RSA Algorithm without OAEP"
  - "CWE-322: Key Exchange without Entity Authentication"
  - "CWE-323: Reusing a Nonce, Key Pair in Encryption"
  - "CWE-311: Missing Encryption of Sensitive Data"
  - "CWE-300: Channel Accessible by Non-Endpoint"
  - "CWE-297: Improper Validation of Certificate with Host Mismatch"

CSRF:
  - "CWE-352: Cross-Site Request Forgery (CSRF)"
XSS:
  - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
  - "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page"
  - "CWE-279: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
  - "CWE-116: Improper Encoding or Escaping of Output"
"SQL Injection":
  - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
"Command Injection":
  - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
  - "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences"
"Code Injection":
  - "CWE-94: Improper Control of Generation of Code (Code Injection)"
  - "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')"
  - "CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')"
  - "CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')"
SSRF:
  - "CWE-918: Server-Side Request Forgery (SSRF)"
"Path Traversal":
  - "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
  - "CWE-73: External Control of File Name or Path"
XXE:
  - "CWE-611: Improper Restriction of XML External Entity Reference"
  - "CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')"
"Cookie Flag Security":
  - "CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag"
  - "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute"
"Active Debug Code":
  - "CWE-489: Active Debug Code"

Deserialization:
  - "CWE-502: Deserialization of Untrusted Data"  
"Hard-coded Secrets":
  - "CWE-798: Use of Hard-coded Credentials"

"Open Redirect":
  - "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')"

"Mass Assignment":
  - "CWE-913: Improper Control of Dynamically-Managed Code Resources" # TODO unsure
"Prototype Pollution":
  - "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes"
  - "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')"

# Surveying existing rules, it seems like there are a variety
# of CVEs based on what's wrong, unrelated to JWTs
#JWT:
#  - TODO

Regex:
  - "CWE-185: Incorrect Regular Expression"
  - "CWE-1333: Inefficient Regular Expression Complexity"

"Denial of Service":
  - "CWE-400: Uncontrolled Resource Consumption"
    
# "CWE-749: Exposed Dangerous Method or Function"
# "CWE-939: Improper Authorization in Handler for Custom URL Scheme"
# "CWE-942: Permissive Cross-domain Policy with Untrusted Domains"
# Information disclosure
# "CWE-521: Weak Password Requirements"
# "CWE-522: Insufficiently Protected Credentials"

# "CWE-250: Execution with Unnecessary Privileges"
# "CWE-242: Use of Inherently Dangerous Function"