Showing all detectors for the Python language with high severity.

Improper privilege management

Privilege escalation happens when a malicious user gains elevated access to resources that should be unavailable to them.

Insufficient Logging CDK

In the case of a security-critical event, the product fails to either log the event or misses crucial details in the logged information.

Unauthenticated LDAP requests

Unauthenticated LDAP requests can allow untrusted access to LDAP servers.

Path traversal

Constructing path names with unsanitized user input can lead to path traversal attacks (for example, ../../..) that allow an attacker access to file system resources.

Loose file permissions

Weak file permissions can lead to privilege escalation.

Exposure of Sensitive Information CDK

The product unintentionally grants unauthorized actors access to a resource by placing it in the wrong control sphere.

File injection

Writing unsanitized user data to a file is unsafe.

XML External Entity

Objects that parse or handle XML can lead to XML External Entity (XXE) attacks when misconfigured.

Outdated subprocess module API

Using outdated multiprocessing API calls and parameters is not recommended.

Improper authentication

Your code doesn't sufficiently authenticate identities provided by its users.

Insecure cookie

Insecure cookies can lead to unencrypted transmission of sensitive data.

XPath injection

Potentially unsanitized user input in XPath queries can allow an attacker to control the query in unwanted or insecure ways.

Missing authorization

Missing authorization checks can lead to unauthorized access to a resource or performance of an action.

SQL injection

Use of untrusted inputs in a SQL database query can enable attackers to read, modify, or delete sensitive data in the database

Improper certificate validation

Lack of validation of a security certificate can lead to host impersonation and sensitive data leaks.

URL redirection to untrusted site

User-controlled input that specifies a link to an external site could lead to phishing attacks and allow user credentials to be stolen.

Mutually exclusive call

Calls to mutually exclusive methods were found in the code.

AWS api logging disabled cdk

Api Logging Disabled may lead to unable to access log and does not record the event.

OS command injection

Constructing operating system or shell commands with unsanitized user input can lead to inadvertently running malicious code.

AWS credentials logged

Logging unencrypted AWS credentials can expose them to an attacker.

Missing Authorization CDK

Improper Access Control.

Zip bomb attack

Expanding unsanitized archive files taken as input can lead to zip bomb attacks.

Synchronous publication of AWS Lambda metrics

Synchronous publication of AWS Lambda metrics is inefficient.

Unrestricted upload of dangerous file type

Insufficiently restrictive file uploads can lead to inadvertently running malicious code.

Insecure connection using unencrypted protocol

Connections that use insecure protocols transmit data in cleartext, which can leak sensitive information.

Unauthenticated Amazon SNS unsubscribe requests might succeed

Failing to set the AuthenticateOnUnsubscribe flag to True when confirming an SNS subscription can lead to unauthenticated cancellations.

Cross-site request forgery

Insecure configuration can lead to a cross-site request forgery (CRSF) vulnerability.

Weak algorithm used for Password Hashing

Weak algorithm used for Password Hashing. Consider using stronger algorithms, such as Argon2, PBKDF2, or scrypt.

Sensitive information leak

Exposure of sensitive information can lead to an unauthorized actor having access to the information.

Client-side KMS reencryption

Client-side decryption followed by reencryption is inefficient and can lead to sensitive data leaks.

Override of reserved variable names in a Lambda function

Overriding environment variables that are reserved by AWS Lambda might lead to unexpected behavior.

Resource management errors cdk

Software system fails to properly track or release resources during its operation. This can lead to resource leaks.

AWS insecure transmission CDK

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Use of Default Credentials CDK

The product relies on default credentials(including passwords and cryptographic keys) for potentially vital functions.

Do not pass generic exception rule

Do not pass generic exception.

Usage of an API that is not recommended - High Severity

APIs that are not recommended were found - High Severity.

S3 partial encrypt CDK

An unencrypted bucket could lead to sensitive data exposure.

Cross-site scripting

Relying on potentially untrusted user inputs when constructing web application outputs can lead to cross-site scripting vulnerabilities.

Improper Access Control CDK

The software does not restrict or incorrectly restrict access to a resource from an unauthorized actor.

aws kmskey encryption cdk

Using an AWS KMS key helps follow the standard security advice of granting least privilege to objects generated by the project.

Usage of an API that is not recommended

APIs that are not recommended were found.

Deserialization of untrusted object

Deserialization of untrusted objects can lead to security vulnerabilities such as inadvertently running remote code.

Improper sanitization of wildcards or matching symbols

Unsanitized wildcards or special matching symbols in user-provided strings can enable attacks and lead to unwanted behavior.

Using AutoAddPolicy or WarningPolicy

Using AutoAddPolicy or WarningPolicy can allow a malicious server to impersonate a trusted server.

Log injection

Using untrusted inputs in a log statement can enable attackers to break the log's format, forge log entries, and bypass log monitors.

Weak obfuscation of web request

Weak obfuscation while configuring a web request.

Socket close platform compatibility

The os.close() does not work on some platforms.

Server-side request forgery

Insufficient sanitization of potentially untrusted URLs on the server side can allow server requests to unwanted destinations.

Module injection

Untrusted user imports in the importlib.import_module() function allow attacks.

Missing Authentication for Critical Function CDK

Missing authentication checks can lead to unauthorized access to a resource or performance of an action.

Inefficient new method from hashlib

The constructors for the hashlib module are faster than new()

LDAP injection

LDAP queries that rely on potentially untrusted inputs can allow attackers to read or modify sensitive data, run code, and perform other unwanted actions.

Clear text credentials

Credentials that are stored in clear text can be intercepted by a malicious actor.

AWS missing encryption CDK

The AWS resource is missing appropriate encryption.