Fix graphql vuln module metadata and add GitLab and Ivanti EPM CVE detection modules#1456
Open
Phantom-Fort wants to merge 6 commits intoOWASP:masterfrom
Open
Fix graphql vuln module metadata and add GitLab and Ivanti EPM CVE detection modules#1456Phantom-Fort wants to merge 6 commits intoOWASP:masterfrom
Phantom-Fort wants to merge 6 commits intoOWASP:masterfrom
Conversation
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
Summary by CodeRabbit
WalkthroughAdded Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 5
🧹 Nitpick comments (1)
.gitignore (1)
34-34: @Phantom-Fort Please keep signed commits enabled for any follow-up pushes.In OWASP/Nettacker, unsigned commits fail pre-merge checks, so every new commit on this PR should be GPG/SSH signed.
Based on learnings: "When reviewing any pull request in the OWASP/Nettacker repository, always remind the PR author to use signed commits and explicitly state that the PR fails pre-merge checks if any commits are unsigned."
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.gitignore at line 34, Ensure all follow-up commits on this PR are GPG/SSH signed (keep signed commits enabled) because the repository pre-merge checks reject unsigned commits; for clarity, mention this requirement in your next commit message and avoid altering files like "report.html" in .gitignore without signing your push so CI will accept the update.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@nettacker/modules/vuln/gitlab_cve_2021_39935.yaml`:
- Around line 56-58: The version regex in content.regex currently uses
"1[0-3]\\." which incorrectly matches 10.0–10.4; update content.regex in
nettacker/modules/vuln/gitlab_cve_2021_39935.yaml to explicitly match the
vulnerable 10.x range (10.5–10.9 and 10.10–10.13), keep 11.x–13.x, include
14.0–14.4 and the specific 14.5.0/14.5.1 entries, and leave reverse:false
unchanged so the check no longer produces false positives for 10.0–10.4.
- Around line 12-16: In the YAML reference list in
nettacker/modules/vuln/gitlab_cve_2021_39935.yaml (the "reference" entry),
replace the incorrect GitLab release URL
"https://about.gitlab.com/releases/2021/02/11/security-release-gitlab-13-8-4-released/"
with the correct security release URL for CVE-2021-39935:
"https://about.gitlab.com/releases/2021/12/06/security-release-gitlab-14-5-2-released/";
keep the other references intact and ensure the updated URL is added to the
reference list for the CVE entry.
- Around line 28-93: Add a temp-event dependency between the two steps so the
POST (CI Lint) only runs when the GET version check finds a vulnerable version:
in the GET step's response (the first step that checks /api/v4/version) add
save_to_temp_events_only: "gitlab_vuln_check" and in the POST step's response
(the CI lint step that posts to /api/v4/ci/lint) add dependent_on_temp_event:
"gitlab_vuln_check" so the second step is executed only when the first step
produced the named temp event.
In `@nettacker/modules/vuln/graphql.yaml`:
- Around line 54-55: The current regex setting in vuln/graphql.yaml is too
permissive (regex: data|errors) and treats the mere presence of "errors" as a
vuln signal; update the regex under the "regex" key to require a positive
GraphQL introspection indicator (e.g., match "__schema" or "__type" in the
response body or "data.__schema") instead of matching "errors" so only actual
exposed introspection endpoints are flagged; locate the "regex" entry in the
GraphQL module and replace the pattern accordingly to look for "__schema" or
"__type" tokens.
In `@nettacker/modules/vuln/ivanti_epm_cve_2026_1603.yaml`:
- Around line 61-62: The regex in the YAML under the key `content: regex`
incorrectly uses a bare dot in `Endpoint.Manager` which matches any character;
update the pattern to escape the dot (use `Endpoint\.Manager`) so it only
matches the literal string "Endpoint.Manager" while leaving the other
alternations (`Ivanti`, `EPM`, `LanDesk`, `credential`) unchanged.
---
Nitpick comments:
In @.gitignore:
- Line 34: Ensure all follow-up commits on this PR are GPG/SSH signed (keep
signed commits enabled) because the repository pre-merge checks reject unsigned
commits; for clarity, mention this requirement in your next commit message and
avoid altering files like "report.html" in .gitignore without signing your push
so CI will accept the update.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: dfd43864-cf13-4a70-9fb4-2157d17a5ccb
📒 Files selected for processing (4)
.gitignorenettacker/modules/vuln/gitlab_cve_2021_39935.yamlnettacker/modules/vuln/graphql.yamlnettacker/modules/vuln/ivanti_epm_cve_2026_1603.yaml
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
nettacker/modules/vuln/graphql.yaml (1)
53-55: Regex is improved but may still allow false positives.The change from
data|errorsto__schema|types.*nameaddresses the previous review concern about matchingerrors. However,types.*nameis still relatively loose and could match unrelated responses containing those words.Consider tightening to require both markers appear together, ensuring the response actually contains GraphQL schema data:
Proposed stricter regex
content: - regex: "__schema|types.*name" + regex: "__schema.*types|types.*name.*kind" reverse: falseAlternatively, for even stricter matching:
regex: '"__schema"\s*:\s*\{.*"types"'🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@nettacker/modules/vuln/graphql.yaml` around lines 53 - 55, The current content.regex in the GraphQL probe (the content.regex entry using "__schema|types.*name") is too loose and may yield false positives; update the content.regex in graphql.yaml (the content.regex setting) to require the "__schema" and "types" markers appear together (for example by matching "__schema" followed by an opening object/brace and then "types", and include "name" in the same match) so the pattern only matches actual GraphQL schema responses rather than any response containing those words separately.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@nettacker/modules/vuln/gitlab_cve_2021_39935.yaml`:
- Around line 94-96: The current content.regex value "__schema|types.*name" in
gitlab_cve_2021_39935.yaml (the content.regex field) is a GraphQL pattern and
will never match the GitLab CI Lint API JSON response; update content.regex to
match the CI Lint JSON structure (for example a regex that looks for the status
key like "\"status\"\\s*:\\s*\"valid\"" or a looser "status\\s*:\\s*\"valid\""
pattern) so the module correctly detects a reachable/valid CI Lint endpoint.
In `@nettacker/modules/vuln/graphql.yaml`:
- Around line 44-46: The GraphQL introspection query in graphql.yaml is using
double braces and will be sent literally; update the json.query value to use
valid GraphQL syntax by replacing "{{__schema{{types{{name}}}}}}" with a
single-braced introspection string "{__schema{types{name}}}" so the schema
introspection executes correctly (look for the json -> query entry in
nettacker/modules/vuln/graphql.yaml).
---
Nitpick comments:
In `@nettacker/modules/vuln/graphql.yaml`:
- Around line 53-55: The current content.regex in the GraphQL probe (the
content.regex entry using "__schema|types.*name") is too loose and may yield
false positives; update the content.regex in graphql.yaml (the content.regex
setting) to require the "__schema" and "types" markers appear together (for
example by matching "__schema" followed by an opening object/brace and then
"types", and include "name" in the same match) so the pattern only matches
actual GraphQL schema responses rather than any response containing those words
separately.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: c7abacfd-6c3f-413e-8631-49b1de62f69e
📒 Files selected for processing (3)
nettacker/modules/vuln/gitlab_cve_2021_39935.yamlnettacker/modules/vuln/graphql.yamlnettacker/modules/vuln/ivanti_epm_cve_2026_1603.yaml
✅ Files skipped from review due to trivial changes (1)
- nettacker/modules/vuln/ivanti_epm_cve_2026_1603.yaml
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
nettacker/modules/vuln/graphql.yaml (1)
54-55: Consider using(?s)flag for multiline JSON responses.The regex
__schema|types.*namemay fail to match whentypesandnameare on separate lines in prettified JSON responses. Pernettacker/core/lib/http.py(lines 50-74),re.compileis called withoutre.DOTALL, so.*won't match newlines.Most GraphQL servers return minified JSON (single line), so this likely works in practice, but a dot-all pattern would be more robust.
♻️ Optional: Use inline DOTALL flag
content: - regex: "__schema|types.*name" + regex: "(?s)__schema|types.*name"🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@nettacker/modules/vuln/graphql.yaml` around lines 54 - 55, The YAML's regex value " __schema|types.*name " can fail on prettified JSON because the dot doesn't match newlines; update the pattern used for GraphQL detection (the regex field value) to enable dot-all matching (e.g., prepend the inline (?s) flag or replace .* with [\\s\\S]*) so "types" and "name" can be matched across line breaks in multiline JSON responses.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@nettacker/modules/vuln/graphql.yaml`:
- Around line 54-55: The YAML's regex value " __schema|types.*name " can fail on
prettified JSON because the dot doesn't match newlines; update the pattern used
for GraphQL detection (the regex field value) to enable dot-all matching (e.g.,
prepend the inline (?s) flag or replace .* with [\\s\\S]*) so "types" and "name"
can be matched across line breaks in multiline JSON responses.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 911ea64c-0b4f-4765-aea2-6e075760de89
📒 Files selected for processing (2)
nettacker/modules/vuln/gitlab_cve_2021_39935.yamlnettacker/modules/vuln/graphql.yaml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed change
This PR includes one bug fix and two new detection modules, all
discovered during GSoC 2026 codebase review.
Fix: graphql_vuln.yaml
module undocumented with no security context
replaced with four real-world GraphQL endpoint paths:
graphql, api/graphql, v1/graphql, query
New module: gitlab_cve_2021_39935_vuln.yaml
vulnerable to unauthenticated SSRF via the CI Lint API
then unauthenticated CI Lint API access confirmation
New module: ivanti_epm_cve_2026_1603_vuln.yaml
to authentication bypass via magic number 64 header
password hashes without authentication
No linked issue - all three discovered during GSoC 2026 codebase review.
Type of change
Checklist
make pre-commitand confirm it didn't generate any warnings/changesmake test, I confirm all tests passed locallydocs/folder