Add business logic and client side curated rules, and a probe that does not follow redirects

Three new read only curated rules, each confirmed against a control, for the two
rule classes that had none.

Client side: a site that reflects any Origin into Access-Control-Allow-Origin
while allowing credentials, so any other website a signed-in user visits can
read their data from this one.

Business logic: an open redirect, a redirect parameter that sends a visitor to
any outside site, which is how a phishing link is made to look like it belongs
here and how an OAuth token is stolen; and a Host header the site trusts, using
the attacker's value to build links or redirects, which poisons a password reset
email.

To support the redirect checks, a probe can now ask not to follow redirects, so
a rule can read the Location header a redirect carries without being bounced to
the place it points.  The real world precedent table gained these three classes
so the review can ground them.

Author: hackrange

app/core/dast_checks/curated/business-logic-host-header-injection.json

@@ -0,0 +1,34 @@
+{
+  "id": "business-logic-host-header-injection",
+  "class": "business-logic",
+  "safety": "read",
+  "severity_floor": "medium",
+  "title": "The site trusts an attacker's Host header",
+  "summary": "The site takes the Host header from the request and uses it to build links or redirects, instead of its own configured name. An attacker who sets the Host can poison a password reset email so its link points at their site, or poison a shared cache. The check sends a made-up host and sees it come back.",
+  "needs": [],
+  "probe": [
+    {
+      "request": {
+        "method": "GET",
+        "path": "/",
+        "headers": {
+          "Host": "canary-host-injection.example"
+        },
+        "follow": false
+      }
+    }
+  ],
+  "confirm": {
+    "control": "A normal request with the site's own Host, so the made-up host coming back is clearly a reflection of the attacker's value.",
+    "differential": "reflected(\"canary-host-injection.example\") or \"canary-host-injection.example\" in header(\"location\")",
+    "retest": 2
+  },
+  "reproduce": "curl -sk -i 'https://host/' -H 'Host: canary-host-injection.example' and check whether canary-host-injection.example comes back in the response body or in a Location header. If it does, the site is building links or redirects from the attacker-controlled Host, which enables password reset poisoning.",
+  "remediate": "Build absolute links and redirects from a fixed, configured host name, not from the Host header. Reject requests whose Host is not an expected value at the web tier.",
+  "references": [],
+  "mappings": {
+    "cwe": "CWE-644",
+    "owasp": "A03:2021"
+  },
+  "rulesets": []
+}

app/core/dast_checks/curated/business-logic-open-redirect.json

@@ -0,0 +1,41 @@
+{
+  "id": "business-logic-open-redirect",
+  "class": "business-logic",
+  "safety": "read",
+  "severity_floor": "medium",
+  "title": "Open redirect sends visitors to any site",
+  "summary": "A redirect parameter sends the visitor wherever its value points, including an outside site. Attackers use that to make a phishing link look like it belongs to this company, and to steal OAuth tokens by redirecting the sign-in response to a site they control.",
+  "needs": [],
+  "candidate_paths": [
+    "/?next=https://canary-openredirect.example/",
+    "/?url=https://canary-openredirect.example/",
+    "/?redirect=https://canary-openredirect.example/",
+    "/?return=https://canary-openredirect.example/",
+    "/?returnUrl=https://canary-openredirect.example/",
+    "/?dest=https://canary-openredirect.example/",
+    "/login?next=https://canary-openredirect.example/",
+    "/logout?next=https://canary-openredirect.example/"
+  ],
+  "probe": [
+    {
+      "request": {
+        "method": "GET",
+        "path": "{route}",
+        "follow": false
+      }
+    }
+  ],
+  "confirm": {
+    "control": "A path that cannot exist, so the site's not found answer is known and a real redirect to the foreign host is told apart from it.",
+    "differential": "status_in(301, 302, 303, 307, 308) and \"canary-openredirect.example\" in header(\"location\")",
+    "retest": 2
+  },
+  "reproduce": "curl -sk -i 'https://host/?next=https://canary-openredirect.example/' and check the response is a 30x whose Location header points at canary-openredirect.example. Try the other parameter names (url, redirect, return, returnUrl, dest) and the login and logout paths. A redirect to an outside host means the parameter is an open redirect.",
+  "remediate": "Do not redirect to a location taken from the request. Allow only relative paths, or an explicit allow list of hosts, and reject or ignore an absolute URL to another site.",
+  "references": [],
+  "mappings": {
+    "cwe": "CWE-601",
+    "owasp": "A01:2021"
+  },
+  "rulesets": []
+}

app/core/dast_checks/curated/client-side-cors-any-origin-credentials.json

@@ -0,0 +1,33 @@
+{
+  "id": "client-side-cors-any-origin-credentials",
+  "class": "client-side",
+  "safety": "read",
+  "severity_floor": "high",
+  "title": "CORS reflects any origin and allows credentials",
+  "summary": "The site echoes whatever Origin a request carries into Access-Control-Allow-Origin and sets Access-Control-Allow-Credentials to true. That lets any other website make credentialed cross-origin requests and read the response, so a malicious page a signed-in user visits can read their data from this site.",
+  "needs": [],
+  "probe": [
+    {
+      "request": {
+        "method": "GET",
+        "path": "/",
+        "headers": {
+          "Origin": "https://canary-cors.example"
+        }
+      }
+    }
+  ],
+  "confirm": {
+    "control": "A normal request without the foreign Origin, so the reflected origin stands out as a reflection, not the site's own policy.",
+    "differential": "header(\"access-control-allow-origin\") == \"https://canary-cors.example\" and header(\"access-control-allow-credentials\") == \"true\"",
+    "retest": 2
+  },
+  "reproduce": "curl -sk -i 'https://host/' -H 'Origin: https://canary-cors.example' and check the response: Access-Control-Allow-Origin comes back as https://canary-cors.example and Access-Control-Allow-Credentials is true. Reflecting an arbitrary origin with credentials means any site can read a signed-in user's data cross-origin.",
+  "remediate": "Do not reflect the Origin header. Allow credentials only for an explicit allow list of trusted origins, and never combine Access-Control-Allow-Credentials: true with an origin the request supplied or with a wildcard.",
+  "references": [],
+  "mappings": {
+    "cwe": "CWE-942",
+    "owasp": "A05:2021"
+  },
+  "rulesets": []
+}

app/core/dast_checks/engine.py

@@ -81,7 +81,7 @@ def _allowed_method(self, method: str) -> bool:
         return method in spec_mod.ALL_METHODS
 
     def request(self, method: str, path: str, query: dict = None,
-                headers: dict = None, body: str = None) -> dict:
+                headers: dict = None, body: str = None, follow: bool = True) -> dict:
         from app.core import external_probe
 
         method = (method or "GET").upper()
@@ -100,7 +100,8 @@ def request(self, method: str, path: str, query: dict = None,
         sent.update(headers or {})
         started = time.monotonic()
         got = external_probe.fetch(url, method=method, headers=sent,
-                                   allow_private=self.allow_private, body=body)
+                                   allow_private=self.allow_private, body=body,
+                                   follow=follow)
         got["seconds"] = time.monotonic() - started
         got.setdefault("body", "")
         return got
@@ -916,7 +917,8 @@ def _run_probe(spec: dict, client: Client, route: str, oob_value: str) -> dict:
         query = {k: _expand(str(v), route, oob_value)
                  for k, v in (req.get("query") or {}).items()}
         last = client.request(req.get("method") or "GET", path, query=query,
-                              headers=req.get("headers") or {})
+                              headers=req.get("headers") or {},
+                              follow=bool(req.get("follow", True)))
     return last
 
 

app/core/dast_precedent.py

@@ -122,6 +122,42 @@
                      "about 300,000 accounts by reusing passwords leaked from other "
                      "sites.",
     },
+    {
+        "key": "cors",
+        "match": re.compile(r"\bcors\b|cross.origin resource sharing|"
+                            r"access-control-allow-origin|CWE-?942\b", re.I),
+        "ref": "CWE-942; OWASP A05:2021",
+        "abuse": "A malicious site that a signed-in user visits makes a credentialed "
+                 "cross-origin request to this site and reads the authenticated "
+                 "response, taking the user's own data.",
+        "precedent": "A permissive CORS policy that reflects any origin with "
+                     "credentials is a well documented cause of cross-origin data "
+                     "theft, recognised in OWASP guidance and reported in many "
+                     "public disclosures.",
+    },
+    {
+        "key": "open-redirect",
+        "match": re.compile(r"open redirect|unvalidated redirect|CWE-?601\b", re.I),
+        "ref": "CWE-601; OWASP A01:2021",
+        "abuse": "The attacker crafts a link on this trusted site that bounces the "
+                 "visitor to a site they control, for phishing or to capture an "
+                 "OAuth token from a sign-in response.",
+        "precedent": "Open redirects are a standard phishing and OAuth token theft "
+                     "technique, documented in the OWASP Top 10 and used repeatedly "
+                     "against sign-in flows.",
+    },
+    {
+        "key": "host-header-injection",
+        "match": re.compile(r"host header|host injection|password reset poison|"
+                            r"cache poison|CWE-?644\b", re.I),
+        "ref": "CWE-644",
+        "abuse": "The attacker sets the Host header so the site builds a password "
+                 "reset link, or a cached page, that points at the attacker's "
+                 "server, then waits for a victim to use it.",
+        "precedent": "Host header injection that poisons password reset emails and "
+                     "web caches is a documented technique, described by security "
+                     "researchers and in OWASP guidance.",
+    },
     {
         "key": "data-exposure",
         "match": re.compile(r"directory listing|directory index|exposed backup|"