search

OrenGitHub / dhscanner

free as in speech container scanner
https://orengithub.github.io/
1 stars 0 forks source link

Detect CVE-2023-45674 Ruby SQLi #42

Closed OrenGitHub closed 1 month ago

OrenGitHub commented 1 month ago
OrenGitHub commented 1 month ago

Delegated to query engine ( responsible for all the scanners ) here

OrenGitHub commented 1 month ago 
[19/05/2024 ( 06:09:26 )] [INFO]: [ cve_2023_37466 ] .............. : looking good 👌
[19/05/2024 ( 06:09:26 )] [INFO]: [ ghsa_97m3      ] .............. : looking good 👌
[19/05/2024 ( 06:09:27 )] [INFO]: [ cve_2024_32022 ] .............. : looking good 👌
[19/05/2024 ( 06:09:27 )] [INFO]: [ cve_2023_45674 ] .............. : looking good 👌# <--- bug !
OrenGitHub commented 1 month ago

No variables on line 29 in bitcode ( although they exist ):

 29   def self.join_tool_slot_and_find_by_id(id)
OrenGitHub commented 1 month ago

Fixed !

1141                                 "to": {
1142                                     "theInstructionInside": {
1143                                         "instructionContent": {
1144                                             "contents": {
1145                                                 "paramVariable": {
1146                                                     "paramVariableFqn": {
1147                                                         "content": "id"
1148                                                     },
1149                                                     "paramVariableSerialIdx": 0,
1150                                                     "paramVariableToken": {
1151                                                         "content": "id",
1152                                                         "location": {
1153                                                             "colEnd": 1084,
1154                                                             "colStart": 1082,
1155                                                             "filename": "workdir/ff02e93b830fa88e2161cd152eb22fc316e2baea969bc0c4803ba477e120b531/farmbot/app/models/tool.rb",
1156                                                             "lineEnd": 29,
1157                                                             "lineStart": 29
1158                                                         }
1159                                                     }
1160                                                 }
1161                                             },
1162                                             "tag": "ParamDecl"
1163                                         },
1164                                         "location": {
1165                                             "colEnd": 1084,
1166                                             "colStart": 1082,
1167                                             "filename": "workdir/ff02e93b830fa88e2161cd152eb22fc316e2baea969bc0c4803ba477e120b531/farmbot/app/models/tool.rb",
1168                                             "lineEnd": 29,
1169                                             "lineStart": 29
1170                                         }
1171                                     }
1172                                 }