Skip to content

Commit 64be817

Browse files
WritingPandaWritingPanda
authored
Merge pull request #62 from advanced-security/mitrekev
Adding the MITRE Top 10 KEV Doc to our repo
2 parents abe3313 + dc68a9a commit 64be817

1 file changed

Lines changed: 260 additions & 0 deletions

File tree

‎code-scanning-guides/MITRETop10KEV.md‎

Lines changed: 260 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,260 @@
1+
# CodeQL CWE Coverage in the MITRE Top 10 KEV
2+
3+
## Overview
4+
5+
This document provides a mapping between the MITRE Top 10 Known Exploited Vulnerabilities (KEV) weaknesses and available CodeQL queries through their Common Weakness Enumeration (CWE) identifiers.
6+
7+
The query mappings below are manually curated to show how CodeQL queries relate to the listed CWE identifiers.
8+
9+
## MITRE Top 10 KEV Weaknesses
10+
11+
| CWE-ID | Name | 2024 CWE Top 25 Rank | Top 10 KEV Weaknesses Rank |
12+
| --- | --- | --- | --- |
13+
| CWE-787 | Out-of-bounds Write | 2nd | 1st |
14+
| CWE-843 | Access of Resource Using Incompatible Type ('Type Confusion') | - (39th) | 2nd |
15+
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection’) | 7th | 3rd |
16+
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | 11th | 4th |
17+
| CWE-502 | Deserialization of Untrusted Data | 16th | 5th |
18+
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 5th | 6th |
19+
| CWE-306 | Missing Authentication for Critical Function | 25th | 7th |
20+
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 3rd | 8th |
21+
| CWE-416 | Use After Free | 8th | 9th |
22+
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | 13th | 10th |
23+
24+
## Comprehensive CodeQL Query Mapping by CWE
25+
26+
### CWE-787: Out-of-bounds Write
27+
28+
| Language | Query |
29+
| --- | --- |
30+
| C/C++ | `cpp/allocation-too-small` |
31+
| C/C++ | `cpp/suspicious-allocation-size` |
32+
| C/C++ | `cpp/overflow-buffer` |
33+
| C/C++ | `cpp/badly-bounded-write` |
34+
| C/C++ | `cpp/overrunning-write` |
35+
| C/C++ | `cpp/overrunning-write-with-float` |
36+
| C/C++ | `cpp/unbounded-write` |
37+
| C/C++ | `cpp/very-likely-overrunning-write` |
38+
| C/C++ | `cpp/unterminated-variadic-call` |
39+
| C/C++ | `cpp/no-space-for-terminator` |
40+
| C/C++ | `cpp/invalid-pointer-deref` |
41+
| C/C++ | `cpp/sign-conversion-pointer-arithmetic` |
42+
| C# | `cs/unvalidated-local-pointer-arithmetic` |
43+
44+
### CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
45+
46+
| Language | Query |
47+
| --- | --- |
48+
| C/C++ | `cpp/upcast-array-pointer-arithmetic` |
49+
| C/C++ | `cpp/type-confusion` |
50+
| JavaScript/TypeScript | `js/type-confusion-through-parameter-tampering` |
51+
52+
### CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection’)
53+
54+
| Language | Query |
55+
| --- | --- |
56+
| GitHub Actions | `actions/command-injection/critical` |
57+
| GitHub Actions | `actions/command-injection/medium` |
58+
| C/C++ | `cpp/command-line-injection` |
59+
| C/C++ | `cpp/wordexp-injection` |
60+
| C# | `cs/command-line-injection` |
61+
| Go | `go/command-injection` |
62+
| Go | `go/stored-command` |
63+
| Go | `go/unsafe-quoting` |
64+
| Java/Kotlin | `java/relative-path-command` |
65+
| Java/Kotlin | `java/command-line-injection` |
66+
| Java/Kotlin | `java/exec-tainted-environment` |
67+
| Java/Kotlin | `java/concatenated-command-line` |
68+
| Java/Kotlin | `java/command-line-injection-extra` |
69+
| Java/Kotlin | `java/command-line-injection-extra-local` |
70+
| Java/Kotlin | `java/command-line-injection-experimental` |
71+
| JavaScript/TypeScript | `js/command-line-injection` |
72+
| JavaScript/TypeScript | `js/indirect-command-line-injection` |
73+
| JavaScript/TypeScript | `js/second-order-command-line-injection` |
74+
| JavaScript/TypeScript | `js/shell-command-injection-from-environment` |
75+
| JavaScript/TypeScript | `js/shell-command-constructed-from-input` |
76+
| JavaScript/TypeScript | `js/unnecessary-use-of-cat` |
77+
| JavaScript/TypeScript | `js/prototype-polluting-assignment` |
78+
| JavaScript/TypeScript | `js/prototype-pollution-utility` |
79+
| JavaScript/TypeScript | `js/prototype-pollution` |
80+
| JavaScript/TypeScript | `js/command-line-injection-more-sources` |
81+
| JavaScript/TypeScript | `js/prototype-polluting-assignment-more-sources` |
82+
| Python | `py/command-line-injection` |
83+
| Python | `py/shell-command-constructed-from-input` |
84+
| Ruby | `rb/command-line-injection` |
85+
| Ruby | `rb/kernel-open` |
86+
| Ruby | `rb/non-constant-kernel-open` |
87+
| Ruby | `rb/shell-command-constructed-from-input` |
88+
| Swift | `swift/command-line-injection` |
89+
90+
### CWE-94: Improper Control of Generation of Code ('Code Injection')
91+
92+
| Language | Query |
93+
| --- | --- |
94+
| GitHub Actions | `actions/code-injection/critical` |
95+
| GitHub Actions | `actions/code-injection/medium` |
96+
| GitHub Actions | `actions/cache-poisoning/code-injection` |
97+
| C# | `cs/code-injection` |
98+
| Go | `go/unsafe-quoting` |
99+
| Java/Kotlin | `java/android/arbitrary-apk-installation` |
100+
| Java/Kotlin | `java/groovy-injection` |
101+
| Java/Kotlin | `java/insecure-bean-validation` |
102+
| Java/Kotlin | `java/jexl-expression-injection` |
103+
| Java/Kotlin | `java/mvel-expression-injection` |
104+
| Java/Kotlin | `java/spel-expression-injection` |
105+
| Java/Kotlin | `java/server-side-template-injection` |
106+
| Java/Kotlin | `java/beanshell-injection` |
107+
| Java/Kotlin | `java/android-insecure-dex-loading` |
108+
| Java/Kotlin | `java/jshell-injection` |
109+
| Java/Kotlin | `java/javaee-expression-injection` |
110+
| Java/Kotlin | `java/jython-injection` |
111+
| Java/Kotlin | `java/unsafe-eval` |
112+
| Java/Kotlin | `java/spring-view-manipulation-implicit` |
113+
| Java/Kotlin | `java/spring-view-manipulation` |
114+
| JavaScript/TypeScript | `js/enabling-electron-renderer-node-integration` |
115+
| JavaScript/TypeScript | `js/template-object-injection` |
116+
| JavaScript/TypeScript | `js/code-injection` |
117+
| JavaScript/TypeScript | `js/bad-code-sanitization` |
118+
| JavaScript/TypeScript | `js/unsafe-code-construction` |
119+
| JavaScript/TypeScript | `js/unsafe-dynamic-method-access` |
120+
| JavaScript/TypeScript | `js/prototype-polluting-assignment` |
121+
| JavaScript/TypeScript | `js/prototype-pollution-utility` |
122+
| JavaScript/TypeScript | `js/prototype-pollution` |
123+
| JavaScript/TypeScript | `js/code-injection-dynamic-import` |
124+
| JavaScript/TypeScript | `js/code-injection-more-sources` |
125+
| JavaScript/TypeScript | `js/prototype-polluting-assignment-more-sources` |
126+
| Python | `py/use-of-input` |
127+
| Python | `py/code-injection` |
128+
| Python | `py/js2py-rce` |
129+
| Ruby | `rb/server-side-template-injection` |
130+
| Ruby | `rb/code-injection` |
131+
| Ruby | `rb/unsafe-code-construction` |
132+
| Swift | `swift/unsafe-webview-fetch` |
133+
| Swift | `swift/unsafe-js-eval` |
134+
135+
### CWE-502: Deserialization of Untrusted Data
136+
137+
| Language | Query |
138+
| --- | --- |
139+
| C# | `cs/deserialized-delegate` |
140+
| C# | `cs/unsafe-deserialization` |
141+
| C# | `cs/unsafe-deserialization-untrusted-input` |
142+
| Java/Kotlin | `java/unsafe-deserialization` |
143+
| Java/Kotlin | `java/log4j-injection` |
144+
| Java/Kotlin | `java/unsafe-deserialization-rmi` |
145+
| Java/Kotlin | `java/unsafe-deserialization-spring-exporter-in-configuration-class` |
146+
| Java/Kotlin | `java/unsafe-deserialization-spring-exporter-in-xml-configuration` |
147+
| JavaScript/TypeScript | `js/unsafe-deserialization` |
148+
| JavaScript/TypeScript | `js/unsafe-deserialization-more-sources` |
149+
| Python | `py/unsafe-deserialization` |
150+
| Ruby | `rb/unsafe-unsafeyamldeserialization` |
151+
| Ruby | `rb/unsafe-deserialization` |
152+
153+
### CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
154+
155+
| Language | Query |
156+
| --- | --- |
157+
| C/C++ | `cpp/path-injection` |
158+
| C# | `cs/path-injection` |
159+
| C# | `cs/zipslip` |
160+
| C# | `cs/webclient-path-injection` |
161+
| Go | `go/path-injection` |
162+
| Go | `go/unsafe-unzip-symlink` |
163+
| Go | `go/zipslip` |
164+
| Java/Kotlin | `java/path-injection` |
165+
| Java/Kotlin | `java/zipslip` |
166+
| Java/Kotlin | `java/partial-path-traversal` |
167+
| Java/Kotlin | `java/partial-path-traversal-from-remote` |
168+
| Java/Kotlin | `java/openstream-called-on-tainted-url` |
169+
| JavaScript/TypeScript | `js/path-injection` |
170+
| JavaScript/TypeScript | `js/zipslip` |
171+
| Python | `py/path-injection` |
172+
| Python | `py/tarslip` |
173+
| Python | `py/zipslip` |
174+
| Python | `py/tarslip-extended` |
175+
| Python | `py/unsafe-unpacking` |
176+
| Ruby | `rb/zip-slip` |
177+
| Ruby | `rb/path-injection` |
178+
| Rust | `rust/path-injection` |
179+
| Swift | `swift/unsafe-unpacking` |
180+
| Swift | `swift/path-injection` |
181+
182+
### CWE-306: Missing Authentication for Critical Function
183+
184+
No matching CodeQL query IDs were found for CWE-306 in [codeql_cwe_coverage.md](codeql_cwe_coverage.md).
185+
186+
### CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
187+
188+
| Language | Query |
189+
| --- | --- |
190+
| C/C++ | `cpp/sql-injection` |
191+
| C# | `cs/sql-injection` |
192+
| Go | `go/sql-injection` |
193+
| Go | `go/unsafe-quoting` |
194+
| Java/Kotlin | `java/concatenated-sql-query` |
195+
| Java/Kotlin | `java/sql-injection` |
196+
| Java/Kotlin | `java/mybatis-annotation-sql-injection` |
197+
| Java/Kotlin | `java/mybatis-xml-sql-injection` |
198+
| JavaScript/TypeScript | `js/sql-injection` |
199+
| JavaScript/TypeScript | `js/env-key-and-value-injection` |
200+
| JavaScript/TypeScript | `js/env-value-injection` |
201+
| JavaScript/TypeScript | `js/sql-injection-more-sources` |
202+
| Python | `py/sql-injection` |
203+
| Ruby | `rb/sql-injection` |
204+
| Rust | `rust/sql-injection` |
205+
| Swift | `swift/sql-injection` |
206+
207+
### CWE-416: Use After Free
208+
209+
| Language | Query |
210+
| --- | --- |
211+
| C/C++ | `cpp/use-after-free` |
212+
| C/C++ | `cpp/iterator-to-expired-container` |
213+
| C/C++ | `cpp/use-of-string-after-lifetime-ends` |
214+
| C/C++ | `cpp/use-of-unique-pointer-after-lifetime-ends` |
215+
| C/C++ | `cpp/use-after-expired-lifetime` |
216+
217+
### CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
218+
219+
| Language | Query |
220+
| --- | --- |
221+
| GitHub Actions | `actions/envpath-injection/critical` |
222+
| GitHub Actions | `actions/envpath-injection/medium` |
223+
| GitHub Actions | `actions/envvar-injection/critical` |
224+
| GitHub Actions | `actions/envvar-injection/medium` |
225+
| GitHub Actions | `actions/command-injection/critical` |
226+
| GitHub Actions | `actions/command-injection/medium` |
227+
| GitHub Actions | `actions/argument-injection/critical` |
228+
| GitHub Actions | `actions/argument-injection/medium` |
229+
| C/C++ | `cpp/command-line-injection` |
230+
| C/C++ | `cpp/wordexp-injection` |
231+
| C# | `cs/command-line-injection` |
232+
| Go | `go/command-injection` |
233+
| Go | `go/stored-command` |
234+
| Go | `go/unsafe-quoting` |
235+
| Java/Kotlin | `java/relative-path-command` |
236+
| Java/Kotlin | `java/command-line-injection` |
237+
| Java/Kotlin | `java/exec-tainted-environment` |
238+
| Java/Kotlin | `java/concatenated-command-line` |
239+
| Java/Kotlin | `java/ognl-injection` |
240+
| Java/Kotlin | `java/command-line-injection-extra` |
241+
| Java/Kotlin | `java/command-line-injection-extra-local` |
242+
| Java/Kotlin | `java/command-line-injection-experimental` |
243+
| JavaScript/TypeScript | `js/command-line-injection` |
244+
| JavaScript/TypeScript | `js/indirect-command-line-injection` |
245+
| JavaScript/TypeScript | `js/second-order-command-line-injection` |
246+
| JavaScript/TypeScript | `js/shell-command-injection-from-environment` |
247+
| JavaScript/TypeScript | `js/shell-command-constructed-from-input` |
248+
| JavaScript/TypeScript | `js/unnecessary-use-of-cat` |
249+
| JavaScript/TypeScript | `js/prototype-polluting-assignment` |
250+
| JavaScript/TypeScript | `js/prototype-pollution-utility` |
251+
| JavaScript/TypeScript | `js/prototype-pollution` |
252+
| JavaScript/TypeScript | `js/command-line-injection-more-sources` |
253+
| JavaScript/TypeScript | `js/prototype-polluting-assignment-more-sources` |
254+
| Python | `py/command-line-injection` |
255+
| Python | `py/shell-command-constructed-from-input` |
256+
| Ruby | `rb/command-line-injection` |
257+
| Ruby | `rb/kernel-open` |
258+
| Ruby | `rb/non-constant-kernel-open` |
259+
| Ruby | `rb/shell-command-constructed-from-input` |
260+
| Swift | `swift/command-line-injection` |

0 commit comments

Comments
 (0)