Amazon QDetector Library Sign in to Amazon Q

Q

Detector Library

Python detectors (131/131)

Improper privilege management Spawning a process without main module Integer overflow Catch and swallow exception Insufficient Logging CDK Unauthenticated LDAP requests Path traversal Loose file permissions Exposure of Sensitive Information CDK File injection Incorrect use of Process.terminate API XML External Entity Pytorch use nondeterministic algoritm Set SNS Return Subscription ARN Tensorflow enable ops determinism Outdated subprocess module API Improper input validation Improper authentication Missing pagination Semaphore overflow prevention Insecure cookie Usage of an API that is not recommended - Low Severity Socket connection timeout AWS client not reused in a Lambda function Pytorch assign in place mod Leaky subprocess timeout Pytorch disable gradient calculation Risky use of dict get method XPath injection Missing authorization Multidimensional list initialization using replication is error prone SQL injection Pytorch miss call to eval AWS AppConfig Improper certificate validation URL redirection to untrusted site Mutually exclusive call Notebook best practice violation Stack trace exposure Use of a deprecated method AWS api logging disabled cdk OS command injection AWS credentials logged Missing Authorization CDK Zip bomb attack Sensitive data stored unencrypted due to partial encryption Synchronous publication of AWS Lambda metrics Unrestricted upload of dangerous file type Pytorch redundant softmax Insecure connection using unencrypted protocol Unauthenticated Amazon SNS unsubscribe requests might succeed Insecure Socket Bind Insecure CORS policy Cross-site request forgery Garbage collection prevention in multiprocessing Catch and rethrow exception Weak algorithm used for Password Hashing Missing none check on response metadata Sensitive information leak Client-side KMS reencryption Override of reserved variable names in a Lambda function Docker arbitrary container run Direct dict object modification Catastrophic backtracking regex Resource management errors cdk Resource leak Tensorflow redundant softmax AWS insecure transmission CDK Public method parameter validation Improper error handling Time zone aware datetimes Pytorch control sources of randomness Deadlocks caused by improper multiprocessing API usage Low maintainability with low class cohesion Untrusted AMI images Notebook invalid execution order Confusion between equality and identity in conditional expression Pytorch sigmoid before bceloss Pytorch data loader with multiple workers Pytorch avoid softmax with nllloss Pytorch miss call to zero grad Error prone sequence modification AWS missing encryption of sensitive data cdk Bad exception handling Use of Default Credentials CDK Notebook variable redefinition Do not pass generic exception rule Usage of an API that is not recommended - High Severity Insecure cryptography S3 partial encrypt CDK Cross-site scripting Mutable objects as default arguments of functions Improper Access Control CDK Violation of PEP8 programming recommendations Insecure temporary file or directory Complex code hard to maintain aws kmskey encryption cdk Usage of an API that is not recommended Enabling and overriding debug feature Deserialization of untrusted object Use of an inefficient or incorrect API Avoid using nondeterministic Tensorflow API Inefficient string concatenation inside loop Improper sanitization of wildcards or matching symbols Insecure hashing Using AutoAddPolicy or WarningPolicy Log injection Weak obfuscation of web request Socket close platform compatibility Unsanitized input is run as code Batch request with unchecked failures Inefficient polling of AWS resource Hardcoded interface binding Hardcoded IP address Hardcoded credentials Server-side request forgery Module injection Unnecessary iteration Tensorflow control sources of randomness Missing Authentication for Critical Function CDK Usage of an API that is not recommended - Medium Severity Unsafe Cloudpickle Load Incorrect binding of SNS publish operations PyTorch create tensors directly on device Inefficient new method from hashlib Dangerous global variables Multiple values in return statement is prone to error LDAP injection Clear text credentials Missing S3 bucket owner condition AWS missing encryption CDK

Security detectors

Improper privilege management

Privilege escalation happens when a malicious user gains elevated access to resources that should be unavailable to them.

Spawning a process without main module

Using the spawn or forkserver start method without importing the main module might lead to unexpected behavior (for example, it might cause a RuntimeError).

Integer overflow

An integer overflow might might cause security issues when it is used for resource management or execution control.

Unauthenticated LDAP requests

Unauthenticated LDAP requests can allow untrusted access to LDAP servers.

Path traversal

Constructing path names with unsanitized user input can lead to path traversal attacks (for example, ../../..) that allow an attacker access to file system resources.

Loose file permissions

Weak file permissions can lead to privilege escalation.

File injection

Writing unsanitized user data to a file is unsafe.

XML External Entity

Objects that parse or handle XML can lead to XML External Entity (XXE) attacks when misconfigured.

Improper input validation

Improper input validation can enable attacks and lead to unwanted behavior.

Improper authentication

Your code doesn't sufficiently authenticate identities provided by its users.

Missing pagination

Missing pagination on a paginated call can lead to inaccurate results.

Insecure cookie

Insecure cookies can lead to unencrypted transmission of sensitive data.

Usage of an API that is not recommended - Low Severity

APIs that are not recommended were found - Low Severity.

Socket connection timeout

Not setting the connection timeout parameter can cause a blocking socket connection.

XPath injection

Potentially unsanitized user input in XPath queries can allow an attacker to control the query in unwanted or insecure ways.

Missing authorization

Missing authorization checks can lead to unauthorized access to a resource or performance of an action.

SQL injection

Use of untrusted inputs in a SQL database query can enable attackers to read, modify, or delete sensitive data in the database

Improper certificate validation

Lack of validation of a security certificate can lead to host impersonation and sensitive data leaks.

URL redirection to untrusted site

User-controlled input that specifies a link to an external site could lead to phishing attacks and allow user credentials to be stolen.

Mutually exclusive call

Calls to mutually exclusive methods were found in the code.

Stack trace exposure

Stack traces can be hard to use for debugging.

AWS api logging disabled cdk

Api Logging Disabled may lead to unable to access log and does not record the event.

OS command injection

Constructing operating system or shell commands with unsanitized user input can lead to inadvertently running malicious code.

AWS credentials logged

Logging unencrypted AWS credentials can expose them to an attacker.

Missing Authorization CDK

Improper Access Control.

Zip bomb attack

Expanding unsanitized archive files taken as input can lead to zip bomb attacks.

Sensitive data stored unencrypted due to partial encryption

Encryption that is dependent on conditional logic, such as an if...then clause, might cause unencrypted sensitive data to be stored.

Unrestricted upload of dangerous file type

Insufficiently restrictive file uploads can lead to inadvertently running malicious code.

Insecure connection using unencrypted protocol

Connections that use insecure protocols transmit data in cleartext, which can leak sensitive information.

Unauthenticated Amazon SNS unsubscribe requests might succeed

Failing to set the AuthenticateOnUnsubscribe flag to True when confirming an SNS subscription can lead to unauthenticated cancellations.

Insecure Socket Bind

Binding the socket with an empty IP address can introduce security risks.

Insecure CORS policy

Cross-Origin Resource Sharing policies that are too permissive may lead to security vulnerabilities.

Cross-site request forgery

Insecure configuration can lead to a cross-site request forgery (CRSF) vulnerability.

Garbage collection prevention in multiprocessing

Passing a parent process object in a child process can prevent its garbage collection.

Weak algorithm used for Password Hashing

Weak algorithm used for Password Hashing. Consider using stronger algorithms, such as Argon2, PBKDF2, or scrypt.

Sensitive information leak

Exposure of sensitive information can lead to an unauthorized actor having access to the information.

Client-side KMS reencryption

Client-side decryption followed by reencryption is inefficient and can lead to sensitive data leaks.

Override of reserved variable names in a Lambda function

Overriding environment variables that are reserved by AWS Lambda might lead to unexpected behavior.

Docker arbitrary container run

Passing an unsanitized user argument to a function call makes your code insecure.

Resource management errors cdk

Software system fails to properly track or release resources during its operation. This can lead to resource leaks.

Resource leak

Allocated resources are not released properly.

AWS insecure transmission CDK

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Public method parameter validation

Public method parameters should be validated for nullness, unexpected values, and malicious values.

Untrusted AMI images

Improper filtering of Amazon Machine Images (AMIs) can result in loading an untrusted image, a potential security vulnerability.

AWS missing encryption of sensitive data cdk

Sensitive or critical information is not encrypted before storage or transmission in the product.

Usage of an API that is not recommended - High Severity

APIs that are not recommended were found - High Severity.

Insecure cryptography

Weak, broken, or misconfigured cryptography can lead to security vulnerabilities.

S3 partial encrypt CDK

An unencrypted bucket could lead to sensitive data exposure.

Cross-site scripting

Relying on potentially untrusted user inputs when constructing web application outputs can lead to cross-site scripting vulnerabilities.

Insecure temporary file or directory

Insecure ways of creating temporary files and directories can lead to race conditions, privilege escalation, and other security vulnerabilities.

aws kmskey encryption cdk

Using an AWS KMS key helps follow the standard security advice of granting least privilege to objects generated by the project.

Usage of an API that is not recommended

APIs that are not recommended were found.

Deserialization of untrusted object

Deserialization of untrusted objects can lead to security vulnerabilities such as inadvertently running remote code.

Improper sanitization of wildcards or matching symbols

Unsanitized wildcards or special matching symbols in user-provided strings can enable attacks and lead to unwanted behavior.

Insecure hashing

Obsolete, broken, or weak hashing algorithms can lead to security vulnerabilities.

Using AutoAddPolicy or WarningPolicy

Using AutoAddPolicy or WarningPolicy can allow a malicious server to impersonate a trusted server.

Log injection

Using untrusted inputs in a log statement can enable attackers to break the log's format, forge log entries, and bypass log monitors.

Weak obfuscation of web request

Weak obfuscation while configuring a web request.

Unsanitized input is run as code

Scripts generated from unsanitized inputs can lead to malicious behavior and inadvertently running code remotely.

Hardcoded interface binding

Binding to all network interfaces can open a service up to traffic on interfaces that are not properly documented or secured.

Hardcoded IP address

Hardcoding an IP address can cause security problems.

Hardcoded credentials

Credentials, such as passwords and access keys, should not be hardcoded in source code.

Server-side request forgery

Insufficient sanitization of potentially untrusted URLs on the server side can allow server requests to unwanted destinations.

Module injection

Untrusted user imports in the importlib.import_module() function allow attacks.

Usage of an API that is not recommended - Medium Severity

APIs that are not recommended were found - Medium Severity.

Unsafe Cloudpickle Load

Pickling issues on Cloudpickle Load.

LDAP injection

LDAP queries that rely on potentially untrusted inputs can allow attackers to read or modify sensitive data, run code, and perform other unwanted actions.

Clear text credentials

Credentials that are stored in clear text can be intercepted by a malicious actor.

Missing S3 bucket owner condition

Not setting the S3 bucket owner condition might introduce a risk of accidentally using a wrong bucket.

AWS missing encryption CDK

The AWS resource is missing appropriate encryption.