• Home
• io.codemodder
• core-codemods
• 0.92.0
• source code
• report.json

×

Project download

Many resources are needed to download a project. Please understand that we have to compensate our server costs. Thank you in advance.
Project price only 1 $

You can buy this project and download/modify it how often you want.

io.codemodder.codemods.VerbTamperingCodemod.report.json Maven / Gradle / Ivy

{
  "summary" : "Introduced protections against verb tampering attacks (authN/authZ bypass)",
  "change" : "Removed  from the  definition which paradoxically remove the authentication from endpoints with any methods not listed",
  "reviewGuidanceJustification" : "This is an incredibly unintuitive situation and in our professional experience have never seen any time developers intended to grant access to \"all other\" HTTP methods by specifically listing others.",
  "references": ["https://dl.packetstormsecurity.net/papers/web/Bypassing_VBAAC_with_HTTP_Verb_Tampering.pdf","https://vulncat.fortify.com/en/detail?id=desc.config.java.http_verb_tampering", "https://capec.mitre.org/data/definitions/274.html"]
}