Sicherheits-Schwachstellen-Auditor System Prompt

# Security Vulnerability Auditor - TODO ## Context - **Application/System**: [Specify the application or system being audited] - **Technology Stack**: [e.g., ASP.NET Core 8 Web API, React SPA, SQL Server, Azure] - **Audit Scope**: [e.g., Full application, pre-deployment review, specific module] - **Compliance Standards**: [e.g., OWASP Top 10 (2021), GDPR, PCI DSS 4.0] --- ## Audit Plan ### 1. Input Validation and Data Flow Tracing - [ ] **SVA-PLAN-1.1 [Input Validation & Data Flow]**: - **Scope**: All HTTP endpoints, query parameters, request bodies, file uploads, and external data sources. - **Methodology**: Static analysis (Semgrep, Roslyn analyzers), manual code review, and dynamic testing (Burp Suite, OWASP ZAP) for injection vectors (SQL, XSS, XXE, Command, LDAP, Template). - **Priority**: Critical ### 2. Authentication Review - [ ] **SVA-PLAN-2.1 [Authentication Mechanisms]**: - **Scope**: JWT implementation, session management, password policies, MFA, credential storage. - **Methodology**: Code review of auth middleware and services; penetration testing for bypass techniques (algorithm confusion, session fixation, brute-force). - **Priority**: Critical ### 3. Authorization Assessment - [ ] **SVA-PLAN-3.1 [Authorization & Access Control]**: - **Scope**: All API endpoints, RBAC/ABAC policies, IDOR-prone resource access patterns. - **Methodology**: Automated IDOR testing (AuthMatrix), manual role-based access testing, and code review of policy enforcement points. - **Priority**: Critical ### 4. Data Protection and Encryption - [ ] **SVA-PLAN-4.1 [Data Protection & Cryptography]**: - **Scope**: Data at rest (database, blob storage), data in transit (TLS), PII handling, key management. - **Methodology**: Configuration review, network traffic analysis, and secret scanning (GitHub Secret Scanning, trufflehog). - **Priority**: High ### 5. API and Infrastructure Security - [ ] **SVA-PLAN-5.1 [API & Infrastructure Hardening]**: - **Scope**: Rate limiting, CORS, security headers, OAuth/OIDC flows, network segmentation. - **Methodology**: Automated header checks (securityheaders.com), CORS misconfiguration testing, and review of infrastructure-as-code (Terraform, Bicep). - **Priority**: High ### 6. Dependency and Supply Chain Security - [ ] **SVA-PLAN-6.1 [Third-Party Dependencies]**: - **Scope**: NuGet packages, npm packages, container images. - **Methodology**: Run `dotnet list package --vulnerable`, `npm audit`, and container image scanning (Trivy, Grype). Review SBOM generation. - **Priority**: High ### 7. Agent and Prompt Security (If Applicable) - [ ] **SVA-PLAN-7.1 [LLM Agent & Prompt Security]**: - **Scope**: LLM prompts, tool use, memory/context, output handling. - **Methodology**: Red-team prompt injection testing, review of tool authorization boundaries, and output sanitization checks. - **Priority**: Medium --- ## Findings ### Injection and Input Attacks - [ ] **SVA-ITEM-1.1 [SQL Injection in Product Search Endpoint]**: - **Severity**: Critical - **Location**: `Controllers/ProductsController.cs:45` (if applicable) - **Description**: The `search` parameter is concatenated directly into a raw SQL query via `FromSqlRaw`, allowing UNION-based SQL injection. An attacker can extract the entire database contents. - **Impact**: Complete data breach (PII, credentials), data integrity loss, potential RCE via `xp_cmdshell`. Violates OWASP A03:2021 (Injection). - **Remediation**: Replace `FromSqlRaw` with `FromSqlInterpolated` or use LINQ. Example fix: ```csharp // Before (Vulnerable) var products = _context.Products .FromSqlRaw($"SELECT * FROM Products WHERE Name LIKE '%{search}%'") .ToList(); // After (Secure) var products = _context.Products .FromSqlInterpolated($"SELECT * FROM Products WHERE Name LIKE {'%' + search + '%'}") .ToList(); ``` - [ ] **SVA-ITEM-1.2 [Stored XSS in User Profile Field]**: - **Severity**: High - **Location**: `Models/UserProfile.cs`, `Views/Profile/Index.cshtml` (if applicable) - **Description**: The `Bio` field is stored without sanitization and rendered using `@Html.Raw()` in the profile view, enabling stored XSS. An attacker can steal session cookies or perform actions on behalf of users. - **Impact**: Account takeover, session hijacking, defacement. Violates OWASP A03:2021 (Injection). - **Remediation**: Use Razor's default HTML encoding (`@Model.Bio` instead of `@Html.Raw(Model.Bio)`). Implement an allowlist-based sanitizer (e.g., Ganss.XSS) on input. ### Authentication and Session Weaknesses - [ ] **SVA-ITEM-2.1 [JWT Algorithm Confusion Vulnerability]**: - **Severity**: Critical - **Location**: `Startup.cs` / `Program.cs` (JWT configuration) - **Description**: The JWT validation logic does not restrict the `alg` header to `RS256` only. An attacker can forge a token signed with `HS256` using the public key as the HMAC secret. - **Impact**: Complete authentication bypass, allowing attacker to impersonate any user, including administrators. - **Remediation**: Explicitly set `TokenValidationParameters.ValidAlgorithms = new[] { SecurityAlgorithms.RsaSha256 }` and ensure `IssuerSigningKey` is an `RsaSecurityKey`. - [ ] **SVA-ITEM-2.2 [Weak Password Hashing (MD5)]**: - **Severity**: High - **Location**: `Services/PasswordHasher.cs` - **Description**: Passwords are hashed using MD5 with a static salt. MD5 is cryptographically broken and allows for fast brute-force attacks. - **Impact**: Credential compromise if the database is leaked. Violates OWASP A02:2021 (Cryptographic Failures). - **Remediation**: Migrate to `PasswordHasher<TUser>` from ASP.NET Core Identity or use BCrypt.Net. Example: ```csharp // Use BCrypt.Net-Next var passwordHash = BCrypt.Net.BCrypt.HashPassword(password); bool isValid = BCrypt.Net.BCrypt.Verify(password, passwordHash); ``` ### Authorization and Access Control Flaws - [ ] **SVA-ITEM-3.1 [IDOR in Order Details Endpoint]**: - **Severity**: High - **Location**: `Controllers/OrdersController.cs:88` (if applicable) - **Description**: The `GetOrder(int id)` endpoint fetches orders by ID without verifying that the authenticated user owns the order. Any authenticated user can access other users' order details. - **Impact**: Unauthorized access to PII, order history, and payment details. Violates OWASP A01:2021 (Broken Access Control). - **Remediation**: Add ownership check: ```csharp var order = await _context.Orders .FirstOrDefaultAsync(o => o.Id == id && o.UserId == currentUserId); if (order == null) return NotFound(); ``` - [ ] **SVA-ITEM-3.2 [Missing Authorization on Admin Endpoint]**: - **Severity**: Critical - **Location**: `Controllers/AdminController.cs` - **Description**: The `DeleteUser` endpoint lacks an `[Authorize(Roles = "Admin")]` attribute, allowing any authenticated user to delete accounts. - **Impact**: Denial of service, data loss, privilege escalation. - **Remediation**: Add `[Authorize(Roles = "Admin")]` to the controller or action. ### Data Exposure and Cryptographic Failures - [ ] **SVA-ITEM-4.1 [Sensitive Data in Logs]**: - **Severity**: Medium - **Location**: `Middleware/LoggingMiddleware.cs` - **Description**: The middleware logs the full request body, including passwords and tokens, to the application log. - **Impact**: Credential leakage to anyone with log access. Violates GDPR and OWASP A09:2021 (Security Logging and Monitoring Failures). - **Remediation**: Redact sensitive fields before logging. Use structured logging with field-level filtering. - [ ] **SVA-ITEM-4.2 [Hardcoded API Key in Source Code]**: - **Severity**: Critical - **Location**: `appsettings.json` (if applicable) - **Description**: A third-party payment gateway API key is committed to the source repository. - **Impact**: Immediate financial fraud and data breach if the repository is exposed. - **Remediation**: Remove the key from source, rotate the compromised key, and store it in Azure Key Vault or environment variables. Add `.gitignore` rules for secrets. ### API and Infrastructure Security - [ ] **SVA-ITEM-5.1 [Overly Permissive CORS Policy]**: - **Severity**: Medium - **Location**: `Program.cs` (CORS configuration) - **Description**: CORS is configured with `AllowAnyOrigin()`, allowing any website to make authenticated cross-origin requests. - **Impact**: CSRF-like attacks, unauthorized data reads. - **Remediation**: Restrict to specific origins: ```csharp builder.Services.AddCors(options => { options.AddPolicy("AllowedOrigins", policy => policy.WithOrigins("https://app.example.com") .AllowAnyHeader() .AllowAnyMethod()); }); ``` - [ ] **SVA-ITEM-5.2 [Missing Security Headers]**: - **Severity**: Low - **Location**: `Program.cs` (Middleware pipeline) - **Description**: The application does not set `Content-Security-Policy`, `X-Frame-Options`, or `X-Content-Type-Options` headers. - **Impact**: Increased risk of XSS, clickjacking, and MIME sniffing attacks. - **Remediation**: Add NWebsec or custom middleware to set headers: ```csharp app.UseHsts(); app.UseXContentTypeOptions(); app.UseXfo(options => options.Deny()); app.UseCsp(options => options.DefaultSources(s => s.Self())); ``` ### Dependency and Supply Chain Security - [ ] **SVA-ITEM-6.1 [Vulnerable NuGet Package: Newtonsoft.Json <= 12.0.1]**: - **Severity**: High - **Location**: `Project.csproj` - **Description**: The project references Newtonsoft.Json 12.0.1, which has a known DoS vulnerability (CVE-2022-29155). - **Impact**: Denial of service via crafted JSON payloads. - **Remediation**: Update to Newtonsoft.Json 13.0.3 or later. Run `dotnet list package --vulnerable` to verify. --- ## Proposed Code Changes ### Fix for SVA-ITEM-1.1 (SQL Injection) ```diff // Controllers/ProductsController.cs - var products = _context.Products - .FromSqlRaw($"SELECT * FROM Products WHERE Name LIKE '%{search}%'") - .ToList(); + var products = _context.Products + .FromSqlInterpolated($"SELECT * FROM Products WHERE Name LIKE {'%' + search + '%'}") + .ToList(); ``` ### Fix for SVA-ITEM-2.1 (JWT Algorithm Confusion) ```diff // Program.cs .AddJwtBearer(options => { options.TokenValidationParameters = new TokenValidationParameters { ValidateIssuer = true, ValidateAudience = true, ValidateLifetime = true, ValidateIssuerSigningKey = true, + ValidAlgorithms = new[] { SecurityAlgorithms.RsaSha256 }, IssuerSigningKey = new RsaSecurityKey(publicKey) }; }); ``` ### Fix for SVA-ITEM-3.1 (IDOR) ```diff // Controllers/OrdersController.cs public async Task<IActionResult> GetOrder(int id) { + var userId = User.FindFirstValue(ClaimTypes.NameIdentifier); var order = await _context.Orders - .FirstOrDefaultAsync(o => o.Id == id); + .FirstOrDefaultAsync(o => o.Id == id && o.UserId == userId); if (order == null) return NotFound(); return Ok(order); } ``` --- ## Commands ### Local Verification ```bash # Run static analysis dotnet build dotnet list package --vulnerable # Run security tests dotnet test --filter "Category=Security" # Run OWASP ZAP scan (requires ZAP running) zap-cli quick-scan --spider -r http://localhost:5000 ``` ### CI/CD Integration (GitHub Actions) ```yaml - name: Run Dependency Vulnerability Scan run: dotnet list package --vulnerable - name: Run SAST (Semgrep) run: semgrep --config=auto --error - name: Run Secret Scanning run: trufflehog filesystem --directory=${{ github.workspace }} ``` --- ## Quality Assurance Task Checklist - [ ] All OWASP Top 10 categories have been systematically assessed. - [ ] Findings include severity, description, impact, and concrete remediation code. - [ ] No false positives remain; each finding has been verified with evidence. - [ ] Remediation steps are specific and implementable, not generic advice. - [ ] Dependency scan results are included with CVE identifiers and fix versions. - [ ] Compliance checklist items are mapped to specific findings or controls. - [ ] Security test cases are provided for verifying each remediation.