russell@unturf.com
6be275b46d
MOAD-0004 CWE-312: EveHttpLogJSONHeaders() in output-json-http.c logs HTTP credential headers (Authorization, Proxy-Authorization, Cookie, Set-Cookie) verbatim when dump-all-headers or custom field logging is enabled. Patch adds a credential denylist that emits "[REDACTED]" instead of the raw value. Default suricata.yaml.in shows Authorization as a custom field example with no warning. Unit test 5/5 PASS. MOADs 0001/0002/0003/0005 CLEAN: bitarray+hash+radix+RB-tree hot paths, per-tenant DetectEngineCtx, thread-scoped thread_local, HRLOCK-guarded THash.
44 lines
2.1 KiB
Text
44 lines
2.1 KiB
Text
suricata — 5-MOAD scan results
|
|
|
|
Target: https://github.com/OISF/suricata (depth=1)
|
|
Language: C
|
|
Date: 2026-03-31
|
|
Scanned by: agent blackops
|
|
|
|
MOAD-0001 CWE-407 (linear scan in loop):
|
|
CLEAN. Suricata uses bitarrays (SigGroupHead sig_array), hash tables
|
|
(SigGroupHeadHashTable, MpmInitHash, THashLookupFromHash with HRLOCK),
|
|
and red-black trees (TCPSEG, SBB) throughout hot paths. Merge-sort
|
|
(O(N log N)) is used for signature ordering. No O(N^2) per-packet path
|
|
found. The probing parser port list scan is O(P) with P < 50 entries.
|
|
|
|
MOAD-0002 Intertangle:
|
|
CLEAN. Subsystems are cleanly separated. The detection engine uses a
|
|
per-tenant DetectEngineCtx. App-layer parsers run in their own context.
|
|
Global registration lists (g_app_inspect_engines etc.) are write-once
|
|
at startup and read-only thereafter. No god object coupling independent
|
|
subsystems through shared mutable state.
|
|
|
|
MOAD-0003 Leaked Context:
|
|
CLEAN. All thread_local variables hold thread-scoped data:
|
|
thread_pkt_pool (packet pool), t_thread_name (thread identifier),
|
|
pcap_file_thread (output file handle), tcp_pool_cache (segment pool),
|
|
locks[] (lock profiling). None holds request-scoped identity that
|
|
could leak across flow or packet boundaries.
|
|
|
|
MOAD-0004 CWE-312 (credentials logged verbatim):
|
|
DEFECT — see defects/suricata-0001/ for patch and test.
|
|
EveHttpLogJSONHeaders() in src/output-json-http.c logs all header values
|
|
verbatim when dump-all-headers is enabled or when a custom field list
|
|
includes credential headers. The default suricata.yaml.in shows
|
|
"Authorization" as a custom field example with no warning. At runtime:
|
|
Authorization (Bearer/Basic tokens), Proxy-Authorization, Cookie
|
|
(session tokens), and Set-Cookie values appear in eve.log in cleartext.
|
|
|
|
MOAD-0005 Thundering Herd:
|
|
CLEAN. THashLookupFromHash acquires a per-row HRLOCK before any read
|
|
or write. THashAdd uses the same HRLOCK. No get+null+compute+put
|
|
race window exists. Flow hash (FlowGetFlowFromHash) also uses per-bucket
|
|
mutex (FBLOCK_LOCK). No concurrent cache unsynchronized race found.
|
|
|
|
Summary: 1 defect (suricata-0001 MOAD-0004 CWE-312 MEDIUM)
|