MalDet · Static Security Report
This repository has two distinct security issues that require immediate attention before it can be considered safe for production use. The most critical finding is a vulnerability score of 338.0, which indicates severe insecure coding patterns in Go code that could allow attackers to inject malicious SQL queries into the database. Additionally, there are multiple signs of malicious intent including preinstall scripts used for malware delivery and steganography techniques designed to hide commands within normal application files. While some findings like string concatenation with user input do look like ordinary insecure coding rather than intentional attacks, they still represent significant risks that must be fixed immediately. The repository should not be deployed until these critical vulnerabilities are patched and the malicious patterns are removed or replaced with secure alternatives.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| semgrep | Insecure coding patterns across many languages | 7 | 158 | 1 | 166 |
| yara | Signatures of malicious behaviour in source files | 23 | 0 | 8 | 31 |
| guarddog | Malicious package and install-time behaviour | 2 | 3 | 2 | 7 |
121 of 204 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | semgrep | Detected string concatenation with a non-literal variable in a "database/sql" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use pre | 2 | /object/ormer.go:212 |
| high | guarddog | Detects npm preinstall scripts, which are almost exclusively used for malware delivery [threat-npm-preinstall-script] | 1 | /web/package.json:17 |
| high | guarddog | Detects steganography decode followed by code execution [threat-runtime-obfuscation-steganography] | 1 | /web/src/lib/setting.tsx:1157 |
| high | semgrep | JWT token detected | 2 | /idp/okta.go:72 |
| high | semgrep | Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. | 2 | /controllers/casbin_cli_api.go:115 |
| high | semgrep | Private Key detected. This is a sensitive credential and should not be hardcoded here. Instead, store this in a separate, private file. | 1 | /object/token_jwt_key.key:1 |
| high | yara | YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed | 5 | /swagger/swagger-ui-es-bundle-core.js.map |
| high | yara | YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone | 8 | /swagger/swagger-ui-bundle.js |
| high | yara | YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together | 10 | /swagger/swagger-ui-es-bundle.js |
| medium | semgrep | RegExp() called with a `key` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled | 4 | /web-old/src/SELinuxEntryViewer.js:57 |
| medium | semgrep | RegExp() called with a `signupItem` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-cont | 8 | /web-old/src/auth/SignupPage.js:560 |
| medium | semgrep | RegExp() called with a `item` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled | 7 | /web/src/lib/account-items.ts:86 |
| medium | semgrep | RegExp() called with a `accountItem` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-con | 2 | /web-old/src/UserEditPage.js:1479 |
| medium | semgrep | Service 'db' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this service to p | 1 | /docker-compose.yml:18 |
| medium | semgrep | Detection of write from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use write, consider using a sanitization library such as DOMPurify to sanitize your HTML. | 2 | /web/src/components/auth/ProviderButtons.tsx:44 |
| medium | semgrep | Detected DES cipher algorithm which is insecure. The algorithm is considered weak and has been deprecated. Use AES instead. | 1 | /util/obfuscator.go:64 |
| medium | semgrep | Detects creations of tls configuration objects with an insecure MinVersion of TLS. These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities. | 1 | /ldap/server.go:89 |
| medium | semgrep | `metadata.replace` method will only replace the first occurrence when used with a string argument ("\n"). If this method is used for escaping of dangerous data then there is a possibility for a bypass. Try to use sanitization library instead or use a Regex with a global flag. | 1 | /web/src/pages/ProviderEditPage.tsx:561 |
| medium | semgrep | `this.state.provider.metadata.replace` method will only replace the first occurrence when used with a string argument ("\n"). If this method is used for escaping of dangerous data then there is a possibility for a bypass. Try to use sanitization library instead or use a Regex with a global flag. | 1 | /web-old/src/ProviderEditPage.js:668 |
| medium | semgrep | Service 'db' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this. | 1 | /docker-compose.yml:18 |
| medium | semgrep | The application accepts potentially user-controlled input `$PROP` which can control the location of the current window context. This can lead two types of vulnerabilities open-redirection and Cross-Site-Scripting (XSS) with JavaScript URIs. It is recommended to validate user-controllable input befor | 6 | /web/public/AuthCallbackHandler.js:447 |
| medium | semgrep | The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious d | 1 | /web-old/src/common/modal/CropperDivModal.js:69 |
| medium | guarddog | Detects URLs to URL shorteners, file sharing, and suspicious services [threat-network-outbound-shady-links] | 2 | /web-old/src/serviceWorker.js:61 |
| medium | guarddog | Detects LOLBAS usage in install hooks (execution and network tools) [threat-process-hooks] | 1 | /web/package.json:17 |
| medium | semgrep | A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by setting 'HttpOnly' to 'true' in the Cookie. | 1 | /service/oauth.go:81 |
| medium | semgrep | No validation of origin is done by the addEventListener API. It may be possible to exploit this flaw to perform Cross Origin attacks such as Cross-Site Scripting(XSS). | 2 | /web/src/components/casbin/CasbinEditor.tsx:113 |
| medium | semgrep | An HTTP redirect was found to be crafted from user-input `r`. This can lead to open redirect vulnerabilities, potentially allowing attackers to redirect users to malicious web sites. It is recommend where possible to not allow user-input to craft the redirect URL. When user-input is necessary to cra | 4 | /service/oauth.go:39 |
| medium | semgrep | The target origin of the window.postMessage() API is set to "*". This could allow for information disclosure due to the possibility of any origin allowed to receive the message. | 8 | /web-old/src/IframeEditor.js:31 |
| medium | semgrep | Detected 'Fprintf' or similar writing to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users. | 3 | /service/util.go:50 |
| medium | semgrep | Disabled host key verification detected. This allows man-in-the-middle attacks. Use the 'golang.org/x/crypto/ssh/knownhosts' package to do host key verification. See https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/ to learn more about the problem and how to fix it. | 3 | /object/viaSSHDialer.go:105 |
| medium | semgrep | ReverseProxy can remove headers added by Director. Consider using ReverseProxy.Rewrite instead of ReverseProxy.Director. | 2 | /controllers/mcp_server.go:107 |
| medium | semgrep | A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct. | 1 | /service/oauth.go:81 |
| medium | semgrep | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. | 6 | /util/string.go:198 |
| medium | semgrep | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. | 2 | /object/ldap_password_type.go:31 |
| medium | semgrep | `MinVersion` is missing from this TLS configuration. By default, as of Go 1.22, TLS 1.2 is currently used as the minimum. General purpose web applications should default to TLS 1.3 with all other protocols disabled. Only where it is known that a web server must support legacy clients with unsuppor | 7 | /object/syncer_activedirectory.go:150 |
| medium | semgrep | String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data. | 3 | /sync/database_canal.go:50 |
| medium | semgrep | GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: ac | 33 | /.github/workflows/build.yml:168 |
| medium | semgrep | Deserializing into `interface{}` allows arbitrary data structures and types, which can lead to security vulnerabilities (CWE-502). Use a concrete struct type instead. | 1 | /controllers/scan.go:94 |
| medium | semgrep | Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. | 2 | /web/src/lib/setting.tsx:1157 |
| medium | semgrep | Checks for disabling of TLS/SSL certificate verification. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks. | 5 | /proxy/proxy.go:95 |
| medium | semgrep | Detected a possible denial-of-service via a zip bomb attack. By limiting the max bytes read, you can mitigate this attack. `io.CopyN()` can specify a size. | 2 | /controllers/cli_downloader.go:295 |
| medium | semgrep | Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information. | 1 | /service/proxy.go:321 |
| medium | semgrep | Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HT | 22 | /web-old/src/Setting.js:2427 |
| medium | semgrep | If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to | 8 | /object/token_jwt.go:448 |
| medium | semgrep | This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted | 5 | /web-old/public/index.html:17 |
| medium | semgrep | In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, | 1 | /k8s.yaml:39 |
| low | guarddog | Detects heavy obfuscation techniques commonly used by malware [threat-runtime-obfuscation] | 1 | /swagger/swagger-ui-bundle.js:2 |
| low | guarddog | Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read] | 1 | /storage/aliyun_oss.go:36 |
| low | semgrep | When running containers in Kubernetes, it's important to ensure that they are properly secured to prevent privilege escalation attacks. One potential vulnerability is when a container is allowed to run applications as the root user, which could allow an attacker to gain access to sensitive resou | 1 | /k8s.yaml:37 |
| low | yara | YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version | 8 | /swagger/swagger-ui-es-bundle.js.map |