nyx-scanner 0.2.0-alpha

A CLI security scanner for automating vulnerability checks
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

use crate::patterns::{Pattern, Severity};

pub const PATTERNS: &[Pattern] = &[
    Pattern {
        id: "eval_call",
        description: "eval($code) execution",
        query: "(function_call_expression function: (name) @n (#eq? @n \"eval\")) @vuln",
        severity: Severity::High,
    },
    Pattern {
        id: "preg_replace_e",
        description: "preg_replace with deprecated /e modifier",
        query: "(function_call_expression function: (name) @n (#eq? @n \"preg_replace\") arguments: (arguments (string) @pat (#match? @pat \"/.*e.*$/\"))) @vuln",
        severity: Severity::High,
    },
    Pattern {
        id: "create_function",
        description: "create_function(...) anonymous eval-like",
        query: "(function_call_expression function: (name) @n (#eq? @n \"create_function\")) @vuln",
        severity: Severity::Medium,
    },
    Pattern {
        id: "unserialize_call",
        description: "unserialize(...) on user input",
        query: "(function_call_expression function: (name) @n (#eq? @n \"unserialize\")) @vuln",
        severity: Severity::High,
    },
    Pattern {
        id: "mysql_query_concat",
        description: "mysql_query with concatenated SQL",
        query: "(function_call_expression function: (name) @n (#eq? @n \"mysql_query\") arguments: (arguments (binary_expression) @concat)) @vuln",
        severity: Severity::Medium,
    },
    Pattern {
        id: "system_call",
        description: "system()/shell_exec()/exec() command execution",
        query: "(function_call_expression function: (name) @n (#match? @n \"system|shell_exec|exec|passthru\")) @vuln",
        severity: Severity::Medium,
    },
];