-
Notifications
You must be signed in to change notification settings - Fork 4
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
9 changed files
with
468 additions
and
45 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Large diffs are not rendered by default.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
148 changes: 148 additions & 0 deletions
148
.../02-testing/09-vulnerabilities/information_disclosure/rest_field_suggestion.mdx
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,148 @@ | ||
| --- | ||
| title: Field Suggestion | ||
| --- | ||
|
|
||
| # Field Suggestion | ||
|
|
||
| ## Description | ||
|
|
||
| **Field Suggestion** allows users to infer the entire schema. Example of errors: ``` Error: Field "XYZ" is missing ```. | ||
|
|
||
| ## Remediation | ||
|
|
||
| Avoid providing verbose error messages to users in production. | ||
|
|
||
|
|
||
|
|
||
| ### REST Specific | ||
|
|
||
| <details> | ||
| <summary>Asp_net</summary> | ||
|
|
||
| Avoid returning verbose error messages. | ||
|
|
||
| </details> | ||
|
|
||
| <details> | ||
| <summary>Ruby_on_rails</summary> | ||
|
|
||
| Avoid returning verbose error messages. | ||
|
|
||
| </details> | ||
|
|
||
| <details> | ||
| <summary>Next_js</summary> | ||
|
|
||
| Avoid returning verbose error messages. | ||
|
|
||
| </details> | ||
|
|
||
| <details> | ||
| <summary>Laravel</summary> | ||
|
|
||
| Avoid returning verbose error messages. | ||
|
|
||
| </details> | ||
|
|
||
| <details> | ||
| <summary>Express_js</summary> | ||
|
|
||
| Avoid returning verbose error messages. | ||
|
|
||
| </details> | ||
|
|
||
| <details> | ||
| <summary>Django</summary> | ||
|
|
||
| Avoid returning verbose error messages. | ||
|
|
||
| </details> | ||
|
|
||
| <details> | ||
| <summary>Symfony</summary> | ||
|
|
||
| Avoid returning verbose error messages. | ||
|
|
||
| </details> | ||
|
|
||
| <details> | ||
| <summary>Spring_boot</summary> | ||
|
|
||
| Avoid returning verbose error messages. | ||
|
|
||
| </details> | ||
|
|
||
| <details> | ||
| <summary>Flask</summary> | ||
|
|
||
| Avoid returning verbose error messages. | ||
|
|
||
| </details> | ||
|
|
||
| <details> | ||
| <summary>Nuxt</summary> | ||
|
|
||
| Avoid returning verbose error messages. | ||
|
|
||
| </details> | ||
|
|
||
| <details> | ||
| <summary>Fastapi</summary> | ||
|
|
||
| Avoid returning verbose error messages. | ||
|
|
||
| </details> | ||
|
|
||
| ## Configuration | ||
|
|
||
| > Identifier: `information_disclosure/rest_field_suggestion` | ||
|
|
||
|
|
||
| ### Examples | ||
|
|
||
|
|
||
|
|
||
| #### Ignore this check | ||
|
|
||
| ```yaml | ||
| checks: | ||
| information_disclosure/rest_field_suggestion: | ||
| skip: true | ||
| ``` | ||
| ## Score | ||
| - Escape Severity: **<span className="low-severity">LOW</span>** | ||
| ### Compliance | ||
| - OWASP: **[API3:2023](https://github.com/OWASP/API-Security/blob/master/editions/2023/en/0xa3-broken-object-property-level-authorization.md)** | ||
| - pci: **5.2.6** | ||
| ### Classification | ||
| ### Score | ||
| ## References | ||
| - [https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A3-Sensitive_Data_Exposure](https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A3-Sensitive_Data_Exposure) | ||
| - [https://cheatsheetseries.owasp.org/cheatsheets/Error_Handling_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Error_Handling_Cheat_Sheet.html) | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,82 @@ | ||
| --- | ||
| title: Vulnerable LLM | ||
| --- | ||
|
|
||
| # Vulnerable LLM | ||
|
|
||
| ## Description | ||
|
|
||
| Large Language Models (LLMs) are powerful tools that can be used to generate text, code, and other content. However, they can also be used to generate malicious content. To prevent these attacks, it is important to carefully validate and sanitize user input before passing it to an LLM. | ||
| LLM vulnerabilities can arise when users input data that manipulates the model to produce harmful or unintended outputs. These vulnerabilities are categorized under the LLM OWASP Top 10, a set of guidelines and potential risks associated with LLM deployment. | ||
| A successful exploitation of LLM vulnerabilities can lead to a variety of adverse effects, such as unauthorized access to sensitive data, unintended disclosure of information, manipulation of the model's responses to perform harmful actions, and the generation of offensive or misleading content. For instance, an attacker might craft inputs to trick the LLM into producing text that discloses confidential information, or they might induce the model to generate code that could compromise the security of a system. | ||
| Mitigating these risks requires robust security measures, including input validation, rate limiting, and continuous monitoring of the model's outputs. Additionally, implementing comprehensive logging and alerting mechanisms can help identify and respond to suspicious activities promptly. | ||
| By understanding and addressing the LLM OWASP Top 10 vulnerabilities, organizations can better secure their LLM implementations and protect against potential threats. | ||
|
|
||
|
|
||
| ## Remediation | ||
|
|
||
| To remediate a vulnerability named "Vulnerable LLM," follow these steps: | ||
|
|
||
| 1. Update the software or system that contains the "Vulnerable LLM" to the latest version provided by the vendor. | ||
| 2. If a patch is available specifically for the vulnerability, apply it immediately following the vendor's instructions. | ||
| 3. Review and apply the principle of least privilege to limit access to the affected component. | ||
| 4. Monitor for any unusual activity that may indicate exploitation attempts. | ||
| 5. If possible, enable additional security features or controls that can mitigate the risk of exploitation. | ||
| 6. Ensure that all dependencies and related software are also updated to prevent indirect exploitation. | ||
| 7. Conduct regular vulnerability scans to ensure the issue is resolved and no new related vulnerabilities have emerged. | ||
| 8. Educate users and administrators about the vulnerability and best practices for avoiding similar issues in the future. | ||
|
|
||
|
|
||
|
|
||
| ## Configuration | ||
|
|
||
| > Identifier: `injection/llm` | ||
|
|
||
|
|
||
| ### Examples | ||
|
|
||
|
|
||
|
|
||
| #### Ignore this check | ||
|
|
||
| ```yaml | ||
| checks: | ||
| injection/llm: | ||
| skip: true | ||
| ``` | ||
| ## Score | ||
| - Escape Severity: **<span className="high-severity">HIGH</span>** | ||
| ### Compliance | ||
| - OWASP: **[API8:2023](https://github.com/OWASP/API-Security/blob/master/editions/2023/en/0xa8-security-misconfiguration.md)** | ||
| - pci: **6.5.10** | ||
| - gdpr: **Article-32** | ||
| - soc2: **CC6** | ||
| - psd2: **Article-95** | ||
| - iso27001: **A.12.6** | ||
| - nist: **SP800-53** | ||
| - fedramp: **SI-10** | ||
| ### Classification | ||
| ### Score | ||
| - CVSS_VECTOR: **CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H** | ||
| - CVSS_SCORE: **5.3** | ||
| ## References | ||
| - [https://owasp.org/www-project-top-10-for-large-language-model-applications/](https://owasp.org/www-project-top-10-for-large-language-model-applications/) | ||
Oops, something went wrong.