AutoFix PR

[nishfath]

Harness SAST and SCA AutoFix

This PR was created automatically by the Harness SAST and SCA AutoFix tool.
As long as it is open, subsequent scans and generated fixes to this same branch will be added to it as new commits.

Each commit fixes one vulnerability.

Some manual intervention might be required before merging this PR.

Project Information

• Name: nishfath_shiftleft-java-demo
• Branch: main
• Pull Request Language: python

Findings/Vulnerabilities Fixed

Finding 1: Log Forging: External Data is Written Directly to Log in exploit.py

Vulnerability Description

The application writes external data directly to a log file.

• Severity: low
• CVSS Score: 2.5 (low)
• CWE: 117
• Category: Log Forging

Commits/Files Changed

• Changed file exploits/JavaSerializationExploit/src/main/java/exploit.py

[github-actions]

Summary

Harness SAST and SCA detected 759 findings in this PR

Severity	Count
Critical	15
Moderate	15
Info	3

Additionally there are 535 secrets leaked, and 191 vulnerabilities
inherited from OSS components.

Get more information about this scan.

[github-actions]

Checking analysis of application shiftleft-java-demo against 1 build rules.

Using sl version 0.9.4066 (c7ed3fd7a4f375b8b9ccc889dbbfa1189e810a11).

no successful scan prior to scan 12 found in branch "master".

Checking findings on scan 12.

Results per rule:

• report: FAIL
  (229 matched vulnerabilities; configured threshold is 0).

  First 5 findings:

  ID	CVSS	Rating	CVE	Title
  195	10.0	critical	CVE-2018-14721	FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to b…
  463	10.0	critical		Deserialization: Use of Unsafe Library Which can Execute Arbitrary Code in AdminController.isAdmin
  75	9.8	critical	CVE-2017-5929	QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components. The RemoteStreamAppenderCli…
  79	9.8	critical	CVE-2017-5929	QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components. The RemoteStreamAppenderCli…
  177	9.8	critical	CVE-2017-15095	jackson-databind in versions prior to 2.8.11 and 2.9.4 contain a deserialization flaw which allows an unauthenticated user to perform code execution by s…

  Severity rating	Count
  Critical	44
  High	91
  Medium	78
  Low	11

  Finding Type	Count
  Oss_vuln	191
  Vuln	29
  Secret	5
  Security_issue	4

  OWASP 2021 Category	Count
  A03-Injection	23
  A01-Broken-Access-Control	3
  A08-Software-And-Data-Integrity-Failures	2
  A05-Security-Misconfiguration	2
  A09-Security-Logging-And-Monitoring-Failures	1
  A07-Identification-And-Authentication-Failures	1
  A02-Cryptographic-Failures	1

  OWASP 2025 Category	Count
  A05-Injection	23
  A08-Software-Or-Data-Integrity-Failures	2
  A06-Insecure-Design	2
  A04-Cryptographic-Failures	2
  A02-Security-Misconfiguration	2
  A09-Security-Logging-And-Monitoring-Failures	1
  A01-Broken-Access-Control	1

1 rule failed.