rules:
- id: bash-curl-insecure-ssl
  message: >-
    Detected use of curl with `-k` or `--insecure` flag. This disables SSL
    certificate verification, making the connection vulnerable to
    man-in-the-middle attacks. Remove the insecure flag and fix certificate
    issues properly.
  metadata:
    cwe:
    - 'CWE-295: Improper Certificate Validation'
    owasp:
    - A02:2021 - Cryptographic Failures
    - A07:2021 - Identification and Authentication Failures
    category: security
    technology:
    - bash
    - curl
    subcategory:
    - vuln
    likelihood: HIGH
    impact: HIGH
    confidence: HIGH
    references:
    - https://owasp.org/www-community/vulnerabilities/Improper_Certificate_Validation
    - https://curl.se/docs/sslcerts.html
  severity: ERROR
  languages: [bash]
  pattern-either:
    - pattern: curl -k ...
    - pattern: curl --insecure ...
    - pattern: curl ... -k ...
    - pattern: curl ... --insecure ...

- id: bash-wget-no-check-certificate
  message: >-
    Detected use of wget with `--no-check-certificate` flag. This disables
    SSL certificate verification, making the connection vulnerable to
    man-in-the-middle attacks. Remove this flag and fix certificate issues.
  metadata:
    cwe:
    - 'CWE-295: Improper Certificate Validation'
    owasp:
    - A02:2021 - Cryptographic Failures
    - A07:2021 - Identification and Authentication Failures
    category: security
    technology:
    - bash
    - wget
    subcategory:
    - vuln
    likelihood: HIGH
    impact: HIGH
    confidence: HIGH
    references:
    - https://owasp.org/www-community/vulnerabilities/Improper_Certificate_Validation
  severity: ERROR
  languages: [bash]
  pattern-either:
    - pattern: wget --no-check-certificate ...
    - pattern: wget ... --no-check-certificate ...

- id: bash-curl-pipe-bash
  message: >-
    Detected downloading and executing script with `curl | bash`. This is
    extremely dangerous as it executes arbitrary code without verification.
    Download the script first, review it, verify checksums, then execute.
  metadata:
    cwe:
    - 'CWE-494: Download of Code Without Integrity Check'
    owasp:
    - A08:2021 - Software and Data Integrity Failures
    category: security
    technology:
    - bash
    - curl
    subcategory:
    - vuln
    likelihood: HIGH
    impact: CRITICAL
    confidence: HIGH
    references:
    - https://www.seancassidy.me/dont-pipe-to-your-shell.html
  severity: ERROR
  languages: [bash]
  pattern-either:
    - pattern: curl ... | bash
    - pattern: curl ... | sh
    - pattern: wget ... -O - | bash
    - pattern: wget ... -O - | sh

- id: bash-ssh-no-host-key-checking
  message: >-
    Detected SSH with host key verification disabled. This makes the
    connection vulnerable to man-in-the-middle attacks. Remove
    StrictHostKeyChecking=no and properly manage known_hosts.
  metadata:
    cwe:
    - 'CWE-295: Improper Certificate Validation'
    owasp:
    - A02:2021 - Cryptographic Failures
    category: security
    technology:
    - bash
    - ssh
    subcategory:
    - vuln
    likelihood: HIGH
    impact: HIGH
    confidence: HIGH
    references:
    - https://www.ssh.com/academy/ssh/host-key
  severity: ERROR
  languages: [bash]
  pattern-either:
    - pattern: ssh -o StrictHostKeyChecking=no ...
    - pattern: ssh -o UserKnownHostsFile=/dev/null ...
    - pattern: ssh ... -o StrictHostKeyChecking=no ...

- id: bash-netcat-unencrypted-transfer
  message: >-
    Detected use of netcat (nc) for data transfer. Netcat transmits data
    in plaintext without encryption. Use SSH, SCP, or other encrypted
    protocols for sensitive data transfer.
  metadata:
    cwe:
    - 'CWE-319: Cleartext Transmission of Sensitive Information'
    owasp:
    - A02:2021 - Cryptographic Failures
    category: security
    technology:
    - bash
    - netcat
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    references:
    - https://owasp.org/www-community/vulnerabilities/Unencrypted_communication
  severity: WARNING
  languages: [bash]
  pattern-either:
    - pattern: echo "$..." | nc ...
    - pattern: cat ... | nc ...
    - pattern: nc ... < ...

- id: bash-ftp-unencrypted
  message: >-
    Detected use of FTP protocol. FTP transmits credentials and data in
    plaintext. Use SFTP or FTPS instead for secure file transfer.
  metadata:
    cwe:
    - 'CWE-319: Cleartext Transmission of Sensitive Information'
    owasp:
    - A02:2021 - Cryptographic Failures
    category: security
    technology:
    - bash
    - ftp
    subcategory:
    - vuln
    likelihood: HIGH
    impact: HIGH
    confidence: HIGH
    references:
    - https://www.rfc-editor.org/rfc/rfc959
  severity: ERROR
  languages: [bash]
  pattern-either:
    - pattern: ftp ...
    - pattern: ncftp ...

- id: bash-telnet-unencrypted
  message: >-
    Detected use of telnet protocol. Telnet transmits all data including
    credentials in plaintext. Use SSH instead for secure remote access.
  metadata:
    cwe:
    - 'CWE-319: Cleartext Transmission of Sensitive Information'
    owasp:
    - A02:2021 - Cryptographic Failures
    category: security
    technology:
    - bash
    - telnet
    subcategory:
    - vuln
    likelihood: HIGH
    impact: CRITICAL
    confidence: HIGH
    references:
    - https://www.ssh.com/academy/ssh/telnet
  severity: ERROR
  languages: [bash]
  pattern: telnet ...
