Sign upLogin

rapid7/metasploit-framework

View on GitHub
Star

Showing 21,886 of 21,886 total issues

File ssllabs_scan.rb has 732 lines of code (exceeds 250 allowed). Consider refactoring.
Open

require 'active_support/inflector'
require 'json'
require 'active_support/core_ext/hash'

class MetasploitModule < Msf::Auxiliary
Severity: Major
Found in modules/auxiliary/gather/ssllabs_scan.rb - About 1 day to fix

    File readable_text.rb has 731 lines of code (exceeds 250 allowed). Consider refactoring.
    Open

    module Msf
module Serializer

# This class formats information in a plain-text format that
# is meant to be displayed on a console or some other non-GUI
    Severity: Major
    Found in lib/msf/base/serializer/readable_text.rb - About 1 day to fix

      File weblogic_deserialize_badattrval.rb has 728 lines of code (exceeds 250 allowed). Consider refactoring.
      Open

      class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::Remote::Tcp
  include Msf::Exploit::CmdStager
      Severity: Major
      Found in modules/exploits/multi/misc/weblogic_deserialize_badattrval.rb - About 1 day to fix

        Method end_element has a Cognitive Complexity of 84 (exceeds 5 allowed). Consider refactoring.
        Open

          def end_element(name=nil)
    block = @block
    case name
    when 'name'
      if in_tag('result')
        Severity: Minor
        Found in lib/rex/parser/openvas_document.rb - About 1 day to fix

        Cognitive Complexity

        Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

        A method's cognitive complexity is based on a few simple rules:

        • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
        • Code is considered more complex for each "break in the linear flow of the code"
        • Code is considered more complex when "flow breaking structures are nested"

        Further reading

        Method cmd_workspace has a Cognitive Complexity of 84 (exceeds 5 allowed). Consider refactoring.
        Open

          def cmd_workspace(*args)
    return unless active?

    state = :nil
        Severity: Minor
        Found in lib/msf/ui/console/command_dispatcher/db.rb - About 1 day to fix

        Cognitive Complexity

        Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

        A method's cognitive complexity is based on a few simple rules:

        • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
        • Code is considered more complex for each "break in the linear flow of the code"
        • Code is considered more complex when "flow breaking structures are nested"

        Further reading

        Similar blocks of code found in 2 locations. Consider refactoring.
        Open

          def exploit
    downfile = datastore['DOWNFILE'] || rand_text_alpha(8+rand(8))
    uri = '/apply.cgi'
    user = datastore['HttpUsername']
    pass = datastore['HttpPassword']
        Severity: Major
        Found in modules/exploits/linux/http/linksys_e1500_apply_exec.rb and 1 other location - About 1 day to fix
        modules/exploits/linux/http/netgear_dgn1000b_setup_exec.rb on lines 102..224

        Duplicated Code

        Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

        Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

        When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

        Tuning

        This issue has a mass of 420.

        We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

        The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

        If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

        See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

        Refactorings

        Further Reading

        Similar blocks of code found in 2 locations. Consider refactoring.
        Open

          def exploit
    downfile = datastore['DOWNFILE'] || rand_text_alpha(8+rand(8))
    uri = '/setup.cgi'
    user = datastore['HttpUsername']
    pass = datastore['HttpPassword']
        Severity: Major
        Found in modules/exploits/linux/http/netgear_dgn1000b_setup_exec.rb and 1 other location - About 1 day to fix
        modules/exploits/linux/http/linksys_e1500_apply_exec.rb on lines 98..220

        Duplicated Code

        Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

        Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

        When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

        Tuning

        This issue has a mass of 420.

        We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

        The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

        If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

        See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

        Refactorings

        Further Reading

        File veeam_credential_dump.rb has 724 lines of code (exceeds 250 allowed). Consider refactoring.
        Open

        require 'metasploit/framework/credential_collection'

class MetasploitModule < Msf::Post
  include Msf::Post::Common
  include Msf::Post::File
        Severity: Major
        Found in modules/post/windows/gather/credentials/veeam_credential_dump.rb - About 1 day to fix

          Method on_request_uri has 334 lines of code (exceeds 25 allowed). Consider refactoring.
          Open

            def on_request_uri(cli, request)
    print_status("Sending #{request.uri}")
    if request.uri =~ %r{/exploit.html$}
      html = %Q^
<html>
          Severity: Major
          Found in modules/exploits/windows/browser/chrome_filereader_uaf.rb - About 1 day to fix

            Class Core has 88 methods (exceeds 20 allowed). Consider refactoring.
            Open

            class Core

  include Msf::Ui::Console::CommandDispatcher
  include Msf::Ui::Console::CommandDispatcher::Common
  include Msf::Ui::Console::ModuleOptionTabCompletion
            Severity: Major
            Found in lib/msf/ui/console/command_dispatcher/core.rb - About 1 day to fix

              File java_jdwp_debugger.rb has 718 lines of code (exceeds 250 allowed). Consider refactoring.
              Open

              class MetasploitModule < Msf::Exploit::Remote
  Rank = GoodRanking

  include Msf::Exploit::Remote::Tcp
  include Msf::Exploit::EXE
              Severity: Major
              Found in modules/exploits/multi/misc/java_jdwp_debugger.rb - About 1 day to fix

                Method exploit has 329 lines of code (exceeds 25 allowed). Consider refactoring.
                Open

                  def exploit
    if target.name =~ /prestashop/
      uri = normalize_uri(target_uri.path)
      res = send_request_cgi({'uri' => uri})
      if res && res.code != 301
                Severity: Major
                Found in modules/exploits/linux/http/php_imap_open_rce.rb - About 1 day to fix

                  Method import_netsparker_xml has a Cognitive Complexity of 82 (exceeds 5 allowed). Consider refactoring.
                  Open

                    def import_netsparker_xml(args={}, &block)
    data = args[:data]
    wspace = Msf::Util::DBManager.process_opts_workspace(args, framework).name
    bl = validate_ips(args[:blacklist]) ? args[:blacklist].split : []
    addr = nil
                  Severity: Minor
                  Found in lib/msf/core/db_manager/import/netsparker.rb - About 1 day to fix

                  Cognitive Complexity

                  Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

                  A method's cognitive complexity is based on a few simple rules:

                  • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
                  • Code is considered more complex for each "break in the linear flow of the code"
                  • Code is considered more complex when "flow breaking structures are nested"

                  Further reading

                  Identical blocks of code found in 3 locations. Consider refactoring.
                  Open

                    def generate_shikata_block(state, length, cutoff)
    # Declare logical registers
    key_reg = Rex::Poly::LogicalRegister::X86.new('key', 'eax')
    count_reg = Rex::Poly::LogicalRegister::X86.new('count', 'ecx')
    addr_reg  = Rex::Poly::LogicalRegister::X86.new('addr')
                  Severity: Major
                  Found in modules/encoders/x86/context_time.rb and 2 other locations - About 1 day to fix
                  modules/encoders/x86/context_cpuid.rb on lines 118..194
                  modules/encoders/x86/context_stat.rb on lines 122..197

                  Duplicated Code

                  Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

                  Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

                  When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

                  Tuning

                  This issue has a mass of 409.

                  We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

                  The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

                  If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

                  See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

                  Refactorings

                  Further Reading

                  Identical blocks of code found in 3 locations. Consider refactoring.
                  Open

                    def generate_shikata_block(state, length, cutoff)
    # Declare logical registers
    key_reg = Rex::Poly::LogicalRegister::X86.new('key', 'eax')
    count_reg = Rex::Poly::LogicalRegister::X86.new('count', 'ecx')
    addr_reg  = Rex::Poly::LogicalRegister::X86.new('addr')
                  Severity: Major
                  Found in modules/encoders/x86/context_cpuid.rb and 2 other locations - About 1 day to fix
                  modules/encoders/x86/context_stat.rb on lines 122..197
                  modules/encoders/x86/context_time.rb on lines 108..183

                  Duplicated Code

                  Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

                  Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

                  When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

                  Tuning

                  This issue has a mass of 409.

                  We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

                  The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

                  If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

                  See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

                  Refactorings

                  Further Reading

                  Identical blocks of code found in 3 locations. Consider refactoring.
                  Open

                    def generate_shikata_block(state, length, cutoff)
    # Declare logical registers
    key_reg = Rex::Poly::LogicalRegister::X86.new('key', 'eax')
    count_reg = Rex::Poly::LogicalRegister::X86.new('count', 'ecx')
    addr_reg  = Rex::Poly::LogicalRegister::X86.new('addr')
                  Severity: Major
                  Found in modules/encoders/x86/context_stat.rb and 2 other locations - About 1 day to fix
                  modules/encoders/x86/context_cpuid.rb on lines 118..194
                  modules/encoders/x86/context_time.rb on lines 108..183

                  Duplicated Code

                  Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

                  Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

                  When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

                  Tuning

                  This issue has a mass of 409.

                  We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

                  The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

                  If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

                  See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

                  Refactorings

                  Further Reading

                  Method exploit has 326 lines of code (exceeds 25 allowed). Consider refactoring.
                  Open

                    def exploit
    if is_root?
      fail_with Failure::BadConfig, 'Session already has root privileges'
    end
                  Severity: Major
                  Found in modules/exploits/solaris/local/rsh_stack_clash_priv_esc.rb - About 1 day to fix

                    Identical blocks of code found in 2 locations. Consider refactoring.
                    Open

                    def check_nsswitch():
    idx = 0
    found_passwd = False
    with open('/etc/nsswitch.conf', 'r') as f:
        for line in f:
                    Severity: Major
                    Found in data/exploits/CVE-2021-3156/nss_u16.py and 1 other location - About 1 day to fix
                    data/exploits/CVE-2021-3156/nss_u14.py on lines 40..65

                    Duplicated Code

                    Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

                    Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

                    When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

                    Tuning

                    This issue has a mass of 182.

                    We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

                    The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

                    If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

                    See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

                    Refactorings

                    Further Reading

                    Identical blocks of code found in 2 locations. Consider refactoring.
                    Open

                    def check_nsswitch():
    idx = 0
    found_passwd = False
    with open('/etc/nsswitch.conf', 'r') as f:
        for line in f:
                    Severity: Major
                    Found in data/exploits/CVE-2021-3156/nss_u14.py and 1 other location - About 1 day to fix
                    data/exploits/CVE-2021-3156/nss_u16.py on lines 38..63

                    Duplicated Code

                    Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

                    Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

                    When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

                    Tuning

                    This issue has a mass of 182.

                    We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

                    The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

                    If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

                    See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

                    Refactorings

                    Further Reading

                    Method cisco_ios_config_eater has 324 lines of code (exceeds 25 allowed). Consider refactoring.
                    Open

                        def cisco_ios_config_eater(thost, tport, config)

      if framework.db.active
        credential_data = {
          address: thost,
                    Severity: Major
                    Found in lib/msf/core/auxiliary/cisco.rb - About 1 day to fix
                      Severity
                      Category
                      Status
                      Source
                      Language