Sign upLogin

rapid7/metasploit-framework

View on GitHub
Star
modules/exploits/windows/fileformat/mcafee_showreport_exec.rb

Summary

Maintainability
D
2 days
Test Coverage

Method process_propfind has 65 lines of code (exceeds 25 allowed). Consider refactoring.
Open

  def process_propfind(cli, request)
    path = request.uri
    vprint_status("Received WebDAV PROPFIND request from: #{path}")
    body = ''
Severity: Major
Found in modules/exploits/windows/fileformat/mcafee_showreport_exec.rb - About 2 hrs to fix

    File mcafee_showreport_exec.rb has 274 lines of code (exceeds 250 allowed). Consider refactoring.
    Open

    class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::FILEFORMAT
  include Msf::Exploit::Remote::HttpServer::HTML
    Severity: Minor
    Found in modules/exploits/windows/fileformat/mcafee_showreport_exec.rb - About 2 hrs to fix

      Method initialize has 49 lines of code (exceeds 25 allowed). Consider refactoring.
      Open

        def initialize(info={})
    super(update_info(info,
      'Name'           => "McAfee SaaS MyCioScan ShowReport Remote Command Execution",
      'Description'    => %q{
          This module exploits a vulnerability found in McAfee Security-as-a-Service.
      Severity: Minor
      Found in modules/exploits/windows/fileformat/mcafee_showreport_exec.rb - About 1 hr to fix

        Method generate_files has 37 lines of code (exceeds 25 allowed). Consider refactoring.
        Open

          def generate_files(path, items)
    trail = path.split("/")
    return "" if trail.length < 2

    files = ""
        Severity: Minor
        Found in modules/exploits/windows/fileformat/mcafee_showreport_exec.rb - About 1 hr to fix

          Method generate_shares has 29 lines of code (exceeds 25 allowed). Consider refactoring.
          Open

            def generate_shares(path)
    share_name = datastore['SHARENAME']
    share = <<-SHARE
    <D:response xmlns:lp1="DAV:" xmlns:lp2="http://apache.org/dav/props/">
    <D:href>#{path}#{share_name}/</D:href>
          Severity: Minor
          Found in modules/exploits/windows/fileformat/mcafee_showreport_exec.rb - About 1 hr to fix

            Method process_propfind has a Cognitive Complexity of 10 (exceeds 5 allowed). Consider refactoring.
            Open

              def process_propfind(cli, request)
    path = request.uri
    vprint_status("Received WebDAV PROPFIND request from: #{path}")
    body = ''
            Severity: Minor
            Found in modules/exploits/windows/fileformat/mcafee_showreport_exec.rb - About 1 hr to fix

            Cognitive Complexity

            Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

            A method's cognitive complexity is based on a few simple rules:

            • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
            • Code is considered more complex for each "break in the linear flow of the code"
            • Code is considered more complex when "flow breaking structures are nested"

            Further reading

            Identical blocks of code found in 2 locations. Consider refactoring.
            Open

              def generate_files(path, items)
    trail = path.split("/")
    return "" if trail.length < 2

    files = ""
            Severity: Major
            Found in modules/exploits/windows/fileformat/mcafee_showreport_exec.rb and 1 other location - About 1 hr to fix
            modules/exploits/windows/misc/wireshark_lua.rb on lines 244..284

            Duplicated Code

            Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

            Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

            When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

            Tuning

            This issue has a mass of 61.

            We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

            The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

            If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

            See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

            Refactorings

            Further Reading

            Identical blocks of code found in 5 locations. Consider refactoring.
            Open

                if path !~ /\/$/
      if path.index(".")
        print_status("Sending 404 for #{path} ...")
        resp = create_response(404, "Not Found")
        resp['Content-Type'] = 'text/html'
            Severity: Major
            Found in modules/exploits/windows/fileformat/mcafee_showreport_exec.rb and 4 other locations - About 1 hr to fix
            modules/exploits/windows/browser/ms10_046_shortcut_icon_dllloader.rb on lines 224..239
            modules/exploits/windows/email/ms10_045_outlook_ref_only.rb on lines 190..205
            modules/exploits/windows/email/ms10_045_outlook_ref_resolve.rb on lines 186..201
            modules/exploits/windows/misc/wireshark_lua.rb on lines 129..143

            Duplicated Code

            Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

            Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

            When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

            Tuning

            This issue has a mass of 50.

            We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

            The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

            If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

            See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

            Refactorings

            Further Reading

            Similar blocks of code found in 7 locations. Consider refactoring.
            Open

              def on_request_uri(cli, request)
    case request.method
    when 'OPTIONS'
      process_options(cli, request)
    when 'PROPFIND'
            Severity: Major
            Found in modules/exploits/windows/fileformat/mcafee_showreport_exec.rb and 6 other locations - About 1 hr to fix
            modules/exploits/windows/browser/webdav_dll_hijacker.rb on lines 64..78
            modules/exploits/windows/http/cogent_datahub_command.rb on lines 64..77
            modules/exploits/windows/http/sap_host_control_cmd_exec.rb on lines 61..74
            modules/exploits/windows/misc/vmhgfs_webdav_dll_sideload.rb on lines 59..72
            modules/exploits/windows/misc/wireshark_lua.rb on lines 62..75
            modules/exploits/windows/scada/ge_proficy_cimplicity_gefebt.rb on lines 58..71

            Duplicated Code

            Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

            Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

            When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

            Tuning

            This issue has a mass of 48.

            We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

            The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

            If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

            See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

            Refactorings

            Further Reading

            Similar blocks of code found in 10 locations. Consider refactoring.
            Open

              def process_options(cli, request)
    vprint_status("OPTIONS #{request.uri}")
    headers = {
      'MS-Author-Via' => 'DAV',
      'DASL'          => '<DAV:sql>',
            Severity: Major
            Found in modules/exploits/windows/fileformat/mcafee_showreport_exec.rb and 9 other locations - About 50 mins to fix
            modules/auxiliary/gather/ie_sandbox_findfiles.rb on lines 175..190
            modules/auxiliary/server/capture/http_ntlm.rb on lines 97..111
            modules/auxiliary/server/http_ntlmrelay.rb on lines 124..138
            modules/exploits/windows/browser/ubisoft_uplay_cmd_exec.rb on lines 171..185
            modules/exploits/windows/browser/webdav_dll_hijacker.rb on lines 125..139
            modules/exploits/windows/http/sap_host_control_cmd_exec.rb on lines 117..131
            modules/exploits/windows/misc/vmhgfs_webdav_dll_sideload.rb on lines 113..127
            modules/exploits/windows/misc/wireshark_lua.rb on lines 106..121
            modules/exploits/windows/scada/ge_proficy_cimplicity_gefebt.rb on lines 96..110

            Duplicated Code

            Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

            Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

            When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

            Tuning

            This issue has a mass of 43.

            We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

            The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

            If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

            See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

            Refactorings

            Further Reading

            Similar blocks of code found in 4 locations. Consider refactoring.
            Open

                register_options([
      OptPort.new('SRVPORT',     [ true, "The daemon port to listen on (do not change)", 80 ]),
      OptString.new('SHARENAME', [ true, "The name of the top-level share.", "files"]),
      OptString.new('URIPATH',   [ true, "The URI to use", "/" ]),
      OptString.new('FILENAME',  [ true, 'The file name.', 'msf.html']),
            Severity: Major
            Found in modules/exploits/windows/fileformat/mcafee_showreport_exec.rb and 3 other locations - About 40 mins to fix
            modules/auxiliary/admin/http/manage_engine_dc_create_admin.rb on lines 34..41
            modules/auxiliary/scanner/http/limesurvey_zip_traversals.rb on lines 55..62
            modules/exploits/windows/browser/webdav_dll_hijacker.rb on lines 51..58

            Duplicated Code

            Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

            Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

            When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

            Tuning

            This issue has a mass of 37.

            We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

            The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

            If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

            See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

            Refactorings

            Further Reading

            Identical blocks of code found in 2 locations. Consider refactoring.
            Open

              def generate_shares(path)
    share_name = datastore['SHARENAME']
    share = <<-SHARE
    <D:response xmlns:lp1="DAV:" xmlns:lp2="http://apache.org/dav/props/">
    <D:href>#{path}#{share_name}/</D:href>
            Severity: Minor
            Found in modules/exploits/windows/fileformat/mcafee_showreport_exec.rb and 1 other location - About 30 mins to fix
            modules/exploits/windows/misc/wireshark_lua.rb on lines 212..241

            Duplicated Code

            Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

            Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

            When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

            Tuning

            This issue has a mass of 32.

            We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

            The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

            If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

            See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

            Refactorings

            Further Reading

            There are no issues that match your filters.

            Category
            Status