REST API architecture baseline

License: Apache License 2.0

HCL 93.59% HTML 0.64% CSS 0.34% TypeScript 3.72% Python 1.17% Go 0.54%

aws hcl2 terraform terraform-module terraform-modules

terraform-aws-rest-api-architecture's People

Stargazers

Watchers

Forkers

eliran-oraganization

terraform-aws-rest-api-architecture's Issues

Codepipline - Github connection

Upgrade the use of GitHub connection to V2 instead of v1

AWS Cognito emails case insensitive

Adding flag for case insensitive link terraform flag

Enable passing roles as a parameter to Elastic Beanstalk

Add AmazonCognitoReadOnly permission to the elasticbeanstalk user

Api gateway validation by swagger

Change Codepipline GitHub connection to V1

API Gateway - Response headers

Change the response headers to return with the security headers policy.

Reference can be found here

Add configuration for adding env vars to elasticbeanstalk

Forgot password flow

Adding forgot password flow with lambda custom message

Add cognito read/write permissions

Add arn:aws:iam::aws:policy/AmazonESCognitoAccess permission to the elastic beanstalk permissions set

react-scripts-5.0.1.tgz: 2 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - react-scripts-5.0.1.tgz

Path to dependency file: /client/package.json

Path to vulnerable library: /tmp/ws-scm/terraform/client/node_modules/nth-check/package.json,/client/node_modules/nth-check/package.json

Found in HEAD commit: 3e1fb10cd793a196e25a9978a3daa4c4ec7bffdc

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in	Remediation Available
CVE-2021-33587	High	7.5	css-what-3.4.2.tgz	Transitive	N/A	❌
CVE-2021-3803	High	7.5	nth-check-1.0.2.tgz	Transitive	N/A	❌

Details

CVE-2021-33587

Vulnerable Library - css-what-3.4.2.tgz

a CSS selector parser

Library home page: https://registry.npmjs.org/css-what/-/css-what-3.4.2.tgz

Path to dependency file: /tmp/ws-scm/terraform/client/package.json

Path to vulnerable library: /tmp/ws-scm/terraform/client/node_modules/css-what/package.json,/client/node_modules/css-what/package.json

Dependency Hierarchy:

react-scripts-5.0.1.tgz (Root Library)
- webpack-5.5.0.tgz
  - plugin-svgo-5.5.0.tgz
    - svgo-1.3.2.tgz
      - css-select-2.1.0.tgz
        
        ❌ css-what-3.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 3e1fb10cd793a196e25a9978a3daa4c4ec7bffdc

Found in base branch: develop

Vulnerability Details

The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.

Publish Date: 2021-05-28

URL: CVE-2021-33587

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33587

Release Date: 2021-05-28

Fix Resolution: css-what - 5.0.1

Step up your Open Source Security Game with WhiteSource here

CVE-2021-3803

Vulnerable Library - nth-check-1.0.2.tgz

performant nth-check parser & compiler

Library home page: https://registry.npmjs.org/nth-check/-/nth-check-1.0.2.tgz

Path to dependency file: /tmp/ws-scm/terraform/client/package.json

Path to vulnerable library: /tmp/ws-scm/terraform/client/node_modules/nth-check/package.json,/client/node_modules/nth-check/package.json

Dependency Hierarchy:

react-scripts-5.0.1.tgz (Root Library)
- webpack-5.5.0.tgz
  - plugin-svgo-5.5.0.tgz
    - svgo-1.3.2.tgz
      - css-select-2.1.0.tgz
        
        ❌ nth-check-1.0.2.tgz (Vulnerable Library)

Found in HEAD commit: 3e1fb10cd793a196e25a9978a3daa4c4ec7bffdc

Found in base branch: develop

Vulnerability Details

nth-check is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-17

URL: CVE-2021-3803

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: fb55/nth-check@v2.0.0...v2.0.1

Release Date: 2021-09-17

Fix Resolution: nth-check - v2.0.1

Step up your Open Source Security Game with WhiteSource here

Remove Cognito authorizer from API Gateway

Enable uploading files to s3 through aws apigateway

in the api-gateway:

Resources => ANY:
Method request:

Integration request:

Settings:

resources:
-- https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-payload-encodings-configure-with-console.html

Enable passing rules to WAF as a parameter

Mongodb adding X.509 authentication as an option

react-scripts-5.0.0.tgz: 4 vulnerabilities (highest severity is: 9.8) - autoclosed

Vulnerable Library - react-scripts-5.0.0.tgz

Path to dependency file: /tmp/ws-scm/terraform/client/package.json

Path to vulnerable library: /tmp/ws-scm/terraform/client/node_modules/nth-check/package.json

Found in HEAD commit: 6030e7c746d928eaa74f9b08cb88ff4485b9a238

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in	Remediation Available
CVE-2022-29078	High	9.8	ejs-3.1.6.tgz	Transitive	N/A	❌
CVE-2021-43138	High	7.8	multiple	Transitive	N/A	❌
CVE-2021-33587	High	7.5	css-what-3.4.2.tgz	Transitive	N/A	❌
CVE-2021-3803	High	7.5	nth-check-1.0.2.tgz	Transitive	N/A	❌

Details

CVE-2022-29078

Vulnerable Library - ejs-3.1.6.tgz

Embedded JavaScript templates

Library home page: https://registry.npmjs.org/ejs/-/ejs-3.1.6.tgz

Path to dependency file: /tmp/ws-scm/terraform/client/package.json

Path to vulnerable library: /tmp/ws-scm/terraform/client/node_modules/ejs/package.json

Dependency Hierarchy:

react-scripts-5.0.0.tgz (Root Library)
- workbox-webpack-plugin-6.5.1.tgz
  - workbox-build-6.5.1.tgz
    - rollup-plugin-off-main-thread-2.2.3.tgz
      - ❌ ejs-3.1.6.tgz (Vulnerable Library)

Found in HEAD commit: 6030e7c746d928eaa74f9b08cb88ff4485b9a238

Found in base branch: develop

Vulnerability Details

The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).

Publish Date: 2022-04-25

URL: CVE-2022-29078

CVSS 3 Score Details (9.8)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29078~

Release Date: 2022-04-25

Fix Resolution: ejs - v3.1.7

Step up your Open Source Security Game with WhiteSource here

CVE-2021-43138

Vulnerable Libraries - async-2.6.3.tgz, async-0.9.2.tgz

async-2.6.3.tgz

Higher-order functions and common patterns for asynchronous code

Library home page: https://registry.npmjs.org/async/-/async-2.6.3.tgz

Path to dependency file: /tmp/ws-scm/terraform/client/package.json

Path to vulnerable library: /tmp/ws-scm/terraform/client/node_modules/async/package.json

Dependency Hierarchy:

react-scripts-5.0.0.tgz (Root Library)
- webpack-dev-server-4.7.4.tgz
  - portfinder-1.0.28.tgz
    - ❌ async-2.6.3.tgz (Vulnerable Library)

async-0.9.2.tgz

Higher-order functions and common patterns for asynchronous code

Library home page: https://registry.npmjs.org/async/-/async-0.9.2.tgz

Path to dependency file: /tmp/ws-scm/terraform/client/package.json

Path to vulnerable library: /tmp/ws-scm/terraform/client/node_modules/jake/node_modules/async/package.json

Dependency Hierarchy:

react-scripts-5.0.0.tgz (Root Library)
- workbox-webpack-plugin-6.5.1.tgz
  - workbox-build-6.5.1.tgz
    - rollup-plugin-off-main-thread-2.2.3.tgz
      - ejs-3.1.6.tgz
        
        jake-10.8.2.tgz
        
        ❌ async-0.9.2.tgz (Vulnerable Library)

Found in HEAD commit: 6030e7c746d928eaa74f9b08cb88ff4485b9a238

Found in base branch: develop

Vulnerability Details

A vulnerability exists in Async through 3.2.1 (fixed in 3.2.2) , which could let a malicious user obtain privileges via the mapValues() method.

Publish Date: 2022-04-06

URL: CVE-2021-43138

CVSS 3 Score Details (7.8)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-43138

Release Date: 2022-04-06

Fix Resolution: async - v3.2.2

Step up your Open Source Security Game with WhiteSource here

CVE-2021-33587

Vulnerable Library - css-what-3.4.2.tgz

a CSS selector parser

Library home page: https://registry.npmjs.org/css-what/-/css-what-3.4.2.tgz

Path to dependency file: /tmp/ws-scm/terraform/client/package.json

Path to vulnerable library: /tmp/ws-scm/terraform/client/node_modules/css-what/package.json

Dependency Hierarchy:

react-scripts-5.0.0.tgz (Root Library)
- webpack-5.5.0.tgz
  - plugin-svgo-5.5.0.tgz
    - svgo-1.3.2.tgz
      - css-select-2.1.0.tgz
        
        ❌ css-what-3.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 6030e7c746d928eaa74f9b08cb88ff4485b9a238

Found in base branch: develop

Vulnerability Details

The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.

Publish Date: 2021-05-28

URL: CVE-2021-33587

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33587

Release Date: 2021-05-28

Fix Resolution: css-what - 5.0.1

Step up your Open Source Security Game with WhiteSource here

CVE-2021-3803

Vulnerable Library - nth-check-1.0.2.tgz

performant nth-check parser & compiler

Library home page: https://registry.npmjs.org/nth-check/-/nth-check-1.0.2.tgz

Path to dependency file: /tmp/ws-scm/terraform/client/package.json

Path to vulnerable library: /tmp/ws-scm/terraform/client/node_modules/nth-check/package.json

Dependency Hierarchy:

react-scripts-5.0.0.tgz (Root Library)
- webpack-5.5.0.tgz
  - plugin-svgo-5.5.0.tgz
    - svgo-1.3.2.tgz
      - css-select-2.1.0.tgz
        
        ❌ nth-check-1.0.2.tgz (Vulnerable Library)

Found in HEAD commit: 6030e7c746d928eaa74f9b08cb88ff4485b9a238

Found in base branch: develop

Vulnerability Details

nth-check is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-17

URL: CVE-2021-3803

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: fb55/nth-check@v2.0.0...v2.0.1

Release Date: 2021-09-17

Fix Resolution: nth-check - v2.0.1

Step up your Open Source Security Game with WhiteSource here

Recommend Projects

React

A declarative, efficient, and flexible JavaScript library for building user interfaces.
Vue.js

🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript

TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
TensorFlow

An Open Source Machine Learning Framework for Everyone
Django

The Web framework for perfectionists with deadlines.
Laravel

A PHP framework for web artisans
D3

Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

javascript

JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
web

Some thing interesting about web. New door for the world.
server

A server is a program made to process requests and deliver data to clients.
Machine learning

Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Visualization

Some thing interesting about visualization, use data art
Game

Some thing interesting about game, make everyone happy.

Recommend Org

Facebook

We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft

Open source projects and samples from Microsoft.
Google

Google ❤️ Open Source for everyone.
Alibaba

Alibaba Open Source for everyone
D3

Data-Driven Documents codes.
Tencent

China tencent open source team.

moveotech / terraform-aws-rest-api-architecture Goto Github PK

terraform-aws-rest-api-architecture's People

Stargazers

Watchers

Forkers

terraform-aws-rest-api-architecture's Issues

Vulnerabilities

Details

Vulnerable Library - css-what-3.4.2.tgz

Vulnerability Details

CVSS 3 Score Details (7.5)

Suggested Fix

Vulnerable Library - nth-check-1.0.2.tgz

Vulnerability Details

CVSS 3 Score Details (7.5)

Suggested Fix

in the api-gateway:

Vulnerabilities

Details

Vulnerable Library - ejs-3.1.6.tgz

Vulnerability Details

CVSS 3 Score Details (9.8)

Suggested Fix

Vulnerable Libraries - async-2.6.3.tgz, async-0.9.2.tgz

async-2.6.3.tgz

async-0.9.2.tgz

Vulnerability Details

CVSS 3 Score Details (7.8)

Suggested Fix

Vulnerable Library - css-what-3.4.2.tgz

Vulnerability Details

CVSS 3 Score Details (7.5)

Suggested Fix

Vulnerable Library - nth-check-1.0.2.tgz

Vulnerability Details

CVSS 3 Score Details (7.5)

Suggested Fix

Recommend Projects

Recommend Topics

Recommend Org