--- name: memstack-security-owasp-top10 description: "Use this skill when the user says 'OWASP audit', 'OWASP top 10', 'security audit', 'vulnerability assessment', 'full security check', or needs a comprehensive web application security review against OWASP Top 10 categories. Do NOT use for dependency audits or secret scanning alone." version: 1.0.0 license: "Proprietary β€” MemStackβ„’ Pro by CW Affiliate Investments LLC. See LICENSE.txt" --- # πŸ›‘οΈ OWASP Top 10 β€” Running Full Vulnerability Assessment... *Audit a web application against the OWASP Top 10 (2021) vulnerability categories with actionable findings and remediation.* ## Activation When this skill activates, output: `πŸ›‘οΈ OWASP Top 10 β€” Running Full Vulnerability Assessment...` Then execute the protocol below. ## Context Guard | Context | Status | |---------|--------| | **User asks for OWASP/security audit** | ACTIVE β€” full assessment | | **User asks for vulnerability check** | ACTIVE β€” full assessment | | **Pre-launch security review** | ACTIVE β€” full assessment | | **User asks about a specific OWASP category** | ACTIVE β€” targeted check for that category | | **User is actively fixing a vulnerability** | DORMANT β€” let them work | ## Scan Modes This skill supports two modes. Default to **deep scan** unless the user specifies otherwise. | Mode | Scope | When to use | |------|-------|-------------| | **Quick scan** | A01 (auth), A05 (headers + config), A06 (deps) | Fast pre-deploy check, CI pipeline gate, or first-pass triage | | **Deep scan** | All 10 categories | Pre-launch review, security audit, compliance check | If the user says "quick OWASP", "quick security check", or "fast scan", run only A01 + A05 + A06 and output the scorecard with the other 7 categories marked as "⏭️ SKIPPED (quick mode)". ## Protocol Run each of the 10 checks below (or A01 + A05 + A06 only in quick mode). For each, search the codebase for vulnerability patterns, classify findings, and record results for the final scorecard. **Finding format:** Every finding MUST include a file path and line number in the format `file:line`. If a finding is project-wide (e.g., "no rate limiting anywhere"), reference the most relevant file where the fix would be applied. Vague findings like "missing HSTS" without pointing to the middleware or config file are not actionable. --- ### A01: Broken Access Control **Risk:** Users acting beyond their intended permissions β€” accessing other users' data, elevating privileges, or bypassing access restrictions. **Detection:** 1. **Missing auth on routes:** Find all API route files, then check each for authentication patterns (`getAuthContext`, `getSession`, `auth()`, or equivalent). 2. **Insecure Direct Object References (IDOR):** Search for routes that take an ID parameter (`params.id`, `params.userId`, `params.orgId`) and fetch data without verifying the authenticated user owns or has access to the referenced resource. 3. **Privilege escalation:** Search for role checks (`role.*admin`, `isAdmin`, `requireRole`). Verify admin-only operations actually enforce role checks, not just rely on route naming. 4. **CORS bypass:** Search for `Access-Control-Allow-Origin` headers. Flag wildcard (`*`) with credentials enabled. **Cross-reference:** Run `api-audit` (Checks 1-2) for detailed route-by-route auth analysis. **Remediation:** - Add auth middleware to all non-public routes - Always derive user/org context from session, never from request parameters - Implement RBAC (Role-Based Access Control) for admin operations - Deny by default β€” explicitly allow, don't explicitly deny --- ### A02: Cryptographic Failures **Risk:** Exposure of sensitive data due to weak or missing encryption. **Detection:** 1. **Weak hashing:** Search for `md5`, `sha1`, `createHash('md5')`, `createHash('sha1')` in source files. MD5/SHA1 for passwords is CRITICAL. For checksums/cache keys it's acceptable (INFO). 2. **Unencrypted sensitive data:** Search for password assignment patterns. Verify passwords use bcrypt/argon2/scrypt, not plaintext or weak hashing. 3. **No HTTPS enforcement:** Check `next.config.js` or middleware for HTTPS redirect, `x-forwarded-proto` checks, `Strict-Transport-Security` header. 4. **Sensitive data in URLs:** Search for `token=`, `password=`, `secret=`, `key=` in URL/redirect/query string contexts. **Remediation:** - Use bcrypt/argon2 for password hashing (cost factor >= 10) - Enforce HTTPS via HSTS header or middleware redirect - Never pass secrets in query strings β€” use headers or POST body - Encrypt sensitive data at rest (database-level or application-level) --- ### A03: Injection **Risk:** Untrusted data sent to an interpreter as part of a command or query. **Detection:** 1. **SQL injection:** Search for template literals with interpolated variables inside SQL query/execute calls. Search for string concatenation in SELECT/INSERT/UPDATE/DELETE statements. 2. **Cross-Site Scripting (XSS):** Search for `dangerouslySetInnerHTML`, `innerHTML`, `__html` in React/JSX files. Search for `v-html` in Vue files. 3. **Command injection:** Search for shell execution imports (`child_process`) and calls (`execSync`, `spawn`). Verify user input is never passed to shell commands. Use `execFile` with argument arrays instead. 4. **Dynamic code execution:** Search for `new Function(` with dynamic strings, `setTimeout`/`setInterval` with string arguments instead of function references. These allow arbitrary code execution if user input reaches them. **Cross-reference:** Run `api-audit` (Check 5) for detailed SQL injection analysis. **Remediation:** - Use parameterized queries or ORM methods exclusively - Use React's default JSX escaping β€” avoid `dangerouslySetInnerHTML` - Sanitize HTML with DOMPurify if raw HTML rendering is required - Never pass user input to shell execution β€” use `execFile()` with argument arrays --- ### A04: Insecure Design **Risk:** Missing or ineffective security controls in the application's design. **Detection:** 1. **Missing rate limits:** Search for `rateLimit`, `rateLimiter`, `@upstash/ratelimit` in source files. Flag login, registration, password reset, and public API routes with no rate limiting. 2. **No account lockout:** Search for login/signIn/authenticate handlers. Check if they track failed attempts. 3. **Predictable IDs:** Search for `autoIncrement`, `SERIAL`, `AUTO_INCREMENT` in SQL/migration files. Flag if sequential IDs are used for user-facing resources (IDOR enabler). UUIDs preferred. 4. **Missing CSRF protection:** Search for `csrf`, `csrfToken`, `x-csrf`, `SameSite` cookie attributes. Check if state-changing operations verify origin. **Remediation:** - Add rate limiting to auth endpoints (5 attempts/minute) - Lock accounts after N failed login attempts with exponential backoff - Use UUIDs for all user-facing resource IDs - Enable CSRF protection via SameSite cookies and origin verification --- ### A05: Security Misconfiguration **Risk:** Insecure default configs, debug mode in production, verbose error messages, missing security headers. **Detection:** 1. **Debug mode / development settings:** Search for `debug.*true`, `DEBUG.*=.*1`, `NODE_ENV.*development` in source files, config, and env files (exclude `.example` files). 2. **Missing security headers:** Check `next.config.js` or middleware for these headers: - `X-Content-Type-Options: nosniff` - `X-Frame-Options: DENY` or `SAMEORIGIN` - `Strict-Transport-Security` (HSTS) - `Content-Security-Policy` (CSP) - `Referrer-Policy` - `Permissions-Policy` 3. **Default credentials:** Search for `admin:admin`, `root:root`, `password:password`, `default.*password` in source and config files. 4. **Verbose error responses:** Search for `.stack` or `.message` in response/return contexts. Verify stack traces are not sent to clients. **Remediation:** - Set security headers via `next.config.js` headers or middleware - Never expose stack traces in production responses - Remove default credentials from all configs - Disable debug mode in production builds --- ### A06: Vulnerable and Outdated Components **Risk:** Using libraries with known security vulnerabilities. **Detection:** ```bash # npm audit for known CVEs npm audit --json 2>/dev/null | head -100 # Check for outdated packages npm outdated 2>/dev/null | head -30 ``` **Cross-reference CVE databases** for key dependencies: 1. Read `package.json` and identify the framework (Next.js, React, Express, etc.) and its exact version 2. Search for known CVEs against the exact version: check the framework's GitHub security advisories, changelog, or release notes for security fixes in newer versions 3. For each HIGH/CRITICAL finding from `npm audit`, extract the CVE ID (e.g., `GHSA-xxxx-xxxx-xxxx`) and note: - The vulnerability description - The affected version range - The fixed version - Whether it affects production or dev only 4. Check if the vulnerability is actually reachable β€” a CVE in an image optimizer only matters if the app uses image optimization **Classify:** - Critical CVEs in production dependencies β†’ CRITICAL - High CVEs in production dependencies β†’ WARNING - CVEs in devDependencies only β†’ INFO - Outdated but no CVEs β†’ INFO - CVE present but feature not used (e.g., image optimizer CVE but no images) β†’ INFO with note **Report each finding with:** `package@version` β†’ `file:line` (where it's imported or configured, e.g., `package.json:15`), CVE ID, severity, fixed version. **Remediation:** - Run `npm audit fix` for automatic patching - Manually update packages with breaking changes - Replace deprecated packages with maintained alternatives - Set up Dependabot or Renovate for automated updates --- ### A07: Identification and Authentication Failures **Risk:** Weak authentication mechanisms allowing account compromise. **Detection:** 1. **Weak password policy:** Search for password length/minimum constraints. Flag if minimum length < 8 or no complexity requirements. 2. **Missing MFA/2FA:** Search for `mfa`, `2fa`, `two.factor`, `totp`, `authenticator` in source files. Flag if no MFA implementation found for admin or sensitive operations. 3. **Session management:** Search for `maxAge`, `expires`, `session.*timeout`, `cookie.*options`. Check session duration, secure/httpOnly flags, SameSite attribute. 4. **Credential recovery:** Search for password reset flow. Check if it uses time-limited, single-use tokens. **Remediation:** - Enforce minimum 8-character passwords with complexity rules - Implement MFA for admin accounts at minimum - Set session cookies: `httpOnly: true, secure: true, sameSite: 'lax'` - Use time-limited (< 1 hour), single-use password reset tokens --- ### A08: Software and Data Integrity Failures **Risk:** Code and infrastructure that doesn't verify integrity of updates, data, or CI/CD pipelines. **Detection:** 1. **Unsigned JWTs:** Search for `jwt`, `jsonwebtoken`, `jose` imports. Verify JWTs use strong algorithms (RS256/ES256 preferred, HS256 acceptable). Flag `algorithm: 'none'` as CRITICAL. 2. **Missing Content Security Policy:** Check for CSP headers in config or middleware. 3. **No Subresource Integrity on CDN scripts:** Search for `