Merge pull request #6514 from kingthorin/add-cwes

Add CWEs to scan rules

Author: thc202

addOns/ascanrules/CHANGELOG.md

@@ -10,6 +10,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 ### Added
 - Rules (as applicable) have been tagged in relation to HIPAA and PCI DSS.
+- The Cloud Metadata Potentially Exposed scan rules now has a CWE reference.
 
 ## [72] - 2025-06-20
 ### Added

addOns/ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/CloudMetadataScanRule.java

@@ -203,6 +203,11 @@ public void scan() {
         }
     }
 
+    @Override
+    public int getCweId() {
+        return 1230; // CWE-1230: Exposure of Sensitive Information Through Metadata
+    }
+
     @Override
     public List<Alert> getExampleAlerts() {
         return List.of(createAlert(null, "www.example.com").build());

addOns/ascanrules/src/test/java/org/zaproxy/zap/extension/ascanrules/CloudMetadataScanRuleUnitTest.java

@@ -189,6 +189,7 @@ void shouldReturnExpectedExampleAlert() {
         Alert alert1 = alerts.get(0);
         assertThat(alert1.getRisk(), is(equalTo(Alert.RISK_HIGH)));
         assertThat(alert1.getConfidence(), is(equalTo(Alert.CONFIDENCE_MEDIUM)));
+        assertThat(alert1.getCweId(), is(equalTo(1230)));
     }
 
     private static NanoServerHandler createHandler(

addOns/ascanrulesAlpha/CHANGELOG.md

@@ -9,6 +9,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 ### Added
 - Rules (as applicable) have been tagged in relation to HIPAA and PCI DSS.
+- The Web Cache Deception scan rule now has a CWE reference.
 
 ## [49] - 2025-06-20
 ### Changed

addOns/ascanrulesAlpha/src/main/java/org/zaproxy/zap/extension/ascanrulesAlpha/WebCacheDeceptionScanRule.java

@@ -206,4 +206,9 @@ public String getReference() {
     public Map<String, String> getAlertTags() {
         return ALERT_TAGS;
     }
+
+    @Override
+    public int getCweId() {
+        return 444; // CWE-444: Inconsistent Interpretation of HTTP Requests
+    }
 }

addOns/ascanrulesAlpha/src/test/java/org/zaproxy/zap/extension/ascanrulesAlpha/WebCacheDeceptionScanRuleUnitTest.java

@@ -175,8 +175,10 @@ void shouldNotAlertIfResponseDoesNotGetsCached() throws Exception {
     void shouldReturnExpectedMappings() {
         // Given / When
         Map<String, String> tags = rule.getAlertTags();
+        int cwe = rule.getCweId();
         // Then
         assertThat(tags.size(), is(equalTo(6)));
+        assertThat(cwe, is(equalTo(444)));
         assertThat(
                 tags.containsKey(CommonAlertTag.OWASP_2021_A05_SEC_MISCONFIG.getTag()),
                 is(equalTo(true)));

addOns/ascanrulesBeta/CHANGELOG.md

@@ -9,6 +9,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 ### Added
 - Rules (as applicable) have been tagged in relation to HIPAA and PCI DSS.
+- The 403 Bypass scan rule now has a CWE reference.
 
 ## [59] - 2025-06-20
 ### Changed

addOns/ascanrulesBeta/src/main/java/org/zaproxy/zap/extension/ascanrulesBeta/ForbiddenBypassScanRule.java

@@ -203,6 +203,11 @@ public Map<String, String> getAlertTags() {
         return ALERT_TAGS;
     }
 
+    @Override
+    public int getCweId() {
+        return 348; // CWE-348: Use of Less Trusted Source
+    }
+
     @Override
     public List<Alert> getExampleAlerts() {
         List<Alert> alerts = new ArrayList<>();

addOns/pscanrules/CHANGELOG.md

@@ -4,7 +4,8 @@ All notable changes to this add-on will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 ## Unreleased
-
+### Added
+- The Reverse Tabnabbing and Retrieved from Cache scan rules now have CWE references.
 
 ## [65] - 2025-06-20
 ### Added

addOns/pscanrules/src/main/java/org/zaproxy/zap/extension/pscanrules/LinkTargetScanRule.java

@@ -156,7 +156,9 @@ private AlertBuilder buildAlert(String evidence) {
                 .setDescription(Constant.messages.getString(MESSAGE_PREFIX + "desc"))
                 .setSolution(Constant.messages.getString(MESSAGE_PREFIX + "soln"))
                 .setReference(Constant.messages.getString(MESSAGE_PREFIX + "refs"))
-                .setEvidence(evidence);
+                .setEvidence(evidence)
+                // CWE-1022: Use of Web Link to Untrusted Target with window.opener Access
+                .setCweId(1022);
     }
 
     @Override