Release 2.51.0: Merge Bugfix into Dev

[rossops]

No description provided.

[dryrunsecurity]

🔴 Risk threshold exceeded.

This pull request modifies several sensitive files and introduces security issues: an IDOR/privilege escalation in dojo/api_v2/serializers.py allowing arbitrary association of vulnerability IDs without authorization checks, and a Markdown injection vulnerability in dojo/tools/github_secrets_detection_report/parser.py where unsanitized report fields are rendered as Markdown; other edits were flagged as sensitive in dojo/finding/views.py, dojo/search/views.py, and dojo/templates/dojo/findings_list_snippet.html.

🔴 Configured Codepaths Edit in dojo/api_v2/serializers.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/finding/views.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/search/views.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/templates/dojo/findings_list_snippet.html

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

Insecure Direct Object Reference (IDOR) / Privilege Escalation in dojo/api_v2/serializers.py

Vulnerability

Insecure Direct Object Reference (IDOR) / Privilege Escalation

Description

The create method in FindingCreateSerializer allows a user to associate arbitrary vulnerability_id_set values with a new finding. The save_vulnerability_ids function, which persists these associations, does not perform any authorization checks to ensure the user has permission to link these specific vulnerability IDs. This allows a user to link a finding in an authorized product to vulnerability IDs they are not otherwise authorized to access or manage, leading to potential information disclosure or data tampering.

django-DefectDojo/dojo/api_v2/serializers.py

Lines 1913 to 1914 in 4a80d28

	new_finding.unsaved_vulnerability_ids = parsed_vulnerability_ids or []
	new_finding.save()

Markdown Injection in dojo/tools/github_secrets_detection_report/parser.py

Vulnerability

Markdown Injection

Description

The GithubSecretsDetectionReportParser constructs the Finding.description field by concatenating various values directly from the uploaded JSON report. These values, such as secret_type_display_name, resolution_comment, repo_full_name, and others, are not sanitized before being included in the description. The DefectDojo UI then renders this description field using a markdown_render filter, which processes Markdown syntax. This allows an attacker to inject malicious Markdown (and potentially HTML if the Markdown renderer allows it) into the displayed finding details by crafting a specially malformed JSON report.

django-DefectDojo/dojo/tools/github_secrets_detection_report/parser.py

Lines 112 to 115 in 4a80d28

	description = "\n\n".join(desc_lines)
	# Determine severity based on state and other factors
	if state == "resolved":

We've notified @mtesauro.

---

All finding details can be found in the DryRun Security Dashboard.