Scan report

swissmakers / fail2ban-ui

View on GitHub (opens in a new tab)
Go
352 stars
Scanned 24 Sep 2026, 09:00

Report Rescan

Vulnerability Medium

Could an attacker exploit mistakes in this code?

30 risk score

Real issues worth reviewing before you rely on this code.

High: 2
Medium: 14
Low: 0

Sources: Bandit, Semgrep, pip-audit

Malicious pattern Medium

Does this code look like it is trying to cause harm?

30 risk score

Real issues worth reviewing before you rely on this code.

High: 7
Medium: 6
Low: 5

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview

34 total findings

Likely real: 23
Uncertain: 2
Likely noise: 9

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

The repository has a medium vulnerability score of 30.0 and a medium malicious-pattern score of 30.0, indicating that while the code contains some risky patterns, it does not appear to be intentionally designed to harm users. The most significant issues involve base64-encoded scripts that are decoded and executed by JavaScript files like echarts.min.js, which suggests an attempt to hide malicious payloads from security scanners. Additionally, there are several high-priority findings related to potential command injection vulnerabilities in Go code and disabled host key verification in Docker configurations that could allow attackers to compromise the system. These patterns look more like sophisticated obfuscation techniques used by malware authors than simple insecure coding errors, as they rely on encoding tricks to bypass standard security checks. However, because these issues are already flagged by multiple independent tools with high confidence scores, they represent real risks that should be addressed before deploying the software in a production environment.

Written by a local language model from the findings below. The risk scores come from the classifier, not from this summary.

Detections by engine

Semgrep 16

Pattern-based code analysis · Vulnerability
GuardDog 10

Supply-chain attack heuristics · Malicious pattern
YARA 7

Malware signature rules · Malicious pattern
Dependency checker 1

CVEs, typosquats and risky installs · Supply chain

Score over time

Overall score each time this repository was scanned.

Findings

Highest severity first. Select a finding to see the code and what it means.

Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/pkg/web/static/vendor/echarts/echarts.min.js line 45

Likely real
Yes, 91% confidence

Detects base64 decoding followed by code execution [threat-runtime-obfuscation-base64exec]
```
...igator.msSaveOrOpenBlob||o){var u=s.split(","),h=u[0].indexOf("base64")>-1,c=o?decodeURIComponent(u[1]):u[1];h&&(c=window.atob(c));var p=i+"."+a;if(window.navigator.msSaveOrOpenBlob){for(var d=c.length,f=new Uint8Array(d);d--;)f[d]=c.charCodeAt(d);v...
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/fail2ban/connector_local.go line 274

Likely real
Uncertain, 46% confidence

Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.
```
cmd := exec.CommandContext(ctx, parts[0], parts[1:]...)
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/Dockerfile line 81

Likely real
Probably noise, 22% confidence

By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'.
```
ENTRYPOINT ["/sbin/tini", "--", "/app/fail2ban-ui"]
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/pkg/web/static/js/utils.js line 119

Likely real
Yes, 100% confidence

RegExp() called with a `query` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS.
```
var regex = new RegExp(escapedPattern, "gi");
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/pkg/web/static/vendor/globe/globe.gl.min.js line 20

Likely real
Yes, 98% confidence

Detects unicode homoglyphs and uncommon characters used for obfuscation [threat-runtime-obfuscation-unicode]
```
...ase",vendor_url:"http://www.magenta.gr/",full_font_name:"Helvetiker",font_family_name:"Helvetiker",copyright:"Copyright (c) Μagenta ltd, 2004",description:"",trademark:"",designer:"",designer_url:"",unique_font_identifier:"Μagenta ltd:Helvetiker:22-1...
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/pkg/web/static/js/core.js line 235

Likely real
Yes, 97% confidence

Detects URLs to URL shorteners, file sharing, and suspicious services [threat-network-outbound-shady-links]
```
{ url: 'https://ip.swissmakers.ch/ip', extract: data => data.ip },
    { url: 'https://api.ipify.org?format=json', extract: data => data.ip },
    { url: 'https://ipapi.co/json/', extract: data => data && (data.ip || dat...
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/pkg/web/static/js/core.js line 237

Likely real
Yes, 97% confidence

Detects URLs to URL shorteners, file sharing, and suspicious services [threat-network-outbound-shady-links]
```
{ url: 'https://ipapi.co/json/', extract: data => data && (data.ip || data.ip_address) },
    { url: 'https://ipv4.jsonip.com/', extract: data => data.ip }
  ];
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/pkg/web/static/js/core.js line 235

Likely real
Yes, 97% confidence

Detects URLs to URL shorteners, file sharing, and suspicious services [threat-network-outbound-shady-links]
```
{ url: 'https://ip.swissmakers.ch/ip', extract: data => data.ip },
    { url: 'https://api.ipify.org?format=json', extract: data => data.ip },
    { url: 'https://ipapi.co/json/', extract: data => data && (data.ip || d...
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/pkg/web/static/js/core.js line 235

Likely real
Yes, 97% confidence

Detects URLs to URL shorteners, file sharing, and suspicious services [threat-network-outbound-shady-links]
```
{ url: 'https://ip.swissmakers.ch/ip', extract: data => data.ip },
    { url: 'https://api.ipify.org?format=json', extract: data => data.ip },
    { url: 'https://ipapi.co/json/', extract: data => data && (data.ip ...
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/pkg/web/static/vendor/globe/globe.gl.min.js line 5

Likely real
Yes, 93% confidence

Detects log/console suppression combined with obfuscated code, a common malware evasion pattern [threat-runtime-obfuscation-log-suppress]
```
...(e,"binary"))),t)},"undefined"!=typeof scriptArgs&&scriptArgs,"undefined"!=typeof print&&("undefined"==typeof console&&(console={}),console.log=print,console.warn=console.error="undefined"!=typeof printErr?printErr:print)):(i||s)&&(s?p=self.location...
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/integrations/mikrotik.go line 193

Likely real
Yes, 55% confidence

Disabled host key verification detected. This allows man-in-the-middle attacks. Use the 'golang.org/x/crypto/ssh/knownhosts' package to do host key verification. See https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/ to learn more about the problem and how to fix it.
```
return ssh.InsecureIgnoreHostKey(), nil
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/pkg/web/handlers_auth.go line 46

Likely real
Yes, 53% confidence

A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct.
```
http.SetCookie(c.Writer, &http.Cookie{
		Name:     "oidc_state",
		Value:    state,
		Path:     CookiePath(),
		MaxAge:   600,
		HttpOnly: true,
		Secure:   isSecure,
		SameSite: http.SameSiteLaxMode,
	})
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/pkg/web/handlers_auth.go line 92

Likely real
Yes, 53% confidence

A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct.
```
http.SetCookie(c.Writer, &http.Cookie{
		Name:     "oidc_state",
		Value:    "",
		Path:     CookiePath(),
		MaxAge:   -1,
		HttpOnly: true,
		Secure:   isSecure,
		SameSite: http.SameSiteLaxMode,
	})
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/auth/session.go line 166

Likely real
Yes, 53% confidence

A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct.
```
cookie := &http.Cookie{
		Name:     sessionCookieName,
		Value:    "",
		Path:     sessionPath(),
		MaxAge:   -1,
		HttpOnly: true,
		Secure:   isSecure,
		SameSite: http.SameSiteLaxMode,
	}
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/auth/session.go line 124

Likely real
Yes, 53% confidence

A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct.
```
cookie := &http.Cookie{
		Name:     sessionCookieName,
		Value:    encrypted,
		Path:     sessionPath(),
		MaxAge:   maxAge,
		HttpOnly: true,
		Secure:   isSecure,
		SameSite: http.SameSiteLaxMode,
	}
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/storage/storage.go line 381

Likely real
Yes, 53% confidence

String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data.
```
query := fmt.Sprintf(
			`UPDATE ban_events SET %[1]s = replace(substr(%[1]s, 1, length(%[1]s)-10), ' ', 'T') || 'Z' WHERE %[1]s LIKE '%% +0000 UTC'`,
			column,
		)
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/storage/storage.go line 1013

Likely real
Yes, 53% confidence

String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data.
```
query = fmt.Sprintf(`SELECT COUNT(*) FROM (SELECT 1 FROM ban_events WHERE 1=1%s LIMIT %d)`, conditions, MaxSearchCount+1)
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/storage/storage.go line 1324

Likely real
Yes, 53% confidence

String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data.
```
countQuery := `SELECT COUNT(DISTINCT ip) FROM ban_events WHERE ip != ''` + conditions
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/pkg/web/handlers_email.go line 260

Likely real
Yes, 53% confidence

`MinVersion` is missing from this TLS configuration. By default, as of Go 1.22, TLS 1.2 is currently used as the minimum. General purpose web applications should default to TLS 1.3 with all other protocols disabled. Only where it is known that a web server must support legacy clients with unsupported an insecure browsers (such as Internet Explorer 10), it may be necessary to enable TLS 1.0 to provide support. Add `MinVersion: tls.VersionTLS13' to the TLS configuration to bump the minimum version to TLS 1.3.
```
tlsConfig := &tls.Config{
		ServerName:         smtpHost,
		InsecureSkipVerify: settings.SMTP.InsecureSkipVerify,
	}
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/storage/storage.go line 1011

Likely real
Yes, 52% confidence

String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data.
```
query := `SELECT COUNT(*) FROM ban_events WHERE 1=1` + conditions
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/httpx/httpx.go line 34

Likely real
Yes, 52% confidence

`MinVersion` is missing from this TLS configuration. By default, as of Go 1.22, TLS 1.2 is currently used as the minimum. General purpose web applications should default to TLS 1.3 with all other protocols disabled. Only where it is known that a web server must support legacy clients with unsupported an insecure browsers (such as Internet Explorer 10), it may be necessary to enable TLS 1.0 to provide support. Add `MinVersion: tls.VersionTLS13' to the TLS configuration to bump the minimum version to TLS 1.3.
```
t.TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.gitea/workflows/build-harbor.yml line 12

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: actions/checkout@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/httpx/httpx.go line 34

Likely real
Uncertain, 49% confidence

Checks for disabling of TLS/SSL certificate verification. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks.
```
t.TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/internal/config/settings.go line 1483

Likely real
Yes, 93% confidence

Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read]
```
if config.ClientSecret == "auto-configured" {
		secretFile := os.Getenv("OIDC_CLIENT_SECRET_FILE")
		if secretFile == "" {
			secretFile = "/config/keycloak-client-secret"
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/internal/config/settings.go line 1481

Likely real
Yes, 93% confidence

Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read]
```
}
	config.ClientSecret = os.Getenv("OIDC_CLIENT_SECRET")
	if config.ClientSecret == "auto-configured" {
		secretFile := os.Getenv("OIDC_CLIENT_SECRET_FILE")
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/internal/config/settings.go line 693

Likely real
Yes, 93% confidence

Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read]
```
}
	if cbSecret := os.Getenv("CALLBACK_SECRET"); cbSecret != "" {
		currentSettings.CallbackSecret = strings.TrimSpace(cbSecret)
	} else if currentSettings.CallbackSecret == "" {
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'tailwindcss^3.4.19' — attacker could push malicious update
```
tailwindcss:^3.4.19
```