file-missing-nginx-rate-limiting: Missing Nginx Rate Limiting Configuration

id: file-missing-nginx-rate-limiting

info:
  name: Missing Nginx Rate Limiting Configuration
  author: pussycat0x
  severity: medium
  description: |
    Ensures that rate limiting is properly configured in Nginx to prevent excessive requests from a single client.
  remediation: |
    Add 'limit_req_zone $binary_remote_addr zone=mylimit:10m rate=10r/s;' in /etc/nginx/nginx.conf.
  reference:
    - https://wiki.devsecopsguides.com/docs/checklists/mongodb/
    - https://nginx.org/en/docs/http/ngx_http_limit_req_module.html
  metadata:
    verified: true
  tags: audit,file,nginx,hardening

file:
  - extensions:
      - conf

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "http"
          - "events"
        condition: and

      - type: word
        words:
          - "limit_req_zone $binary_remote_addr zone="
          - "rate="
        condition: and
        negative: true
# digest: 4a0a00473045022100876d7bd496d8aafd74b3cc2879968f46d1dab56f86072bcee7a3d3fc4619579d022030b12c854fafb64fb3041a91ead557252c322011a37e9f602cf11b177078eb39:922c64590222798bb761d5b6d8e72950