rules:
- id: telnet-request
  message: >-
    Checks for attempts to connect to an insecure telnet server using the package telnet.
    This is bad because it can lead to man in the middle attacks.
  severity: WARNING
  metadata:
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    category: security
    cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
    owasp: 'A03:2017 - Sensitive Data Exposure'
    references:
    - https://godoc.org/github.com/reiver/go-telnet
    subcategory:
    - vuln
    technology:
    - go-telnet
    vulnerability: Insecure Transport
  languages:
  - go
  pattern: |
    telnet.DialToAndCall(...)