Skip to content

Øvelse 29 - Skanning for tredjeparts sårbarheder med Snyk CLI-værktøjet

Scanninger og resultater

snyk test

Tested 236 dependencies for known issues, found 11 issues, 66 vulnerable paths.


Issues to fix by upgrading:

  Upgrade System.Data.SqlClient@4.8.3 to System.Data.SqlClient@4.8.6 to fix
  ✗ Information Exposure [Medium Severity][https://snyk.io/vuln/SNYK-DOTNET-SYSTEMDATASQLCLIENT-3110424] in System.Data.SqlClient@4.8.3
    introduced by System.Data.SqlClient@4.8.3
  ✗ Unprotected Storage of Credentials [High Severity][https://snyk.io/vuln/SNYK-DOTNET-SYSTEMDATASQLCLIENT-6149433] in System.Data.SqlClient@4.8.3
    introduced by System.Data.SqlClient@4.8.3


Issues with no direct upgrade or patch:
  ✗ Improper Access Control [Critical Severity][https://snyk.io/vuln/SNYK-DOTNET-NUGETPACKAGING-6245712] in NuGet.Packaging@6.6.1
    introduced by Microsoft.VisualStudio.Web.CodeGeneration.Design@7.0.10 > Microsoft.DotNet.Scaffolding.Shared@7.0.10 > NuGet.ProjectModel@6.6.1 > NuGet.DependencyResolver.Core@6.6.1 > NuGet.Protocol@6.6.1 > NuGet.Packaging@6.6.1 and 3 other path(s)
  This issue was fixed in versions: 5.11.6, 6.0.6, 6.3.4, 6.4.3, 6.6.2, 6.7.1, 6.8.1
  ✗ Improper Input Validation [Medium Severity][https://snyk.io/vuln/SNYK-DOTNET-SYSTEMFORMATSASN1-7443633] in System.Formats.Asn1@5.0.0
    introduced by Microsoft.VisualStudio.Web.CodeGeneration.Design@7.0.10 > Microsoft.DotNet.Scaffolding.Shared@7.0.10 > NuGet.ProjectModel@6.6.1 > NuGet.DependencyResolver.Core@6.6.1 > NuGet.Protocol@6.6.1 > NuGet.Packaging@6.6.1 > System.Security.Cryptography.Cng@5.0.0 > System.Formats.Asn1@5.0.0 and 19 other path(s)
  This issue was fixed in versions: 6.0.1, 8.0.1
  ✗ Denial of Service (DoS) [High Severity][https://snyk.io/vuln/SNYK-DOTNET-SYSTEMNETHTTP-60045] in System.Net.Http@4.3.0
    introduced by Microsoft.VisualStudio.Web.CodeGeneration.Design@7.0.10 > Microsoft.DotNet.Scaffolding.Shared@7.0.10 > Microsoft.CodeAnalysis.CSharp.Features@4.4.0 > Microsoft.CodeAnalysis.Features@4.4.0 > Microsoft.DiaSymReader@1.4.0 > NETStandard.Library@1.6.1 > System.Net.Http@4.3.0 and 3 other path(s)
  This issue was fixed in versions: 4.1.2, 4.3.2
  ✗ Improper Certificate Validation [High Severity][https://snyk.io/vuln/SNYK-DOTNET-SYSTEMNETHTTP-60046] in System.Net.Http@4.3.0
    introduced by Microsoft.VisualStudio.Web.CodeGeneration.Design@7.0.10 > Microsoft.DotNet.Scaffolding.Shared@7.0.10 > Microsoft.CodeAnalysis.CSharp.Features@4.4.0 > Microsoft.CodeAnalysis.Features@4.4.0 > Microsoft.DiaSymReader@1.4.0 > NETStandard.Library@1.6.1 > System.Net.Http@4.3.0 and 3 other path(s)
  This issue was fixed in versions: 4.1.2, 4.3.2
  ✗ Privilege Escalation [High Severity][https://snyk.io/vuln/SNYK-DOTNET-SYSTEMNETHTTP-60047] in System.Net.Http@4.3.0
    introduced by Microsoft.VisualStudio.Web.CodeGeneration.Design@7.0.10 > Microsoft.DotNet.Scaffolding.Shared@7.0.10 > Microsoft.CodeAnalysis.CSharp.Features@4.4.0 > Microsoft.CodeAnalysis.Features@4.4.0 > Microsoft.DiaSymReader@1.4.0 > NETStandard.Library@1.6.1 > System.Net.Http@4.3.0 and 3 other path(s)
  This issue was fixed in versions: 4.1.2, 4.3.2
  ✗ Authentication Bypass [Medium Severity][https://snyk.io/vuln/SNYK-DOTNET-SYSTEMNETHTTP-60048] in System.Net.Http@4.3.0
    introduced by Microsoft.VisualStudio.Web.CodeGeneration.Design@7.0.10 > Microsoft.DotNet.Scaffolding.Shared@7.0.10 > Microsoft.CodeAnalysis.CSharp.Features@4.4.0 > Microsoft.CodeAnalysis.Features@4.4.0 > Microsoft.DiaSymReader@1.4.0 > NETStandard.Library@1.6.1 > System.Net.Http@4.3.0 and 3 other path(s)
  This issue was fixed in versions: 4.1.2, 4.3.2
  ✗ Information Exposure [High Severity][https://snyk.io/vuln/SNYK-DOTNET-SYSTEMNETHTTP-72439] in System.Net.Http@4.3.0
    introduced by Microsoft.VisualStudio.Web.CodeGeneration.Design@7.0.10 > Microsoft.DotNet.Scaffolding.Shared@7.0.10 > Microsoft.CodeAnalysis.CSharp.Features@4.4.0 > Microsoft.CodeAnalysis.Features@4.4.0 > Microsoft.DiaSymReader@1.4.0 > NETStandard.Library@1.6.1 > System.Net.Http@4.3.0 and 3 other path(s)
  This issue was fixed in versions: 2.0.20710, 4.0.1-beta-23225, 4.1.4, 4.3.4
  ✗ Denial of Service (DoS) [High Severity][https://snyk.io/vuln/SNYK-DOTNET-SYSTEMTEXTJSON-7433719] in System.Text.Json@7.0.0
    introduced by Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation@7.0.12 > Microsoft.Extensions.DependencyModel@7.0.0 > System.Text.Json@7.0.0 and 7 other path(s)
  This issue was fixed in versions: 8.0.4
  ✗ Regular Expression Denial of Service (ReDoS) [High Severity][https://snyk.io/vuln/SNYK-DOTNET-SYSTEMTEXTREGULAREXPRESSIONS-174708] in System.Text.RegularExpressions@4.3.0
    introduced by Microsoft.VisualStudio.Web.CodeGeneration.Design@7.0.10 > Microsoft.DotNet.Scaffolding.Shared@7.0.10 > Microsoft.CodeAnalysis.CSharp.Features@4.4.0 > Microsoft.CodeAnalysis.Features@4.4.0 > Microsoft.DiaSymReader@1.4.0 > NETStandard.Library@1.6.1 > System.Text.RegularExpressions@4.3.0 and 11 other path(s)
  This issue was fixed in versions: 4.3.1

Refleksionsspørgsmål

  1. Hvordan kan brugen af flere værktøjer som Snyk og dotnet vulnerability forbedre jeres sikkerhedsindsats?

Forskellige værktøjer med forskellige databaser kan muligvis finde forskellige sårbarheder.

  1. Hvilke udfordringer kan der være ved at holde tredjepartsbiblioteker opdaterede?

At de dele man bruger kan være ændret og dermed skal ens egen kode opdateres.

  1. Hvordan kan automatisering i CI/CD-pipelines hjælpe med at forebygge sårbarheder?(Hvis du endnu ikke er bekendt med CI/CD, så blier den introduceret senere i dette fag)

Det kan hjælpe ved at stoppe sin pipeline hvis nu en sårbarhed findes. På den måde kan man stoppe kendte sårbarheder i at nå ud til produktions miljøer.

Kobling til relevante standarder og principper

Element i øvelsen Relateret standard / princip Kommentar
Sårbarhedsscanning ISO/IEC 27002:2022, afsnit 8.8 (Styring af tekniske sårbarheder, særligt stykke d. og f.) Anbefaler løbende scanning og håndtering af kendte sårbarheder i softwarekomponenter.
OWASP Application Security Verification Standard (ASVS), Kontrol 15 Krav om håndtering af tredjepartskomponenter og kendte sårbarheder i applikationer.
Secure by Design (Johnsson et al.) Fremhæver vigtigheden af at kende og minimere risiko ved tredjepartssoftware.