Ensure scanners are in place for API runtime security weaknesses

低级别 2人工审核gitlab

说明

Dynamic Application Security Testing (DAST) runs automated penetration tests to find vulnerabilities in your APIs as they are running. DAST automates a hacker’s approach and simulates real-world attacks for critical threats such as cross-site scripting (XSS), SQL injection (SQLi), and cross-site request forgery (CSRF) to uncover vulnerabilities and misconfigurations that other security tools cannot detect.

检查方式

审计方法: 人工审核

此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。

Audit: Ensure a dynamic API scanning tool is set up to identify API-specific vulnerabilities and that every project that contains an APi is scanned by it. - The DAST-API template must be configured for your project. - A successful pipeline was run on the default branch. You should not change the default behavior of allowing the application security jobs to fail. - Review the output from the scan in Secure > Vulnerability Report

修复方式

修复方法: 操作指南或基础设施补丁

1. Include the DAST-API.gitlab-ci.yml template in your .gitlab-ci.yml file. 2. The configuration file has several testing profiles defined with different checks enabled. Select a profile and provide it by adding the DAST_API_PROFILE CI/CD variable to your .gitlab-ci.yml file. 3. Provide the location of the OpenAPI Specification as either a file or URL. Specify the location by adding the DAST_API_OPENAPI variable. 4. The target API instance’s base URL is also required. Provide it by using the DAST_API_TARGET_URL variable or an environment_url.txt file. 5. After configuration, the analyzer will run in your pipeline. 6. View the results in the Vulnerability report and remediate the vulnerabilities.

属性

操作系统: 任意
标签: devsecopsgitlab
参考: CIS GitLab Benchmark v1.0.1 - 1.5.8 Ensure scanners are in place for API runtime security weaknesses