Ensure scanners are in place for API runtime security weaknesses

低等級 2人工審核gitlab

說明

Dynamic Application Security Testing (DAST) runs automated penetration tests to find vulnerabilities in your APIs as they are running. DAST automates a hacker’s approach and simulates real-world attacks for critical threats such as cross-site scripting (XSS), SQL injection (SQLi), and cross-site request forgery (CSRF) to uncover vulnerabilities and misconfigurations that other security tools cannot detect.

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

Audit: Ensure a dynamic API scanning tool is set up to identify API-specific vulnerabilities and that every project that contains an APi is scanned by it. - The DAST-API template must be configured for your project. - A successful pipeline was run on the default branch. You should not change the default behavior of allowing the application security jobs to fail. - Review the output from the scan in Secure > Vulnerability Report

修補方式

修補方法: 操作指南或基礎設施修補檔

1. Include the DAST-API.gitlab-ci.yml template in your .gitlab-ci.yml file. 2. The configuration file has several testing profiles defined with different checks enabled. Select a profile and provide it by adding the DAST_API_PROFILE CI/CD variable to your .gitlab-ci.yml file. 3. Provide the location of the OpenAPI Specification as either a file or URL. Specify the location by adding the DAST_API_OPENAPI variable. 4. The target API instance’s base URL is also required. Provide it by using the DAST_API_TARGET_URL variable or an environment_url.txt file. 5. After configuration, the analyzer will run in your pipeline. 6. View the results in the Vulnerability report and remediate the vulnerabilities.

屬性

作業系統: 不限
標籤: devsecopsgitlab
參考資料: CIS GitLab Benchmark v1.0.1 - 1.5.8 Ensure scanners are in place for API runtime security weaknesses