May 19, 2024

OWASP dep-scan is a robust open-source security and risk assessment tool designed to analyze project dependencies for vulnerabilities, advisories, and licensing restrictions. The tool can handle inputs from local repositories and container images, making it ideal for integration with Application Security Posture Management (ASPM) and Vulnerability Management (VM) platforms, as well as Continuous Integration (CI) environments.

Key Features of OWASP dep-scan

Caroline Russell, Staff Security Engineer at AppThreat, highlights the primary features of OWASP dep-scan:

• Software Bill-of-Materials (SBOMs) Creation: OWASP dep-scan utilizes cdxgen to generate SBOMs, supporting various programming languages and source code configurations. This feature enhances the tool’s adaptability across different project environments.
• Customizable Reports: The tool offers export options for results in customizable Jinja reports and JSON documents. Supported standards include CycloneDx Vulnerability Disclosure Report (VDR) and Common Security Advisory Framework (CSAF) 2.0.
• Reachability Analysis: Using AppThreat/atom, OWASP dep-scan performs reachability analysis by creating slices of the source code. This helps in understanding which parts of the code are potentially affected by vulnerabilities.
• Deep Packages Risk Audit: The tool conducts a thorough risk audit of dependencies to identify potential dependency confusion attacks and maintenance risks.

Vulnerability Data Sources

OWASP dep-scan aggregates data from multiple vulnerability sources to provide comprehensive assessments:

• OSV (Open Source Vulnerabilities)
• NVD (National Vulnerability Database)
• GitHub
• NPM
• Linux vuln-list (using the –cache-os option)

Future Development and Enhancements

Russell shared insights into the upcoming OWASP dep-scan 6.0, expected near the end of the year. Key enhancements include:

• Faster Backend Database: Improved performance for querying vulnerabilities.
• BLint Integration: Adding BLint for enhanced code analysis.
• User Configuration Settings: Options for automatic updates to the backend threat database and user-defined scan exclusions.

Availability

OWASP dep-scan is freely available on GitHub, providing an accessible tool for developers and security professionals to ensure the security and compliance of their project dependencies.

Conclusion

OWASP dep-scan is a powerful tool for conducting security and risk assessments of project dependencies. With its comprehensive features and ongoing development, it remains an essential resource for maintaining secure and compliant software environments.