5

I was wondering if brakeman covers/scans for OWASP top 10 security vulnerabilities:

This is the OWASP top 10:

https://www.owasp.org/index.php/Top_10_2013-Top_10

Is there documentation somewhere on brakeman that shows that it covers the above scans.

I am using ruby on rails 4 and the latest version of brakeman.

Micheal
  • 2,272
  • 10
  • 49
  • 93
  • 1
    Have a look at the list of warning types that Brakeman gives [here](http://brakemanscanner.org/docs/warning_types/) and then you can map them to the OWASP list. – Paul Fioravanti Feb 04 '16 at 22:37

1 Answers1

6

You can't really define things in terms of "covering" the OWASP Top 10 since they are categories of vulnerabilities, sometimes very broad.

A1 Injection

Brakeman detects SQL injection and command injection.

A2 Broken Authentication and Session Management

Brakeman warns about unsafe Basic Auth usage and poor session settings. However, A2 is really about how applications implement authentication and session management. Detecting if this is done poorly is pretty difficult.

A3 Cross-Site Scripting (XSS)

Brakeman warns about many instances and variations of XSS.

A4 Insecure Direct Object References

Brakeman has an optional check for unscoped finds, which are an instance of IDOR.

A5 Security Misconfiguration

This is more often a server-level issue and is incredibly broad. Brakeman does detect when SSL verification is turned off for HTTP calls.

A6 Sensitive Data Exposure

A6 is mostly about storing/transmitting data unencrypted. Brakeman does not detect this.

A7 Missing Function Level Access Control

Brakeman does not detect this. Pretty hard to guess what should and should not have access controls.

A8 Cross-Site Request Forgery (CSRF)

Brakeman warns about disabled CSRF protection and unsafe configurations.

A9 Using Components with Known Vulnerabilities

Brakeman only warns about CVEs in Rails. Use bundler-audit for other dependencies.

A10 Unvalidated Redirects and Forwards

Brakeman warns about open redirects.

Keep in mind the OWASP Top 10 is a good resource but not exhaustive (just the "Top 10"). Brakeman's warning categories will give you a sense of the other issues it detects.

Justin
  • 1,561
  • 10
  • 12