[Autogenerated] here comes the really good stuff.
We're going to run an analysis and cover the security issues
that sona cube will find in our code base.
We already saw how to create a project,
obtained the token and to generate the command to run the analysis.
But before we do just a quick walkthrough of the sonar project
Properties configuration file that I have included with the
resources for this module here we have just a few important
security settings to take care of.
We need to map the project on our file system to the project we created
in sonar via the sonar dot project key and the sonar dot project Named
Properties point to the source code directories via this owner dot
source property and optionally to the source code for the tests via the
sonar dot test property key.
Already we are ready to run the analysis,
so open the terminal cd into the directory of your
project and paste this maven command.
Now we execute it and wait for a few seconds for the run to complete.
What happens here is the command invokes the maven sonar target which triggers
a build and then runs a static analysis on the code Okay,
all done Now we navigate to the sonar server,
select projects, then click on the project link in this case,
insecure app and see quality gates and measures.
We're mostly interested in the measures and since this is our first run,
let's click on the overall cold tab here we find our project and see
that we have several vulnerabilities and hotspots.
Starting with the vulnerabilities,
we see that sonar cube has detected the following.
A problem with password protection for the database A problem with secure
mode and padding scheme and the weak cipher algorithm.
This is a quick list but it comes with some nice details like the tags that
indicate how the issue is classified according to a wasp.
For example,
the first problem is classified as A two and A three or broken
authentication and sensitive data exposure respectively.
On the left.
You can see a breakdown by type under the security category
here we see that they were further subdivided into week
photography and authentication,
clicking on the add password protection to this database reveals where
it is in the code the registration service class.
Sonar gives us a nice message to add a password to the database
because currently the driver manager Carlo uses an empty string or
no password even though one is passed into the method and encrypted
a little bit above the message.
If we need more information on what the issue is as
well as some help on how to fix it.
We can click on the why is this an issue tab and that will show us a
piece of noncompliant code Exemplifying the problem a piece of
corresponding compliant code that shows us how to fix the issue and
the reference section with links to the respective A two and A three
in os and miners.
Common weaknesses.
Enumeration or C W e documentation describing the problem at hand
notice that there is no direct mapping to minor attack techniques But
what we see here is related to T1190 exploit.
Public facing application notice that we still have the
short list of vulnerabilities on the left.
For easy navigation, Clicking on the 2nd 1.
We see that it is also in the registration service and has to
do with using an insecure padding scheme.
D S E C B No padding going to the detailed step,
we can see the compliant code specifies a s padding scheme.
Instead,
the issue is classified under OSPF Top 10 2017 category A six security
misconfigurations This indirectly points to minor attack.
T 1078 valid accounts.
This is perhaps a good place to point out differences in classification
in the open web application security project or os based on the year in
which the areas of concern were examined.
You can see two different classifications here.
One for 2021 and one for 2017.
The one Sonar Cube uses is generally the 2017
ranking which we briefly saw earlier.
Of course in 2021.
top 10 were ranked differently because of the changes of relative
importance over time and now on to the last vulnerability.
It is also in the registration service where sonar is suggesting the usage of
a stronger cipher algorithm Switching to the Y is this an issue tab reveals
the problem is classified as Top 10 2017 category.
A three sensitive data exposure or mr C w E 3 27.
Use of a broken risky cryptographic algorithm Which again
points to minor attack T 1078 valid accounts.
Now we turn our attention to the security hotspots,
click security hotspots in the top horizontal.
Many we see something similar to what we had with vulnerabilities but since
developers will need to decide whether to fix a hotspot or not,
they need more information.
Hence the problems are categorized much better along with
corresponding prioritization ranking from high to low.
Starting at the top we see that the authentication and SQL injection.
Hotspots are ranked as high,
whereas the insecure configuration and others are ranked as low priority.
We also have two more tabs.
One that describes the risk representing common vulnerabilities and
exposures or CVS that show examples of vulnerabilities in practice and
one that helps developers assess the risk here.
Sonja cube offers questions and sensitive code samples.
Let's delve into the details.
The two authentication problems are pretty much identical.
Sonar is telling us it is likely we have hard coded credentials
and indeed with you user sonar with password.
Sonar are hard coded into the user controller and the sequel injection,
vulnerable ripple classes.
Navigating to the how to fix it.
Tab reveals best practices and a corresponding compliant code sample.
The problem is classified under os up?
Top 10 2017 category.
A two broken authentication which also points to minor attack.
T 10 78 valid accounts.
Next we examined the sequel injection hotspot.
The issue is with the potentially unsafe dynamically formatted query I
provided a detailed explanation in the code comment that follows along
with the sample exploit of this unsafe.
Query The comment before the method is for you to trace this to minor attack.
T 11 90 exploit the public facing application And wider CWE 89
improper neutralization of special elements used in a sequel command
clicking on the how to fix it tab reveals.
The problem is classified as OSPF top 10 2017 category a one
injection and more specifically SQL injection.
Going down the list under insecure configuration.
We see a hotspot that deals with sensitive data exposure
or in this case putting the session I.
D.
In a cookie who's http only flag is set to false.
This presents the possibility of a hacker stealing the session,
IDE and potentially wreaking havoc on the system switching to the help to
fix it tab shows us we need to set the flag to true and that the problem is
classified as top 10 2017 category a three sensitive data exposure Which
again refers indirectly to minor attack.
T 1078 valid accounts.
Finally,
let's see what's under other here we look at the previous problem we
just discussed but from a different perspective the insecure cookie
can become ample ground for a cross site scripting attack and indeed
switching to the last tab.
We see that the issue is classified under all WASP top 10 2017,
Category 87 cross site scripting, which indirectly points to T 1189 drive.
By compromise where cross site scripting is one of the varieties and
this is pretty much it for reviewing the results.
You learned a lot in this module.
You should take a moment to celebrate and review what you've learned.
In the next clip,
we'll review some additional resources you can use to
expand your sonar cube skill set even more.