It's now time to check the Globomantics search API.
That's the last of the three components that they want to secure,
and it's built using the .NET platform.
We'll learn how we can configure Dependency‑Check for ongoing monitoring by
setting severity failure levels and suppressing false positives.
This time,
Globomantics want us to configure Dependency‑Check to fail whenever genuine
vulnerabilities above a certain level are found so that they can use that
failure to trigger an alert in their monitoring system.
In fact,
Dependency‑Check has a feature for that built right into it,
so we're going to take advantage of that.
It's called fail on CVSS.
CVSS, or common vulnerability scoring system,
is a structured scoring framework that rates a security
vulnerability on a scale of 0 to 10.
There is actually a lot of additional information about the
vulnerability encoded in a full CVSS rating,
but we're just going to look at the numeric score in this course.
This table shows how they map to objective descriptions,
0.1 to 3.9 is low, 4.0 to 6.9 is medium,
7 to 8.9 is high, and then 9.0 to 10.0 would be critical.
Remember that Log4Shell vulnerability that we
mentioned at the beginning of this course?
Well, it got a 10.0 on this scale.
Globomantics have asked us to make this command fail for
anything high or critical for now.
That will be a 7.0 or greater on the CVSS scale,
and we can do this by adding the flag ‑‑failOnCVSS 7.0.
That's case sensitive.
I'm going to run that, and when it completes,
sure enough, Dependency‑Check has issued a failure.
Let's take a look at the report to understand why.
We've got one medium severity, which is below the threshold Globomantics gave us,
and one high severity vulnerability in the log4net logging library.
That will be what's caused the failure.
We'll need to do something about that.
We'll follow the steps that I outlined in the previous clip.
First of all, could we patch?
Well it looks like we probably could.
The report says the vulnerability doesn't exist in 2.0.10.
Well we're on 2.0.9, so that upgrade would probably not be too disruptive.
But let's assume for demo purposes that patching is not
an option here for whatever reason.
We then need to investigate to see if our app specifically is vulnerable.
Reading the description,
we see this allows for XML external entity‑based attacks in applications that
accept attacker controlled log4net configuration files.
Okay,
so the attack vector here is if the attacker has
control of a logging configuration file.
In this case,
I happen to know that the configuration file is safe from attackers.
It's not hosted on any network location,
the build process is tightly controlled to authorized developers,
and the API does not accept or pass configuration files from users.
In our specific application, this is a false positive.
Globomantics did say that they only wanted the task to fail for genuine
high severity vulnerabilities in their application,
which means we need to suppress this CVE report so that it
doesn't cause a failure going forward.
In Dependency‑Check, this is done by creating a suppression file,
and the HTML report gives us a helping hand with this.
If we click the Suppress button next to the CVE listing,
we get a pop‑up with some auto‑generated XML.
The idea is that we copy this XML snippet and add it to our suppression file.
We don't actually have a suppression file yet,
but we can hit the Complete XML Doc button and hopefully we get
the contents of an entire suppression file.
I'm going to take that XML and add it to a new file
called suppression.xml in my project root.
According to the best practice that we discussed in the previous clip,
I'm going to do two additional things.
First,
I'm going to add to the notes field an explanation of
why we are suppressing this report, and two,
I'm going to add an until attribute to the suppress XML tag
with an expiry date 3 months from now.
In 3 months,
I want this to start failing again so that we can check
that the situation hasn't changed.
Finally, we can run Dependency‑Check with another command line argument,
‑‑suppression and the path to the file that we just created.
You'll see that this time Dependency‑Check has completed without error.