OWASP dep-scan: an open source security Audit Tool

[Father]

A free tool for analyzing vulnerabilities and license restrictions.

OWASP Dependency-Scan (OWASP dep-scan) is a powerful open source tool designed for security analysis and risk assessment of software projects. It scans project dependencies, including external libraries and frameworks, and checks them for known vulnerabilities, non-compliance with security recommendations, and violations of license restrictions.

One of the key advantages of OWASP dep-scan is its ability to work with a variety of input data sources. It supports local package repositories such as Maven, NPM, NuGet, and others, and can also analyze container images, making it compatible with platforms for automated container creation, deployment, and management (ASPM/VM).

With flexible integration with Continuous Integration and Continuous Delivery (CI/CD) systems, OWASP dep-scan can be easily integrated into software development processes. This allows you to identify and fix security issues in a timely manner at an early stage, reducing the risks and costs of fixing vulnerabilities in the future.

OWASP dep-scan uses multiple data sources to get information about vulnerabilities:

• OSV
• NVD
• GitHub
• NPM
• Linux vuln-list (with the --cache-os option)

It also takes into account recommendations for the safe use of libraries and frameworks, as well as checks compliance with license restrictions, which is especially important for open source projects. Caroline Russell, Senior Security Engineer at AppThreat, points out the following critical features of OWASP dep-scan:Wide compatibility with various programming languages and source code configurations. Dep-scan uses the cdxgen framework to create software specifications (SBOM), which allows you to support multiple languages, development environments, and project types.

1. Flexible ability to export analysis results in various formats, including custom reports based on the Jinja template engine, JSON documents in accordance with CycloneDX Vulnerability Disclosure Report (VDR) and Common Security Advisory Framework (CSAF) 2.0 standards. This facilitates integration with other tools and systems.
2. Analyze the availability of source code using the AppThreat/atom framework for generating code snippets. This feature helps you identify vulnerabilities related to incorrect use of secure APIs or the lack of necessary input data checks.
3. In-depth package audit for risks related to dependency confusion and maintenance risks. Dep-scan checks the correctness of project dependencies and analyzes their history of updates and support by developers, which allows you to identify potential security threats in a timely manner.

OWASP dep-scan is available for free on GitHub.