Framework Security

5 automated security scanners

Laravel Symfony Security

Purpose: The Laravel/Symfony Security Scanner is designed to analyze and assess the security posture of Laravel and Symfony framework applications by identifying potential vulnerabilities such as exposure of application secrets, outdated dependencies containing exploitable CVEs, misconfigurations that could lead to unauthorized access, remote code execution, and more. This tool helps in maintaining a secure environment for web applications built using these frameworks.

What It Detects:

Framework Detection: Identifies the presence of Laravel or Symfony frameworks, checks for version disclosure, detects framework fingerprints, flags vendor directory exposure.
Debug Mode Detection: Checks if debug mode is enabled (APP_DEBUG=true), detects the use of Symfony Debug Toolbar, exposes error pages and stack traces, and identifies development mode in production environments.
Configuration Exposure: Verifies the exposure of sensitive configuration files (.env, config files), lists storage directories, logs vulnerabilities, and checks access to composer.json/lock files.
Security Features: Assesses CSRF protection, authentication guards, encryption key exposure, session security, and XSS prevention mechanisms.
Known Vulnerabilities: Scans for Laravel and Symfony specific CVEs, outdated dependencies, mass assignment issues, and insecure route definitions that could be exploited.

Inputs Required:

domain (string): Fully qualified domain name (e.g., ekkatha.com) which is essential for network operations to identify framework presence and configurations.

Business Impact: Misconfigurations in Laravel or Symfony applications can lead to unauthorized access, data leakage, and potential remote code execution, significantly impacting the security of web applications. It’s crucial to maintain a secure configuration to prevent such risks.

Risk Levels:

Critical: Exposure of sensitive information through debug mode, outdated framework versions containing known CVEs, and mass assignment vulnerabilities that can lead to privilege escalation are critical issues.
High: Misconfigurations in security settings like lack of CSRF protection or improper encryption keys can be highly risky, affecting the integrity and confidentiality of data.
Medium: Exposure of configuration files and logs might lead to information leakage but does not pose a direct threat to high-value assets unless exploited further by other vulnerabilities.
Low: Informational findings such as minor misconfigurations or non-critical debug mode settings are considered low risk, although they should still be addressed for overall security enhancement.
Info: These are primarily informational and do not directly affect the system’s security but can guide improvements in configuration practices.

Example Findings:

A Laravel application is detected running with an outdated version that contains a known vulnerability.
Symfony app exposes detailed error pages containing stack traces, which could be exploited by attackers to gain insights into the application structure and potential vulnerabilities.

This documentation provides a clear overview of what the scanner does, its inputs, the business impact, risk levels it assesses, and examples of findings that might be flagged by the tool.

Django Flask Security

Purpose: The Django/Flask Security Scanner is designed to analyze and assess the security posture of Django and Flask web frameworks by identifying potential vulnerabilities that could compromise application integrity. This tool evaluates various aspects such as framework versions, detection of known CVEs, debugging mode exposure, configuration issues, and specific framework-dependent vulnerabilities like SQLAlchemy and Jinja2 template injections.

What It Detects:

Framework Detection: The scanner identifies the presence of Django or Flask frameworks by analyzing domain names, headers, and content for relevant keywords and patterns indicative of these frameworks.
Debug Mode Detection: It checks for indicators of debugging mode in both Django and Flask applications, which can expose sensitive information if not properly secured.
Security Middleware: The scanner evaluates the configuration of security middleware to ensure features like CSRF protection, HTTPS enforcement, and proper headers are implemented.
Known Vulnerabilities: It checks for outdated versions that may contain known CVEs, identifies misconfigurations in settings files, and verifies the presence of secure elements such as CSRF tokens and appropriate header configurations.
Configuration Issues: The scanner looks for exposure of sensitive information like secret keys and misconfigurations in admin panels and static file management.

Inputs Required:

domain (string): A fully qualified domain name (e.g., example.com) that represents the target application.

Business Impact: This scanner is crucial as it helps organizations proactively identify and address security flaws within their Django or Flask applications, which could lead to unauthorized access, data leakage, and other severe consequences. Properly securing these frameworks can mitigate risks associated with potential cyber-attacks.

Risk Levels:

Critical: The critical risk level is triggered when the scanner detects outdated versions of Django or Flask that are known to have significant security vulnerabilities. Additionally, exposure of secret keys in configuration files poses a high risk as it directly impacts data integrity and confidentiality.
High: High risks include misconfigurations such as missing CSRF protection tokens and improper handling of static files which can lead to unauthorized access and information disclosure.
Medium: Medium risks involve the presence of debug mode, which may expose sensitive application details, and vulnerabilities in middleware configurations that could be exploited by malicious users.
Low: Low risk findings include minor issues such as missing security headers or misconfigurations in settings files, although these should still be addressed to maintain a secure environment.
Info: Informational findings are those that do not directly indicate a vulnerability but highlight areas for improvement in configuration and maintenance practices.

Example Findings:

A Django application is detected with a version known to have multiple CVEs affecting its stability and security features.
Flask applications running on outdated versions, which could be exploited by attackers to inject malicious code into the system.
Misconfigurations in settings files that expose sensitive information or allow unrestricted access to admin panels.

By providing this detailed overview of what the scanner detects and how it assesses risks, users can understand the importance of maintaining a secure configuration for Django and Flask applications.

React Angular Vue Security

Purpose: The React/Angular/Vue Security Scanner is designed to assess the security posture of applications built using React, Angular, and Vue frameworks. It aims to identify potential vulnerabilities that could compromise the application’s integrity, such as client-side attacks, data exposure, and misconfigurations.

What It Detects:

Framework Detection: Identifies the presence of React, Angular, and Vue frameworks through various indicators in HTML content.
Build Configuration: Checks for production builds, detects development mode, verifies minification status, and checks for debug code.
XSS Protection: Analyzes the use of dangerouslySetInnerHTML, v-html directive, innerHTML usage, and tests for sanitization to prevent XSS attacks.
Security Headers: Evaluates the presence of Content Security Policy (CSP), X-Frame-Options, X-Content-Type-Options, and Subresource Integrity (SRI) for external scripts.
Data Exposure: Scans for API keys in bundle files, exposed credentials, sensitive data in source code, and verifies handling of environment variables to prevent leakage.

Inputs Required:

domain (string): A fully qualified domain name (e.g., ekkatha.com) representing the target application.

Business Impact: Identifying and mitigating vulnerabilities in React, Angular, and Vue applications is crucial for securing client-side environments against attacks that could lead to unauthorized access or data theft. Proper configuration of frameworks, build processes, and security headers can significantly reduce these risks.

Risk Levels:

Critical: Dangerously set innerHTML enables XSS attacks, exposing source maps leaks application logic, and development builds in production are problematic.
High: Missing CSP allows script injection, client-side routing exposes sensitive routes, API keys in bundle files can lead to unauthorized access, and exposed credentials pose a significant data exposure risk.
Medium: Development mode misconfiguration and debug code present in production could degrade performance and security.
Low: Minimal impact on security but still recommended to improve overall application integrity.
Info: Informational findings such as framework version disclosure or minification status can affect performance without direct security implications.

Example Findings:

An Angular application with a development build deployed in production exposes potential XSS risks through ng-version fingerprinting.
A React component using dangerouslySetInnerHTML without proper sanitization could be exploited by an attacker to inject malicious scripts.

Express Nest.js Security

Purpose: The Express/Nest.js Security Scanner is designed to assess and report on the security posture of applications built using the Express and Nest.js frameworks by evaluating various aspects such as framework presence, middleware usage, header configurations, dependency vulnerabilities, and configuration practices that could expose an application to risks like injection attacks or denial-of-service (DoS) scenarios.

What It Detects:

Framework Detection: Identifies the presence of Express.js, detects Nest.js usage, checks for version disclosure through headers, and flags framework fingerprints in content.
Security Middleware: Assesses the use of Helmet.js for common security enhancements, tests CORS configurations for unauthorized access, identifies rate limiting mechanisms, verifies body parser limits, and checks for CSRF protection.
Header Security: Evaluates practices to remove or configure X-Powered-By headers, ensures proper implementation of security headers like Strict-Transport-Security (HSTS), Content Security Policy (CSP), and adherence to the X-Frame-Options directive.
Dependency Vulnerabilities: Checks for outdated versions of Express, tests dependencies for known vulnerabilities, detects deprecated middleware, identifies presence of Common Vulnerabilities and Exposures (CVEs), and flags insecure packages.
Configuration Issues: Investigates exposure of debug mode which can lead to information leakage, verifies the handling of stack traces that might reveal system details, detects exposed routes leading to potential data breaches, and assesses the management of sensitive data in error messages or logs.

Inputs Required:

domain (string): A fully qualified domain name (e.g., ekkatha.com) which serves as the target for security analysis.

Business Impact: This scanner is crucial for maintaining a secure application environment, especially when dealing with third-party libraries and frameworks that might introduce vulnerabilities. By identifying and mitigating risks associated with outdated dependencies, misconfigured middleware, and insecure headers, organizations can significantly reduce the likelihood of data breaches or system compromises that could lead to significant financial losses or reputational damage.

Risk Levels:

Critical: Missing essential security headers (e.g., missing Content Security Policy) which expose applications directly to high risks without any mitigation.
High: Presence of outdated Express versions, vulnerabilities in dependencies, and misconfigurations that can be exploited by malicious actors to gain unauthorized access or execute attacks.
Medium: Exposure of debug mode or stack traces which might lead to sensitive information leakage but does not pose a direct threat to critical systems unless actively targeted.
Low: Minimal impact findings such as presence of X-Powered-By headers, though this is generally discouraged due to lack of security enhancements.
Info: Informational about potential improvements in configuration or middleware usage which do not currently affect the application’s functionality but are recommended for future best practices.

Example Findings:

An application using an outdated version of Express could be at risk if a critical vulnerability affecting that version is discovered, potentially leading to unauthorized access and data theft.
A misconfigured CORS policy might allow any origin to interact with the API, which could lead to unauthorized operations or data exposure unless explicitly allowed origins are properly defined.

This structured documentation provides a comprehensive overview of what the scanner evaluates and how it reports its findings, ensuring clear understanding for both technical implementers and security stakeholders.

Spring Jakarta EE Security

Purpose: The Spring/Jakarta EE Security Scanner is designed to analyze and assess the security posture of applications built using the Spring and Jakarta EE frameworks. It aims to identify potential vulnerabilities, misconfigurations, and weaknesses that could be exploited by malicious actors, such as remote code execution through known vulnerabilities like Spring4Shell, insecure deserialization attacks, unauthorized access to sensitive endpoints, and more.

What It Detects:

Framework Detection: Identifies the presence of the Spring Framework or Jakarta EE/Java EE frameworks on a target domain.
Actuator Security: Checks for exposed actuator endpoints that may allow unauthenticated access and information disclosure.
Security Configuration: Evaluates the configuration settings related to authentication, CORS policies, CSRF protection, and session management within the Spring ecosystem.
Known Vulnerabilities: Tests for specific indicators of known vulnerabilities like Spring4Shell, Log4Shell, outdated versions, and deserialization flaws.
Information Disclosure: Identifies potential exposure of error pages, stack traces, configuration settings, and debug endpoints that may leak sensitive information.

Inputs Required:

domain (string): A fully qualified domain name (e.g., ekkatha.com) representing the target application.

Business Impact: The security of enterprise applications built on Spring or Jakarta EE frameworks is critical, as misconfigurations and vulnerabilities can lead to significant risks such as data breaches, unauthorized access, and remote code execution. This scanner helps organizations proactively identify and mitigate these risks before they are exploited by attackers.

Risk Levels:

Critical: The application is vulnerable to known exploits like Spring4Shell or Log4Shell, allowing for remote code execution without authentication.
High: Exposes sensitive information through error pages, stack traces, or configuration endpoints that can be used in further attacks.
Medium: Indicates the presence of outdated components or missing security configurations that could be exploited if upgraded properly.
Low: Identifies informational findings such as misconfigured CORS policies or lack of CSRF protection, which while not critical, should still be addressed for enhanced security.
Info: Reports on general framework detection and version information to aid in ongoing maintenance and updates.

Example Findings:

A detected Spring Framework with a known vulnerability that could be exploited remotely without authentication.
Exposed actuator endpoints allowing unauthorized access to system information.
Misconfigured session management leading to potential security risks.

This documentation provides a clear overview of the purpose and capabilities of the Spring/Jakarta EE Security Scanner, detailing what it detects, the inputs required for operation, its business impact, and the various risk levels that can be identified during a scan.