OWASP Dependency Check (dep-scan)

OWASP dep-scan is a security and risk audit tool designed to identify known vulnerabilities, advisories, and license limitations in project dependencies. It supports scanning local repositories and container images. It is designed for integration into CI environments and ASPM/VM platforms. Key capabilities include:

• Vulnerability Scanning: Identifies CVEs in application code, Linux container images, Kubernetes manifests, and OS layers.
• Reachability Analysis: Determines if a vulnerable package is actually on an executed path (Reachable) or merely declared in the BOM (Non-reachable).
• SBOM & Compliance: Generates Software Bill-of-Materials (SBOM) with Vulnerability Disclosure Report (VDR) information and CSAF 2.0/2.1 VEX documents.
• Risk Auditing: Performs deep audits for dependency confusion attacks and maintenance risks.

OWASP dep-scan is a security and risk audit tool designed to identify known vulnerabilities (CVEs), advisories, and license limitations within project dependencies. It supports scanning local repositories, Linux container images, Kubernetes manifests, and operating systems.

Key capabilities include:

• Reachability Analysis: Advanced analysis to determine if a vulnerability is actually reachable in your code.
• Local Scanning: Package vulnerability scanning is performed locally for speed, without requiring a central server.
• SBOM & VEX Generation: Generates Software Bill-of-Materials (SBOM) with Vulnerability Disclosure Report (VDR) information and Common Security Advisory Framework (CSAF) 2.0 VEX documents.
• Risk Auditing: Performs deep audits for dependency confusion attacks and maintenance risks.

When generating CSAF documents, you can choose between version 2.0 and 2.1. CSAF 2.1 is the default and provides a richer data set.

CSAF 2.1 (Recommended):

• Sets document.csaf_version to 2.1.
• Includes a $schema URI.
• Supports the cvss_v4 score family.
• Supports multiple CWEs per vulnerability via a cwes array.

CSAF 2.0:

• Sets document.csaf_version to 2.0.
• Omits the $schema URI.
• Does not support cvss_v4 (CVSS v4 vectors are only retained when targeting 2.1).
• Supports only a single cwe per vulnerability; additional CWEs are relegated to developer notes.

The "Next Steps" column in the dep-scan console's Top Priority table provides human-readable guidance based on the reachability tier of a finding. The logic is driven by find_next_steps in analysis_lib/output.py:

The package risk audit path performs network lookups to PyPI, npm, and crates.io, and uses GitHub token helpers to call the GitHub API.

Existing Controls:

• Timeouts: Applied to network calls.
• Fixed Hosts: Registry base URLs are fixed in configuration.
• Circuit Breaker: The metadata fetch path includes a circuit breaker to stop after repeated failures.

Risks to Monitor:

• Over-trusting remote metadata.
• Silent changes to security conclusions due to failed lookups.
• Credential leakage through logs.

In server mode, dep-scan provides an HTTP endpoint (using a Quart server) at /scan to process scan requests. This mode introduces a new trust boundary as it accepts remote inputs.

Supported scan types via the server include:

• Path-based scans: Scanning specific local paths.
• URL-based scans: Using the cdxgen server to inspect remote URLs.
• Uploaded BOM scans: Processing a provided SBOM file.

Client --> Quart server (/scan) --> input validation --> BOM generation and analysis --> JSON response
             |
             +--> path-based scan
             +--> URL-based scan via cdxgen server
             +--> uploaded BOM scan

Dep-scan provides a prioritized view of vulnerabilities (Top Priority BOM) to help teams focus on remediation. The recommendation report includes:

• Package: The specific dependency identifier (e.g., pkg:maven/org.apache.tomcat.embed/tomcat-embed-core).
• Prioritized CVEs: The list of vulnerabilities associated with that package.
• Fix Version: The recommended version to upgrade to, if determinable.
• Next Steps: Actionable guidance, such as identifying upgrade challenges or checking issue trackers for patches when a fix version cannot be determined.

When using the dep-scan CLI, be aware that the arguments provided (source paths, images, binary paths, BOM files, etc.) directly influence file reading, report writing, analyzer execution, and external service communication.

Key Risks:

• Untrusted Inputs: Risk increases when scanned content is untrusted or when automation passes partially untrusted values to the CLI.
• Subprocess/Network Injection: Ensure user-controlled values do not cross into subprocess construction, network targets, report rendering, or filesystem writes without validation.
• Execution Modes: The CLI can execute external tools locally, over HTTP, or via container images.

Reachability data is used to automate triage and compliance artifacts:

1. Prioritization: The prioritization engine tags reachable findings (especially endpoint-reachable or malicious-and-reachable) with the CycloneDX property depscan:prioritized. These are surfaced in the Top Priority table.

2. VEX (Vulnerability Exploitability eXchange) Output: The VEX exporter maps reachability to machine-readable status:

• Reachable dependencies: Become known_affected.
• Present-but-unreachable dependencies: Become known_not_affected with the justification vulnerable_code_not_in_execute_path.