About OpenText Fortify Software Security Research

The Fortify Software Security Research team translates cutting-edge research into security intelligence that powers the Fortify product portfolio – including Fortify Static Code Analyzer (SCA) and Fortify WebInspect. Today, Fortify Software Security Content supports 1,399 vulnerability categories across 30 languages and spans more than one million individual APIs.

Fortify Software Security Research (SSR) is pleased to announce the immediate availability of updates to Fortify Secure Coding Rulepacks (English language, version 2023.1.0), Fortify WebInspect SecureBase (available via SmartUpdate), and Fortify Premium Content. 

Fortify Secure Coding Rulepacks [Fortify Static Code Analyzer]

With this release, the Fortify Secure Coding Rulepacks detect 1,177 unique categories of vulnerabilities across 30 programming languages and span over one million individual APIs. In summary, this release includes the following:

GoLang Updates (version supported: 1.17)
Updated support for the Go standard library to support up to version 1.17. Go is a statically typed open-source language designed by Google^TM that aims to make it easy to build simple, reliable, and efficient software. Go is syntactically similar to C, but with memory safety mechanisms, garbage collection, and structural typing. This update improves the coverage of the standard library namespaces to include the following additional categories:

• Header Manipulation: SMTP
• Mail Command Injection: SMTP

 Support improves detection of weaknesses under existing namespace coverage and expands to include the following new namespaces:

• io/fs
• math/big
• math/random
• net/smtp
• net/textproto
• text/template

Python Updates (version supported: 3.10)
Python is a general-purpose, powerful programming language, with dynamic typing and efficient high-level data structures.  It supports multiple programming paradigms, including structured, object-oriented, and functional programming. This release increases our coverage to the Python 3.10 by expanding our support for changes in Python’s standard library API. Updated categories include:

• Path Manipulation
• Privacy Violation
• System Information Leak

ECMAScript Updates (version supported: 2022)^[1]
ECMAScript 2022, also known as ES2022 or ES12, is the latest version of the ECMAScript standard for the JavaScript language. Key features of ES2022 are private methods and accessors, extended numeric literals, logical assignment operators, and improved error handling. Support for ES2022 extends coverage of all relevant JavaScript vulnerability categories to the latest version of the ECMAScript standard.

Vue 2 (version supported: 2.7)
Initial support for Vue 2. Vue is an open-source reactive framework for building user interfaces and single-page-applications for all ECMAScript 5 compatible browsers. Vue focuses on the view layer of a web application and was created as a minimalist alternative to common frameworks such as Angular and React.

iOS SDK Updates (version supported: 16)^[2]

Apple's iOS SDK provides a collection of frameworks that enable developers to build mobile applications for Apple iPhone and iPad devices. This release contains incremental updates to our iOS SDK support for Swift and Objective-C. New and updated rules extend our API coverage of the DataDetection, Foundation, Security, SwiftUI, and UIKit frameworks in iOS SDK 15 and 16 for Swift iOS and iPadOS applications. These updates improve issue detection for many existing weakness categories, including:

• Biometric Authentication: Insufficient Touch ID Protection
• Format String
• Insecure Transport: Weak SSL Protocol
• Log Forging
• Privacy Violation
• System Information Leak: External
• System Information Leak: Internal
• Weak Encryption: Inadequate RSA Padding

Additionally, two new weakness categories are introduced in this release for iOS and iPadOS applications:

• Insecure Storage: Persistent Named Pasteboard
• Insecure Storage: Universal Clipboard

Salesforce Apex and Visualforce Updates (version supported: v57)^[3]
Salesforce Apex is the programming language used for creating Salesforce applications such as business transactions, database management, web services, and Visualforce pages. This update improves our support for Apex v57 APIs and Visualforce APIs. In addition to improving support of existing weakness categories, the following have been added to our Apex support:

• Cross-Site Request Forgery
• Poor Error Handling: Empty Catch Block
• Unsafe Reflection

Additionally, the following new weakness category is introduced for Apex applications:

• Access Control: Unenforced Sharing Rules

Initial Support for Google Dataflow with Java Apache Beam (version supported: 2.46.0)
Apache Beam is an open-source, unified programming model for building data processing pipelines capable of being run on a variety of data processing backends. Initial support for Apache Beam enables data processing pipelines, such as Google Dataflow, and is limited to the Java programming language by identifying sources of data within Apache Beam pipelines. Support enables reporting of relevant Java vulnerability categories such as Command Injection, Privacy Violation, and Log Forging within Apache Beam transforms.

.NET 7 (version supported: 7.0)
.NET is a general programming platform that enables programmers to write code in languages such as C# and VB.NET with a standardized set of APIs. This release increases our coverage to the latest version of .NET, improving dataflow, as well as expanding our API coverage for the following categories:

• Denial of Service: Regular Expression
• Path Manipulation
• Path Manipulation: Zip Entry Overwrite
• Permission Manipulation
• Privacy Violation
• Setting Manipulation
• System Information Leak

ASP.NET Core 7 (version supported: 7.0)
ASP.NET Core is the flagship web framework for use with .NET. The framework includes functionality to create many types of applications including MVC web applications and Web APIs. This release increases our coverage to the latest version of ASP.NET Core, expanding our categories supported to include:

• Denial of Service
• Privacy Violation
• Setting Manipulation
• System Information Leak

 Additionally, the following new weakness category is introduced for ASP.NET applications:

• ASP.NET Misconfiguration: Logging Sensitive Information

Cloud Infrastructure as Code (IaC)
IaC is the process of managing and provisioning computer resources through code rather than various manual processes. Improved support includes Terraform configurations for deployment to AWS and Azure as well as improved coverage for Azure Resource Manager (ARM). Common issues related to the configuration of these services are now reported to the developer.

Amazon AWS and Microsoft Azure Terraform Configurations
Terraform is an open-source infrastructure as code tool for building, changing and versioning cloud infrastructure. It uses its own declarative language known as HashiCorp Configuration Language (HCL). Cloud infrastructure is codified in configuration files to describe the desired state. Terraform providers support the configuration and management of Microsoft Azure infrastructure and Amazon Web Services (AWS). In this release, we report the following categories for Terraform configurations:

• AWS Terraform Misconfiguration: AMI Missing Customer-Managed Encryption Key
• AWS Terraform Misconfiguration: Aurora Missing Customer-Managed Encryption Key
• AWS Terraform Misconfiguration: Aurora Publicly Accessible
• AWS Terraform Misconfiguration: CloudTrail Missing Customer-Managed Encryption Key
• AWS Terraform Misconfiguration: Database Migration Service Publicly Accessible
• AWS Terraform Misconfiguration: DocumentDB Missing Customer-Managed Encryption Key
• AWS Terraform Misconfiguration: DocumentDB Publicly Accessible
• AWS Terraform Misconfiguration: EBS Missing Customer-Managed Encryption Key
• AWS Terraform Misconfiguration: EC2 Image Builder Missing Customer-Managed Encryption Key
• AWS Terraform Misconfiguration: EFS Missing Customer-Managed Encryption Key
• AWS Terraform Misconfiguration: Elasticache Missing Customer-Managed Encryption Key
• AWS Terraform Misconfiguration: File Cache Missing Customer-Managed Encryption Key
• AWS Terraform Misconfiguration: FSx Lustre Missing Customer-Managed Encryption Key
• AWS Terraform Misconfiguration: FSx Missing Customer-Managed Encryption Key
• AWS Terraform Misconfiguration: FSx ONTAP Missing Customer-Managed Encryption Key
• AWS Terraform Misconfiguration: FSx OpenZFS Missing Customer-Managed Encryption Key
• AWS Terraform Misconfiguration: FSx Windows Missing Customer-Managed Encryption Key
• AWS Terraform Misconfiguration: Insecure AMI Storage
• AWS Terraform Misconfiguration: Insecure Aurora Storage
• AWS Terraform Misconfiguration: Insecure DocumentDB Storage
• AWS Terraform Misconfiguration: Insecure EC2 Image Builder Storage
• AWS Terraform Misconfiguration: Insecure EFS Storage
• AWS Terraform Misconfiguration: Insecure Neptune Storage
• AWS Terraform Misconfiguration: Insecure Redshift Storage
• AWS Terraform Misconfiguration: Insufficient Aurora Monitoring
• AWS Terraform Misconfiguration: Insufficient DocumentDB Monitoring
• AWS Terraform Misconfiguration: Insufficient RDS Monitoring
• AWS Terraform Misconfiguration: Kinesis Missing Customer-Managed Encryption Key
• AWS Terraform Misconfiguration: Lightsail Publicly Accessible
• AWS Terraform Misconfiguration: Location Service Missing Customer-Managed Encryption Key
• AWS Terraform Misconfiguration: Neptune Missing Customer-Managed Encryption Key
• AWS Terraform Misconfiguration: RDS Missing Customer-Managed Encryption Key
• AWS Terraform Misconfiguration: RDS Publicly Accessible
• AWS Terraform Misconfiguration: Redshift Missing Customer-Managed Encryption Key
• AWS Terraform Misconfiguration: SageMaker Missing Customer-Managed Encryption Key
• AWS Terraform Misconfiguration: Secrets Manager Missing Customer-Managed Encryption Key
• AWS Terraform Misconfiguration: S3 Missing Customer-Managed Encryption Key
• AWS Terraform Misconfiguration: Timestream Missing Customer-Managed Encryption Key
• Azure Terraform Misconfiguration: Improper App Service CORS Policy
• Azure Terraform Misconfiguration: Improper Cognitive Services Network Access Control
• Azure Terraform Misconfiguration: Improper CosmosDB CORS Policy
• Azure Terraform Misconfiguration: Improper Functions CORS Policy
• Azure Terraform Misconfiguration: Improper Healthcare CORS Policy
• Azure Terraform Misconfiguration: Improper IoT Central Network Access Control
• Azure Terraform Misconfiguration: Improper IoT Hub Network Access Control
• Azure Terraform Misconfiguration: Improper Key Vault Network Access Control
• Azure Terraform Misconfiguration: Improper Logic App CORS Policy
• Azure Terraform Misconfiguration: Improper Media Services Network Access Control
• Azure Terraform Misconfiguration: Improper Service Bus Network Access Control
• Azure Terraform Misconfiguration: Improper SignalR CORS Policy
• Azure Terraform Misconfiguration: Improper SignalR Network Access Control
• Azure Terraform Misconfiguration: Improper Spring Apps CORS Policy
• Azure Terraform Misconfiguration: Improper Storage CORS Policy
• Azure Terraform Misconfiguration: Improper Storage Network Access Control
• Azure Terraform Misconfiguration: Improper Web PubSub Network Access Control
• Azure Terraform Misconfiguration: Insecure Event Hubs Transport
• Azure Terraform Misconfiguration: Insecure Front Door Transport
• Azure Terraform Misconfiguration: Insecure Functions Transport
• Azure Terraform Misconfiguration: Insecure Redis Transport
• Azure Terraform Misconfiguration: Insecure Service Bus Transport
• Azure Terraform Misconfiguration: Insecure SQL Database Transport
• Azure Terraform Misconfiguration: Insecure SQL Managed Instance Transport

Microsoft Azure Resource Manager (ARM) Configurations
ARM is the deployment and management service for Azure. ARM provides a management layer that enables you to create, update, and delete resources in your Azure account. In this release, we report the following weakness categories for ARM configurations:

• Azure ARM Misconfiguration: Automation Missing Customer-Managed Encryption Key
• Azure ARM Misconfiguration: Batch Missing Customer-Managed Encryption Key
• Azure ARM Misconfiguration: Cognitive Services Missing Customer-Managed Encryption Key
• Azure ARM Misconfiguration: Databricks Missing Customer-Managed Encryption Key
• Azure ARM Misconfiguration: Event Hubs Missing Customer-Managed Encryption Key
• Azure ARM Misconfiguration: Insecure CDN Transport
• Azure ARM Misconfiguration: Insecure Database for MySQL Storage
• Azure ARM Misconfiguration: Insecure Database for PostgreSQL Storage
• Azure ARM Misconfiguration: Insecure DataBricks Storage
• Azure ARM Misconfiguration: Insecure EventHub Storage
• Azure ARM Misconfiguration: Insecure EventHub Transport
• Azure ARM Misconfiguration: Insecure IoT Hub Transport
• Azure ARM Misconfiguration: Insecure Recovery Services Backup Storage
• Azure ARM Misconfiguration: Insecure Recovery Services Vaults Storage
• Azure ARM Misconfiguration: Insecure Redis Enterprise Transport
• Azure ARM Misconfiguration: Insecure Redis Transport
• Azure ARM Misconfiguration: Insecure Service Bus Storage
• Azure ARM Misconfiguration: Insecure Service Bus Transport
• Azure ARM Misconfiguration: Insecure Storage Account Storage
• Azure ARM Misconfiguration: IoT Hub Missing Customer-Managed Encryption Key
• Azure ARM Misconfiguration: NetApp Missing Customer-Managed Encryption Key
• Azure ARM Misconfiguration: Service Bus Missing Customer-Managed Encryption Key
• Azure ARM Misconfiguration: Storage Account Missing Customer-Managed Encryption Key
• Azure ARM Misconfiguration: Weak App Service Authentication
• Azure ARM Misconfiguration: Weak SignalR Authentication

Customizable Password Management and Key Management Regular Expressions^[4]
Sometimes the only way to match passwords and encryption keys within source code is by making an educated guess using regular expressions. These are now customizable via properties, have been made more consistent across languages, and the default regular expressions have been restricted to minimize false positives.

The global regular expressions can be configured with one of the following properties:

com.fortify.sca.rules.key_regex.global
or
com.fortify.sca.rules.password_regex.global

You can set more specific variants per-language with the following properties:

com.fortify.sca.rules.key_regex.abap
com.fortify.sca.rules.key_regex.actionscript
com.fortify.sca.rules.key_regex.cfml
com.fortify.sca.rules.key_regex.cpp
com.fortify.sca.rules.key_regex.golang
com.fortify.sca.rules.key_regex.java
com.fortify.sca.rules.key_regex.javascript
com.fortify.sca.rules.key_regex.jsp
com.fortify.sca.rules.key_regex.objc
com.fortify.sca.rules.key_regex.php
com.fortify.sca.rules.key_regex.python
com.fortify.sca.rules.key_regex.ruby
com.fortify.sca.rules.key_regex.sql
com.fortify.sca.rules.key_regex.swift
com.fortify.sca.rules.key_regex.vb 

com.fortify.sca.rules.password_regex.abap
com.fortify.sca.rules.password_regex.actionscript
com.fortify.sca.rules.password_regex.cfml
com.fortify.sca.rules.password_regex.cobol
com.fortify.sca.rules.password_regex.config
com.fortify.sca.rules.password_regex.cpp
com.fortify.sca.rules.password_regex.docker
com.fortify.sca.rules.password_regex.dotnet
com.fortify.sca.rules.password_regex.golang
com.fortify.sca.rules.password_regex.java
com.fortify.sca.rules.password_regex.javascript
com.fortify.sca.rules.password_regex.json
com.fortify.sca.rules.password_regex.jsp
com.fortify.sca.rules.password_regex.objc
com.fortify.sca.rules.password_regex.php
com.fortify.sca.rules.password_regex.properties
com.fortify.sca.rules.password_regex.python
com.fortify.sca.rules.password_regex.ruby
com.fortify.sca.rules.password_regex.sql
com.fortify.sca.rules.password_regex.swift
com.fortify.sca.rules.password_regex.vb
com.fortify.sca.rules.password_regex.yaml

For more specific details about the default regular expressions, see the Fortify Static Code Analyzer User Guide.

DISA STIG 5.2

To support our federal customers in the area of compliance, correlation of the Fortify Taxonomy to the Defense Information Systems Agency (DISA) Application Security and Development STIG version 5.2 has been added.

PCI DSS 4.0
To support our e-commerce and financial services customers in the area of compliance, this release supports correlation between our Fortify Taxonomy categories and the requirements specified in the latest version of the Payment Card Industry Data Security Standard, version 4.0.

PCI SSF 1.2
To support our e-commerce and financial services customers in the area of compliance, this release supports correlation between our Fortify Taxonomy categories and the control objectives specified in the new "Secure Software Requirements and Assessment Procedures", defined in the Payment Card Industry (PCI) Secure Software Standard (SSS) as part of the new Software Security Framework (SSF), version 1.2.

Miscellaneous Errata
In this release, resources have been invested to ensure we can reduce the number of false positive issues, refactor for consistency, and improve the ability for customers to audit issues. Customers can also expect to see changes in reported issues related to the following:

Removal of "Denial of Service: Parse Double"
The Denial of Service: Parse Double category has been removed because the vulnerability only exists in Java version 6 update 23 and earlier versions. Customers who are using those vulnerable Java versions can still download the removed rules in a separate Rulepack from the Fortify Customer Support Portal under Premium Content.

False Positive Improvements
Work has continued with the effort to remove false positives in this release. In addition to other improvements, customers can expect further removal of false positives in the following areas:

• Access Control: Database – false positives reduced when data originates from a database
• Android Bad Practices: Unnecessary Component Exposure – false positives reduced when an Android receiver is marked with android:exported="false"
• NET MVC Bad Practices: Controller Action Not Restricted to POST – false positives reduced when controller actions pass their input directly to a view without state change
• Credential Management: Hardcoded API Credentials – is no longer found in google-services.json when recommended
• Credential Management: Hardcoded API Credentials – false positives reduced on Facebook revision keys
• Cross-Site Scripting – false positives removed that were triggered in VB6 Windows Forms applications
• Dead Code: Unused Field – false positives reduced in Java lambdas
• Dockerfile Misconfiguration: Dependency Confusion – false positives reduced when using a local library definition
• False positives removed across multiple categories in all supported languages when a dataflow issue is reported on a Boolean variable
• False positives removed across multiple categories in C/C++ applications when retrieving file information via WinAPI functions
• HTTP Parameter Pollution – false positives reduced on URL encoded values
• Insecure Randomnes: Hardcoded Seed and Insecure Randomness: User-Controlled Seed – false positives reduced when using Random and SplittableRandom classes in Java applications
• Insecure Storage: Unspecified Keychain Access Policy, Insecure Storage: Externally Available Keychain, and Insecure Storage: Passcode Policy Unenforced – false positives reduced in Swift iOS applications when recommended remediations are applied
• Memory Leak – false positives reduced when adding a pointer to a boost program options description
• Memory Leak – false positives reduced when using std::unique_ptr
• Null Dereference – false positives removed when casting 0 to a byte in .NET applications
• Password Management: Hardcoded Password – false positives reduced on passwords in comments
• Privacy Violation: Android Internal Storage – false positives reduced when using EncryptedSharedPreferences objects in Android applications
• SOQL Injection and Access Control: Database – false positives reduced when using getQueryLocator() in Salesforce Apex applications

Category Changes
When weakness category name changes occur, analysis results when merging prior scans with new scans will result in added/removed categories.

To improve consistency, the following category was renamed:

• NET Bad Practices: Leftover Debug Code now reports as .NET Bad Practices: Leftover Debug Code when triggering in general .NET code.

Furthermore, to improve consistency in the reporting of IaC flaws across categories, an additional 121 categories have been renamed in this release (see Appendix A).

Fortify SecureBase [Fortify WebInspect]

Fortify SecureBase combines checks for thousands of vulnerabilities with policies that guide users in the following updates available immediately via SmartUpdate:

Vulnerability Support

Insecure Deployment: Unpatched Application^[5]
Cacti is a framework that provides logging and graphing capabilities for users to monitor devices on the network. The remote_agent.php file is susceptible to a remote code execution (RCE) vulnerability identified by CVE-2022-46169 in Cacti versions earlier than 1.2.23. The poller_id parameter is passed when polling data calls proc_open method using user input. As this value is not sanitized, it enables an attacker to execute commands on the target machine. Combining this command injection issue with an authentication bypass using an X-Forwarded-For header results in an unauthenticated attacker compromising the entire application. This release includes a check to detect this vulnerability on a target server that runs affected Cacti versions.

SAML Bad Practices: Insecure Transform
SAML messages are cryptographically signed to guarantee validity and integrity of the assertion. One of the steps the service provider must perform for signature verification is the transformation of the data that is pointed to by the Reference element. Usually, the Transform operation aims at selecting just a subset of the referenced data. However, an attacker could use some types of transforms to cause a denial of service and in some environments even arbitrary code execution. This release includes a check that triggers if the service provider allows insecure types of transforms in XML references.

Compliance Reports

DISA STIG 5.2
To support our federal customers compliance needs, this release contains a correlation of the WebInspect checks to the latest version of the Defense Information Systems Agency Application Security and Development STIG, version 5.2.

PCI DSS 4.0
To support our e-commerce and financial services customers compliance needs, this release contains a correlation of the WebInspect checks to the requirements specified in the latest version of the Payment Card Industry Data Security Standard, version 4.0.

PCI SSF 1.2
To support our e-commerce and financial services customers compliance needs, this release contains a correlation of the WebInspect checks to the control objectives specified in the new "Secure Software Requirements and Assessment Procedures", defined in the Payment Card Industry (PCI) Secure Software Standard (SSS) as part of the new Software Security Framework (SSF), version 1.2.

Policy Updates

DISA STIG 5.2
A policy customized to include checks relevant to DISA STIG 5.2 has been added to the WebInspect SecureBase list of supported policies.

PCI DSS 4.0
A policy customized to include checks relevant to PCI DSS 4.0 has been added to the WebInspect SecureBase list of supported policies.

PCI SSF 1.2
A policy customized to include checks relevant to PCI SSF 1.2 has been added to the WebInspect SecureBase list of supported policies.

Miscellaneous Errata
In this release, we invested resources to further reduce the number of false positives and improve the ability for customers to audit issues. Customers can also expect to see changes in reported findings related to the following:

Password Management: Weak Password Policy^[6]
This release includes minor improvements for the password entropy check where password/username fields have improved detection of custom username and password fields. This fix helps reduce false positives in findings related to check IDs 11496, 11498 and 11661.

Fortify Premium Content

The research team builds, extends, and maintains a variety of resources outside our core security intelligence products.

DISA STIG 5.2, PCI SSF 1.2, and PCI DSS 4.0
To accompany the new correlations, this release also contains a new report bundle for Fortify Software Security Center with support for DISA STIG 5.2, PCI DSS 4.0, and PCI SSF 1.2, which is available for download from the Fortify Customer Support Portal under Premium Content.

Fortify Taxonomy: Software Security Errors
The Fortify Taxonomy site, which contains descriptions for newly added category support, is available at https://vulncat.fortify.com. Customers looking for the legacy site, with the last supported update, can obtain it from the Fortify Support Portal.

Appendix A: IaC Weakness Categories Renamed

Contact Fortify Technical Support

OpenText Fortify
http://softwaresupport.softwaregrp.com/
+1 (800) 509-1800

Contact SSR

Alexander M. Hoole
Senior Manager, Software Security Research
OpenText Fortify
hoole@opentext.com
+1 (650) 427-9973

Peter Blay
Manager, Software Security Research
OpenText Fortify
pblay@opentext.com
+1 (669) 309-1634

© Copyright 2023 OpenText or one of its affiliates. The information contained herein is subject to change without notice. The only warranties for OpenText products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. OpenText shall not be liable for technical or editorial errors or omissions contained herein.

[1] Requires Fortify Static Code Analyzer 23.1.
[2] New rules for iOS SDK 16 require Fortify Static Code Analyzer 22.2 or later.
[3] Requires Fortify Static Code Analyzer 23.1 or later for some new rules that target the Apex v57 APIs.
[4] Requires Fortify Static Code Analyzer 23.1.
[5] Requires OAST features that are available in the WebInspect 21.2.0.117 patch or later.
[6] Requires WebInspect 23.1 or later.

PDF