ASP.NET Support in SAST and IBM F4F

At the moment (Dec 2012) my understanding is that all SAST tools struggle to scan/understand ASP.NET MVC apps.

The only way to really support/understand/scan ASP.NET MVC is to map how that framework works/behaves (I don't think any SAST vendor/tool does that),  and as with any Framework, there is a lot to map:

• The controllers (equivalent to WebService's methods, which need to be marked as Tainted-Sources/Callbacks)
• The controller's authorization/authentication mappings (done using Attributes)
• The Autobinded Models
• The Views mappings (i..e what views are connected to what controllers)
• The MVC Execution life cycle
• The auto-encoding (or not) of view controls (and new display engines like razor)

ASP.NET MVC – XSS and AutoBind Vulns in MVC Example app (from 2008)

Here is a old pdf that I wrote ages ago (Sep 2008) that documents a couple Spring MVC AutoBinding vulnerabilities (similar to the ones shown in Exploiting Microsoft MVC vulnerabilities using OWASP O2 Platform)

Tool - O2 Cmd SpringMVC v1.0.exe - as standalone exe

I just had a request  for the O2's Spring MVC module (developed ages ago), and It was was a good opportunity to test the latest version of the 'O2 Standalone tool builder', since it now supports the embedding of the tools installed via an O2 Script (usually stored in the _ToolsOrApis folder).

You can download the Tool - O2 Cmd SpringMVC v1.0.exe (or build it using O2) which is the stand alone exe of the old O2_Cmd_SpringMvc.msi tool (See at the end of this post for details on how this exe was created)

Exploiting Microsoft MVC vulnerabilities using OWASP O2 Platform

Michael Hidalgo wrote this great article on using O2 to exploit an overposting (i.e. auto-binding) vuln in an ASP.NET MVC demo app: Exploiting Microsoft MVC vulnerabilities using OWASP O2 Platform

As you can notice that was posted on CodeProject.com which has always been a good source of technical content for me (although not a site I would use everyday). That said, I'm starting to like the new version of http://codeproject.com and this could be a great place to post O2-related technical articles.

On the Asp.NET MVC topic, if you are interested, here are a couple related posts:

• Why ASP.NET MVC is 'insecure by design' , just like Spring MVC (and why SAST can help) 
• Current O2 support for analyzing Spring MVC 
• "Two Security Vulnerabilities in the Spring Framework’s MVC" pdf (from 2008)

The next step is to see how we can write SAST rules (maybe executed by Cat.NET) to find these issues on the source code.

I really don't have hard numbers, but I will bet that the number of Asp.NET apps vulnerable is really high (just like what happens with the Spring Framework MVC)