Some Random Notes

1.3 Snyk and OWASP Dependency-Check

3 min read

What are Snyk and OWASP Dependency-Check?

Snyk and OWASP Dependency-Check are Software Composition Analysis (SCA) tools.

Modern applications are built like Lego blocks: your actual custom code might only make up 10% of the project, while the other 90% consists of third-party open-source libraries, packages, and frameworks (transitive dependencies) pulled from Maven Central, NuGet, or npm. SCA tools scan your project’s dependency manifest (like pom.xml, build.gradle, or .csproj) and binary files, comparing them against vulnerability databases (like the National Vulnerability Database - NVD) to flag known CVEs (Common Vulnerabilities and Exposures).

How Do They Compare to IntelliJ CVE Scans and Fortify?

To understand where they fit, it helps to distinguish between different types of security testing tools:

Tool CategoryWhat it ScansExamplesPurpose
SCA (Software Composition Analysis)Third-party libraries you imported (e.g., an old Log4j version, a vulnerable Jackson parser).Snyk, OWASP Dependency-CheckCatching vulnerable open-source code written by someone else.
SAST (Static Application Security Testing)Your own custom source code (e.g., SQL injection, raw string concatenation, path traversal).Micro Focus Fortify, SonarQube, CheckmarxCatching logical security flaws in code you wrote.
IDE Scans (IntelliJ / Visual Studio)Both dependencies and local code, but running locally.IntelliJ vulnerability warnings, NuGet audit in IDEProviding real-time, lightweight feedback while you type.

  • Vs. IntelliJ CVE Scan: IntelliJ’s built-in inspection is fantastic for local, real-time feedback while you code. However, Snyk and Dependency-Check are enterprise-grade tools designed to be integrated directly into CI/CD pipelines to block builds automatically if a high-severity CVE slips through.

  • Vs. Fortify: Fortify is primarily a SAST tool (it reads your Java/C# source code to find bad logic). Snyk and Dependency-Check are SCA tools (though Snyk has expanded into SAST). You typically use both an SCA tool and a SAST tool for comprehensive coverage.

How to Implement Them

1. Java Ecosystem (Maven / Gradle)

  • OWASP Dependency-Check (Maven):

    You can wire it directly into your pom.xml build lifecycle:

    XML

    <plugin>
    <groupId>org.owasp</groupId>
    <artifactId>dependency-check-maven</artifactId>
    <version>9.0.9</version>
    <executions>
        <execution>
            <goals>
                <goal>check</goal>
            </goals>
        </execution>
    </executions>
</plugin>

    Running mvn verify will download vulnerability databases, scan your dependencies, and generate an HTML report (target/dependency-check-report.html), failing the build if a threshold is breached.

  • Snyk (Java):

    Install the Snyk CLI and run it in your project root:

    Bash

    snyk auth
snyk test

    It scans your pom.xml or build.gradle against Snyk’s proprietary vulnerability database, offering deep remediation advice (e.g., “Upgrade spring-boot-starter from 3.1.0 to 3.1.5 to fix CVE-2023-XXXX”).

2. .NET Ecosystem (.NET Core / C#)

  • Built-in .NET NuGet Auditing:

    Modern .NET SDKs have vulnerability auditing built right into the CLI. Running this command checks your NuGet packages against the GitHub Advisory Database:

    Bash

    dotnet list package --vulnerable --include-transitive

    You can also enforce this in your .csproj file so builds fail automatically on vulnerabilities:

    XML

    <PropertyGroup>
  <NuGetAudit>true</NuGetAudit>
  <NuGetAuditMode>all</NuGetAuditMode>
  <NuGetAuditLevel>high</NuGetAuditLevel>
</PropertyGroup>

  • Snyk (.NET):

    Just like in Java, you install the Snyk CLI and point it to your solution or project file:

    Bash

    snyk auth
snyk test --file=MyApp.csproj

Reference

https://owasp.org/projects/dependency-check https://nvd.nist.gov/vuln https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures https://tuxcare.com/blog/how-to-read-a-cve/

Backlinks