Sanctum AppScan 4 misses potential vulnerabilities in wrapped links

[RAFAEL SAN MIGUEL CARRASCO <rsmc () tid es>]

"AppScan 4.0 Audit Edition, the market leading application vulnerability assessment 
tool, accurately detects security vulnerabilities automatically as an integrated 
component of an enterprise security process review."

AppScan 4 have a flaw regarding the way the "Explore stage" is implemented
when the "Automatic Scan" is selected.
When a reference to a URL in a "a href" tag is made using a wrapper function 
instead of directly calling "window.open" or "document.location" javascript 
functions, AppScan will not detect the link and the URL will not be tested 
against any attack.

As this is a common way to reference URLs (it enables the coder to do some 
stuff before the window is actually opened), many pages of a website may not
be analyzed by AppScan, hiding potential vulnerabilities to the user. 
An attacker with this knowledge would scan first pages referenced in the way 
explained above, speeding up the vulnerability discovery process.

Here is an example of a link that will be ignored by AppScan:

<script>
function openBrWindow(theURL,winName,features) 
{ window.open(theURL,winName,features); }
</script>

<a href="#" onClick="openWindow('bla.html','','');">
<img src="bla.jpg"></a>

I contacted SanctumInc, and this was the solution proposed:

"We are aware of this limitation and in case of extensive usage of Java Script 
we recommend the user to choose "Interactive" Scan Type and explore the site 
manually. If you do so, just like a normal user will explore your site, AppScan 
will test the encapsulated links."

More information about this product: www.sanctuminc.com


Rafael San Miguel Carrasco
División de Infraestructura y Seguridad en Redes IP
Telefónica I+D