ALomeli398225 (Community Member) asked a question.
Does Veracode SCA detect dependency hijacking vulnerabilities?
Hello. I haven't seen anything related in the scans I've executed. I would like to know if Veracode would be able to detect common bad practices that can potentially lead to dependency hijacking. I'm talking about something like what was discussed in Alex Birsan's recent post "Dependency Confusion": https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610
.png){kind=logo}
Hello @ALomeli398225 (Community Member) ,
Currently Veracode don't have anything in place to prevent this type of attack but hope to develop a process to counter dependency hijacking. In the meantime, there are some Best Practices that would be helpful to follow:
Microsoft has also put out a whitepaper detailing the dependency confusion technique and can be read here: https://azure.microsoft.com/en-us/resources/3-ways-to-mitigate-risk-using-private-package-feeds/
If the information we’ve provided you has helped resolve your challenge (or answered your question), we would appreciate it if you could mark the response that was helpful with “Select as Best”. This will help other Community members who come across your question as a similar challenge they might be facing and your best answer will help them find the right solution as well.
Jason
Veracode Support Engineer