PI45160: IBM SECURITY APPSCAN SOURCE FOR ANALYSIS 9.0.2 CROSS SITESCRIPTING.REFLECTED : FALSE POSITIVE

APAR status

• Closed as program error.

Error description

• IBM Security AppScan Source for Analysis 9.0.2  flags a
  CrossSiteScripting.Reflected vulnerability against the scan rule
  JSP 2.0 <c:forEach tag when used with Struts ActionForms.
  This occurs when the JSP 2.0 ActionForms Property scan rule is
  enabled in the scan by the inclusion of the Java scan rule set
  ('Properties' of project).
  As the rule does not take into consideration the <c:forEach tag,
  false positives may result
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * Any users using PBSA rules to scan their Java/JSP projects   *
  * using AppScan Source.                                        *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * If the code that is being scanned contains a word such as    *
  * forEach tag, it will be reported as False Positive.          *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  

Problem conclusion

• We updated our PBSA rules to consider this tag as well while
  looking for vulnerabilities and starting 9.0.3 release this will
  no longer reported as a False Positive.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  SEC APPSCAN SRC

• Fixed component ID

  5724Z3400

Applicable component levels

• R901 PSY

     UP

• R902 PSY

     UP