Scanning files under media for vulnerability

Question

We would like to scan our solution for security vulnerabilities. We already have a tool for static analysis.

The problem is as follows:

We are using the Sitecore media library to host the jQuery files of our solution. In the YML file, we find the blob value. So we cannot see the content there.

I can think of the following:

1. Write an SPE script to download all the media files in a folder.
2. Scan the files from that folder.

Challenge: we have a lot of media items. So, it will be a pain to download and scan them all.

Any suggestions?

Answer 1

I believe a practical approach to the problem would be to use a product like Qualys to perform a Web Application Scan. This would inspect all of the assets made visible to consumers of your site and then report on the issue. You need some sort of database of vulnerabilities and if you built something custom you would have to maintain that.

Most of your media would be low risk. Realistically, 99.99% of your problems are going to be JavaScript related and the volume of custom files you have (e.g. jQuery) would be low compared to pictures and pdfs.

You'll also want to take into account the web services you build and assess the risk of those.

Answer 2

Taking the SPE approach, you could scan by MIME type / Template Name and Extension. It shouldnt take too long to recurse the full media library pulling out the files you wanted.

You could either copy to a single directory or add something to download and scan on the fly.

$sourcePath = Get-Item "/sitecore/media library/Files";
$templateNameToExclude = "Media folder";

function Find-MediaItems {
    $items = Get-ChildItem -Path $sourcePath.Paths.FullPath -Recurse | 
    Where-Object {($_.TemplateName -eq "File") -and ($_.Extension -eq "js") -and ($_."Mime Type" -eq "application/x-javascript") }      
    foreach($item in $items) {
        $item;
        // Add in scanning actions here
    }
}

$props = @{
    InfoTitle = "Javascript files"
    InfoDescription = "Files to be scanned"
    PageSize = 25
}

Find-MediaItems |
    Show-ListView @props -Property @{Label="Name"; Expression={$_.DisplayName} },
        @{Label="Updated"; Expression={$_.__Updated} },
        @{Label="Updated by"; Expression={$_."__Updated by"} },
        @{Label="Created"; Expression={$_.__Created} },
        @{Label="Created by"; Expression={$_."__Created by"} },
        @{Label="Path"; Expression={$_.ItemPath} }
        
Close-Window