Skip to content

Security: rksharma-owg/vuln-scan-diff

Security

SECURITY.md

Security Policy

Threat Model

Vuln Scan Diff is designed to process sensitive security scan exports that contain detailed information about an organization's infrastructure, including hostnames, IP addresses, open ports, installed software, and vulnerability details. The threat model accounts for the following:

Primary Threats Addressed

  1. XML External Entity (XXE) Attacks: Nessus .nessus files are XML-based and could contain malicious entity definitions. The tool uses defusedxml for all XML parsing to prevent XXE attacks.

  2. Stored Script Injection via HTML Reports: Scanner output may contain malicious HTML/JavaScript. All scanner-controlled content is HTML-escaped before inclusion in HTML reports.

  3. Excel Formula Injection: Scanner output beginning with =, +, -, or @ could be interpreted as formulas by Excel. All cell values are sanitized to prevent formula injection.

  4. Secret Exposure in Logs and Reports: Plugin output may contain credentials, API keys, or other secrets. The tool redacts common secret patterns in verbose output and does not include raw plugin output in summary reports.

Design Decisions for Security

  • No Network Access: The tool makes zero outbound network requests. It does not phone home, check for updates, or transmit any data.
  • No Telemetry: There is no usage analytics, telemetry, or tracking of any kind.
  • No External Dependencies at Runtime: Reports are self-contained. HTML reports embed all CSS and use no CDN or external resources.
  • No Code Execution: Scanner plugin output is never executed, evaluated, or interpreted.
  • Local Processing Only: All processing happens on the local machine. Files are never uploaded or transmitted.

Safe Handling of Scan Exports

Input Validation

  • All input files are validated before processing.
  • Malformed XML is rejected with clear error messages.
  • CSV files with missing required columns are rejected.
  • File encodings are detected and handled safely.
  • File size is not artificially limited, but streaming parsing is used for large XML files.

Output Sanitization

  • HTML reports escape all scanner-controlled content.
  • Excel reports sanitize cell values to prevent formula injection.
  • Terminal output limits the display of potentially sensitive plugin output.
  • JSON reports include all data but are intended for programmatic consumption by authorized tools.

Temporary Files

  • Temporary files, if created, use secure tempfile facilities.
  • Temporary files are cleaned up after use.

Reporting Vulnerabilities

If you discover a security vulnerability in Vuln Scan Diff, please report it responsibly:

  1. Do not open a public GitHub issue.
  2. Email the maintainer with details of the vulnerability.
  3. Allow reasonable time for the vulnerability to be addressed before public disclosure.

Sensitive Data Considerations

Scan exports processed by this tool may contain:

  • Internal IP addresses and hostnames
  • Details of installed software and versions
  • Configuration details of network services
  • Vulnerability descriptions that reveal infrastructure topology
  • Plugin output that may contain credentials or configuration snippets

Users should:

  • Store scan exports securely with appropriate access controls.
  • Restrict access to generated reports.
  • Consider the sensitivity of the data when sharing reports.
  • Delete intermediate and output files when they are no longer needed.
  • Use encrypted storage for scan exports and reports.

This tool does not add any additional network exposure beyond reading local files and writing local output files.

There aren't any published security advisories