6

Thanks to this blog post Using the Burp Suite to test a Web Service that is consumed in a Salesforce app I believe I have successfully scanned the two web services that my managed package calls. (This scan has been asked for by Salesforce as part of a managed package security review.)

Both result summaries look more or less like this:

enter image description here

and in checking the detail of the issues reported I'm pretty confident they are "false positives".

Having invested the time to do this I am wondering what the value-add is. Does anyone have examples of fixable security issues identified by this tool for this scenario of external web services called by Apex code?

Improve this question

1 Answer 1

Reset to default
5

I personally didn't find much value in it. It was mostly done to satisfy the certification requirements.

Burp as a tool doesn't seem well suited to testing web services vulnerabilities. It is more focused on the web sites/applicaitons.

In my case there was a medium level warning about a possible XML injection risk as the web service was sending back a ]]>> that was injected into the request. But what does that really mean for the web service? The web service wasn't actually processing the request, instead it was sending back a response that the request was badly formed and the ]]>> was the issue. Not much of an injection risk as the response needs to pass through the wsdl2apex generated classes first. If there was a vulnerability it would be in wsdl2apex.

I think the only other thing of note was an email address that intentionally appears in some of the responses. Again, a non issue.

What did actually happen with the app submission was that the Salesforce certification team somehow found a web application that is connected with the same web service and was provided by the web service provider.

My interaction was only with the web service from Salesforce, but there was a separate web front end from the web service provider that worked with the same data. I didn't have anything to do with the separate web application so didn't BURP test it or include it in the submission.

They tested the web application and found issues there which caused the certification to fail initially. Fair enough that they found it I guess.

You might find yourself in a similar situation with the web service data also being surfaced in a web application. In that case you will want to run BURP over that web application. It will be a lot more informative there.

Improve this answer
2
  • Appreciate the detailed answer. I think one of the services may have HTML UI as well; I'll look into that so thanks for that heads-up. I'll hold-off accepting your answer for a couple of days in case anyone else has an answer though I guess this is pretty niche stuff...
    – Keith C
    Commented Mar 7, 2014 at 0:02
  • Fair enough. Others may have different certification experiences. My scenario was a bit complicated with all the parties involved in implementing the complete solution.
    – Daniel Ballinger
    Commented Mar 7, 2014 at 0:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .