1

As part of the Salesforce security review they state:

If your solution connects to any non-Salesforce domains, also run Chimera, ZAP, or Burp Suite on the external endpoints. Include reports from your scans when you submit your solution for security review.

I am a little confused about what a need to scan here they don't seem to provide any examples, in my managed package I call out to a dynamic endpoint in an external system like the example below:

https://example-system.com/spr/object/interface/edit/{id of object}?sso={generated token}

Does any one know should I submit can results for a version of this endpoint containing the data e.g.

https://example-system.com/spr/object/interface/edit/4567654567?sso=abc123

or do I submit a scan for:

https://example-system.com/spr/object/interface/edit/

or the root domain:

https://example-system.com

Improve this question
1
  • IMHO you should effectively record a sequence of interactions with the external system by exercising it the way you would from your Salesforce application. You then have burp/zap generate a probing/attack sequence. The tool will likely do things like changing the URL, but also include modified payloads with various data values designed to catch SQL injection and other possible flaws in the system.
    – Phil W
    Commented Feb 9 at 9:12

1 Answer 1

Reset to default
2

For external endpoints , there are 2 types :

  1. Endpoints owned by package publisher : Since package publisher owns the external endpoint, it needs Chimera scan as stated here.

  2. Endpoints not owned by package publisher : We need to scan the exact endpoints which Salesforce integrates with using Burp Suite or ZAP. Since we do not own the external endpoint , we need to scan all the endpoints which are used by Salesforce.

In your case , if Salesoforce integrates with - https://example-system.com/spr/object/interface/edit/4567654567?sso=abc123 , we need to do a scan for that particular endpoint.

w.r.t. the dynamic parameters, the tool will generate it.

Improve this answer
4
  • thank you for the response, looking at the details on Chimera it doesnt look like this is an option as our solution is hosted on AWS, I can see by entering a url like: example-system.com/spr/object/interface/edit/?sso= That Zap is adding data to the path, to fill in the blanks. So I need to run / generate a report for each endpoint the app hits? for example if i also had the below these would be separate scans? example-system.com/spr/object/results/view/… example-system.com/spr/object/history/view/…
    – ravent
    Commented Feb 9 at 9:54
  • Usually for Burp Suite, you can scan multiple endpoints with same domain in one scan.
    – Rohit
    Commented Feb 9 at 9:58
  • Burp subscriptions cost money, it is complex to use and doesn't really do anything you can't do with zap, from which Salesforce also accepts reports. I recommend using zap since it doesn't cost you money or really any more effort to set up than burp.
    – Phil W
    Commented Feb 9 at 11:42
  • I'am not recommending burp. I have used it and just sharing my experience.
    – Rohit
    Commented Feb 9 at 12:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .