OWASP Dependency-Check

Overview

OWASP Dependency-Check performs Software Composition Analysis (SCA) — it identifies project dependencies and checks whether any contain known public vulnerabilities (CVEs) using the NVD database.

Common Usage

Scan a directory

dependency-check.sh --project "MyApp" --scan /path/to/project --out reports/

Scan specific file types

dependency-check.sh --project "MyApp" --scan . --out reports/ \
  --enableExperimental

Java/Maven project

dependency-check.sh --project "MyApp" --scan target/ --out reports/

Node.js project

dependency-check.sh --project "MyApp" --scan . --out reports/ \
  --nodePackageSkipDevDependencies

Update NVD database only

dependency-check.sh --updateonly

Output formats

dependency-check.sh --project "MyApp" --scan . \
  --format HTML --format JSON --out reports/

Maven Plugin

<!-- pom.xml -->
<plugin>
  <groupId>org.owasp</groupId>
  <artifactId>dependency-check-maven</artifactId>
  <version>latest</version>
</plugin>

mvn dependency-check:check

Interpreting Results

• CVSS Score 9.0+ — Critical, investigate immediately
• Focus on direct dependencies first (you can fix these)
• Check if the vulnerable code path is actually reachable
• Look for available patched versions

dependency-check.sh [options]

REQUIRED:
  --project NAME      Project name
  --scan PATH         Path to scan (repeatable)
  --out DIR           Output directory

SCAN OPTIONS:
  --enableExperimental  Enable experimental analyzers
  --enableRetired       Enable retired analyzers
  --nodePackageSkipDevDependencies  Skip devDependencies
  --exclude PATTERN   Exclude files matching pattern

OUTPUT:
  --format FORMAT     HTML (default), JSON, XML, CSV, SARIF, JUNIT
  --prettyPrint       Pretty-print JSON/XML output

DATABASE:
  --updateonly        Update NVD database only, don't scan
  --nvdApiKey KEY     NVD API key for faster updates
  --noupdate          Skip NVD update (use cached data)
  --connectionTimeout N  Timeout for NVD downloads

REPORTING:
  --failOnCVSS N      Exit with error if CVSS >= N
  --junitFailOnCVSS N JUnit failure threshold
  --suppression FILE  XML file of false-positive suppressions

Vue d’ensemble

OWASP Dependency-Check réalise une analyse de composition logicielle (SCA) : il identifie les dépendances du projet et vérifie si l’une d’elles contient des vulnérabilités publiques connues (CVEs) en utilisant la base de données NVD.

Utilisation courante

# Scanner un répertoire
dependency-check.sh --project "MyApp" --scan /path/to/project --out reports/

# Scanner des types de fichiers spécifiques
dependency-check.sh --project "MyApp" --scan . --out reports/ \
  --enableExperimental

# Projet Java/Maven
dependency-check.sh --project "MyApp" --scan target/ --out reports/

# Projet Node.js
dependency-check.sh --project "MyApp" --scan . --out reports/ \
  --nodePackageSkipDevDependencies

# Mettre à jour la base NVD uniquement
dependency-check.sh --updateonly

# Formats de sortie
dependency-check.sh --project "MyApp" --scan . \
  --format HTML --format JSON --out reports/

Plugin Maven

<!-- pom.xml -->
<plugin>
  <groupId>org.owasp</groupId>
  <artifactId>dependency-check-maven</artifactId>
  <version>latest</version>
</plugin>

mvn dependency-check:check

Interprétation des résultats

• Score CVSS 9.0+ : Critique, à investiguer immédiatement
• Se concentrer d’abord sur les dépendances directes (vous pouvez les corriger)
• Vérifier si le chemin de code vulnérable est réellement accessible
• Chercher les versions corrigées disponibles

dependency-check.sh [options]

REQUIRED:
  --project NAME      Project name
  --scan PATH         Path to scan (repeatable)
  --out DIR           Output directory

SCAN OPTIONS:
  --enableExperimental  Enable experimental analyzers
  --enableRetired       Enable retired analyzers
  --nodePackageSkipDevDependencies  Skip devDependencies
  --exclude PATTERN   Exclude files matching pattern

OUTPUT:
  --format FORMAT     HTML (default), JSON, XML, CSV, SARIF, JUNIT
  --prettyPrint       Pretty-print JSON/XML output

DATABASE:
  --updateonly        Update NVD database only, don't scan
  --nvdApiKey KEY     NVD API key for faster updates
  --noupdate          Skip NVD update (use cached data)
  --connectionTimeout N  Timeout for NVD downloads

REPORTING:
  --failOnCVSS N      Exit with error if CVSS >= N
  --junitFailOnCVSS N JUnit failure threshold
  --suppression FILE  XML file of false-positive suppressions