Note this tool is not an official Veracode product. It comes with no support or warranty.

This tool performs bulk mitigation actions on open SAST flaws reported in multiple application profiles. The definitions of what to mitigate (e.g. file name, line number) and the mitigation comments and actions to apply are defined via a JSON file. Application profile names to target are specified via a text file or alternatively a flag can be set to process all application profiles.

There are two primary uses cases this tool solves:

1. Bulk mitigating flaws - useful for development teams/security champions
2. Bulk accepting mitigated flaws - useful for security teams

Development teams or security mentors could use this tool to propose mitigations (e.g. Mitigate By Design, False Positive) for idential flaws that are reported in a number of application profiles.

The tool can be used by security teams for bulk-approving or rejecting mitigations that have been reviewed, where those flaws arise form 2nd party components that are reported in more than one application profile.

• Uses the standard Veracode API credentials file
• Shows a summary before any action is carried out
• Can propose and/or approve/reject mitigations in bulk
• Multithreaded for speed

For targeted mitigation, the tool will check for all 5 matching signatures when considering every open flaw for each application specified:

1. CWE
2. Module name
3. File name
4. Attack vector
5. Line Number

The applications can be specified using a text file data/application_names.txt. It is recommended when testing a new mitigation signature to only use a single application profile name in this text file. Once the tool has been verified to work as expected the file can be updated to include more profile names, or alternatively specify --all-application-profiles=true to apply mitigations across all the application profiles.

The tool will not take any mitigation action until the user explicitly enters "y" to apply the mitigations once a summary of what will be mitigated has been presented.

You can see a demo of the tool below:

The tool can be used to apply a single action or multiple mitigation actions per flaw, for example a "Mitigate By Design" or a "False Positive" followed by an "Approve" action. The tool will make sure they are applied in a logical order. It is not allowed to specify both "Mitigate By Design" and "False Positive" because that does not make sense as only one of those statements can be true.

It is also possible to propose an "Accept the Risk" action prior to "Approve" if that is how your organisation operates.

This tool makes use of the Veracode APIs (listed below). You will need Veracode API credentials and the Reviewer or Security Lead role for this tool to work. We recommend you configure a Veracode API credentials file.

Follow these steps to install the tool:

1. Ensure you have Python 3 installed.
2. Install Pipenv typically via your package manager or by running pip install --user --upgrade pipenv
3. Clone this repository git clone https://github.com/antfie/veracode_bulk_mitigator/tree/main
4. Ensure you have a Veracode API credentials file configured.

1. Ensure you have configured and reviewed appropriate mitigation signatures in data/approved_bulk_mitigations.json (see below for the documentation of this file).

2. Make sure you have added a list of applications to data/application_names.txt, or alternatively to run against all application profiles, set this flag when running the tool --all-application-profiles=true.

3. Run the below command to run the tool. Note that the tool will not make any changes unless you enter "y" at the prompt following the summary of mitigations to add.

   pipenv run bulk_mitigator

mitigations.json is a JSON file which can contain a number of bulk mitigation definitions.

* You can find this information from the Flaw Details section of the Triage Flaws page.

In the example below you can see how to use the TSRV format.

[
  {
    "friendly_name": "CWE-117 identified in app.dll",
    "process_policy": true,
    "process_sandboxes": true,
    "sandboxes": [
      "Release"
    ],
    "cwe": 117,
    "module": "app.dll",
    "file_path": "app/controllers/portalcontroller.cs",
    "attack_vector": "microsoft_extensions_logging_abstractions_dll.Microsoft.Extensions.Logging.LoggerExtensions.LogInformation",
    "line_number": 75,
    "mitigate_by_design": "Technique : M1 :  Establish and maintain control over all of your inputs\nSpecifics : TODO\nRemaining Risk : TODO\nVerification : TODO",
    "false_positive": "TODO",
    "accept_risk": "Specifics : TODO\nRemaining Risk : TODO\nVerification : TODO",
    "approve": "TODO",
    "reject": "TODO"
  }
]

If you experience issues running pipenv see this guide. On Windows you may need to update your path environment variable. Alternatively try running pipenv via python like so:

python3 -m pipenv run bulk_mitigator

Finally, as a last resort consider using pip to install the dependencies:

python3 -m pip install --user -r requirements.txt
python3 bulk_mitigator.py

When repeatedly running the tool it helps to cache some of the requests to speed things up. Use this flag to do that:

pipenv run bulk_mitigator --application-cache-file-path=data/application_cache.csv

Note that if an application or sandbox is renamed/added/deleted then the cache may have stale data, so it is recommended to clear the cache file regularly.

There is a script to lint the code, keep dependencies up to date and run some tests:

pipenv run test