We regularly get questions where OP has run a vulnerability scanner on an application and asks for help with interpretation of the results. Usually they quote part of the scanner's report, and OP is uncertain about whether some particular finding is valid, what it means, or how to address it. The flagged issue then often turns out to be a false positive caused by some coarse scanning heuristics or other limitations of the tool.
A few examples:
- Remote file inclusion (RFI) found - vulnerability or false positive?
- Nexpose Vulnerability scanner
- JSON API response flagged as XSS by vulnerability scanner. Is this a false positive?
- VeraCode static code scan of django view reports "External control of Filename or Path" on render method
- Remote OS Command Injection - scanned by ZAP
- Sucuri giving false positive with their free online scanner because of an .htaccess RewriteRule (IMO well-written question, but probably still better suited for vendor support.)
Why it's a problem
Vulnerability scanning tools and services are becoming more widespread and their quality varies. Especially as some are advertised as complete security solutions, we'll probably keep seeing more questions by users who run automated scans, but lack the expertise to then assess and act on the reported results.
However, critical evaluation of the output and identification of false positives is a normal part of using a security tool. We should be able to expect some human analysis, not just an auto-generated scan report that's passed on to the community to do the "real" work. Similarly, we wouldn't accept a question that just lists open ports found via
nmap or a dump of compilation warnings from
If a scanner doesn't seem to be working correctly, that's more a matter for the vendor rather than SE. The community shouldn't have to take on the role of compensating for poor performance or superfluous warnings by a subpar scanning service/software. And given that exaggerated or false alerts are a business model for some antivirus scareware already, this will probably also be a concern with vulnerability scanners in the future.
A suggested course of action
We could treat these like homework questions. That is, close questions which ask for analysis of a vulnerability scanner's report unless the asker also provides some assessment and reasoning of their own.
A question that boils down to just "Why has my scanner flagged this line of code? It seems fine to me." or "My scan report mentions this vulnerability. How do I fix it?" wouldn't be okay. In that case, we could point out that automated scans have limitations and may produce false positives – and recommend getting support from the vendor.
Bonus: We could establish a canonical question along the lines of "My vulnerability scanner gave a result that I don't understand. What now?" as a place to point to.
Happy to hear opinions!