AppScan (or any DAST / SAST tool) against a BPM / BAW application finds two kinds of things: platform findings (the same for every installation) and your application's findings. Handling both:
Platform findings - cookie flags, headers, framework versions:
- HttpOnly / Secure on JSESSIONID and LtpaToken2: set in WebSphere (Session management > cookie settings; Global security > LTPA > SSO cookie options).
- Missing headers (X-Frame-Options, Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options): add them on IHS (Header always set …) or the load balancer; BAW 20+ ships sensible defaults, CP4BA's Zen front door sets most of them. Beware: a strict CSP breaks coaches (inline scripts) - use frame-ancestors and nosniff first, CSP script rules only after testing.
- Old libraries flagged (Dojo, jQuery in the UI Toolkit): fixed by BAW fix packs / CP4BA image updates - upgrade rather than patch files; document accepted risks with IBM's security bulletins.
- CSRF: the BPMCSRFToken requirement exists since the 2018 cumulative fixes of 8.6 / BAW; on 8.5.7 install the interim fix that adds the CSRF protection, or front the APIs with a gateway.
- Information disclosure (server version in headers, verbose error pages): ServerTokens Prod on IHS, custom error pages in the web container, disable the REST API tester (/bpmrest-ui) in production.
Application findings - the ones you fix in the process app:
- XSS: Output Text with allow HTML showing user input, custom coach views writing innerHTML from data - escape (textContent) or sanitise; never build HTML with string concatenation of user data.
- Injection: SQL statements built from variables in SQL integrations - always parameters (? with SQLParameter); LDAP filters; shell commands in Java integrations.
- Authorization: REST calls from coaches to instances / tasks the user should not see - BPM enforces teams, but your services must check the user (tw.system.user) before returning data for an id from the request.
- Sensitive data in URLs / logs: no clear-text ids of people in GET parameters where avoidable; log statements without personal data.
Process: scan a test environment with a test user per role (the crawler must log in), triage findings into platform / app, fix the app ones in the next snapshot, track platform ones against IBM bulletins, and rescan after fix packs. Keep the AppScan login sequence out of the CSRF trap by recording it with the token flow.
References