Cargo Audit Integration with DefectDojo

Cargo Audit Integration with DefectDojo

cargo-audit is an open source command-line tool from the RustSec project, maintained by the Rust Secure Code Working Group, that audits Rust dependencies for known security issues. It reads a project's Cargo.lock, compares every locked crate version against the RustSec Advisory Database, and reports vulnerabilities with the RustSec ID, any CVE or GHSA aliases, a CVSS vector when the advisory has one, the affected functions, and the patched versions. It can also warn about unmaintained or yanked crates. DefectDojo imports cargo-audit's JSON output.

Cargo Audit Integration with DefectDojo

We run cargo-audit on every Rust repository because it is the reference check for RustSec advisories and it takes seconds. Importing the JSON into DefectDojo is how those advisories become tracked work. Each vulnerable crate becomes a Finding on the Asset that owns the service, with the RustSec ID, CVE aliases, CVSS score, and the exact version to upgrade to. When someone runs cargo update and the advisory goes away, the next reimport closes it, and we keep a record of how long it was open.

Why Cargo Audit Matters

Rust's memory safety removes whole classes of bugs, but it doesn't make dependencies safe. Crates still ship logic errors, unsound unsafe code, denial of service issues, and protocol handling flaws, and a typical service pulls in hundreds of them.

• cargo-audit works from Cargo.lock, so it reports the versions actually built, including transitive dependencies.
• The RustSec Advisory Database is curated for the Rust ecosystem and links advisories to CVE and GHSA identifiers where they exist.
• Advisories often list the specific affected functions, which helps teams judge whether their code reaches the vulnerable path.
• Each result names the patched version ranges, which turns the finding into a concrete upgrade task.
• On its own, cargo-audit fails or passes a build. It has no way to show which advisories are new, accepted, or overdue.

Advantages of This Integration

What we gained by running cargo-audit through DefectDojo:

• Identifiers that connect across tools. The RustSec ID and every alias (for example a CVE) are stored as vulnerability IDs, so a search for a CVE finds the Rust finding alongside results from other scanners.
• CVSS-based severity. When the advisory has a CVSS v3.x or v4.0 vector, the parser stores the vector and score and derives severity from it, so SLAs reflect the advisory's rating.
• Deduplication tuned for dependencies. DefectDojo hashes cargo-audit findings on vulnerability IDs, severity, component name, component version, and the RustSec ID, so rescanning an unchanged lockfile adds nothing new.
• Lifecycle on reimport. Reimporting into the same Test mitigates advisories that disappear after an upgrade, adds new ones, and reactivates any that return.
• Searchable tags. Advisory keywords are added as tags, which makes it easy to filter by topics such as denial of service or memory handling.

How This Integration Works

DefectDojo imports cargo-audit results with the CargoAudit Scan scan type, which reads the JSON report.

1. Produce a JSON report. From the project root, run:

cargo audit --json > cargo-audit.json

cargo-audit fetches the latest advisory database before auditing unless told not to, so the report reflects current advisories. The parser reads the vulnerabilities.list array. Informational warnings in the separate warnings section, such as unmaintained or yanked crates, are not imported.

2. Import it. In the UI, open the Engagement, choose Import Scan Results, select CargoAudit Scan, and upload the file. For automation, use the API, available in Community Edition and DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=CargoAudit Scan" \
  -F "file=@cargo-audit.json" \
  -F "product_name=edge-proxy" \
  -F "engagement_name=CI" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "CargoAudit Scan" \
  --report-path "./cargo-audit.json" \
  --product-name "edge-proxy" \
  --engagement-name "CI" \
  --auto-create-context

3. Reimport on each build. Send later reports to /api/v2/reimport-scan/ against the same Test, so crate upgrades are recorded as mitigated findings.

Data Granularity: What Gets Imported

Within one report, entries with the same advisory ID, date, crate name, and version are imported once, with the occurrence count increased for each repeat.

Use Cases

In a CI pipeline: Every merge to main runs cargo-audit and reimports into the main branch Test. When a new RustSec advisory affects a locked crate, it shows up as a new Finding with an owner, even if no code changed.

Across a Rust workspace or fleet: An organization with many Rust services imports each into its own Asset. When a widely used crate gets an advisory, a search by RustSec ID or CVE shows every affected service at once.

For embedded or long-lived builds: Teams that can't upgrade a crate right away risk-accept the finding with an expiration date and a note on reachability, using the affected functions list from the description.

Alongside container and SAST results: Rust services shipped as containers get their crate advisories next to image CVEs and code findings on the same Asset, which gives one view of the service's risk.

Operational Tips

• Review findings without a CVSS vector. Many RustSec advisories have none, and the parser rates those High by default, which may be stricter or looser than the real impact.
• Use the affected functions list during triage. If your code never calls the listed function, document that and risk-accept rather than marking it a false positive.
• Track unmaintained and yanked crate warnings separately. They aren't imported, so keep them visible in CI output or a periodic review.
• Remember that severity is a dedupe field. If an advisory later gains a CVSS vector and its severity changes, the next import can create a new Finding for the same issue.
• Use advisory keyword tags to build filters, for example to pull every denial of service advisory across Rust services.
• Tag imports with the workspace or branch (for example tags=main,edge-proxy) for clean metrics.