DAST is using an outdated version of Firefox
Since we had issues with the latest version of Firefox available in the official zap image, we had to replace it by an older version. This version is currently frozen in the Dockerfile: https://gitlab.com/gitlab-org/security-products/dast/blob/c8ff0f980b1a18713a235e532b04f4fbf452032c/Dockerfile#L4 While this change brings stability, it also brings a security risk. An attacker could modify the behavior of the spider to skip some pages, known to be vulnerable. Worse, with an RCE vulnerability exploited, the results of the report could be directly impacted or altered. Since some of these attacks can be conducted through assets, they would not so easy to spot during reviews.
/cc @dappelt (let us know if we should label this with security instead)