September 2023 Summaries

Software composition analysis (SCA) is crucial for organizations using third-party open-source components in their applications, as it helps manage security risks associated with these dependencies. Common Vulnerabilities and Exposures (CVE) severity ratings provide a useful indicator of a vulnerability's potential impact, but the severity of an SCA risk also depends on other factors such as likelihood of exploitation and business importance of the application system. To determine the severity of an SCA Risk, organizations can use various security frameworks like EPSS, CVSS, and KEV in addition to CVE severity ratings. A Software Bill of Materials (SBOM) is a list of all software components used in an application and helps identify third-party components and their versions. SBOMs enable teams to quickly assess the existence of vulnerabilities in source code and manage risks associated with them. Organizations should also consider their own specific risk tolerance when determining the severity of a risk associated with a third-party vulnerability based on how essential the vulnerable component is in achieving the organization's mission, and whether the vulnerable component would cause material or irreversible harm to public well-being and the organization's business reputation. Strategies for expediting severity measurement for newly published CVEs include setting up automated alerts for new vulnerabilities, regularly updating security databases, and using SCA tools that integrate with existing development workflows.

The Software Bill of Materials (SBOM) is an emerging tool designed to improve third-party vulnerability management and reduce risks associated with software dependencies. SBOM artifacts provide a snapshot of all package versions included within or referenced by a product, offering insight into its security posture. While they can increase transparency for customers and expedite risk assessments, their static nature limits their value in incident response. If not updated regularly, SBOMs could become outdated and less useful. Additionally, shared product documentation exposes source code architecture and potential vulnerabilities, which could be exploited by hackers. To mitigate these risks, organizations should adopt comprehensive SBOM solutions that visualize risks, assist in the triage and remediation process, and expedite mitigation efforts.

On August 30, 2023, Sourcegraph's Head of Security revealed that a hacker gained administrative access to Sourcegraph and may have accessed user information. The breach occurred when a Sourcegraph engineer accidentally committed code containing an active site-admin token with extensive privileges. A malicious user exploited the exposed credentials to create a proxy application granting free access to Sourcegraph APIs, resulting in 2 million views within hours. The exposure affected Sourcegraph.com's public code only, and while data was potentially accessed, its extent remains uncertain. Arnica has introduced a custom validator for Sourcegraph tokens as part of their secrets detection and validation service, which can help prevent similar issues by alerting developers to the presence of secrets in source code and offering assistance in removing them.