December 2023 Summaries

Software identification plays a crucial role in managing software assets, version control, and vulnerability management, yet remains a fragmented field with no single identifier capable of meeting all requirements across diverse use cases. This complexity is highlighted by three primary formats: Common Platform Enumeration (CPE), which focuses on product-specific identification; Package URL (PURL), which targets third-party dependencies and is prevalent in open-source software ecosystems; and Software Identification Tags (SWID), which provide structured metadata for software products. Challenges arise from the need for timely availability and precision in software identifiers, as well as from the differing methodologies of inherent and defined identifiers—each with its own advantages and drawbacks. The Cybersecurity and Infrastructure Security Agency (CISA) discusses potential paths forward, including a mix of inherent and defined identifiers, centralized and distributed models, and the possibility of multiple identifier formats to ensure comprehensive coverage and correlation across datasets in the software ecosystem. The ongoing debate reflects the need for a more unified approach that can adapt to the growing complexity and security demands of modern software environments.

CVE-2023-50164 is a significant vulnerability in the Apache Struts web application framework, discovered on December 7, 2023, that can potentially lead to path traversal and remote code execution. The flaw arises from the mishandling of HTTP parameters during file uploads, allowing attackers to upload arbitrary files to unintended directories, potentially executing malicious code on the server. This vulnerability is exacerbated by the presence of proof-of-concept exploits on GitHub repositories, with observed exploitation attempts starting December 12. There is some confusion over which versions are affected, as the GitHub Advisory Database and Open Source Vulnerability (OSV) database list certain versions, while the official advisory includes different end-of-life releases. Users of Apache Struts are urged to prioritize identifying and updating affected applications to mitigate the risk, drawing lessons from the Equifax data breach in 2017, which was attributed to a similar Struts vulnerability.

Endor Labs has introduced new software composition analysis (SCA) capabilities for JavaScript, TypeScript, and NodeJS, featuring reachability and phantom dependency detection, which help prioritize vulnerabilities across both direct and transitive dependencies. Reachability analysis determines if vulnerable code is being used in an application, and Endor Labs' approach does not rely on runtime agents, instead utilizing program analysis for comprehensive dependency coverage. This method contrasts with traditional manifest scanning, which can miss critical vulnerabilities due to discrepancies between declared and actual dependencies, such as phantom dependencies—packages used but not declared in the manifest. The tool supports package managers like yarn, npm, and pnpm, and automatically resolves dependencies in complex environments like workspaces. Endor Labs' program analysis provides a unified view of all dependencies by analyzing the application's source code and comparing it with a pre-populated vulnerability database, offering enhanced security insights beyond conventional SCA tools.

MileIQ, a leading mileage tracking app, partnered with Endor Labs to enhance their software security and developer productivity by focusing on managing open source software (OSS) supply chain risks. Faced with an overwhelming number of alerts from their previous software composition analysis (SCA) provider, MileIQ sought a replacement that would allow them to prioritize vulnerabilities and maintain business value without sacrificing security. Endor Labs' reachability analysis enabled the team to identify and deprioritize unreachable vulnerabilities, streamlining the process and allowing MileIQ to concentrate on evolving their product while maintaining a robust compliance posture. As a result, MileIQ has improved developer productivity, reduced technical debt, and enhanced risk management, supporting their mission to innovate and serve millions of global customers efficiently.

In the realm of cybersecurity, modern networks generate a vast number of vulnerability findings, yet only a small fraction are typically exploitable, making it crucial for organizations to prioritize which vulnerabilities to address. Tools like the Exploit Prediction Scoring System (EPSS) and reachability analysis aid in discerning genuine threats, but communicating these findings remains a challenge, often relying on outdated methods such as custom web pages, emails, and spreadsheets. The introduction of the Vulnerability Exploitability eXchange (VEX) offers a solution by providing a machine-readable format that efficiently conveys the exploitability status of vulnerabilities, enhancing communication between software publishers and consumers. The VEX format, particularly the one from the CycloneDX SBOM standard, includes detailed fields like analysis, justification, and response, which help in accurately assessing and responding to vulnerabilities. This format is designed to streamline the vulnerability management process, reduce the workload on security teams, and ultimately improve application security by facilitating quicker and more precise communication.

Endor Labs offers a tutorial on using its platform to identify and resolve leaked valid secrets within an organization, emphasizing prioritization based on validity, investigation, and resolution directly from GitHub, as well as using policies to prevent future leaks. The content also references the critical remote code execution vulnerabilities found in React and Next.js, highlighting the importance of addressing such issues. Additionally, the use of AI, specifically GPT-3.5, in malware reviews is discussed, noting that while AI can aid human efforts, it still produces false positives and negatives. The text also touches on the security risks posed by invisible threats and the exploitation of Unicode shadows in VS Code supply chains.

IoT devices have significantly transformed healthcare by allowing broader access to medical services and empowering individuals to manage their health, but they also present substantial cybersecurity risks, as evidenced by the high incidence of attacks reported in 2022. The U.S. FDA has responded to these challenges with regulatory measures, notably Section 524B of the FD&C Act, which mandates cybersecurity requirements for medical devices. These requirements include a Risk Mitigation Plan, the use of Secure Development Processes, and the creation of a Software Bill of Materials (SBOM), each requiring specific strategies to ensure compliance. The Risk Mitigation Plan involves monitoring and addressing cybersecurity vulnerabilities, while Secure Development Processes demand the integration of security into the software lifecycle, supported by tools and frameworks like SLSA and SSDF. The SBOM must comprehensively document all software components, necessitating collaboration across various teams to enhance supply chain security. Despite their challenges, these FDA requirements underscore the necessity of embedding security into the software development lifecycle, with broader implications for any device or software vendor interested in maintaining robust cybersecurity measures.