October 2022 Summaries

Semgrep Supply Chain introduces a novel approach to application security by focusing on the reachability of vulnerabilities within codebases, aiming to reduce the noise typically associated with supply chain findings. Unlike traditional tools that often flood engineers with alerts, Semgrep Supply Chain emphasizes identifying high-impact vulnerabilities that are genuinely exploitable, thus allowing professionals to prioritize their efforts effectively. The platform supports various programming languages and package registries and operates without the need for building or deploying agents, making it accessible and efficient. By leveraging advanced detection capabilities and integrating feedback from industry professionals, Semgrep Supply Chain offers a streamlined solution for managing dependency vulnerabilities, promising to help AppSec teams achieve "inbox zero" by filtering out non-critical alerts and enabling focused remediation efforts.

PyYAML's API has undergone significant scrutiny and updates to address deserialization vulnerabilities that could allow arbitrary code execution, particularly involving the yaml.load function. Historically, the function was deemed unsafe, leading to the introduction of FullLoader and UnsafeLoader classes to mitigate risks. Despite these efforts, vulnerabilities such as CVE-2020-1747 and CVE-2020-14343 were discovered, prompting further patches in version 5.4. Testing using Tox confirmed that while yaml.safe_load has consistently been secure across all versions, yaml.load and yaml.full_load became safe from known exploits post-version 5.4. As a result, Semgrep's Python YAML deserialization rule was updated to specifically alert on vulnerable APIs from version 5.4 onwards, encouraging users to either upgrade their PyYAML versions or ensure the use of safe_load for security.

Semgrep Supply Chain is a high-signal dependency scanner designed to address the challenges posed by false positives in traditional Software Composition Analysis (SCA) tools, which often generate overwhelming alerts that are mostly ignored due to their inaccuracy. By integrating Semgrep's first-party code analysis with dependency analysis, Semgrep Supply Chain focuses on the small percentage of vulnerabilities that are actually reachable within an organization's code, thereby enabling security teams to prioritize critical issues effectively. This tool scans lockfiles to determine if vulnerable package versions are in use and employs reachability analysis to identify dangerous usage of such packages, supported by curated rules from its security research team. Acknowledging the reality of limited resources and the need for pragmatic solutions, Semgrep Supply Chain aims to reduce the manual triage burden, allowing security teams to concentrate on vulnerabilities that pose real threats, and it supports multiple programming languages, including Go, JavaScript/TypeScript, Python, and Ruby, with more to be added.