October 2023 Summaries

Semgrep Secrets is a newly launched product designed to detect and remediate sensitive credentials in code, complementing the existing Semgrep Code (SAST) and Semgrep Supply Chain (SCA) products. It utilizes a semantic analysis approach rather than traditional regex scanning, allowing it to understand code context and prioritize findings, thus enhancing detection accuracy and reducing false positives. This sophisticated method enables the identification of hardcoded credentials and tracks the flow of sensitive data, providing security teams with the ability to focus on critical issues. Semgrep Secrets also introduces a validation post-processor to confirm the activity status of detected credentials, ensuring that security efforts are concentrated on live keys. This innovation supports developer workflows by integrating findings into developer environments through pull request comments and pre-commit hooks, allowing developers to address security issues without disrupting their workflow. The product is now available for public beta, offering organizations enhanced security measures during the build process.

Charissa Kim's summer internship at Semgrep challenged the typical stereotypes associated with startup culture, offering her a well-balanced and enriching work environment that contrasted with her previous experiences at tech giants and government roles. Her role as an internal security intern involved working on Governance, Risk, and Compliance (GRC) and privacy initiatives, including maintaining SOC-2 compliance and preparing for GDPR compliance, which underscored the importance of data security and regulatory adherence. The internship provided her with significant professional growth opportunities, including attending major security events such as BSides and DefCon, which allowed her to network and expand her knowledge in the cybersecurity field. Contrary to the common perception of demanding work hours in startups, Semgrep offered flexibility and a supportive environment, fostering personal and professional development. Charissa's positive experience culminated in a full-time offer as a Security TPM, marking a transformative step in her career.

Semgrep Supply Chain, designed to streamline vulnerability management by filtering out unnecessary alerts, has addressed the recent cURL version 8.4.0 release, which patches a heap corruption issue affecting libcurl versions 7.69.0 to 8.3.0. The vulnerability, identified as CVE-2023-38545, arises when a hostname longer than 255 bytes is used in SOCKS5 requests, potentially leading to heap corruption on systems without proper memory safety. Users accepting arbitrary URLs without hostname validation are particularly at risk. The recommended immediate action is to update system curl and libcurl via package managers to mitigate the vulnerability. Additionally, Semgrep Supply Chain is investigating the presence of vulnerable statically-linked libcurl dependencies, emphasizing the importance of updating the system environment rather than individual libraries. This approach ensures the most comprehensive protection against the exploit, and users are encouraged to conduct a dependency audit to understand how libraries link to libcurl.