June 2024 Summaries

The Common Vulnerabilities and Exposures (CVE) Program, managed by the MITRE Corporation, catalogs publicly known cybersecurity vulnerabilities and has recently updated its rules with the release of CNA Rules v4.0, effective August 8, 2024. The updated rules aim to provide more flexibility and clarity in the CVE assignment process, emphasizing a technology-neutral approach and ensuring entities most familiar with a product have the primary role in assigning CVE IDs. Notable changes include a more adaptable definition of vulnerabilities, particularly regarding cloud security misconfigurations, and a shift towards conditional language to accommodate varying scenarios. This overhaul is expected to increase the number of recognized cybersecurity threats by allowing for a broader interpretation of what constitutes a vulnerability. However, the success of these changes depends on consistent enforcement, something that has been inconsistent historically. With predictions of a significant increase in CVE recognition, the program anticipates approving more submissions in the coming years, continuing the trend of recent growth in CVE approvals.

In 2024, a significant security incident occurred involving the domain polyfill.io, a widely used CDN service for adding modern web functionality to older browsers, which was compromised to deliver malware after being acquired by a malicious actor. This breach affected over 100,000 websites by injecting harmful JavaScript code, redirecting users, and circumventing security measures, prompting entities like Google to notify impacted parties and identify similar threats from other CDNs. The incident underscored the risks associated with legacy software dependencies, leading to a recommendation for developers to replace polyfill.io with Cloudflare's alternative, which has replicated the original functionality. The Semgrep Security Research Team developed a rule to detect and mitigate the use of polyfill.io in applications by scanning repositories and encouraging a switch to safer alternatives, highlighting the importance of updating and securing web technologies to prevent future vulnerabilities.

The Semgrep Community team is introducing two new Twitter accounts, Semgrep and Semgrep Community, to give users the option of choosing the type of content they want in their feed. This division aims to cater to different preferences: the Semgrep Community account focuses on engaging with the community through educational content, jokes, contests, and memes, while the Semgrep Corporate account provides updates on company news, product information, and event invitations. This initiative empowers users to select their preferred stream of information or follow both accounts for a comprehensive experience, ensuring users have control over their engagement and can unsubscribe at any time if they choose.