December 2018 Summaries

A critical arbitrary code execution vulnerability was discovered in Kubernetes, allowing an attacker to gain remote access to backend services and execute arbitrary commands, potentially resulting in privilege escalation. The vulnerability exists due to a flaw in the kubelet API service, which allows proxied requests to internal backend servers, creating a direct tunnel between the backend servers and the user. This is exacerbated by insecure defaults, such as allowing both authenticated and unauthenticated users to query the Kubernetes API, and insufficient logging that fails to capture malicious activities. To protect against this vulnerability, it is recommended to upgrade to patched versions of Kubernetes, use workarounds or mitigation options, and consider using a developer-friendly solution like Snyk's Docker image scanning solution to detect and remediate vulnerabilities in container images.

Guy Podjarny, CEO of Snyk, a developer-first solution for automating vulnerability finding and fixing in dependencies, recently discussed his journey to building a successful freemium product on the SaaStr podcast. He shares insights on navigating the balance between market expansion and product depth, feature prioritization, and the importance of giving away "secret sauce" in freemium models. Guy also addresses challenges such as agency with developers versus CIOs, pricing transparency, and scaling team communication across locations. Additionally, he offers advice on hiring sales personnel, letting go of control, and lessons learned from his early days as a founder.

We have improved our lockfile support for JavaScript projects, allowing for faster and more accurate test results. Our new functionality uses a node-lockfile-parser lib to traverse the lockfile itself and the package.json file instead of the entire node_modules folder, resulting in better performance and accuracy. For projects with yarn.lock or package-lock.json files, we will automatically detect these and process them as lockfile-based, while for projects without lockfiles, our previous support is still available. This change affects how Snyk tests work, providing more accurate results but also requiring manual intervention to update lockfiles before merging Pull Requests.

A malicious package, flatmap-stream, was published to npm and later added as a dependency to the widely used event-stream package by user right9ctrl. The event-stream package is a toolkit that provides utilities to creating and managing streams. Some time, and 8 million downloads later, applications all over the web were unwittingly running malicious code in production. This incident highlights the fragility of the open-source model if not respected and the need for responsible disclosure and security research as part of the development process.