March 2020 Summaries

As remote work becomes more prevalent, it's essential to adapt security practices to mitigate risks and ensure a secure development workflow. To empower developers through documented guidelines, limit "breaking the build" due to security violations, and invest in security visibility, such as software bills of materials, post vulnerabilities discovered in builds, and create leaderboards showcasing security achievements. Additionally, improving individual skills, celebrating security wins, aligning security partners with dev teams, focusing on security hygiene, adjusting critical infrastructure defenses, improving SSH security, and implementing bug bounties can help strengthen remote development security practices.

The Gradle plugin-publish plugin has revealed a security vulnerability, known as an "Insertion of Sensitive Information" vulnerability, which displays sensitive information in the log file when publishing a pre-signed AWS URL to the plugin. An attacker could potentially use this URL to replace a recently uploaded plugin with a malicious package. To mitigate this issue, Gradle released a new version of the publish plugin that reduces the log level of the URL and shortened the lifespan of the pre-signed URL, advising users to update to version 0.11.0 and avoid running Gradle with --debug log level. The vulnerability affects all versions below 0.11.0, and it is considered very dangerous to lower the log level when logs are publicly visible.

Snyk has enhanced its security and license testing for pull requests to better support shift-left security, secure development workflows, and DevSecOps strategies. The new features allow developers to integrate security into existing development pipelines in a frictionless manner, with full visibility into the results of automated security testing on their pull requests. Security teams can also have control over when to fail status checks and remove blocks in a safe way. With these capabilities, Snyk provides a responsible shift-left approach to implementing DevSecOps strategies.

The month of March 2020 saw the launch of the State of Open Source Security survey, which aims to analyze trends in how organizations use and secure open source software and cloud-native technologies. Several security news highlights included discussions on vulnerabilities in Kubernetes and the detection and fixing of a backdoor in Node.js. Additionally, Snyk released new product updates, including improved automatic dependency upgrades functionality and combined status checks for pull request tests. The company also announced its integration with Amazon ECR and EKS, as well as expanded platform support for Red Hat OpenShift 4. Various community learnings and events were also showcased, including a webinar on cloud misconfiguration detection and the first-ever DevSecCon virtual conference. Furthermore, Snyk's Developer Advocate Liran Tal will be walking through how to test APIs at the Destination: Centralization Conference.

The author created an automated testing tool called autotest using Terraform and PyTest to verify cloud infrastructure compliance and security with Fugue. The design involved three steps: deploying modular infrastructure using Terraform, creating a Fugue environment and scanning it, and retrieving and verifying scan results. To achieve this, the author used PyTest's fixtures to manage dependencies and abstract away implementation details. They defined custom fixtures for Terraform deployment, Fugue environment creation, and scan initiation, which were then used in tests to verify infrastructure compliance. The autotest tool provides a clean and powerful abstraction layer for testing cloud infrastructure and ensures that it is scanned correctly by Fugue.

Django provides numerous security features and best practices to help developers keep their projects secure. It is essential to know the version of Django being used, as it determines known vulnerabilities and the availability of support. Throttling user authentications can prevent brute force attacks, while protecting source code by not including it in the web server's root directory or using private repositories on GitHub or Bitbucket can prevent unauthorized access. Using raw queries and custom SQL with caution is recommended, as they may open the door for SQL injection attacks. Deploying behind HTTPS prevents malicious users from intercepting information sent between the client and server. Watching headers, especially referer request headers, is crucial to prevent cross-site request forgery (CSRF) attacks. Carefully handling user uploads by validating files, limiting file size, and disabling handlers that execute static files as code can prevent security vulnerabilities. Understanding all dependencies, including indirect ones, is vital to identify potential risks. Ultimately, every security step taken is a step in the right direction, and implementing these concepts can dramatically improve the security of Django projects.

The State of Open Source Security Survey - 2020` is an annual report by Snyk that analyzes trends in open source security and how organizations manage vulnerabilities in their software and cloud native technologies. The report, which has been produced annually since 2017, aims to better understand the challenges faced by the community through a survey and gather data from various sources. In the 2020 report, Snyk plans to expand its focus on cloud native technologies such as containers, orchestration tools, and infrastructure as code. The previous year's report found that known vulnerabilities grew by almost 88% across multiple ecosystems between 2017 and 2018, with PHP seeing a significant increase in reported vulnerabilities in 2018. Additionally, the time to fix vulnerabilities ranged from 289 days to over 2,000 days for popular packages in npm. The 2020 report aims to build upon these findings while expanding its scope to understand how organizations are driving their DevSecOps culture and managing security across open source software, containers, and orchestration.

AngularJS has several security fundamentals that developers should follow to ensure secure coding practices. It's essential to avoid dynamically loading Angular templates from untrusted sources, as this can introduce security risks. Additionally, users should avoid using the Angular `.element` jQuery-compatible API to manipulate the DOM, as this can lead to Cross-site Scripting vulnerabilities. Scanning and fixing vulnerabilities in third-party components is also crucial, especially since AngularJS has over 20 known security vulnerabilities across its version branch. Furthermore, developers should use built-in features like CSRF support and Content Security Policy (CSP) compatibility to enhance security. By following these best practices, developers can help protect their AngularJS applications from common web security threats.

The company behind Snyk, a software development and security platform, had to adapt quickly to a fully remote environment due to the coronavirus pandemic. Despite being well-prepared for remote work, they still had to learn and react to the sudden crisis. The team came together to respond as one, demonstrating adaptability to change. The company took a precautionary approach, prioritizing employee safety and social responsibility while also setting up for success in their remote environment. They provided guides, technology budget, and wellness support to employees, and established spontaneous social interaction opportunities to maintain wellbeing. The experience has built new confidence in the team's ability to anticipate, react quickly, and be agile in coming together as a community.

As the COVID-19 pandemic continues to evolve, the Snyk team is committed to supporting customers through this challenging time, with remote work and virtual engagement being business as usual for the company. The service remains unaffected, with all teams operating at full capacity, including Engineering and Technical Support. In light of canceled meetings and events, Snyk invites customers to participate in virtual events and resources, such as Allthetalks.online, MyDevSecOps Community, and Secure Developer podcast, offering a platform for talks and educational content to fill the gap. The company is dedicated to ongoing support and security guidance during this period.

The shift from traditional IT infrastructure to cloud-based applications has significant implications for IT security, as security tools and practices are designed for central IT teams, not independent application teams. The cloud eliminates the need for centrally managed infrastructure, making it a part of the application itself, but also introduces new security concerns such as unpatched containers and open ports that can be exploited by attackers. To address these challenges, organizations need to rethink their security practices, tools, and team structures to work with the development organization, understand the needs of application developers, and invest in flexible, API-driven, self-serve security tools. This transition will require significant changes, but is necessary to stay ahead of emerging threats and ensure the security of cloud-based applications.

Kubernetes has recently experienced two serious vulnerabilities, CVE-2019-11247 and CVE-2019-11249, which can be exploited for directory traversal attacks and bypassing security permissions through role-based access control. These issues arise from insufficient security configurations, such as incorrect or missing path sanitization in the kubectl cp operation, allowing malicious actors to manipulate file systems outside their intended scope. To remediate these vulnerabilities, users are advised to upgrade to a patched version of Kubernetes, remove wildcard role definitions for resources or apiGroups if upgrading is not possible, and avoid removing Role-Based Access Control (RBAC) from clusters, as this would introduce an even larger security risk. By taking these steps, users can protect their Kubernetes clusters from these serious vulnerabilities.

The Fastify Node.js framework has improved its JSON security thanks to a security report from Francesco Soncina on the HackerOne platform. The vulnerability was deemed relatively harmless as it didn't affect Fastify itself, but rather highlighted the importance of security reports and collaborative efforts in securing open-source projects. A more robust and secure JSON parsing mechanism was introduced through a pull request, along with a security disclaimer in the documentation to inform users on how to handle data safely. This incident promoted awareness among maintainers of security concerns around their code and demonstrated the value of security disclosures in securing the Node.js ecosystem.

Urllib3, a widely used Python library for HTTP clients, has been found to be vulnerable to a denial of service attack due to an inefficient method in its request processing logic. This vulnerability was discovered in version 1.25.2 and could potentially allow an attacker to consume excessive CPU resources, leading to a denial of service. To mitigate this risk, users are advised to update their urllib3 version to the latest current version (1.25.8) or use tools like Snyk to check for vulnerabilities in their dependencies. The vulnerability was addressed in later versions of urllib3, and Snyk offers free tier scans for open source projects and private repositories to help developers identify and remediate vulnerabilities.

Snyk has partnered with the makers of Greenkeeper to provide a new capability called Automatic Dependency Upgrades, which helps developers proactively maintain dependency health by monitoring open source dependencies and triggering actionable pull requests for upgrades. This feature is designed to reduce security vulnerabilities and make it easier for developers to keep their software up-to-date and healthy. With Automatic Dependency Upgrades, Snyk provides contextual and actionable information to help developers make informed upgrade decisions, control the pace of upgrades, and avoid overwhelming themselves with too much noise. The feature is now available in all Snyk Open Source plans and supports popular project types such as npm, Maven-Central, and Yarn projects on GitHub/GitHub Enterprise and Bitbucket Cloud.

Many websites are vulnerable due to security issues in third-party JavaScript libraries, with 84% impacted by jQuery XSS vulnerabilities according to a recent study. This problem is exacerbated when developers fail to update their installed JavaScript dependencies. To mitigate this risk, it's crucial to detect the libraries and their versions, cross-check them against a reliable vulnerability database, and upgrade vulnerable dependencies to their fixed versions. An open source project called "is-website-vulnerable" can help identify publicly known security vulnerabilities in frontend JavaScript libraries. Automated tools like Snyk can also be used to monitor open source dependencies and suggest upgrades when vulnerabilities are detected, helping reduce overall security risk.

Automating Kubernetes workload security reporting` The Snyk Container integration now enables automation of cloud workload security, allowing users to import Kubernetes workloads and identify vulnerable container images and misconfigurations. By adding a specific annotation to Kubernetes objects, users can centralize monitoring and automate security checks as part of their DevOps pipeline. This feature reduces the amount of manual work required for reporting and fixing issues, enabling easier workflow integration with regular cluster monitoring. The Snyk integration supports automation across the entire software development lifecycle, including integrations with image registries, Dockerfile repositories, and Kubernetes clusters.

At RSA 2020, we met with passionate customers and fans of Snyk, showcasing a growing excitement around our developer-first approach to application security. We discussed the benefits of building security into the software development process, including increased collaboration between security and development teams. Many companies adopting Snyk have found improved security outcomes by automating collaboration and integrating security into their development workflows. The shift towards embracing this new approach to application security is gaining momentum, with businesses recognizing its value in continuously building security from the start. We were proud to partner with Auth0 at RSA 2020, highlighting the importance of Snyk in modern security practices.