January 2022 Summaries

The PwnKit vulnerability is a high-severity bug in Polkit, a component used to control privileges in Unix-like operating systems, which has existed since 2009 and was recently discovered by a security researcher. The vulnerability allows an attacker to corrupt memory through a buffer overflow, leading to full root privileges on the target host. It is caused by a flaw in command line argument handling and can be exploited when the `pkexec` command is run without arguments, resulting in corrupted memory. Patches have been made available quickly, and it is recommended to install operating system updates immediately or remove the SUID bit from `pkexec` manually. The vulnerability affects many major Linux distributions, including Red Hat, Ubuntu, and SUSE, and highlights the importance of keeping up-to-date with security patches.

A developer-focused application security program is a journey, not a destination, requiring guiding principles to navigate stages, milestones, and challenges. To build an effective AppSec program from scratch, start small, focusing on individuals and shared secure coding practices, while releasing control and embracing transparency and cross-collaboration. As the program matures, refine it through continuous improvement, defining success metrics that serve the program's message, such as tracking design requirements, operational metrics, and security maturity assessments. Ultimately, AppSec should support developers, empowering them to take ownership of their secure coding practices with integrated and automated security tools like Snyk.

A new Chief Information Security Officer (CISO) must establish a security-focused ecosystem in an organization by gaining a thorough understanding of the business and its industry, developing trust with leadership, recognizing the company culture, making security a team sport, and thinking and acting strategically. To build trust with the board, the CISO needs to align with current strategies, deliver on promised projects, and understand the business's goals. Understanding the organization's culture is also crucial for security practices to be adopted, and it requires shifting existing cultural norms towards openness and collaboration. The CISO must communicate clearly with employees at all levels, regardless of their position, and advocate for security as a benefit to the bottom line, not an operating expense.

The PHP security support in Snyk Code is now Generally Available, bringing the ability to identify potential vulnerabilities at the code level. This feature adds to existing PHP scanning functionality that scans composer manifests for open source library and dependency vulnerabilities. The Snyk Visual Studio Code extension also supports code and composer scanning for PHP, highlighting insecure code as it's written and identifying vulnerabilities in open source libraries or dependencies. With this GA release, developers can delve into the issue and track down potential security threats through the codebase. A demo app, called a "goof app", has been added to test Snyk Code's capabilities, and users can try it out with a free Snyk account. The scan identifies issues such as SQL injection and use of hard-coded credentials, and provides fix analysis and remediation advice.

Log4Shell is a critical, widely distributed remote-code-execution vulnerability in the Log4j2 Java logging framework, caused by JNDI lookups in interpolated log strings that can contact malicious LDAP and HTTP servers and load unauthorized Java classes. Present since 2013 and exposed in late 2021, it affects many applications because Log4j is commonly included as both a direct and transitive dependency. A demonstrated exploit injects a malicious string into a logged login-field value, prompting the vulnerable application to retrieve attacker-controlled code and establish a reverse connection that enables remote commands on the server. The primary remediation is identifying every Log4j instance and upgrading to version 2.17.1, which also addresses a related denial-of-service issue, while temporary workarounds such as removing JNDI lookup functionality are considered less effective. Snyk’s tools can scan dependencies, source code, infrastructure configurations, and containers, map direct and indirect Log4j usage, and help create upgrade pull requests or surface fixes through IDE and CLI integrations.

I’m excited to announce that both Kathleen Murphy and Zach Nelson have joined the Snyk Board of Directors effective as of January 1, 2022, bringing valuable experience from their respective careers in finance and technology leadership, with Kathy having a deep understanding of the financial services industry and Zach having successfully led NetSuite to its successful IPO and acquisition by Oracle. These new additions join other recent board members, solidifying Snyk's mission to make every developer secure as they embark on this journey. The company is grateful for their expertise and looks forward to benefiting from their wisdom and experience. With these new board members, Snyk continues to grow its presence in the financial services realm and beyond, offering global opportunities for developers seeking to join the leader in developer security.

Shifting security left is a crucial aspect of building a cloud native bank, allowing Lunar to prioritize security earlier in the software development lifecycle and empower its developers through security tooling. By adopting a microservices architecture and using tools like Snyk, Lunar has improved the security of its services without slowing down development. The company's shift left approach enables transparent ownership over each microservice, ensuring that every team member is responsible for the entire service, from design to deployment. This approach has allowed Lunar to meet compliance requirements as a licensed bank while releasing 25 production builds per day.

The Open Policy Agent (OPA) is a general-purpose policy engine that enables organizations to define policies in code, leveraging a high-level declarative language called Rego. OPA allows for uniform policy definitions and enforcement across disparate services and environments, reducing the need for duplicated logic and improving compliance governance. By implementing policies and enforcing them in the developer's workflow, organizations can stop violations as they are created, rather than relying on late-stage auditing or manual reviews.

Snyk Code is a static application security testing service that combines machine learning with expert-reviewed rules to deliver real-time security and code-quality findings, allowing developers to identify and fix issues during development. As part of the broader Snyk developer security platform, it also supports scanning open-source dependencies, container base images, and infrastructure-as-code configurations, with remediation guidance and automated fixes. Snyk expanded its Visual Studio support through the Snyk Vulnerability Scanner extension, which scans project dependencies for known vulnerabilities and adds Snyk Code analysis for languages including C#, JavaScript, TypeScript, Python, and Ruby. Available for Visual Studio 2019 and 2022, the open-source extension can be installed through the IDE or Visual Studio Marketplace, authenticates through a Snyk account, and downloads the Snyk CLI automatically. The post encourages developers to scan regularly at development milestones and after fixes, emphasizing that early, repeated scanning can help prevent vulnerabilities from accumulating later in the project lifecycle.

The article highlights the importance of integrating security into the Software Development Lifecycle (SDLC) to protect applications from complex security threats and ensure efficient development. It emphasizes the need for a Secure Software Development Lifecycle (SSDLC) to address vulnerabilities early in the coding process, thereby reducing time and resources spent on post-release fixes. Key strategies include adopting a DevSecOps mindset, keeping security requirements up-to-date, utilizing threat modeling, and standardizing secure design requirements. The use of open-source components should be managed securely with tools like software composition analysis, while code reviews and penetration testing are essential for identifying vulnerabilities. Effective vulnerability management and incident response preparation are crucial for maintaining application security, and establishing a security champions program can foster collaboration between security and development teams. Overall, the article advocates for a proactive approach to security that integrates seamlessly with development processes to strengthen application security without compromising development speed.

This article discusses the importance of manual code reviews in software development and provides eight proven best practices for conducting effective code reviews. The first practice is to add comments during source code creation to explain the intent of a code block, while the second practice involves not assuming something works without testing it. The third practice is to run test suites on proposed code to validate its functionality. Additionally, the article emphasizes the importance of ensuring pull requests are small and focused on a singular purpose, always running automated code checkers, reviewing all code and PRs, setting limits for review time and code lines checked, and conducting security code reviews. By implementing these best practices, development teams can ensure their software is properly tested before pushing it to production and deliver high-quality, secure code quickly.

The demand for powerful Java review tools is driven by the need to ensure secure and high-quality software development, particularly in the face of increasing security threats. The top 7 Java code review tools include JArchitect, PMD, FindBugs/SpotBugs, Checkstyle, SonarLint, Graudit, and Snyk, each offering unique features such as static analysis, code querying, and security vulnerability detection. These tools can help automate code reviews, detect common mistakes and security threats, and provide actionable suggestions for improvement. By leveraging a comprehensive database of known flaws and using smart approaches to optimize the review process, developers can significantly reduce review time and improve overall code quality.

A 2021 review of Snyk’s The Secure Developer podcast identifies three major application-security trends: security teams increasingly hiring people with software engineering backgrounds, security practices adapting to developer workflows rather than operating as end-of-cycle checkpoints, and organizations strengthening basic security hygiene at scale to respond effectively to incidents such as Log4Shell. Across 22 episodes featuring 23 guests, discussions also covered Codecov’s response to its breach, the growing role of cloud-native technologies such as eBPF, and public-sector efforts to adopt DevSecOps despite institutional risk aversion and fragmented systems. Looking ahead to 2022, the discussion highlights supply chain security, software-oriented cloud security, and better methods for quantifying application-security risk as critical priorities, alongside a broader shift toward assessing applications and their dependencies as interconnected systems rather than isolated vulnerabilities.

I traditionally start the new year with resolutions, this time focusing on not exposing confidential information while hacking my demo application during presentations or demos. This resolution stems from a security horror story where I accidentally exposed my GitHub token and other sensitive information during a presentation at J-Fall 2021. The incident occurred when I used a deserialization gadget chain to demonstrate a Java Security-related topic, inadvertently showing the environment variables on stage, which included API tokens like my GitHub token. A participant, Nils Breunese, pointed out the mistake, and I was both embarrassed and relieved. To prevent similar incidents in the future, I've decided to practice what I preach by being more mindful of my actions and ensuring that sensitive information remains confidential during demos or presentations.

URLs remain fundamental to web navigation, but differing interpretations of evolving URL RFC standards by libraries, browsers, and network tools can create “URL confusion” vulnerabilities when one component validates a URL differently from another that later processes it. Research by Claroty and Snyk examined 15 URL parsing libraries, fetchers, and browsers and identified inconsistencies involving missing schemes, irregular numbers of slashes, backslashes treated as slashes, and URL-encoded characters, all of which can cause disagreement over a URL’s host, path, or validity. These discrepancies can let attackers bypass host-validation controls and trigger issues such as server-side request forgery or open redirects, illustrated by a Ruby Clearance vulnerability in which repeated slashes were interpreted differently by the application and browser. The researchers reported multiple CVEs across projects in Python, Ruby, JavaScript, PHP, and C, and recommend minimizing the number of parsers used, parsing URLs once at a system entry point where possible, and understanding behavioral differences among every parser involved in a request flow.

Snyk has announced that Samantha Wessels has joined the company as its new Vice President of EMEA Sales, marking the most significant year in Snyk's history. Samantha brings an impressive sales track record and a customer-first approach to her new role, having previously worked at Elastic and Dimension Data. She is well respected within the global technology industry for her ability to rally teams and embrace transformation, as well as her passion for mentoring and volunteering. With her infectious ambition and energy, Samantha is expected to bring innovative ways to incorporate Snyk Impact initiatives into the sales organization, with a focus on bringing more women into sales across the tech industry.

The npm package `colors` was intentionally introduced with an infinite loop that causes a Denial of Service (DoS) vulnerability, and its version `1.4.1` has been flagged by Snyk as a security vulnerability, prompting users to revert to the stable version `1.4.0`. The maintainer of the package has also taken down the GitHub repository for another popular npm package, `faker`, which was previously used by thousands of developers. This incident highlights the importance of open source governance and funding models, as well as the need for maintainers to be transparent about their intentions and actions. To mitigate this issue, users are advised to pin their dependencies and consider using alternative packages.

The FTC warned companies that they may face enforcement action if they fail to take reasonable steps to address known vulnerabilities such as Log4Shell, the critical zero-day flaw discovered in the widely used Java logging library Log4j in December 2021. The warning reflects increasing U.S. government attention to software supply chain security, reinforced by the Equifax breach settlement and broader cybersecurity policy efforts. Although additional Log4j vulnerabilities emerged after the initial disclosure, the account argues that open-source risks can be managed through mature, auditable vulnerability-management programs that identify, prioritize, remediate, and continuously monitor flaws. It presents Snyk as a tool for scanning code and dependencies, locating Log4j instances, and integrating remediation into developer workflows, while noting that the company expanded free scan limits and published educational resources to support teams responding to the incident.

The article highlights the DevSecOps leaders recognized at SnykCon 2021, a virtual event that brought together thousands of developers and security practitioners from around the world. These leaders were honored for their innovative approaches to securing application development, bridging the gap between development and security teams, and promoting social or environmental impact. The article also mentions SnykCon 2022 and encourages those who missed the previous event to watch the engaging sessions online.

The challenge, "Fetch the Flag" from SnykCon 2021, was a web-based challenge involving an oracle attack using blind SQL injection. The team approached this problem by first investigating the available pages and identifying potential attack vectors. They then tested the vulnerability of the order query string and determined that it was susceptible to a blind SQL injection attack. Using an oracle attack, they were able to extract the login information from the database, including table names, column names, and data. The team then used this information to manipulate the admin panel's cookies and gain access to the admin page, ultimately retrieving the Snyk CTF flag.

As 2022 security resolutions, developers are encouraged to adopt practical habits that strengthen application and software supply-chain security without disrupting existing workflows. Recommended practices include signing and verifying container images with tools such as Cosign, Docker Notary, and Docker Content Trust to reduce tampering and man-in-the-middle risks; configuring Kubernetes containers with read-only root file systems to limit privilege escalation and application modification; disabling npm install scripts that can execute arbitrary commands; and scanning open-source dependencies, including indirect ones, for vulnerabilities or malicious packages. The recommendations also emphasize automated code review and vulnerability scanning during pull requests, rather than relying solely on manual review, alongside secure coding standards and developer education. Snyk’s container, infrastructure-as-code, open-source, code-scanning, and learning products are presented as tools that can support these measures within development environments.

Log4Shell, tracked as CVE-2021-44228, is a critical remote code execution vulnerability in the widely used Log4j2 Java logging library that received the maximum CVSS score of 10. It stems from Log4j’s handling of JNDI lookups, which can allow attackers to cause vulnerable applications to contact malicious services and execute supplied code. Potential consequences include malware or ransomware deployment, server takeover, data theft or manipulation, service disruption, and compliance or cloud-security failures. Identifying exposure can be difficult because Log4j is frequently included as a transitive dependency in other libraries, including within unmanaged or shaded JAR files. The recommended remediation is upgrading to Log4j version 2.17.1 or later, while organizations unable to upgrade immediately should apply available mitigations, scan dependency graphs, and monitor updated security guidance because vulnerable dependencies may persist or be reintroduced over time.

Atlassian's Bitbucket Cloud, a Git-based source code repository service, streamlines software development for collaborative teams while ensuring speed and efficiency. The integration of Snyk with Bitbucket allows developers to find, fix, and monitor vulnerabilities in their open source dependencies and container images, simplifying securing the DevSecOps pipeline. Through these integrations, security analysts gain visibility into existing vulnerabilities and open-source license issues, enabling better prioritization of resolutions. Snyk's integration with AWS services across the application lifecycle automates security controls, providing real-time visibility into any security issues in code and containers. This collaboration empowers organizations using Bitbucket to adopt a DevSecOps approach to software delivery, improving the security posture of their applications throughout the development lifecycle.