March 2022 Summaries

Spring4Shell is a reported remote code execution vulnerability in the Spring Framework’s spring-beans package that emerged amid confusion, deleted social media posts, and initially incomplete public information in late March. The exploit can reportedly manipulate a Java ClassLoader through a specially crafted HTTP POST request and was known at the time to affect environments using JRE 9 or later together with Tomcat 9 or later. Security researchers concluded that the threat was credible and recommended upgrading Spring Framework to versions 5.2.20 or 5.3.18, or upgrading Spring Boot to versions 2.5.12 or 2.6.6, while using JRE 8 or an earlier Tomcat version could serve as a temporary mitigation when upgrades were not possible. The account also distinguishes Spring4Shell from a separate Spring Cloud Function vulnerability that was frequently conflated with it, notes that additional vulnerabilities or patches could emerge as investigation continued, and points users to Snyk tooling for vulnerability detection.

In observance of International Transgender Day of Visibility, Snyk’s Martin McKeay and his daughter share their family’s ongoing experience after she came out as transgender nearly five years earlier. His daughter describes being transgender not as a choice or a single realization, but as a gradual understanding of longstanding discomfort with being perceived as male, while Martin reflects on the shock, confusion, and adjustment he and his wife experienced as their expectations for their child’s future changed. She recalls feeling hurt by her parents’ initially hesitant response, though she found important support among transgender and LGBTQ+ peers in college, while both acknowledge that consistent use of her chosen name and pronouns has strengthened their relationship. Their conversation emphasizes that parents may struggle and make mistakes but should ultimately support their child’s autonomy and well-being, and it calls attention to broader political and legal threats facing transgender rights while stressing the need to defend LGBTQ+ people.

Snyk’s Vulnerability Database helps developers monitor and remediate open-source security issues across ecosystems such as TensorFlow and Electron, while initiatives like The Big Fix encourage community members to identify and fix vulnerable packages. Participants can create a free Snyk account, register for the program, connect public or private repositories through the Snyk dashboard, scan package manifests, review recommended remediation steps, and optionally generate pull requests for fixes. The account of contributing to the PHP invoicing project Invoice Ninja illustrates this process: after forking and scanning the repository, the author traced a legacy cross-site scripting vulnerability through the DOMPDF dependency to PHP-Font-Lib, updated affected packages, tested the application locally, and submitted a pull request that was later reviewed and merged. The piece emphasizes careful testing during dependency upgrades to avoid disrupting projects that businesses and users rely on, and presents open-source security contributions as a collaborative way to improve the broader digital ecosystem.

This article discusses building a secure GraphQL API with Node.js using Fastify and Mercurius. The author creates a basic server, sets up a schema, resolvers, and implements authentication and authorization using the Mercurius Auth plugin. The API is secured by defining custom auth directives on fields in the schema, applying custom auth policies to these protected fields, and masking errors. The article also covers strategies for securing GraphQL APIs, including query depth limit, sanitizing and validating inputs, and more. The author tests the API using GraphQL Playground and demonstrates how to authenticate and authorize requests. Overall, this article provides a comprehensive guide on building a secure GraphQL API with Node.js using Fastify and Mercurius.

Meet (and join) our newest Snyk Ambassadors, a group of cybersecurity professionals who share their knowledge and passion for secure development, DevSecOps, and the developer community. The Snyk Ambassador program was launched in 2021 and has recruited a fresh cohort of ambassadors, including experts from various fields such as cloud security, DevSecOps, threat modeling, and more. These ambassadors are passionate about spreading the word of secure development, developing themselves, and engaging with the developer community. They share their expertise through speaking engagements, community activities, and personal projects, promoting cybersecurity awareness and best practices in software development. The Snyk Ambassador program offers benefits such as neat swag, speaking opportunities, support for learning and personal development, access to early features, spotlight to grow your personal brand, and more. If you're interested in joining the program, head to the Snyk Ambassadors page to register and become a part of this community of cybersecurity professionals.

There are multiple ways to store sensitive passwords, and choosing the wrong method can be a security nightmare. When deciding how to store sensitive passwords, consider using an authentication and authorization service that provides open standards like OpenID Connect and supports MFA for improved user security. If you need to store passwords in your Java application yourself, use a strong password hashing algorithm that consumes computational resources and is slow to run, making brute force attacks less effective. The recommended password hashing algorithms include Argon2id, scrypt, and BCrypt, each with its own strengths and weaknesses. When implementing password hashing, follow best practices such as never implementing the algorithm yourself, keeping up-to-date with security news and trends, using secure libraries and techniques, and learning from capture the flag challenges to improve your skills.

Drift detection of managed resources has been deprecated. Snyk IaC helps developers discover cloud resources not under Terraform control, or that have drifted from their expected state, by listing them as Terraform resources. It also provides a built-in way to ignore resources in bulk and reports everything in Terraform terms with the right information to help developers import those resources into their HCL code. However, automatically reverting changes might not always be the desired outcome, and a lightweight drift detection alerting system is needed in conjunction with the deployment pipeline. Snyk IaC drives faster fixes by closing the feedback loop between cloud security and engineering teams and reporting actionable fixes direct to engineer, in engineer-friendly terms.

The White House has issued a fact sheet with security best practices to enhance cybersecurity and protect data and critical infrastructure in response to potential cyberattacks by Russia. These recommendations include building security into products from the ground up, developing software on secure systems, using modern tools to check for known and potential vulnerabilities, ensuring software developers are responsible for all code used in their products, and implementing security practices mandated by the President's Executive Order. Snyk, a modern application security platform, aligns with these recommendations by providing integrations into popular IDE, CI/CD, and Git tools, automated vulnerability scanning, and developer-first approach to secure software development workflows.

This summary provides an overview of the key points from the provided text on containerizing a Go application using Docker. The article covers creating a sample Go API, preparing a Dockerfile, building and optimizing images, deploying containers with security best practices in mind, including running as a non-root user, limiting access to system resources, and improving overall efficiency and security of the containerized application.

Snyk has reported on a new type of threat vector in the open source community called protestware, which is being used to express support for Ukraine amid the ongoing conflict. Protestware comes in different forms, including repo banners that add political messages to README files or package descriptions, CLI protest logs that display messages on users' machines during installation, out-of-env protest logs that run code outside of the installation environment, and destructive protests that overwrite files with protest information. Snyk is providing guidance on how to differentiate between these types of protestware and will add advisories for packages that exhibit undesired behavior or malicious activity. The company aims to help the community reach a consensus on how to approach protestware and promote safe open source practices.

The dompdf library, a popular PDF generation library used extensively within the PHP ecosystem, has been found to have a remote code execution (RCE) vulnerability due to its handling of custom font styles and loading of external style sheets. Researchers from Positive Security discovered that by manipulating these features, an attacker could load arbitrary PHP code into a PDF file, which would then be executed on the target server. This vulnerability affects versions 0.8.5 and above of dompdf, with no fix currently available. To mitigate this issue, developers can disable the loading of custom fonts or restrict access to the Composer install location, or use alternative libraries that do not have this vulnerability. The vulnerability was first identified by researchers who created a working demo using the php-goof application on a Snyk GitHub repo, showcasing how an attacker could exploit it to execute arbitrary PHP code.

Snyk announced that it would cease business operations in Russia and Belarus in response to U.S. export control provisions following the Ukrainian crisis. The measures include restricting access to its free software in those regions, ending contracts with companies headquartered there, and blocking future sales and services. Customers whose contracts are terminated will receive pro-rata refunds through individually arranged payment methods, while Snyk stated that it will revise its policies as export regulations and sanctions evolve.

In March 2022, npm package maintainer RIAEvangelist introduced protest-related code into the widely used node-ipc dependency, creating a software supply chain incident that affected downstream projects including Vue.js CLI and reportedly Unity. Briefly available node-ipc versions 10.1.1 and 10.1.2 contained obfuscated code that checked users’ geolocation and, when Russia or Belarus was detected, recursively overwrote files with a heart symbol; the payload was later removed and those releases were deprecated. Subsequent node-ipc releases, including 9.2.2 and 11.x, added the peacenotwar package, which created a war-related message file on users’ desktops, while version 9.2.2 reached stable dependency chains used by many projects. Snyk tracked the incident under CVE-2022-23812 and related advisories, emphasizing that trusted maintainers and transitive dependencies can introduce significant risks despite being outside an application’s direct codebase. Recommended responses included updating affected tools such as Vue CLI and Unity, avoiding or pinning node-ipc to known-safe versions, using dependency overrides, and monitoring open-source dependency changes through security scanning and supply-chain management practices.

Infrastructure drift detection is crucial for maintaining secure cloud environments, as it helps identify deviations from desired configurations. This article explores the principles of drift detection, different kinds of drift, and tools to help detect drift with a simple example using Hashicorp Terraform. The three tools discussed are terraform plan, CloudQuery, and driftctl. Each tool has its strengths and weaknesses, but all can be useful in managing infrastructure drift.

A software bill of materials (SBOM) is a complete list of all software components used across an organization, including third-party open source libraries, vendor-provided packages, and first-party artifacts built by the organization. Maintaining an up-to-date SBOM is crucial to track license and security risks associated with software components, ensuring rapid software development can be kept up with changing components and their versions. The use of open source software has increased significantly, making it essential for developers to understand the impact on supply chain security. Security concerns include vulnerabilities in third-party libraries, such as event-stream and Log4Shell, which can lead to security incidents if not addressed promptly. Developers need to be aware of legal implications of using software components, including copyleft licenses like GPL, and ensure they are using permissive licenses like MIT. A software bill of materials is essential for standardizing open source library usage, providing insights into package health, and accelerating supply chain security readiness. By maintaining an up-to-date SBOM, developers can mitigate concerns of software supply chain security across their entire software development lifecycle. Tools like Snyk provide solutions for generating SBOMs and managing license compliance, ensuring secure open source dependencies.

The "Dirty Pipe" Linux vulnerability (CVE-2022-0847) is a kernel-level flaw that allows any process to modify files regardless of their permission settings or ownership, posing a significant risk to containerized applications. Upgrading the host operating system to one of the specified kernel versions (5.16.11, 5.15.25, or 5.10.102) is the only known fix for this vulnerability. Container images are particularly vulnerable due to the use of read-write layers that can be modified by malicious actors, even if the volume was mounted with the `:ro` flag set. The vulnerability can also be exploited in host-mounted volumes, allowing attackers to gain elevated privileges and bypass normal protections.

Infrastructure drift refers to the difference between what's defined in your Infrastructure as Code (IaC) configuration and the real-time state of infrastructure in the cloud. This can be caused by human input, poor configuration, applications making unwanted changes, or other factors. Drift detection is a continuous process that identifies deviations from IaC configurations that pose security risks to organizations. If left unmanaged, drift can lead to data breaches, application downtime, and deployment failures. However, with effective drift management, organizations can standardize infrastructure setup, reduce errors, and improve security controls. A comprehensive approach to IaC security includes increasing IaC coverage, adopting a tool for scanning configurations during development and build pipelines, leveraging IaC to detect synchronized infrastructure, employing an open-source drift detection tool, taking action on findings, and closing the feedback loop. When choosing a drift management tool, consider factors such as access levels and least-privileged policies to ensure effective security.

A virtual Chief Information Security Officer (vCISO) is a part-time or remote security practitioner who offers expertise to an organization on a temporary or ongoing basis, providing benefits such as cost savings and access to security expertise without adding a full-time employee. vCISOs can be hired through talent agencies or freelance arrangements, and their role can vary from short-term to long-term based on the organization's needs. They can assist with tasks such as security policy development, risk assessment, compliance, and incident resolution, offering flexibility and scalability for companies that want to scale at lightning speed while maintaining security standards. With a vCISO program, organizations can reap the benefits of having a CISO without the long-term commitment and cost associated with hiring a full-time employee, making it an attractive option for businesses looking to enhance their security posture.

Open-source software and layered container images accelerate development but can introduce vulnerabilities through base images and their Linux packages, making container security more complex than scanning application code alone. Because Linux distributions such as Alpine, Debian, Ubuntu, and Red Hat independently maintain, rename, version, patch, and assess packages differently, upstream vulnerability information cannot be directly applied to every distribution or image; Log4Shell is presented as an example of differing package names and fixed versions. Variations in security terminology, severity ratings, advisory data, package backports, and the large volume of dependencies further complicate vulnerability triage. Snyk’s Container Security Team addresses these challenges by collecting distribution-specific security data, collaborating with Linux security teams, applying automated processing alongside human expert review, enriching findings with external signals, and contextually prioritizing issues through severity and priority scores. Planned improvements include insights that distinguish build-time from runtime risks, additional metadata on fix availability and vulnerability status, and broader support for Linux distributions.

Amid Ukraine’s ongoing crisis, the post highlights Ukrainian contributors whose open-source work has significantly influenced software development, especially in the JavaScript ecosystem. Featured projects include Oleksii Trekhleb’s JavaScript algorithms and Python learning resources, Vadim Demedes’s React-based CLI framework Ink, Denys Dovhan’s Spaceship ZSH prompt, Zoltan Kochan’s efficient pnpm package manager, Paul Miller’s cross-platform file watcher Chokidar, Vladimir Agafonkin’s widely used Leaflet mapping library, and Volodymyr Shymanskyy’s wasm3 WebAssembly interpreter. It also notes Sviatoslav Sydorenko’s early core contributions to Ansible and points readers to curated repositories such as made-in-ukraine and awesome-ukraine, which document the country’s broader technology community. The post concludes with recommended Ukraine support organizations, information about Snyk’s donation and expanded free security testing for maintainers, and a promotion for an on-demand capture-the-flag training workshop.

Snyk has acquired TopCoat Data, a company founded by Seth and Josh Rosen that develops a dbt-integrated platform for creating customized data applications, reporting, and visualizations. TopCoat’s full team will join Snyk’s platform engineering organization, and its technology will become the foundation for expanded reporting and analytics within Snyk’s developer security platform, helping developers, operations teams, and security professionals understand and respond to vulnerabilities. The acquisition reflects a shared goal of making analytical applications faster and easier to build with modern data tooling, while TopCoat plans to remain an active contributor to the open-source dbt community. Founded after its creators identified the cost and limitations of traditional dashboards and custom-built data products, TopCoat aimed to give data professionals capabilities typically associated with full-stack engineers, a mission its team expects to continue and broaden at Snyk.

This International Women’s Day, members of SnykHer reflect on the theme #BreakTheBias, which means challenging internal biases and promoting a diverse, equitable, and inclusive environment. They share personal experiences and insights on how to break unconscious assumptions, value differences, and celebrate individuality. The group emphasizes the importance of paying it forward, reflecting on past achievements, and calling for change and action to overcome future challenges. By recognizing and addressing bias, individuals can create a more open-minded and inclusive world that benefits everyone.

Snyk has expanded its free JetBrains IDE plugin to include infrastructure-as-code and container security alongside existing scans for proprietary code and open-source dependencies, enabling developers to assess application security within their coding environment. The plugin identifies vulnerabilities in dependencies and first-party code, configuration issues in Terraform, Kubernetes, AWS CloudFormation, and Azure Resource Manager files, and vulnerabilities in container images referenced by Kubernetes workloads. It provides severity-based prioritization, in-line issue locations, explanations of impact, remediation guidance, references, ignore options, recommended image upgrades, and quick fixes, while IaC configuration files remain local rather than being uploaded to Snyk servers. Developers can install the plugin from the JetBrains Marketplace, authenticate with a free Snyk account, and begin scanning projects automatically, supporting Snyk’s goal of shifting security checks earlier into development workflows.

The Payment Card Industry Data Security Standard (PCI DSS) is a set of guidelines to secure sensitive data, particularly in the payments industry. To achieve PCI compliance, organizations must implement various security measures, including installing and maintaining firewalls, protecting stored cardholder data through encryption and hashing, and restricting access to authorized personnel. The PCI compliance requirements cover aspects of software development lifecycle (SDLC) and infrastructure, emphasizing the need for secure systems, applications, and networks. Automation of security scanning with tools like Snyk can streamline the process of identifying vulnerabilities and ensuring compliance. By integrating Snyk into CI/CD pipelines, organizations can automatically scan their code, detect issues, and provide remediation advice, making it easier to maintain PCI compliance.

The Snyk and Bitbucket best practices cheat sheet provides guidance on securely managing and storing code in Bitbucket, continuously monitoring for potential vulnerabilities using Snyk, and implementing strong access controls to protect against human errors and unauthorized access. The seven best practices outlined include never storing credentials in code or configs, removing sensitive data, tightly controlling access, adding a SECURITY.md file, validating Bitbucket apps, receiving security tips as part of the workflow with code insights, and adding security testing to pull requests. These measures can help prevent security breaches, protect intellectual property, and ensure that development teams receive timely security insights.

Penetration testing is an ethical security assessment practice that simulates an attacker’s attempts to compromise systems in order to identify, exploit, and report vulnerabilities before software is released. Often conducted late in the software development lifecycle, it complements DevSecOps, code reviews, and automated scanners by uncovering complex flaws involving business logic, intended functionality, misuse, or abuse cases that conventional tools may miss. Pentesters study a system’s design and implementation, test the boundaries of its functionality, and use methods and tools such as fuzzers, exploit kits, scanners, and reporting templates to identify exploitation paths and recommend remediation. For developers, learning pentesting can strengthen secure coding practices by providing direct insight into how attackers and security researchers probe applications, much like mutation-based testing exposes weaknesses by altering expected inputs or behavior.

Container monitoring is a practice that collects metrics and tracks the health of containerized applications and microservices architectures to ensure security, performance, and availability. It's a subset of container observability and helps DevOps teams reduce mean time to recovery (MTTR) of performance issues, meet critical KPIs, and troubleshoot root cause analysis. However, traditional monitoring tools often struggle with distributed microservices environments, making cloud-native monitoring tools necessary. A suitable container monitoring tool should provide an overview of the application and infrastructure components, correlate logs and system events, and visualize the topology of the container ecosystem. Advanced features like automated resource utilization recommendations are also important. Container scanning can help DevSecOps teams proactively find new vulnerabilities in custom code, open-source dependencies, containers, and Dockerfiles. A developer-first container security approach complements container monitoring by empowering developers to fix security issues through direct guidance and automating fixes through pull requests.

Security experts in a Snyk panel discussion argued that application security should be incorporated from the earliest stages of development, including ideation and initial scoping, rather than being added later through CI/CD pipelines alone. Panelists emphasized that security guidelines, regulatory requirements, and collaboration between security and development teams help establish clear expectations for tools, environments, and implementation practices. Core considerations include sanitizing inputs, protecting authentication and access privileges, understanding what data an application generates and stores, and assessing the consequences of compromise. The discussion also highlighted the value of embedding developer-focused security tools early in workflows, fostering shared responsibility between developers and security specialists, and creating security champions within development teams. The panel’s overall conclusion was that early security integration supports safer applications, protects user data and trust, and creates a more comprehensive security culture throughout the software development lifecycle.