February 2023 Summaries

Snyk notified Enterprise customers using its Kubernetes Monitor integration about CVE-2023-1065, a medium-severity authentication vulnerability affecting the API endpoint that receives Kubernetes container scan results. The issue did not create a direct security risk or expose user data, but it could have allowed irrelevant scan data to be sent to a Snyk organization, potentially obscuring legitimate security findings. Snyk has released an updated Kubernetes Monitor controller with stronger authentication and a new API endpoint, advising affected customers to upgrade promptly because the older insecure endpoints were scheduled for deprecation on April 11, after which older monitor versions would no longer function. Snyk credited Tesco’s Cybersecurity Team for responsibly disclosing the vulnerability and emphasized its commitment to external security testing, accurate vulnerability detection, and service reliability.

A recent security research project by Snyk Security Labs discovered a full workspace takeover vulnerability in the Gitpod platform via WebSocket connections, which allowed attackers to leverage a widely misunderstood vulnerability called Cross-Site WebSocket Hijacking and bypass SameSite cookies. The vulnerability was found in Gitpod's server component, specifically in its JSONRPC API served over WebSocket connections. The researchers were able to exploit this vulnerability by serving an HTML file that contained malicious JavaScript code, which ultimately granted them full control over the user's workspaces. The vulnerability was responsibly disclosed to Gitpod and resolved within a single working day, with a new version of the platform released shortly after. This incident highlights the importance of considering additional security risks introduced by cloud-based development environments and emphasizes the need for responsible disclosure and timely patching of vulnerabilities in such platforms.

Worker threads provide a mechanism for running code in parallel using a form of threading in Node.js, addressing the problem of CPU-bound operations blocking the main thread and creating delays. However, worker threads have several caveats, including not being true threads with shared state, and having significant overhead and resource consumption when used excessively. They are suitable for CPU-intensive tasks such as job queues or background processing but may not be the best choice for I/O tasks or highly performance-critical code, which can benefit from real threads in other languages like C/C++ or Rust. Libraries such as Piscina, Bree, and Poolifier provide a more convenient interface to worker threads, abstracting away complexity and providing features like thread pooling and concurrency management.

This vulnerability allows for Remote Code Execution (RCE) through YAML deserialization, which can lead to arbitrary command execution and potentially allow for total system takeover in systems utilizing the geokit-rails plugin. This issue was discovered in version 2.3.2 of the geokit-rails gem, which uses an unsafe YAML.load() method to deserialize data from Ruby on Rails cookies. An attacker can exploit this vulnerability by crafting a malicious HTTP request with a specially crafted YAML payload that is deserialized and executed, allowing for RCE. The issue was responsibly disclosed to the maintainer of geokit-rails and fixed in version 2.5.0. Snyk Code's rules have also been improved to detect YAML injection vulnerabilities.

The Big Fix is an annual event by Snyk to help secure open source software by finding and fixing vulnerabilities, while also providing job opportunities in cybersecurity and tech. Participating in community-focused activities such as open source projects, speaking at conferences or meetups, organizing meetup groups, and contributing to online forums can increase chances of getting hired in cybersecurity. The event features a prioritized list of open job opportunities with various tech organizations, including ServiceNow, Enso, Vanta, Sysdig, and Brightsec, which are hiring for roles such as cybersecurity compliance analyst, senior backend developer, and engineering manager. Snyk's community lead, Sam Hepburn, has advice on contributing to open source projects, while Randall Degges emphasizes the importance of community participation in enhancing development careers.

Node.js’s built-in `vm` module can compile and execute dynamically supplied JavaScript in isolated V8 contexts, which may initially appear suitable for products that let users run custom code, such as cloud IDEs or coding-practice platforms. Although context boundaries can prevent direct access to variables not explicitly provided, they do not make the module a secure sandbox for untrusted input. Malicious code can create denial-of-service conditions through infinite loops and may escape the intended context to achieve remote code execution, including reading environment variables, accessing the file system, or spawning processes. Such compromise can expose credentials and cloud or database secrets, potentially enabling broader network attacks. Node.js documentation explicitly states that `node:vm` is not a security mechanism and should not be relied upon to execute untrusted code.

This tutorial provided a comprehensive guide on building Vue 3 components with Tailwind CSS, covering key aspects such as setting up the project, configuring Tailwind CSS, and styling components using utility classes. The author demonstrated how to create a responsive article card component, handle breakpoints, and customize the design system. By using Tailwind CSS, developers can build visually stunning UI components efficiently and streamline their workflow.

Snyk and Dynatrace announced a strategic alliance at Dynatrace Perform 2023 that expands their earlier vulnerability-intelligence integration into a broader DevSecOps offering spanning development through production. The collaboration combines Snyk’s developer-focused security and container scanning capabilities with Dynatrace’s observability and runtime vulnerability analysis, aiming to give security and development teams a unified view of application exposures, scanned workloads, policy gaps, and remediation priorities across cloud environments. Built in part on the Dynatrace AppEngine, the integration is intended to support earlier detection of vulnerabilities in containerized applications, targeted remediation based on production context, and data-driven security governance, with general availability expected within weeks.

The author, a Public Relations and Advertising student, spent 3 days a week in the Snyk Boston office as a Social Media Intern during the Summer Internship Program. The experience allowed them to grow as a social media professional, learn about cybersecurity, and develop valuable skills. They were impressed by Snyk's core values, including One Team, Care Deeply, Learn Always, Ship It, and Think Bigger, which were consistently applied throughout their internship. The author was given opportunities to learn from experienced employees, attend events, and work on various projects, including social media campaigns and a cybersecurity month campaign. They also participated in Snyk Week of Impact, an annual event that demonstrates the company's commitment to social impact and community involvement. Throughout their internship, the author gained valuable knowledge, skills, and networking opportunities, and was highly recommended to future interns interested in improving their career growth and knowledge of the field.

Snyk’s Daniel Appelquist argues that “software supply chain” is a useful but imperfect metaphor for describing the interconnected dependencies, registries, marketplaces, and maintainers involved in modern open source development. While the term helps policymakers and nontechnical decision-makers understand software security concepts such as SBOMs, it can incorrectly imply that open source maintainers have contractual supplier relationships with projects that use their work. The author cites the Log4j era, when Curl creator Daniel Stenberg received procurement requests treating him as a formal supplier, as an example of the confusion this language can create. Appelquist notes that open source communities range from corporate-oriented projects, where supply-chain terminology may fit, to free software communities that may reject the framing, and recommends either using terms such as “software dependency chain” in appropriate contexts or more clearly explaining what “software supply chain” does and does not mean.

The dangers of setattr function in Python is a potential mass assignment vulnerability that can occur when user input is bound to variables or objects within a program, allowing an attacker to manipulate the logic of a program by adding unexpected fields to an object. This was seen in the famous GitHub authentication vulnerability where mass assignment functionality in Ruby on Rails allowed an attacker to add their public key to the rails GitHub organization and push a commit to master. The Python ecosystem is also vulnerable due to the setattr function, which can be used to implement mass assignment logic, but it allows for traditional mass assignment vulnerabilities as well as unexpected changes to object fields such as __class__ and __dict__. To prevent these vulnerabilities, creating Data Transfer Objects (DTOs) using dataclasses or validating user input against a list of allowed attributes is recommended. Additionally, alternative methods like collections.UserDict and implementing a __getattr__ method can also be used to provide extra functionality to key/value mappings while preventing attributes belonging to the class from being overridden by user input. Protecting Python libraries from these vulnerabilities requires weighing security against convenience and flexibility, and using education and alternative methods is crucial in this regard.

Snyk’s Big Fix is a month-long security fix-a-thon encouraging developers and security professionals of all experience levels to identify and remediate vulnerabilities in open- and closed-source software. Building on its 2022 event, where participants found more than 450,000 vulnerabilities and fixed over 125,000, the initiative aims to collectively fix more than 200,000 issues this year. Participants register through Snyk, add projects for tracking, and can compete on an anonymized leaderboard, while anyone who fixes at least one vulnerability receives a limited-edition T-shirt and top performers can win additional prizes. The event also offers support through a Discord community of more than 4,000 members, a 24-hour livestream on February 28 featuring security sessions and expert troubleshooting, and partnerships with organizations including Atlassian, AWS, Slack, and The Linux Foundation. Throughout February and March, Snyk plans to provide security articles, educational livestreams, and social-media giveaways to promote participation and software security awareness.

Computers cannot produce inherently random values through deterministic processes, so standard pseudo-random number generators can simulate randomness but may be predictable and unsuitable for security-sensitive uses such as password-reset tokens. Cryptographically secure pseudo-random number generators are designed to make outputs difficult to predict, reproduce, or identify as patterned, supporting applications including encryption, key generation, password hashing, session keys, and unique tokens. Their security depends on entropy drawn from unpredictable sources such as hardware noise, operating-system randomness services, and environmental activity; in Python, functions such as os.urandom() and secrets.token_urlsafe() can use these sources to generate secure random bytes or URL-safe tokens. The material also notes that predictable values derived from sources such as the current time can expose systems to attacks and promotes Snyk Learn as a free resource for further secure-coding education.

Snyk and Atlassian are expanding their partnership to bring security and collaboration to developers and security teams at every stage of the development lifecycle. This new integration for Jira Software will allow developer teams to access Snyk data within the Jira UI, giving organizations a comprehensive view of their security posture. The expanded partnership aims to reduce organizational risks at scale by facilitating easy collaboration between development and security teams, enabling them to quickly identify and prioritize security issues, minimize errors, and complete sprints on time.

Snyk is evolving its CLI from a centralized monolithic application into a distributed, extensible model intended to support custom security analyses, filters, and workflows while preserving a consistent developer experience. Under the new architecture, top-level `snyk` commands will serve as entry points for multiple extensions, including the existing legacy CLI, allowing Snyk to maintain backward compatibility while gradually decomposing and modernizing the original application. The beta `snyk sbom` command already uses this extensibility framework, and future first-class extensions may enable integrations such as third-party tools that expand the security analyses available through commands like `snyk test`. Although the CLI’s internal delivery model now uses standalone binaries for its entry point and extensions, users will continue to install and use it through GitHub, npm, and Snyk’s CDN without immediate workflow changes, while any future breaking changes will be explicitly announced.

Snyk IaC is a cloud compliance solution that automates compliance assessments for multiple cloud environments, unique infrastructure setups, and various configurations, supporting over 10 compliance standards. It provides teams with visibility into their cloud environments' compliance, helping them identify issues and take action to reach a more compliant state. The solution offers a single view of cloud compliance, enabling investigation and remediation of compliance violations, as well as securing cloud configurations from the source in infrastructure as code through to the running cloud(s). It integrates natively into engineering tools and workflows via IDE extensions, Git, and CI/CD, providing complete visibility into all application and cloud security issues.

Cloud application security practices should evolve to address changing development environments, greater cloud reliance, and software supply chain risks. Organizations are encouraged to include developers in shift-left security efforts through centralized tools and clear remediation guidance, rather than leaving cloud security ownership fragmented across IT, security, and engineering teams. The source also recommends reducing security tool sprawl by consolidating capabilities, integrating infrastructure as code with cloud security to provide contextual alerts and centralized policy management, and automating software bill of materials creation so teams can track components and vulnerabilities despite rapidly changing dependencies. It presents Snyk’s tools and platform as options for assessing and strengthening these developer-focused security practices.

Snyk has integrated with AWS CloudTrail Lake to simplify security audits for customers. AWS CloudTrail Lake is a managed security and audit data lake that allows users to aggregate, store, and query events from third-party sources like Snyk. The integration enables customers to consolidate audit events across all their environments and applications, streamlining the process of security investigations and operational troubleshooting. Joint customers of Snyk and AWS can easily activate this integration through the AWS CloudTrail Lake console.