February 2023 Summaries

A recent security research project by Snyk Security Labs discovered a full workspace takeover vulnerability in the Gitpod platform via WebSocket connections, which allowed attackers to leverage a widely misunderstood vulnerability called Cross-Site WebSocket Hijacking and bypass SameSite cookies. The vulnerability was found in Gitpod's server component, specifically in its JSONRPC API served over WebSocket connections. The researchers were able to exploit this vulnerability by serving an HTML file that contained malicious JavaScript code, which ultimately granted them full control over the user's workspaces. The vulnerability was responsibly disclosed to Gitpod and resolved within a single working day, with a new version of the platform released shortly after. This incident highlights the importance of considering additional security risks introduced by cloud-based development environments and emphasizes the need for responsible disclosure and timely patching of vulnerabilities in such platforms.

Worker threads provide a mechanism for running code in parallel using a form of threading in Node.js, addressing the problem of CPU-bound operations blocking the main thread and creating delays. However, worker threads have several caveats, including not being true threads with shared state, and having significant overhead and resource consumption when used excessively. They are suitable for CPU-intensive tasks such as job queues or background processing but may not be the best choice for I/O tasks or highly performance-critical code, which can benefit from real threads in other languages like C/C++ or Rust. Libraries such as Piscina, Bree, and Poolifier provide a more convenient interface to worker threads, abstracting away complexity and providing features like thread pooling and concurrency management.

This vulnerability allows for Remote Code Execution (RCE) through YAML deserialization, which can lead to arbitrary command execution and potentially allow for total system takeover in systems utilizing the geokit-rails plugin. This issue was discovered in version 2.3.2 of the geokit-rails gem, which uses an unsafe YAML.load() method to deserialize data from Ruby on Rails cookies. An attacker can exploit this vulnerability by crafting a malicious HTTP request with a specially crafted YAML payload that is deserialized and executed, allowing for RCE. The issue was responsibly disclosed to the maintainer of geokit-rails and fixed in version 2.5.0. Snyk Code's rules have also been improved to detect YAML injection vulnerabilities.

The Big Fix is an annual event by Snyk to help secure open source software by finding and fixing vulnerabilities, while also providing job opportunities in cybersecurity and tech. Participating in community-focused activities such as open source projects, speaking at conferences or meetups, organizing meetup groups, and contributing to online forums can increase chances of getting hired in cybersecurity. The event features a prioritized list of open job opportunities with various tech organizations, including ServiceNow, Enso, Vanta, Sysdig, and Brightsec, which are hiring for roles such as cybersecurity compliance analyst, senior backend developer, and engineering manager. Snyk's community lead, Sam Hepburn, has advice on contributing to open source projects, while Randall Degges emphasizes the importance of community participation in enhancing development careers.

This tutorial provided a comprehensive guide on building Vue 3 components with Tailwind CSS, covering key aspects such as setting up the project, configuring Tailwind CSS, and styling components using utility classes. The author demonstrated how to create a responsive article card component, handle breakpoints, and customize the design system. By using Tailwind CSS, developers can build visually stunning UI components efficiently and streamline their workflow.

The author, a Public Relations and Advertising student, spent 3 days a week in the Snyk Boston office as a Social Media Intern during the Summer Internship Program. The experience allowed them to grow as a social media professional, learn about cybersecurity, and develop valuable skills. They were impressed by Snyk's core values, including One Team, Care Deeply, Learn Always, Ship It, and Think Bigger, which were consistently applied throughout their internship. The author was given opportunities to learn from experienced employees, attend events, and work on various projects, including social media campaigns and a cybersecurity month campaign. They also participated in Snyk Week of Impact, an annual event that demonstrates the company's commitment to social impact and community involvement. Throughout their internship, the author gained valuable knowledge, skills, and networking opportunities, and was highly recommended to future interns interested in improving their career growth and knowledge of the field.

The dangers of setattr function in Python is a potential mass assignment vulnerability that can occur when user input is bound to variables or objects within a program, allowing an attacker to manipulate the logic of a program by adding unexpected fields to an object. This was seen in the famous GitHub authentication vulnerability where mass assignment functionality in Ruby on Rails allowed an attacker to add their public key to the rails GitHub organization and push a commit to master. The Python ecosystem is also vulnerable due to the setattr function, which can be used to implement mass assignment logic, but it allows for traditional mass assignment vulnerabilities as well as unexpected changes to object fields such as __class__ and __dict__. To prevent these vulnerabilities, creating Data Transfer Objects (DTOs) using dataclasses or validating user input against a list of allowed attributes is recommended. Additionally, alternative methods like collections.UserDict and implementing a __getattr__ method can also be used to provide extra functionality to key/value mappings while preventing attributes belonging to the class from being overridden by user input. Protecting Python libraries from these vulnerabilities requires weighing security against convenience and flexibility, and using education and alternative methods is crucial in this regard.

Snyk and Atlassian are expanding their partnership to bring security and collaboration to developers and security teams at every stage of the development lifecycle. This new integration for Jira Software will allow developer teams to access Snyk data within the Jira UI, giving organizations a comprehensive view of their security posture. The expanded partnership aims to reduce organizational risks at scale by facilitating easy collaboration between development and security teams, enabling them to quickly identify and prioritize security issues, minimize errors, and complete sprints on time.

Snyk IaC is a cloud compliance solution that automates compliance assessments for multiple cloud environments, unique infrastructure setups, and various configurations, supporting over 10 compliance standards. It provides teams with visibility into their cloud environments' compliance, helping them identify issues and take action to reach a more compliant state. The solution offers a single view of cloud compliance, enabling investigation and remediation of compliance violations, as well as securing cloud configurations from the source in infrastructure as code through to the running cloud(s). It integrates natively into engineering tools and workflows via IDE extensions, Git, and CI/CD, providing complete visibility into all application and cloud security issues.

Snyk has integrated with AWS CloudTrail Lake to simplify security audits for customers. AWS CloudTrail Lake is a managed security and audit data lake that allows users to aggregate, store, and query events from third-party sources like Snyk. The integration enables customers to consolidate audit events across all their environments and applications, streamlining the process of security investigations and operational troubleshooting. Joint customers of Snyk and AWS can easily activate this integration through the AWS CloudTrail Lake console.