September 2024 Summaries

On September 27, 2024, a zero-day vulnerability was discovered in the Common UNIX Printing System (CUPS), which can allow for arbitrary remote code execution (RCE). There are currently four CVEs associated with these findings, with potentially more on the way. The severity of these vulnerabilities is debated, but one has been assigned a CVSS score of 9.9. These vulnerabilities impact downstream packages cups-browsed, libcupsfilters, cups-filters, and libppd. CUPS has been part of UNIX and Linux operating systems since 1999 and is widely distributed with many UNIX and Linux distributions, Apple, Windows, and other operating systems. Snyk can detect the vulnerabilities in both Snyk Open Source and Snyk Container, providing guidance on remediation and prioritization of fixes.

Log injection vulnerability is a common security issue in JavaScript and Node.js applications where attackers manipulate input data to inject malicious code into logs. This can compromise the integrity and confidentiality of an application. To prevent log injection vulnerabilities, developers should sanitize user inputs, be cautious about what they log, use structured logging, and consider using a logging library like pino. Additionally, tools such as Snyk's IDE extension for Visual Studio Code can help detect potential security issues in code.

Deno is a secure runtime for JavaScript and TypeScript that enhances security, simplifies module management, and supports TypeScript out of the box. It uses Promise queues and task batching to manage concurrency more efficiently, preventing potential issues from asynchronous code execution. This approach provides better handling of large numbers of tasks without risking memory overload or complete failure in case of a single task error. By adopting secure coding practices and being mindful of the permissions granted to Deno applications, developers can effectively mitigate the risk of SSRF vulnerabilities.

C and C++ are widely used languages for critical software development, particularly in Japan's manufacturing and industrial sectors. However, these languages lack built-in safety features, making them prone to vulnerabilities like buffer overflows, use-after-free, and memory leaks. Valgrind is a powerful tool for finding memory leaks, but it requires compiling the program first. Snyk Code is a static code analysis tool that applies machine learning techniques to identify security vulnerabilities in C code without requiring compilation or build steps. It can detect more vulnerability types than just malloc memory leaks and helps developers ensure code security in C and C++, which is crucial for maintaining high standards in critical software development.

Snyk has introduced Snyk AppRisk Essentials, a new set of capabilities designed to help customers gain better visibility into their software assets and ensure they are properly secured by Snyk's other products. The package includes asset inventory, policies, and integrations with various tools and platforms used across the SDLC. To successfully operationalize these new features, Snyk recommends connecting your SCM(s), creating relevant policies, and understanding your inventory and coverage. These capabilities aim to improve efficiency in shift-left application security efforts, enhance security posture, and maximize ROI for customers using Snyk's services.

Snyk Learn has introduced a new learning path covering the OWASP Top 10 for LLMs and GenAI, aimed at addressing security challenges associated with these advanced AI systems. This free course is designed to help developers, cybersecurity professionals, and AI enthusiasts understand and tackle vulnerabilities in AI-driven applications. The learning path covers topics such as prompt injection and sensitive information disclosure risks. Snyk Learn also offers other learning paths on OWASP Top 10 and Snyk Top 10 for free.

Snyk has received FedRAMP ATO from its sponsor, the Center for Medicare and Medicaid (CMS), allowing public sector organizations to leverage their developer security solution, Snyk for Government (SFG). This marks a significant step in Snyk's commitment to supporting public sector agencies in achieving secure application development processes. SFG offers powerful solutions tailored to the public sector, including shift-left developer platforms, secure software supply chain design capabilities, access to industry-leading security intelligence, and controls for various areas of modern development environments. The next step is obtaining FedRAMP Moderate PMO review, which will further demonstrate Snyk's commitment to supporting U.S. agencies in their cybersecurity efforts.

Secrets detection is a crucial part of ensuring application security in software development. It involves identifying sensitive data such as API keys, database credentials, encryption keys, and other confidential information that could lead to unauthorized access or exposure if mishandled. Hardcoded secrets are common during early stages of development but pose significant security risks. Secrets detection tools can help identify these potential vulnerabilities before they can be exploited by malicious actors. Integrating secrets detection into the CI/CD pipeline is essential for catching any potential secrets at the earliest stage of the development process. Snyk provides robust secrets detection capabilities and best practices to avoid committing secrets and prevent potential data breaches.

The article discusses the potential security risks introduced by AI coding tools like GitHub Copilot, which can replicate and amplify existing vulnerabilities in a codebase. It highlights three main issues: command injection vulnerabilities, cross-site scripting (XSS), and SQL injection. The author demonstrates how these issues can be mitigated using Snyk Code, a real-time, in-IDE static application security testing scanning and autofixing tool that secures both human-created and AI-generated code. Snyk Code not only detects vulnerable code patterns but also provides fixes for them right within the IDE.

Snyk has announced a new integration with Orca Security, combining the developer-loved security platform of Snyk with the leading cloud security of Orca. This integration is significant for organizations looking to align with DevSecOps and enhance collaboration between development and security teams. By combining Snyk's application security posture management (ASPM) solution with Orca's robust cloud security and visibility, teams can work together more effectively to identify, prioritize, and mitigate top risks to the business, driving faster and safer development cycles. The integration allows users to leverage runtime context from both platforms to streamline prioritization and remediation workflows.

Researchers from Snyk Security Labs discovered a privilege escalation vulnerability in Ubuntu 24.04, specifically in the cups daemon, which allows an attacker to gain root access by exploiting a bug in the DBus interface that manages the cups daemon. The vulnerability was found by analyzing the DBus bus and identifying a service that allowed for arbitrary command execution as root. The researchers used various tools and techniques, including strace and AppArmor, to exploit the vulnerability and achieve full root command execution. They also identified a way to use the wpa_supplicant project's CreateInterface method to load a shared object with malicious code, which could be executed by the cups daemon. The researchers reported their findings to Ubuntu Security and the OpenPrinting/cups team, who responded quickly with patches and advisories to fix the vulnerability.

Developers at Financial Services (FinServ) institutions are outpacing their security teammates due to several reasons. These include adoption of new technologies and processes, infrastructure-as-code (IaC), complex multi-cloud environments, microservices architecture, automation in development, and the use of generative AI for coding. As a result, traditional security tools often fail to keep up with these developments, leading to potential vulnerabilities and threats. To address this issue, application security teams need new approaches that can effectively secure cutting-edge financial applications while keeping pace with fast-paced development pipelines.

Protecting against PHP security vulnerabilities is crucial due to its popularity, which makes it a target for hackers and malicious entities. Security vulnerabilities can arise from poor coding practices, lack of sanitization of user inputs, and outdated versions. To mitigate these risks, developers should validate and sanitize user input, use prepared statements with parameterized queries, keep the latest versions of PHP and its frameworks, regularly scan code and application dependencies for vulnerabilities using tools like Snyk, and follow secure coding practices. Additionally, staying updated on PHP interpreter vulnerabilities is essential, and using a tool like Snyk to monitor dependencies and notify about new vulnerabilities can help prevent data breaches, loss of customer trust, and regulatory fines.

Axel Springer National Media and Tech, a leading digital publisher in Europe, partnered with Snyk to achieve continuous security coverage for its software development lifecycle. Prior to implementing Snyk, the company lacked consistency in its vulnerability scanning processes and tooling, resulting in limited visibility into its applications and manual security processes that took up significant time and effort. By integrating Snyk Code and Snyk Open Source, Axel Springer was able to shift left its security approach, equipping developers with tools to find and fix vulnerabilities early in the pipeline. Today, the team has over 90% security scan coverage of its relevant repositories, providing complete transparency into its existing code and open source vulnerabilities. With this level of visibility, Axel Springer can motivate teams to implement processes that fix vulnerabilities continuously and prioritize fixes based on risk scores, allowing them to focus on the most critical issues first.

Modernized application security (AppSec) is a game-changer for financial services companies as they prioritize innovative customer experiences and adopt fast-paced development practices, but struggle with outdated security controls that can't keep up with the speed of development. To address this challenge, modernized AppSec enables developer adoption by prioritizing compatibility with today's development environments, empowering developers to find and fix vulnerabilities with minimal context shifts or extra steps. Modernized AppSec also matches developer speed at scale by leveraging fast scan times and high accuracy, such as AI-powered tools that can check new lines of code in seconds. Additionally, modernized AppSec better aligns with a variety of tech stacks, allowing security teams to seamlessly plug into existing development pipelines and prepare for future growth. By adopting modernized AppSec practices and technologies, financial services companies can ensure their application security keeps pace with development, ultimately supporting the business's bottom line.