March 2021 Summaries

SonarCloud has added support for mono-repositories on Bitbucket Cloud, allowing users to configure multiple quality gates per project, receive individualized results, and access project-labeled messages. This feature enables developers to approach code quality and security at the project level, increasing accuracy and visibility in their development strategy. To set up a monorepo in SonarCloud, users can either import an existing repository or convert standard projects into a monorepo configuration, adding additional project keys as needed. With this new support, developers can leverage SonarCloud's feedback at the right level for their individual projects, improving overall code quality and security outcomes.

The role of an Application Support Engineer at SonarSource offers a unique and rewarding experience that differs from traditional support desk jobs. As a former software developer, I transitioned into this role after feeling unfulfilled by the routine of creating features and architecting microservices. The company's single level of support for all customers, regardless of size, provides a fair and customer-centric approach. Support Engineers at SonarSource learn about various topics such as programming languages, security, CI/CD tools, and cloud platforms, which are integral to the SonarQube platform. This role allows me to make an impact on the product and company through empowerment and collaboration, making it an exciting opportunity for those who enjoy learning new technologies, working on projects that effect change, and helping people get maximum value from their products.

The vulnerabilities discovered in MyBB forums with versions between and including 1.8.16 and 1.8.25 are related to defective regexes, specifically Nested Auto URL persistent XSS (CVE-2021-27889) and Theme properties SQL injection (CVE-2021-27890). The first vulnerability enables any unprivileged forum user to embed Stored XSS payloads into threads, posts, and private messages, while the second vulnerability leads to Remote Code Execution (RCE) through a sophisticated attacker-developed exploit that can be triggered by any user with an active session in the administrator dashboard. These vulnerabilities are due to issues with MyBB's custom implementation of regexes and HTML rendering, which can lead to nested HTML tags being rendered, allowing attackers to craft malicious payloads. The MyBB team has acknowledged both vulnerabilities and released patch version 1.8.26 to address them.

LocalStack is a popular open-source application that provides an easy-to-use test framework for cloud applications, allowing developers to host a fully functional AWS cloud setup in their local network for developing and testing cloud and serverless apps. However, security researchers recently discovered critical code vulnerabilities in the latest LocalStack version 0.12.6, including OS Command Injection, Server-Side Request Forgery, Cross-Site Scripting, and Denial of Service via regular expressions. These vulnerabilities can be combined to compromise a local instance and execute arbitrary system commands, making it possible for attackers to remotely interact with LocalStack instances running locally through cross-site HTTP requests or by exploiting the lack of authentication. The vulnerabilities also allow an attacker to add a man-in-the-middle proxy in LocalStack, enabling abuse of further features and triggering other code vulnerabilities. The security researchers reported these issues responsibly to the vendor but were left unpatched due to a limited attack scenario. Despite this, they emphasize the importance of awareness among developers to protect their setups and write secure code for their own applications.