May 2021 Summaries

The critical vulnerabilities in Rocket.Chat's source code can be exploited by attackers to gain complete control over a server, starting with as little as any user's email address. The first vulnerability is a Blind NoSQL Injection that allows leaking a user's password reset token, while the second vulnerability is a NoSQL Injection that can elevate privileges and leak sensitive data. To prevent such vulnerabilities, it is essential to validate all user inputs strictly, restrict the usage of operators in queries, prefer allowlists over blocklists, and keep in mind that simply restricting projection may not be enough to prevent blind or error-based NoSQL Injections. Rocket.Chat has released new versions (3.13.2, 3.12.4, 3.11.4) that fix the vulnerabilities, and users are highly recommended to update to the latest version.

The SonarCloud JavaScript and TypeScript Security Analysis has been updated to improve its performance and accuracy. The new version can detect more execution flows, increase performance, and provide better results. The analysis engine was previously lacking a publicly available benchmark for JS/TS, but it now uses the OWASP JuiceShop project as a reference point. This project is used to demonstrate insecure code that the SonarCloud analysis can find, including 39 Security Hotspots and 28 Vulnerabilities. The analysis can detect injection vulnerabilities such as SQL Injection, XSS attacks, and NoSQL Injection, with a detection rate of 81% for injection vulnerabilities in the OWASP JuiceShop project. The analysis is designed to provide fast results, with an average scan time of under 6 minutes on a medium-sized machine. SonarCloud also offers Automatic Analysis, which can scan projects made with JavaScript or TypeScript and detect security vulnerabilities in under 8 minutes.

The new Long-Term Support (LTS) version of SonarQube has been released, offering various new features and improvements for developers. To minimize downtime and remove surprises during the upgrade process, administrators can follow tips and recommendations provided by SonarQube to prepare for their upgrade. This includes referencing the Upgrade Guide, LTS Upgrade release notes, and practicing first in a staging environment to test the upgrade without disrupting production. Additionally, tuning performance by adjusting database settings and reviewing integrations with supporting software and third-party plugins are also crucial to ensure a smooth transition. With the help of the SonarQube community and commercial support contracts, developers can stay on the road to cleaner and safer code.