October 2021 Summaries

In this article, SecurityAgent 007 discusses the pre-auth takeover of build pipelines in GoCD, a popular open-source continuous integration and continuous delivery tool. The author highlights the importance of securing build pipelines to prevent unauthorized access to sensitive data and applications. They explain how GoCD's API allows for authentication tokens to be passed between agents and servers, which can be vulnerable to interception or manipulation by attackers. SecurityAgent 007 proposes a solution using OAuth 2.0 and JWT (JSON Web Tokens) to securely authenticate users and authorize access to build pipelines in GoCD. The author also emphasizes the need for regular security audits and monitoring to detect potential vulnerabilities in the system.

The company has released a new project experience in SonarCloud, a code analysis tool, aiming to improve clarity, simplicity, and efficiency for users. The revamped interface provides more visibility into project health, clear indicators of potential issues, and interactive graphs to track progress. A central 'Overview' page offers vital signs of the project, while a quality gate status indicator helps understand what needs to be fixed before release. The new experience is designed to empower users to take effective action and reduce time to success, with features such as a focus on new code and a cleaner interface built for efficiency.

The Squirrel programming language, used in various games and cloud services for customization and plugin development, has a vulnerability discovered that allows an attacker to bypass sandbox restrictions and execute arbitrary code within a Squirrel VM, gaining full access to the underlying machine. The Out-Of-Bounds Read vulnerability (CVE-2021-41556) can be exploited by creating a malicious class definition with specific bitflags, which leads to accessing memory outside of the array's bounds. This allows an attacker to craft a fake SQObjectPtr and trick the engine into returning an array that points to the entire process space, enabling reading and writing to the address space and ultimately hijacking control flow. The vulnerability affects both stable release branches (2.x and 3.x) of Squirrel and has been patched with a commit released on GitHub. Maintainers are advised to apply this fix to protect against these attacks.