February 2022 Summaries

The Hippocratic License, version 2.0, has been adopted by the vcr project, a large dependency stack with over 15,000 dependent repositories. The new license prohibits usage in situations that violate human rights and has several provisions that may raise concerns for businesses, including third-party monitoring of legal compliance, human rights compliance, failure modes, governance, and new versions. A small number of organizations will analyze the license to ensure compliance, while most users won't notice the change and will continue using the library as they have in the past. The license has been criticized for being difficult to comply with, especially by businesses, due to its strict provisions on human rights and economic well-being, which may require significant changes to business practices. Despite these challenges, the authors of the Hippocratic License are adopting an open-source-y release-early, release-often model, which may help them iterate more quickly towards a license that meets both moral and pragmatic needs.

SonarCloud has integrated with GitHub's code scanning feature, allowing developers to review security vulnerability lists directly within the GitHub interface for public and private repositories, independently of their SonarCloud plan. This integration provides a developer-first approach to easily find security vulnerabilities before they reach production, helping developers review and prioritize vulnerabilities during their code review process in a more convenient manner. With this integration, users can access code scanning alerts at the repository level or within pull requests, and can dismiss false positives with just two clicks, ensuring instant issue status synchronization between SonarCloud and GitHub. This feature is available for free for public projects or as part of the Advanced Security package for private repositories, and provides better security oversight to catch vulnerabilities before they reach production.

The Horde webmail suite is a popular, browser-based communication solution that can be vulnerable to certain security threats. The article discusses an unusual cross-site scripting (XSS) vulnerability in the Horde webmailer that allows an attacker to craft a malicious OpenOffice document that, when previewed as an email attachment, enables the attacker to steal all emails from the victim's account. This vulnerability was reported almost six months ago, but there is currently no official patch available. To mitigate this vulnerability, administrators can disable the rendering of OpenOffice attachments by editing the Horde installation's configuration file. The article emphasizes the importance of sanitizing HTML documents after XSLT rendering, especially when using third-party libraries or stylesheets.

The Zabbix monitoring platform has been identified as a high-profile target due to its popularity and widespread use. Two critical vulnerabilities, CVE-2022-23131 and CVE-2022-23134, have been discovered in the Zabbix Web Frontend's client-side session storage implementation. These vulnerabilities can allow attackers to bypass SAML SSO authentication, gain administrator privileges, and execute arbitrary commands on attached servers and agents. The vulnerabilities arise from the use of custom session handlers that do not validate the authenticity of session data when accessing it. The Zabbix maintainers have addressed these issues by introducing additional signature fields, using HMAC constructs for cookie authentication, and modifying the setup process to prevent bypassing. It is recommended to upgrade to version 6.0.0beta2 or later to protect against these vulnerabilities.

The Object Injection vulnerability in WordPress (CVE-2022-21663) is a code vulnerability that enables attackers to inject PHP objects of arbitrary types into the application, which can then tamper with the application's logic at runtime. The vulnerability was discovered and reported by a security researcher who found an asymmetry between two functions in the WordPress core. This vulnerability was fixed with version 5.8.3, but it highlights the importance of careful consideration when handling and interpreting data in software applications to prevent similar issues. The vulnerability can be exploited if a malicious super-admin gains access to a multi-site WordPress installation by exploiting a Cross-Site-Scripting vulnerability or installing a malicious plugin. The vulnerability is particularly concerning because it allows an attacker to run any database upgrade scripts, including those that operate on controllable data, such as option values and meta-data associated with users and posts. This gives the attacker access to an interesting attack surface in the WordPress core.

The trend towards increasingly granular modules in open source software is leading to a complex dependency tree with hundreds or thousands of dependencies. Understanding and navigating this complexity can be challenging, and malicious actors may exploit these dependencies to introduce unwanted code into applications. A study on 14 package managers found that the number of dependencies for a representative open source package varies widely between ecosystems, but the average number of dependencies is relatively consistent across communities, with most packages pulling in fewer than five dependencies. This highlights the importance of considering all dependencies, not just those directly brought in by the developer, to ensure the health and security of an application.