March 2022 Summaries

The PEAR (PHP Extension Collection) repository has been identified to have two critical code vulnerabilities, which could be exploited by threat actors with minimal technical expertise, causing significant disruption and security breaches globally. The first vulnerability is related to the password reset functionality, allowing attackers to take over any developer account and publish malicious releases. The second vulnerability involves a bug in the Archive_Tar library, which enables remote code execution on the server, granting attackers persistent access and the ability to alter package releases. These vulnerabilities have been present for more than a decade and were easily identifiable but not actively patched by the PEAR maintainers until after they were reported to them. The maintainers released patches, and the vulnerabilities were publicly presented at Insomni'hack, highlighting the importance of security contributions from companies relying on PEAR. It is recommended that users review their use of PEAR and consider migrating to Composer, which has a more active contributor community and similar packages available.

The concept of Infrastructure as Code (IaC) is gaining popularity, allowing developers to manage and provision infrastructure through machine-readable definition files. This approach enables a declarative or imperative process, where the system executes the necessary commands to achieve the desired state. However, IaC also brings its own set of challenges, including security risks that can be exploited by bugs and vulnerabilities in the code. The Shared Responsibility Model between cloud providers and customers is crucial in addressing these concerns, with customers responsible for securing their platform and resource configurations within the cloud. To mitigate these risks, SonarSource has added rules to detect code smells, bugs, and vulnerabilities in IaC projects, providing a solution for secure coding practices.

In the developer community, security threats are increasing, with recent examples including a backdoored .NET development tool and a North Korean entity's social engineering campaign. Developers' access to intellectual property assets makes them an attractive target for cybercriminals, who can compromise a company's products by embedding malicious code into a single developer's system. Security researchers recently discovered vulnerabilities in various tools used by developers, which could be exploited by threat actors. The risks include the execution of arbitrary commands upon access to a malicious folder planted on the victim's system, particularly when using Git integrations in terminals and code editors. The vulnerabilities can allow attackers to bypass security features and execute unintended commands without user knowledge or consent. To mitigate this risk, users should disable SCM prompts when dealing with untrusted data, set specific variables to temporarily disable them, or use alternative Git implementations that may not support the exploited feature. Popular IDEs like Visual Studio Code, JetBrains IDEs suite, and GitHub Atom are also vulnerable due to their integration of Git extensions without proper user consent or awareness. The fix is available in updated versions of these tools, including Visual Studio Code 1.63.2 and JetBrains IntelliJ 2021.3.1.

A package manager vulnerability summary is presented in this article, highlighting the risks of Command Injection, Argument Injection, and Untrusted Search Path vulnerabilities. These vulnerabilities can be exploited by attackers to compromise developer machines, steal or modify sensitive data, and inject malicious code into products. The article provides examples of how these vulnerabilities can occur and suggests ways to avoid them, such as using command strings with argument lists instead of command strings, ensuring that no double-wrapping happens, and running commands in safe directories on Windows. The article also reports the discovery of these vulnerabilities in popular package managers, including Composer, Yarn, pnpm, Bower, Poetry, pip, and pipenv, and provides a timeline of when each issue was reported and fixed.

When comparing performance of static analysis tools such as SonarQube or SonarCloud to another tool in production, it's essential to consider multiple factors including environment, scope, languages, rules, and issues. Starting with the analysis environment is crucial, ensuring both tools are running on comparable machines with similar resources available. The analysis scope should also be consistent, taking into account operational scope and the inclusion of important files and third-party content. Since SonarQube and SonarCloud offer multi-language and multi-domain analysis by default, this broader analysis can impact speed and results. Additionally, rules have a significant impact on performance, with SonarCloud and SonarQube providing more comprehensive analysis that may take longer to complete. When evaluating the quality of performance, it's essential to consider True Positives and not just raw issue counts, as false positives or missed issues can skew the results. Ultimately, comparisons between these tools are often apples-to-oranges due to their unique features and capabilities.