November 2022 Summaries

This year's Code Security Advent Calendar is the seventh consecutive one, and it invites all developers and security enthusiasts to participate. The calendar will feature 24 daily code puzzles that hide new favorite security flaws and attacker tricks, allowing participants to sharpen their security skills and have fun during December. The challenges will be hosted on Sonar's website, with solutions available online for education and future reference. Real-world code vulnerabilities from this year's security research will be used in the challenges, crafted in popular programming languages such as C, JavaScript, Java, PHP, Python, and C#. Participants can expect a mix of vulnerability types, including those related to unvalidated user input, bad configurations, and harmless-looking features that can be abused by attackers. The calendar aims to make the event enjoyable for all skill levels, with hints provided throughout the day if needed, and detailed solutions available after 24 hours.

SonarLint is a tool that helps developers catch common pitfalls and errors in their React code, such as dead code, which can slow down the development process. It uses rules like "react/no-unused-class-component-methods" to detect unused methods in React components and reports them instantly. Additionally, SonarLint can also detect undead code, which refers to component methods that appear to be dead code but are actually being used dynamically with a property accessor or passed as props to another component. By using SonarLint, developers can prevent issues before they happen and improve the overall quality of their code. The tool is free and open-source, and it provides explanations for the rules in the rule description.

In today's fast-paced business climate, software developers face the challenge of managing growing workloads with fewer resources, leading to frequent failures to meet project deadlines. To address this issue, technologies such as automated code review tools and code analysis can be utilized to make development teams' jobs easier. Automated code reviews reduce time and effort required in manual code reviews, scaling easily for large teams and offering a cost-effective solution. The "Clean as You Code" approach focuses on minimizing risk and maximizing output by detecting issues and providing contextual help to developers, ensuring high-standard code is deployed throughout an organization. By implementing Sonar's solutions, development teams can maximize their time, focus on delivering better products, and meet critical deadlines.

Moment.js, a popular date-handling library, was deprecated by its maintainers in September 2020 due to its essential design not changing despite the rapid development of the JavaScript ecosystem. The library's maintainers prioritized stability over new features, leading to potential breaking changes for millions of projects. Moment is now considered a "legacy project in maintenance mode" with limited support and no new features, discouraging its use in new projects. Its limitations include mutable objects, issues with modern tree shaking algorithms, and less effective date handling compared to modern browsers and implementations. To mitigate these risks, developers should consider using alternative libraries like Luxon, Day.js, or date-fns, which offer improved functionality and maintainability. One developer's experience shows that while the transition from Moment to Day.js was significant, it ultimately led to reduced bundle sizes and a safer codebase.

The Checkmk - Remote Code Execution by Chaining Multiple Bugs series highlights a critical vulnerability in the NagVis integration with Checkmk, which can be chained together to gain remote code execution. The arbitrary file read vulnerability in NagVis allows an attacker to access sensitive files and delete them, leading to authentication bypass and further exploitation of a code injection vulnerability in Checkmk's watolib. This series emphasizes the importance of applying security on all layers, addressing vulnerabilities proactively, and ensuring that sensitive data is not stored in plaintext. The patches for these vulnerabilities were released as part of NagVis 1.9.34 and Checkmk version 2.1.0p11, respectively.

SonarSource attended KubeCon, hosted by the Cloud Native Computing Foundation (CNCF) in Detroit. The event had over 7k attendees and more than 300 sponsors. SonarSource showcased its support for cloud native and IaC technologies such as CloudFormation, Terraform, Kubernetes, and serverless functions. Key themes observed at the event included cloud native removing blockers and enabling new ways of achieving cool things, security being top-of-mind for DevOps teams, and a growing number of vendors in the space.

The Checkmk NagVis integration has a vulnerability that allows an unauthenticated attacker to bypass authentication and gain access to the NagVis component. This is achieved by leveraging the ability to delete arbitrary files, which results in an empty secret value if executed in a specific order. The vulnerability is due to the different implementations of file deletion operations between Checkmk GUI and Nagvis, making it possible for an attacker to exploit this technique despite the Checkmk GUI's defense-in-depth approach.

The Checkmk security vulnerabilities are a series of multiple identified vulnerabilities in the open-source IT infrastructure monitoring solution, which can be chained together by an unauthenticated, remote attacker to gain code execution on the server running vulnerable versions of Checkmk. These vulnerabilities include Code Injection in watolib's auth.php, Arbitrary File Read in NagVis, Line Feed Injection in ajax_graph_images.py, and Server-Side Request Forgery in agent-receiver. The exploitation chain starts with a Server-Side Request Forgery in the agent-receiver, which can be leveraged by an attacker to access an endpoint only reachable from localhost, followed by a Line Feed Injection vulnerability that allows an attacker to forge arbitrary LQL queries. These vulnerabilities have limited practical impact on their own but can be chained together to achieve remote code execution. The Checkmk team has patched the identified issues in version 2.1.0p12, and it is recommended to update any instance with a version before this release.

The text discusses the Responsible AI Licenses (RAIL) initiative and its impact on machine learning (ML) licensing. The RAIL licenses, including RAIL-S and RAIL-M, are designed to enforce ethical obligations in ML models, but they face challenges such as unclear applicability of copyright law to trained models, potential conflicts with other governance tools, and difficulties in enforcing the obligations against serial harassers or large corporations. Despite these challenges, the licenses have the potential for wide adoption due to their "unavoidable" application, documentation and education efforts, vision and evangelism from practitioners, partnerships with companies like HuggingFace, and successful governance structures. However, it is unclear whether the licenses will be widely adopted, and traditional open communities should build bridges and share knowledge with these new communities.