August 2023 Summaries

In this article, we present a critical vulnerability found in Moodle that allows attackers to leverage a self-XSS vulnerability to an impactful Account Takeover. The vulnerability was identified through an audit of the open-source project and is tracked as CVE-2023-40320. It affects Moodle versions before 4.2.2, 4.1.5, 4.0.10, 3.11.16, and 3.9.23, where an attacker can exploit a self-XSS vulnerability in the WYSIWYG editor to gain access to a victim's account through OAuth authentication. The vulnerability was patched by removing the call to the complete_user_login function, which caused the confirm-linkedlogin.php endpoint to not automatically login the user by clicking the link. This highlights the importance of clean code practices and regular security audits in reducing the risk of introducing security flaws that could be exploited by attackers.

Moodle is an open-source learning management system used to create and deliver online courses, widely adopted by educators and institutions worldwide with over 350 million users across 242 countries. A recent security audit revealed a vulnerability in Moodle versions 4.1.x before 4.1.3 and 4.2.x before 4.2.0, allowing an unauthenticated attacker to create arbitrary folders and trigger a Stored Cross-Site Scripting (XSS) attack, resulting in arbitrary code execution on the server. The vulnerability was fixed in versions 4.1.3 and 4.2.0 by casting the `$rev` parameter to integers. An attacker can leverage this vulnerability to gain full control over the Moodle instance, compromising the security of educational institutions.

At Sonar, they have been continuously improving their SAST capabilities by leveraging benchmarks to track progress. They initially stated a detection rate of 80% and a false-positive rate of no more than 20%, but later provided more detailed information for specific cases like the OWASP Benchmark project, where their True-Positive Rate was at 85%. The company's focus has always been on delivering value to developers through their products, rather than solely focusing on benchmark scores. Recently, they received feedback from prospects indicating that not all companies have the resources or time to thoroughly assess SAST solutions, leading them to provide a list of top 3 SAST benchmarks by language, along with the issues expected to be detected in each project (known as Ground Truth), and their own results for these benchmarks.

BlackHat USA 2023` was a significant event with various topics including `Application Security`, `Cloud security`, and `AI/Data Science`. The conference highlighted the importance of AI-powered security products, with DARPA announcing an `AI Cyber Challenge` that offers millions in prize money. Sonar, an integral part of the show, launched its new innovation, `deeper SAST`, which discovers vulnerabilities created by user code interacting with third-party libraries. This technology addresses a gap in modern SAST solutions and will help customers deepen their security coverage against advanced attacks. The conference also saw two Sonar researchers nominated for the `Pwnie Awards`, and the company's vulnerability researchers attended the oldest security conference, `DEF CON`. Overall, BlackHat was a great event with impactful presentations that attracted a broad range of profiles, from students to industry veterans.

Deeper SAST expands the capabilities of Sonar's SAST to help detect more security vulnerabilities in JavaScript or TypeScript applications by considering interactions with third-party, open-source libraries. Traditional SAST scans application code but lacks understanding of dependencies, while Deeper SAST pre-scans popular libraries to find sources and sinks, enhancing Sonar's taint analysis engine to uncover hidden vulnerabilities. This improves the detection of injection attacks and other security issues, promoting Clean Code and secure development practices.

The text discusses vulnerabilities discovered by members of a Vulnerability Research team during the Pwn2Own Toronto 2022 competition, which were later reported to vendors and addressed through security updates. The team found two LAN-side vulnerabilities on the NETGEAR RAX30 router and one WAN-side vulnerability on both the NETGEAR RAX30 and Synology RT6600ax routers. They also discovered a buffer overflow vulnerability in the telnet service of the NETGEAR RAX30, which could be exploited to control the instruction pointer and execute arbitrary system commands. The vulnerabilities were reported to ZDI (Zero Day Initiative) and addressed through patches by vendors. The team's findings demonstrate the importance of security testing on consumer devices and provide valuable insights into the technical details of these vulnerabilities.

SonarCloud's automatic analysis for C++ simplifies the process of code analysis by eliminating the need for manual effort, allowing users to analyze their code with just one click. This feature is particularly important for C++, a language that can benefit from static analysis due to its complexity and flexibility. Sonar believes that all developers should use static analysis tools, but the current state of C++ tooling makes it difficult to get properly working. SonarCloud's solution addresses this issue by providing an automatic analysis experience without requiring users to understand how their project is built or configure the analysis manually. This feature is available for free on SonarCloud for public projects and supports a wide range of languages, including Java, Python, JavaScript, TypeScript, and C#.

Red Hat's IPO in 1999 was a notable experiment in paying open source maintainers, offering them the option to buy stock through the company's initial public offering. This move recognized the value created by the community contributors who made Red Hat's success possible. However, the process of selecting eligible contributors was complex and involved navigating SEC regulations. Despite the challenges, the IPO provided a unique opportunity for open source developers to participate in the company's financial success. Today, as open source usage continues to grow exponentially, organizations are realizing the importance of investing in the long-term health and security of their dependent projects by supporting their maintainers with recurring income. This approach is crucial for ensuring the continued vitality of open source software and protecting an organization's revenue, data, and customers.

The 2023 WeAreDevelopers event in Berlin focused on AI, Clean Code, and TypeScript. Key speakers discussed the importance of personal security when using AI tools like Chat GPT, and the need for developers to adopt a "Clean as You Code" methodology to ensure high-quality code. Generative AI is expanding access to code development but also creating challenges such as ensuring the cleanliness of generated code. The event highlighted the growth of TypeScript, with talks on its benefits and how to transition from JavaScript. Security vulnerabilities were also discussed, including those in popular IDEs like Visual Studio Code. Renowned developers attended and interacted with attendees, emphasizing the value of the WeAreDevelopers community.

Sonar's deeper SAST solution detects deeply hidden security vulnerabilities that traditional tools cannot identify, particularly those arising from interactions with third-party dependencies. Taint analysis capabilities have been expanded to analyze transitive dependency code, enabling the detection of taint vulnerabilities in project code and its interactions with dependencies. This solution addresses the limitations of traditional static application security testing (SAST) tools by providing a comprehensive understanding of code interactions within projects and their dependencies. With deeper SAST, developers can identify obscure security issues that may arise from complex interactions between code sequences and transitive dependency code, potentially leading to dramatic consequences if exploited.

The new feature in SonarQube 10.1 allows developers to analyze multiple code variants simultaneously, which can include different build configurations such as debug and release builds, cross-platform variants, and support for various architectures like 32-bit and 64-bit. This feature is designed to help developers manage the complexities of modern software development by providing a more expressive and easier way to set up analysis for different code variants. With this new feature, SonarQube can now analyze all possible build configurations and provide aggregated results, making it easier for developers to identify issues that affect multiple variants and prioritize their attention accordingly. The feature also allows filtering of issues by specific variant and provides detailed information on how many variants are impacted by each issue, enabling developers to make informed decisions about their codebase.