January 2024 Summaries

SonarCloud detected a Cross-Site Scripting (XSS) vulnerability via event listener (CVE-2023-46252) and an authenticated Arbitrary File Write (CVE-2023-46253) in Squidex version 7.8.2 and below, which allowed attackers to gain remote code execution on a vulnerable Squidex instance by tricking a user into clicking on a malicious link. Both vulnerabilities were fixed with Squidex version 7.9.0. The missing origin check in the event listener function was exploited by attackers to craft a malicious link, triggering an XSS attack and combining it with the arbitrary file write vulnerability for remote code execution.

Sonar's Vulnerability Research Team has discovered two security vulnerabilities in Jenkins, the leading open-source Continuous Integration and Continuous Deployment (CI/CD) software. The Critical vulnerability CVE-2024-23897 allows unauthenticated attackers to read a limited amount of arbitrary files' data, while "read-only" authorized attackers can read an entire arbitrary file from Jenkins' server. Attackers could leverage this vulnerability by reading Jenkins secrets and escalating privileges to admin and eventually execute arbitrary code on the server. The High severity cross-site WebSocket hijacking (CSWSH) vulnerability CVE-2024-23898 allows an attacker to execute arbitrary CLI commands by manipulating a victim to click on a link. The vulnerabilities were fixed in Jenkins versions 2.442, and LTS 2.426.3.

Sonar has expanded its support for Microsoft ASP.NET Core Blazor framework by adding new rules targeting Razor components. The company has been helping .NET developers create clean code for over a decade with its SonarQube, SonarCloud, and SonarLint products. It now provides over 450 rules and covers specific cases such as Microsoft Azure Functions, Cognitive Complexity, Async-Await usage, Multi-Threading, or DateTime usage. The company also supports Microsoft Visual Basic .NET and covers code in Azure DevOps, GitHub, GitLab, and Bitbucket. Blazor is a part of the ASP.NET Core technology that allows developers to code their UI with a mix of C# code and HTML presentation. Sonar now supports the analysis of Razor templates, which are at the core of the Blazor front-end web framework.

The SonarQube front-end team recently upgraded their app from React 17 to 18, using TypeScript and Jest with React Testing Library (RTL) for testing. They faced three main issues during the upgrade process: changes in TypeScript types, the need to update RTL, and breaking changes introduced by React 18. The team learned valuable lessons from these challenges, such as the importance of using Sebastian Silbermann's codemods to automatically update types when upgrading from React 17, addressing issues with fake timers in Jest, and understanding how automatic batching works in React 18. By sharing their experiences, they hope to help others who are planning similar upgrades.

The recent judicial ruling in the Vizio case has significant implications for open source license compliance. Traditionally, enforcement was limited to copyright law, with only authors able to initiate lawsuits and financial remedies being the primary outcome. However, this case argues that open source licenses can also be enforced through contracts, potentially expanding who can bring a lawsuit to enforce terms. The court's ruling found that the General Public License (GPL) creates a legal duty for Vizio to share source code with SFC, but allowed the trial to settle the scope of the duty rather than its existence. This decision has the potential to increase the number of potential enforcers and make threat letters from groups like SFC more credible, which could lead to changes in how companies approach open source licensing and compliance. The ruling is seen as a welcome news for those who believe in staying true to the original principles that led to the creation of the GPL.

Sonar, an AI tool dedicated to improving code security, has recently published its research highlights for the year 2023. The company's dedicated research team focuses on finding and inspecting vulnerabilities in modern open-source applications to keep up with the latest trends and better understand recent threats. Based on these insights, Sonar improves its product, enabling users to easily detect weak spots in their own code. In 2023, Sonar's team found critical vulnerabilities in popular applications across different domains and major programming languages. The company also participated in conferences like Black Hat Asia 2023, DEF CON 31, HEXACON2023, and Pwn2Own Toronto edition to share its research findings and keep up with the latest research trends.