May 2024 Summaries

Cross-site scripting (XSS) is a common vulnerability where an attacker injects malicious JavaScript code into a vulnerable web page. The impact of XSS attacks varies from no business impact to account takeover, data leakage, or even remote code execution. Recent years have seen the rise of mutation class XSS, which can bypass sanitizers like DOMPurify and Google Caja. Mutation Cross-Site Scripting (mXSS) takes advantage of HTML's tolerance for broken markup and its various parsing modes to evade sanitization. Understanding the intricacies of HTML parsing is crucial in addressing mXSS vulnerabilities. Different content parsing types, foreign content elements, namespace confusion techniques, and desanitization are some factors that contribute to mXSS attacks. Developers can mitigate these risks by sanitizing client-side, not re-parsing sanitized content, always encoding or deleting raw content, and supporting sanitizing foreign elements with parent namespace checks. The future of addressing mXSS lies in the development of built-in sanitizers in browsers like the Sanitizer API initiative and updates to HTML specifications.

The G2 Spring 2024 reports have named Sonar as the LEADER in Static Code Analysis. This recognition highlights SonarQube's commitment to customer needs and its ability to enable developers to consistently deliver high-quality software. The G2 Grid is a peer-to-peer review site that helps technology buyers make informed purchasing decisions by plotting products against Satisfaction and Market Presence scores. SonarQube, a static code analysis tool, offers coverage for 30+ languages, frameworks, and IaC platforms, seamless integrations with multiple IDEs, security by design, advanced SAST capabilities, and more. Over 7 million developers and 400k organizations use SonarQube, making it a popular choice in the industry.

Sonar's innovative analysis technology, deeper SAST, detects deeply hidden code vulnerabilities by extending its taint analysis to cover the interaction of first-party code with dependencies. This enables unique insights into security side effects of dependent code and helps find vulnerabilities missed by traditional SAST and SCA tools. Deeper SAST evaluates all security-sensitive interactions between a project's code and its dependent code without any additional configuration or major performance overhead. A real-world example of a critical vulnerability in Jenkins, CVE-2024-23897, demonstrates the importance of deeper SAST for finding hidden vulnerabilities that can have significant consequences if left unaddressed.

This article discusses the second critical vulnerability in Apache Guacamole's remote desktop gateway. The first article explained a parser differential vulnerability (CVE-2023-30575). In this article, we dive into concurrency issues and glibc heap exploitation to gain remote code execution. Parallelism is a source of severe security vulnerabilities, with challenges arising when the same resource needs simultaneous access. Guacamole's architecture employs many threads for handling user connections, initiating internal host connections, and communicating with parent processes. The audio input feature was found to have a Use-After-Free vulnerability (CVE-2023-30576) when the RDP connection is established, and the user disconnects before the RDP host closes the audio input channel. Exploiting this vulnerability involves leveraging glibc's heap internals to craft valid data structures without reallocation or using connection sharing to gain code execution on the Guacamole Server. The article concludes by emphasizing the importance of addressing parallelism-related security issues and acknowledges the quick response from Guacamole maintainers in providing a comprehensive patch.

In April 2023, the Sonar Research team discovered two critical vulnerabilities (CVE-2023-30575 and CVE-2023-30576) in Apache Guacamole, a popular remote desktop gateway. These vulnerabilities allowed low-privileged users to gain remote code execution on the Guacamole server by attacking the external web interface. Attackers could leverage this access to spy on every connection, harvest sensitive credentials, and pivot to an organization's internal network. Thanks to our report, the Guacamole maintainers fixed the vulnerabilities in May 2023 with version 1.5.2, and there were no signs of in-the-wild exploitation.

The "Shift Left" philosophy in agile development emphasizes proactive identification and resolution of potential issues at the beginning of the development phase to improve efficiency and code quality. This approach involves writing clean code from the start, embedding comprehensive code quality, security, and reliability checks early in the lifecycle. Tools like SonarQube, SonarCloud, and SonarLint empower developers to adopt a shift-left approach by providing real-time feedback on coding issues and promoting a culture of continuous improvement. By catching bugs and vulnerabilities early, this philosophy leads to faster release cycles, improved code quality, enhanced security, reduced costs, and increased developer productivity.