June 2025 Summaries

Fortinet, a prominent cybersecurity solutions provider, faces scrutiny as vulnerabilities in its key products, FortiClient and EMS, are explored, revealing how attackers can exploit these tools to gain complete organizational control. The vulnerabilities, identified as CVE-2025-22859 among others, allow authenticated attackers to upload stored XSS payloads to Linux-based EMS servers, enabling them to manipulate endpoints to connect to malicious EMS servers and potentially execute arbitrary code. Critical flaws in Fortinet's communication protocol between FortiClient and EMS are highlighted, illustrating how attackers can create arbitrary files due to the lack of input normalization, leading to stored XSS attacks despite content-type restrictions. The vulnerabilities, now patched, emphasize the importance of keeping systems updated to prevent such severe threats, with Fortinet's Product Security Incident Response Team (PSIRT) actively collaborating to address these security issues.

Fortinet is a major player in the cybersecurity sector, offering a broad array of security solutions, including firewalls and endpoint security, which are used across various industries to protect against cyber threats. Recent research into Fortinet's FortiClient and FortiClient Endpoint Management Server (EMS) uncovered multiple severe vulnerabilities that allow attackers to potentially take over organizations with minimal user interaction. These vulnerabilities, which affect FortiClient, FortiClient EMS, FortiOS, and FortiProxy, have been addressed and fixed, though researchers believe the CVSS scores provided by Fortinet underestimate their severity. The research demonstrated how an attacker could exploit a vulnerability in FortiClient to execute arbitrary code on a victim's machine through a simple user interaction. Despite the CVSS scores suggesting a low threat level, researchers emphasize the critical nature of these vulnerabilities and advise users to update to the fixed versions immediately. The blog series aims to highlight the potential impact of these vulnerabilities by presenting realistic attack scenarios, showcasing the importance of addressing such security issues promptly.

Google's use of AI to generate new code has reached over 30%, but the real impact on engineering productivity is a more modest 10% increase, as noted by CEO Sundar Pichai. This discrepancy is largely due to the necessity for AI-generated code to undergo rigorous review and approval by engineers to ensure reliability, maintainability, and security. The concept of "flow balancing," where optimizing one part of a system can inadvertently create bottlenecks elsewhere, is relevant here, as AI tools like GitHub Copilot and Cursor accelerate code production but can introduce issues in the production phase. Companies must therefore prioritize a strong culture of code review, supported by tools like SonarQube, to manage the complexities and risks of AI-generated code. This involves establishing high standards for all code, fostering accountability, and employing automated code assessments to identify potential issues, thereby enhancing overall productivity while mitigating risks.

This summary highlights a previously unknown vulnerability in several popular SQL client libraries that could be exploited to inject malicious SQL statements into prepared statements. The vulnerability arises from the way libraries handle line comments, particularly when using negative numbers or multi-line strings. This can lead to syntax ambiguity and allow attackers to alter the query syntax, potentially injecting malicious code. Several libraries, including PgJDBC, pg-promise, pgx, pg, and pgdriver, were found to be vulnerable, with some having patches available while others do not. The vulnerability was discovered through a thorough analysis of PostgreSQL client libraries and has been reported to their maintainers, leading to the release of fixed versions. The incident emphasizes the importance of including third-party code in security testing and highlights the benefits of using tools like SonarQube's Advanced SAST and SCA capabilities to detect known vulnerabilities in dependencies.

The Sonar engineering team successfully removed a performance bottleneck and transformed the Processor service to make it scalable, resilient, and cost-effective while improving the user experience. They achieved this by cutting the file storage cost on SonarQube Cloud by 90 percent and extracting 3.4 TB of data from a relational database to a more suitable storage option. The team evaluated two main candidates for file storage: Amazon Simple Storage Service (Amazon S3) and Amazon Elastic File System (AWS EFS). After running a proof of concept, they validated their assumptions and gathered initial data before conducting a larger experiment. This experiment showed that Amazon S3 is the fastest option with the asynchronous client, but saving each file individually is costly due to high requests, impacting Amazon S3's pricing. However, by bundling files in archives, the cost of S3 can be reduced to 10 percent of EFS' cost. The team also realized the need to transform their architecture to fully leverage the new storage's potential, which led to a more efficient and scalable design. This transformation improved the platform's scalability, resilience, and user experience, while preparing it for future growth and improvements.