May 2022 Summaries

StackHawk has introduced several new features and updates, including API access to scan data, which allows users to integrate StackHawk scan results into their preferred reporting tools, and seed paths functionality to ensure critical application paths are always scanned. The tool now supports Apple Silicon chipsets, enhancing compatibility with the latest Mac devices. StackHawk has also successfully raised a Series B funding round, with investment from Sapphire, Costanoa Ventures, and Foundry Group, to support its growth and commitment to developer-first application and API security testing. The company is hosting webinars and workshops to help integrate security testing into software delivery processes, featuring insights from industry experts. Additionally, StackHawk is engaging with the community through various virtual and in-person events and is open to hiring for several positions to expand its team.

Security in software development encompasses various aspects, including safe execution on the JVM for Kotlin applications, language API security, and broader application security concerns such as vulnerabilities like SQL injection and cross-site scripting (XSS). The Kotlin team addresses security issues at the JVM and API levels through updates and patches, while developers are responsible for mitigating application security risks through practices like input validation and data encryption. Kotlin's strengths in security include null safety to prevent application crashes and libraries for data encryption, while weaknesses include the potential for reverse engineering and exposure of sensitive data via internet-driven APIs. Frameworks such as Ktor, Spring, and Javalin highlight common vulnerabilities if not implemented properly, like SQL injection and XSS attacks. Security best practices for Kotlin involve validating user inputs, avoiding hard-coded API keys, maintaining up-to-date software, and encrypting data in transit. Common security attacks in Kotlin applications include SQL injection, XSS, command injection, cross-site request forgery (CSRF), and issues related to HTTP transport security, emphasizing the need for developers to stay vigilant and proactive in securing their applications.

Broken object-level authorization (BOLA) is a security vulnerability where users gain access to data without the necessary privileges, topping OWASP's API Security Top 10 for 2023. This vulnerability often results from inadequate code-level validation, allowing attackers to manipulate URL and request parameters to access unauthorized data. For instance, an attacker might exploit a todo app API by altering user-ids or task-ids to view tasks or details not belonging to them, or by accessing admin-only features without proper credentials. Prevention strategies include validating user identity and access privileges, implementing API rate-limiting, and using hard-to-guess identifiers. It's also crucial to rigorously test APIs for unauthorized access to mitigate BOLA risks. The article is authored by Pius Aboyi, a developer with extensive experience in Android development, who emphasizes the importance of thorough testing to safeguard against such vulnerabilities.

The .NET Framework, originally developed by Microsoft as a proprietary platform for Windows, has evolved into a free and open-source framework available across Windows, Linux, and macOS, serving as a robust tool for enterprise application development. It includes a range of security features, such as the use of Principal and Identity Objects for role-based access control, although cross-platform capabilities like .NET Core require additional support for authentication. Best practices for maintaining security in .NET applications involve not overriding code verification checks, carefully verifying user input to prevent attacks like SQL injection and cross-site scripting, and regularly updating packages through Nuget. Common security threats include SQL injection, cross-site scripting (XSS), cross-site request forgery (CSRF), and XML external entities (XXE) attacks, all of which exploit vulnerabilities in input handling. Developers can enhance application security by using tools such as the Dynamic Application Security Testing (DAST) suite, which runs real-time security tests to identify and address potential vulnerabilities.

Software engineers must prioritize API security to prevent excessive data exposure, which occurs when an API returns more information than necessary, potentially exposing sensitive data. This issue can make applications vulnerable to hackers and legal repercussions, especially if personally identifiable information (PII) is leaked. Excessive data exposure is highlighted as a significant concern, particularly in Ruby on Rails applications, where API design flaws can lead to security vulnerabilities. Data sensitivity is categorized into four levels: public, internal, sensitive, and restricted, each requiring different handling to ensure security. Preventative measures include avoiding auto-incrementing primary keys, implementing server authorization checks, using data masking and encryption, and not returning raw unfiltered API responses. Storing sensitive data with third-party services like Stripe is recommended to mitigate risks. These practices help protect user data, safeguard company reputation, and avoid legal challenges, thereby fostering trust between businesses and their customers.

Excessive data exposure in web applications is a significant security concern where sensitive data is unnecessarily sent from the server to the client, potentially exposing critical information to attackers. This issue often arises when back-end APIs return more data than necessary for front-end use, which attackers can exploit by inspecting network requests. In Angular applications, this vulnerability can be mitigated by ensuring back-end REST APIs are structured to only send required data and by using GraphQL to explicitly request only necessary data, thereby preventing exposure of sensitive information. The post illustrates this with examples and practical steps for preventing excessive data exposure, emphasizing collaboration between front-end and back-end teams to enhance application security. Written by Siddhant Varma, a full-stack developer with extensive experience in frontend engineering, the post highlights the importance of responsible data handling and provides insights into securing web applications against data exposure vulnerabilities.

APIs serve as interfaces between clients and software, with some methods modifying application states and others returning data. A significant concern with APIs is excessive data exposure, where APIs inadvertently expose more data than necessary, which can pose security risks. This issue is particularly prevalent in REST APIs, which follow a standard structure and can be vulnerable to endpoint sniffing by attackers who exploit unauthenticated endpoints or rely on default paths. Excessive data exposure can also occur when APIs return more information than needed, relying on front-end developers to filter it, which attackers can bypass. Mitigation strategies include ensuring only non-sensitive data is returned from the back-end, protecting endpoints requiring authentication, and avoiding exposing all API methods via HATEOS. Java Spring Boot, a popular framework for creating back-end applications, provides tools to address this vulnerability by allowing developers to specify which data should be excluded from API responses. These preventive measures are crucial in safeguarding APIs against potential breaches and ensuring that only necessary data is shared with clients.

Authentication is a critical component for safeguarding resources within applications, yet improper implementation can lead to security vulnerabilities known as broken authentication. This occurs when attackers bypass authentication processes, potentially accessing sensitive data or systems without valid credentials. Common vulnerabilities include using weak passwords, lack of brute-force protection, and storing passwords in clear text. Exploitation methods such as brute-force attacks, password spraying, and response manipulation are prevalent. Specific coding practices in Java, such as failing to hash passwords or lacking session management, contribute to these risks. Preventive measures include enforcing strict password policies, implementing multi-factor authentication, and using rate limiting to mitigate brute-force attempts. Addressing these vulnerabilities is essential to prevent unauthorized access and protect organizational data from potential breaches.

Broken Object-Level Authorization (BOLA) is a critical security flaw that occurs when applications fail to properly verify user entitlements, allowing unauthorized access to sensitive data. This vulnerability is particularly problematic in web applications, as it can lead to severe data breaches if exploited. The article explores BOLA within the context of Java applications, demonstrating how inadequate access control can give authenticated users the ability to view, modify, or delete data they should not have access to. A RESTful API example is used to illustrate the issue, where users with the BASIC_GUY role can perform unauthorized actions due to improper authorization checks. The article emphasizes the necessity of implementing explicit authorization for privileged operations, which is achievable through annotations like @RolesAllowed in Java frameworks such as Dropwizard. By restricting sensitive operations to users with administrative roles, developers can prevent unauthorized data manipulation and enhance application security. The article, authored by Eric Goebelbecker, underscores the importance of robust access control mechanisms to protect user data and maintain application integrity.

StackHawk, a company specializing in application security testing, has secured $20.7 million in funding co-led by Sapphire Ventures and Costanoa Ventures, with contributions from Foundry Group and other investors, bringing its total funding to $35.3 million. This investment will bolster StackHawk's position in developer-first application and API security testing, emphasizing the importance of integrating security into Continuous Integration and Continuous Delivery (CI/CD) processes. As the frequency of software releases increases, so does the necessity for continuous security testing to detect vulnerabilities during development, a demand echoed by Forrester's findings on the prevalence of web application and API exploits. Gartner forecasts a surge in application security testing spending, presenting a significant opportunity for StackHawk. The company plans to use the funding to advance its product development, expand its leadership team, and enhance marketing and sales efforts, which include its recent integration with Snyk. Key figures from Sapphire Ventures and Costanoa Ventures highlight the importance of modern security tools in delivering secure applications and recognize StackHawk's potential in this high-growth market.

StackHawk has announced a significant funding round of $20.7 million, co-led by Sapphire and Costanoa Ventures, bringing its total funding to $35.3 million. This investment aims to enhance product development and address the rising demand for improved application and API security testing within the software development process. StackHawk, founded in response to the evolving needs of DevOps and security teams, integrates dynamic application security testing (DAST) directly into the CI/CD pipelines, enabling security issues to be identified and resolved early in the development lifecycle. The company has developed advanced API security testing capabilities for modern application architectures, such as REST, SOAP, and GraphQL APIs, and has introduced a developer-friendly approach to security testing that includes integration with Snyk for enhanced vulnerability detection. With a focus on continuous security testing and improving the developer experience, StackHawk aims to become the go-to solution for developers needing efficient and effective security testing tools as the market shifts away from traditional post-production security checks.

Excessive data exposure is a significant API security threat identified by OWASP, where APIs return more data than necessary, potentially leading to serious data breaches. The issue is prevalent in applications where API requests return a superset of data fields, with the expectation that display applications will filter the needed information, leaving vulnerabilities when excess data can be accessed by unauthorized users. In Laravel applications, this problem can be mitigated by using the Eloquent ORM's features to hide unnecessary fields from JSON responses, employing the $hidden or $visible arrays to specify which fields should be excluded or included in API responses, respectively. This approach ensures that sensitive data such as passwords and tokens are not exposed to display clients or potential attackers, thereby enhancing the security of the application. The article emphasizes the importance of proactive data management in API design to prevent unauthorized data access, while promoting tools like StackHawk for further security enhancements.

Online activities and data sharing are enabled by Application Programming Interfaces (APIs), but they come with security challenges such as excessive data exposure, especially in frameworks like Django REST. Excessive data exposure occurs when APIs inadvertently provide more data than necessary, leading to potential security risks if sensitive information is leaked. This vulnerability is often due to over-fetching, where clients receive more data than requested, increasing the risk of data breaches. Solutions include implementing server-side data filtering, data masking, encryption, and using tools like Django RESTQL to tailor API responses to client needs, minimizing unnecessary data exposure. Through proper API structuring and filtering of responses, developers can significantly reduce the risk of data leaks, thereby enhancing security. Siddhant Varma, a full-stack JavaScript developer, emphasizes the importance of addressing these issues to safeguard sensitive information and shares his experience in teaching programming to graduates.

Path traversal attacks are a prevalent form of cyberattack where malicious actors exploit web applications by tricking them into revealing sensitive files outside the intended directories, such as configuration files or authentication data. These attacks occur when a web application fails to properly validate user input, allowing attackers to manipulate file paths and access restricted areas of the server. Common methods include using relative paths, encoding escaped characters, or employing Null Byte attacks. To mitigate these vulnerabilities, developers should normalize file paths, avoid using high-privilege users, regularly update software, and escape special characters. Additionally, maintaining up-to-date software, automating security vulnerability tests, enforcing strong password policies, and using SSL certificates are key strategies to protect web applications from various security threats, including path traversal. The blog emphasizes the importance of secure coding practices and suggests tools like StackHawk's DAST Scanner for identifying vulnerabilities in the development pipeline.

An XML External Entity (XXE) attack exploits vulnerabilities in applications that process XML documents by using malicious XML constructs to compromise data security or cause a denial of service. These attacks take advantage of XML external entities, which can reference data from external sources, including internal networks or files, leading to unauthorized data access or application malfunctions. Prevention involves ensuring that applications do not process untrusted data in unsafe ways, and using secure XML parsers like xml2js or sax-js, which default to ignoring or safely handling custom entities. The discussion includes examples of how XXE attacks can retrieve network information, steal files, and execute denial-of-service attacks, emphasizing the importance of using the right parsers and keeping dependencies updated to protect Angular applications. The post, authored by Eric Goebelbecker, also suggests utilizing tools like StackHawk to enhance application security further.

Excessive data exposure is a security vulnerability in web applications where the front end requests more data than necessary, potentially revealing sensitive information that attackers could exploit. This issue arises when server responses include data that is not used by the front-end application, allowing malicious actors to access it through browser developer tools. The article highlights how this vulnerability can manifest in scenarios like an e-commerce platform, where sensitive data such as credit card details might be exposed unnecessarily. To prevent this, developers should refactor REST API endpoints to ensure only necessary data is sent to the client or opt for GraphQL APIs, which allow the front end to specify and request only the required data. By using GraphQL, developers can mitigate excessive data exposure by controlling the data retrieved, as demonstrated through examples involving a React application and a mock GraphQL API. The article underscores the importance of backend and frontend collaboration to safeguard user data, suggesting best practices for handling API requests effectively.

Rust, known for its high performance and reliability, is increasingly favored for network and web applications, yet it is not immune to security vulnerabilities such as broken authentication. Authentication is essential in software development for verifying user identities, but when compromised, it can allow cybercriminals to impersonate legitimate users, leading to system breaches. The article explores various types of broken authentication, including predictable login credentials, sensitive data exposure, session hijacking, rainbow attacks, and session ID vulnerabilities, all of which can be exploited in Rust applications. It emphasizes the importance of securing user data through measures like encrypting passwords with added salt, using passwordless authentication, session invalidation, and session time-outs. Additionally, monitoring tools like StackHawk can be instrumental in identifying and mitigating potential vulnerabilities in Rust applications, highlighting the language's commitment to security despite the potential for developer errors or insecure third-party libraries.