How lgtm Discovered the Spring Framework Vulnerability – InApps Technology is an article under the topic Software Development Many of you are most interested in today !! Today, let’s learn How lgtm Discovered the Spring Framework Vulnerability – InApps Technology in today’s post !

Read more about How lgtm Discovered the Spring Framework Vulnerability – InApps Technology at Wikipedia

You can find content about How lgtm Discovered the Spring Framework Vulnerability – InApps Technology from the Wikipedia website

Security researchers at are urging users of the Pivotal Spring framework to upgrade to the latest version due to a critical remote code execution vulnerability.

The vulnerability allows attackers to execute arbitrary commands on any machine that runs an application built using Spring Data REST. The company characterizes the upgrade as “a matter of urgency.” The Spring Data REST component is distributed as part of various other Spring projects, including the Spring Boot framework.

Spring Framework is the most popular platform for building web applications, according to analyst firm RedMonk.

“This vulnerability in Spring Data REST is unfortunately very easy to exploit. As it is common for RESTful APIs to be publicly accessible, it potentially allows bad actors to easily gain control over production servers and obtain sensitive user data,” said researcher Man Yue Mo at parent company Semmle.

Mo, also discovered the Apache Struts vulnerability last fall.

In a blog post about how he found the Spring vulnerability using lgtm tools, Mo explained that it enables an attacker to send a PATCH request with maliciously crafted JSON data to run arbitrary code on the server. When reported to Pivotal, it responded quickly with a method to thwart the remote input, he said.

Read More:   Hello Kubernetes Operators (and Vendors), Few People Know What You’re Selling – InApps 2022

Semmle CEO Oege de Moor called the discovery of the Pivotal Spring vulnerability, using variant analysis, an example of how lgtm is supposed to be used.

Built on research in compilers and data analysis at the University of Oxford, Semmle offers software engineering productivity analytics and its code exploration tool lgtm, which takes its name from the code review signoff “Looks good to me.”

Its technology turns a code base into to text that can be queried to find bugs and errors.

“Whenever you use data from an unchecked source, you have to be very careful to protect yourself from all sorts of vulnerabilities. An example would be data that flows from an untrusted user to a deserialization method in Java. So we track the data all the way from where it comes into the application to where it is used in a dangerous fashion, and we flag where a problem exists,” said product manager Bas van Schalk.

While security is the focus of many of its customers, it has other uses. Data scientist Albert Ziegler wrote about its use in reducing alerts in testing.

“You may already know a bug that exists, but you want to find all the places where the same logical mistake has been made. Our technology allows you to write a query across your code base and find them; then it looks continuously to ensure the same mistake is never made again,” de Moor said.

An investment company used it to track dependencies in libraries when modernizing a 30-year-old code base and to onboard new hires with real work when its staff was thin during vacation season.

Headquartered in San Francisco, it also has offices in Oxford, New York City, and Copenhagen. Customers include Citi, Credit Suisse, NASA and Dell.

It treats code as a database.

“If you’ve got a compiled language like Java or C++,  we observe exactly what tiles are being processed by the compiler and we store information from the source code in text files in relational form. So you get a table of functions, a table of expressions, a table of variables. So the analysis [involves] queries against a relational database,” de Moor said of its custom-built technology.

Read More:   Toward a 3-Stage Software Development Lifecycle – InApps 2022

It also developed the QL query language, with syntax similar to SQL, but the semantics of QL are based on Datalog, a declarative logic programming language with a long history in academia. All operations in QL are logical operations. It inherits recursive predicates from Datalog, and adds support for aggregates, simplifying even complex queries.

Competitors in code analysis include Coverity, now part of Synopsis; Fortify, now part of Micro Focus; and Checkmarx, though Semmle touts that lgtm makes it extremely easy to create new analyses.

The NASA Jet Propulsion Laboratory reported a code review competitor missed a defect in the critical entry, descent and landing software of its Mars rover Curiosity while it was en route. Worries about potential other bugs prompted a review from lgtm. In 20 minutes, it defined a new rule to query for other instances of the defect and found 30 related cases elsewhere in the code. NASA engineers were able to fix them in time to ensure a safe landing on Mars.

In addition to its enterprise customers, lgtm works with open source projects to improve their code. It processes code stored in public Git repositories hosted on GitHub or Bitbucket Cloud.

It supports projects in C and C++ (currently in beta testing), Java, JavaScript/TypeScript and Python and analyzes every revision to a project committed to the default branch. It alerts on problems and compares them with a list of new or fixed alerts.

In a different take on code analysis, Israeli security startup Intezer looks to the body’s immune system with what it calls “DNA mapping for software,” and its goal of being the “Google of binary code” by providing a search engine for all the world’s code.

Another interesting startup building a source-code database, though not specifically security-related, source{d} mines a data set based on 57 million public Git repositories — hundreds of terabytes of source code — to train machine-learning models to understand natural language, intent and similarity.

Read More:   GitLab’s Top 5 Tips for Running a Bug Bounty Program – InApps Technology 2022

Feature image via Pixabay.

InApps Technology is a wholly owned subsidiary of Insight Partners, an investor in the following companies mentioned in this article: Checkmarx.

List of Keywords users find our article on Google:

spring vulnerabilities
lgtm full form
lgtm github
micro focus fortify pricing
micro focus competitors
bitbucket upgrade
microfocus qc
spring github
springframework boot
spring vulnerability
bitbucket base branch
data scientist credit suisse
java spring github
micro focus quality center
product control credit suisse
custom application development
spring exploit
spring cloud vulnerability
spring boot vulnerability
micro focus linkedin
spring boot wikipedia linkedin
wawa city blue
albert github
typescript security vulnerabilities
lgtm corporation
spring cloud github
spring-cloud github
hire struts developer
semmle lgtm
checkmarx icon
github parent team
checkmarx reviews
pivotal spring boot
code lgtm
oxford flatform
what is lgtm
fortify typescript
hire remote spring boot developers
oxford flatforms
fortify checkmarx
microfocus jobs
checkmarx review
mars rover github
spring boot salesforce


Rate this post

Let’s create the next big thing together!

Coming together is a beginning. Keeping together is progress. Working together is success.

Let’s talk

Get a custom Proposal

Please fill in your information and your need to get a suitable solution.

    You need to enter your email to download

      Success. Downloading...