Abusing SAST Tools: When Scanners Do More Than Just Scanning
Rotem Bar turns static application security testing (SAST) tools and linters against developers, weaponizing malicious repositories to achieve RCE during source code scanning.
Summary
The Implicit Trust in Static Code Analyzers
Developers and CI/CD pipelines regularly scan untrusted third-party code and open-source pull requests using linters, formatters, and static application security testing (SAST) tools.
Analyzing Unsafe Dynamic Execution in SAST Parsers
Rotem Bar audits popular SAST tools, discovering that many engines invoke underlying language interpreters, dynamic imports, or external binaries during AST generation.
Crafting Poisoned Repositories for Scanner RCE
By embedding malicious directives in configuration files, package manifests, or custom lint rules, an attacker achieves remote code execution upon the developer opening or scanning the repository.
Sandboxing Security Tools in the Development Lifecycle
Bar outlines essential containment strategies, including containerizing CI/CD linters and disabling arbitrary code evaluation during static analysis.
Related talks
Main Stage·38 min
Thomas Chauchefoin · Paul Gerste
Uncovers critical RCE vulnerabilities in Visual Studio Code, demonstrating how malicious repository configurations bypass Workspace Trust protections.
Main Stage·23 min
David Dworken
David Dworken challenges the developer trust model by discovering critical vulnerabilities in modern IDEs (VS Code, IntelliJ) that execute code simply upon opening a repo.
Blacks in Cyber Village·44 min
Ochuan Marshall
Ochuan Marshall breaks down Log4Shell (CVE-2021-44228), demonstrating how to exploit JNDI lookups in a Minecraft homelab and secure software supply chains.