Scaling the Security Researcher to Eliminate OSS Vulnerabilities Once and For All

Overview: Jonathan Leitschuh, the inaugural Dan Kaminsky Fellow at Human Security, alongside Patrick Way from Moderne, presents an automated methodology for finding and fixing open-source software (OSS) vulnerabilities at scale. The talk details the discovery of widespread plaintext HTTP dependency resolution in Java build systems and the subsequent ecosystem-wide remediation. The speakers demonstrate how combining CodeQL queries with automated pull request generation and AST-preserving refactoring tools enables security researchers to eliminate entire bug classes.

Key Topics: - Plaintext HTTP dependency resolution risks in Maven and Gradle build systems - Ecosystem-level coordinated deprecation of HTTP across Java artifact repositories - Large-scale vulnerability discovery with CodeQL and automated pull request generation - AST-preserving code transformations and automated refactoring with OpenRewrite

Technical Details: The research originated from identifying insecure HTTP repository declarations within Gradle (build.gradle) and Maven (pom.xml) build configuration files. Resolving dependencies over plaintext HTTP exposes builds to Man-in-the-Middle (MITM) attacks where malicious actors can tamper with downloaded JAR artifacts. Because Java build tools do not enforce cryptographic artifact signing checks by default, compromised dependencies execute arbitrary code during compilation and CI/CD test phases. Furthermore, plaintext build uploads frequently expose repository credentials over the wire. Audits revealed that major organizations—including Spring, Apache, Red Hat, Jenkins, Gradle, Oracle, LinkedIn, and the NSA—contained vulnerable configurations, and Sonatype reported that 25% of Maven Central traffic was still served over HTTP in June 2019.

To remediate the ecosystem, Leitschuh coordinated an initiative with major Java artifact repositories to permanently decommission HTTP support on January 15, 2020. To fix downstream open-source projects, Leitschuh utilized CodeQL across 100,000+ GitHub repositories to identify vulnerable build files, earning a $2,300 GitHub Security Lab bounty. For remediation, he developed a Python automation bot wrapping the GitHub hub CLI with backoff logic to handle API rate limits. Rather than using standard XML parsers—which strip formatting, modify indentation, and generate massive diffs rejected by maintainers—the bot utilized refined regular expressions to swap http:// for https:// while preserving whitespace. This automated pipeline generated 1,596 pull requests across open-source projects, achieving a ~40% merge rate.

Recognizing that regex solutions fail on complex vulnerabilities such as Zip Slip (path traversal during archive extraction), the presentation introduces OpenRewrite. Developed by Moderne, OpenRewrite constructs Lossless Semantic Trees (LSTs) that preserve exact code formatting, comments, and whitespace while enabling precise structural code transformations. By combining declarative CodeQL vulnerability queries with OpenRewrite recipes, researchers can automatically generate production-ready, maintainer-acceptable pull requests that eliminate recurring vulnerability patterns across thousands of repositories simultaneously.

Key Takeaways: Scaling software security requires moving beyond manual vulnerability reporting toward automated, bulk pull request generation. Automated fixes must prioritize developer ergonomics by preserving code style, indentation, and formatting, as formatting noise severely depresses maintainer merge rates. Modern supply chain defense must leverage semantic transformation frameworks like OpenRewrite alongside static analysis engines like CodeQL to eliminate entire vulnerability classes across open-source ecosystems.

(AI summary — Gemini Flash)