Stranger Danger: Addressing Vulnerable CF Application Dependencies

on YouTube ↗31m

" summary

Cloud Foundry apps routinely contain vulnerable third‑party packages; a live scan of two demo droplets finds 19 vulnerabilities, 43 vulnerable paths and Snyk identifies issues earlier in source. Exploits shown include a URL‑encoded directory traversal in the st static server, a Buffer memory‑leak extraction via JSON type coercion in Mongoose, and a Struts remote code‑execution via crafted headers using curl. Remediation is mostly upgrades or patches, automated PRs from Snyk, and continuous scans because fixes lag — 390 days mean time to repair.

AI-written summary · about

" chapters (5)

1. 0:00Introduction and speaker background
2. 10:57Live vulnerability demonstration
3. 19:49Fixing vulnerabilities in dependencies
4. 27:16Four-phase strategy for secure dependencies
5. 29:05Q&A on dependency scanning tools

" related talks

• 24mStrangerDanger: Finding Security Vulnerabilities Before They Find You!Liran Tal · JSConf Budapest 2019
• 27mStrangerDanger: Finding Security Vulnerabilities Before They Find YouLiran Tal · ReactiveConf 2019
• 35mBuilding Security In: Using Cloud Foundry to Secure CF AppsGuy Podjarny · Cloud Foundry Summit Europe 2017
• 14mStranger Danger: Tracking Vulnerabilities in Your Third Party CodeGuy Podjarny, Assaf Hefetzz · Velocity Conference Amsterdam 2015
• 40mSecuring your dependenciesNina Juliadotter · NDC Sydney 2018
• 37mStranger Danger: Finding Security Vulnerabilities Before They Find You!Liran Tal · Node.js Global Summit 2020
• 35mStrangerDanger: Finding Security Vulnerabilities Before They Find You!Liran Tal · DevDays Europe 2019
• 34mStranger Danger: Finding Security Vulnerabilities Before They Find You!Liran Tal · Voxxed Days Frontend Bucharest 2019