Security on foojay.io - Friends of OpenJDK

AI Found the Bugs. Who's Patching Your EOL Java Code?

Thu, 23 Jul 2026 15:26:53 +0000

Earlier this year an AI model found a flaw in OpenBSD’s TCP stack that had been sitting there for 27 years. The same scanning run turned up a 16-year-old bug in FFmpeg’s H.264 code.

How do you feel about AI being used to discover bugs in open source, across the board and at scale?

Because that’s what’s happening. It’s tough enough dealing with machine-speed vulnerability discovery in code that has active maintainers. What about all the code with no friendly pair of safe hands?

BoxLang AWS, Azure, and Google Secrets Manager Module Released

Tue, 21 Jul 2026 11:38:18 +0000

Every production application carries secrets: database passwords, API tokens, encryption keys. The question is never whether to manage them – it’s how badly the current approach is going to hurt you.

Hardcoded credentials in config files get committed to repos. Environment variables sprawl across deployment pipelines with no audit trail. Custom integration code for each cloud provider means three different patterns to maintain, test, and rotate. And when a key needs to rotate at 2am? Someone is waking up.

This Dependency Update Looked Exactly Like an Account Takeover

Fri, 03 Jul 2026 08:31:27 +0000

I pointed a scanner I have been building at an old Spring project, and it flagged javax.activation. The bump was 1.1-rev-1 to 1.1.1. Prior releases carried a GPG signature. This one did not.

If you have read the post-mortems of real supply-chain attacks, that pattern should make you sit up. A package that has signed its releases for years suddenly ships one unsigned. The boring explanation is a build pipeline change. The other explanation is that a different person is publishing now, and the signing key stayed behind with the old one. When ua-parser-js was hijacked in 2021, the malicious versions came from a compromised account. When event-stream went bad in 2018, it was a new maintainer nobody had vetted. The artifact looks fine. The metadata around it is what changed.

7 Jackson CVEs in One Day: AI-Assisted Security Research

Mon, 29 Jun 2026 11:47:41 +0000

Quick version check: the affected range for all seven is broadly >=2.10.0 =2.19.0 =3.0.0 <3.1.4 — with some CVEs affecting narrower ranges. If you’re on a supported release, upgrade to 2.18.8, 2.21.4, or 3.1.4. If you’re on an EOL line — 2.13.x, 2.14.x, 2.15.x — jump to the bottom of the page for more specifics or visit HeroDevs Jackson Support

Not a sales pitch

Anyone who knows me knows I dont do that. In this case I’m pointing you at HeroDevs because the Jackson issues are serious, HeroDevs have a solution thats stupidly easy to use and I know the folks behind the fixes. It takes a particular type of engineer to create security fixes and I know they have that skillset. Do your own research.

Quarkus Unpacked: Insights from the Foojay Podcast

Tue, 23 Jun 2026 12:36:54 +0000

I recently had the pleasure of joining the Foojay podcast to talk about Quarkus in depth. The conversation covered a lot of ground, from what makes Quarkus different to the practical trade-offs between JVM and native mode. This post captures the key questions and answers from that discussion, lightly edited for readability.{#_quarkus_unpacked_insights_from_the_foojay_podcast}

If you have been following this blog series, note that the third installment on building your own stack with Quarkus is coming next. Consider this a bonus entry that distills the podcast conversation into a format you can read, reference, and share.

Did AI Just Break Software Security For Ever?

Tue, 16 Jun 2026 14:51:04 +0000

Whether the answer is yes or no (read on for my opinion) , something fundamental has changed this year. Not one thing. Four things, converging at once.

First: The rate of CVE arrivals

More than 40,000 CVEs were published in 2024, rising to just under 50,000 in 2025. FIRST — the Forum of Incident Response and Security Teams, projects a median of 68,000 for 2026, with realistic scenarios reaching 70,000 to 100,000.

Spring Boot 3.5 Migration and the CRA: When Good Enough Isn't"

Fri, 05 Jun 2026 08:52:01 +0000

Back in April I wrote about what happens to your security posture when Spring Boot 3.5 crosses the EOL line.

The short version: the CVE pipeline dries up, your scanner goes quiet, and the bad actors keep watching upstream for anything they can exploit downstream against the dead code nobody’s patching.

I called them zombie dependencies.

June 30th is coming. In a few weeks, Spring Boot 3.5 reaches end of open-source support. You’ve either got a plan or you haven’t.

Tiberius: A Security Testing Framework for LLM Applications in Java

Thu, 04 Jun 2026 20:09:09 +0000

How do you write a regression test for a system that is non-deterministic by design?

The Problem {#h2-0-1-the-problem}

Large Language Models have moved from research artifacts to production infrastructure. Java applications are embedding them into customer-facing services via Spring Boot, and e.g. LangChain4J — for document summarization, customer support, healthcare assistance, and financial guidance, to name just a few. The deployment surface is growing faster than the security tooling.

The vulnerability landscape is empirically well-established. Horlacher, Vifian, and Zagidullina (2026) [4] red-teamed gpt-oss-20b and found that adversarial techniques achieved alarmingly high Attack Success Rates, while non-adversarial probing exposed pervasive stereotypical defaults — both consistent across English and Swiss German. Their conclusion: “current alignment mechanisms have not fully resolved jailbreaks and inherent bias, posing critical challenges for automated decision-making.”

Introducing bx-jwt: Enterprise-Grade JSON Web Tokens for BoxLang

Tue, 26 May 2026 10:14:00 +0000

JWT authentication is everywhere. But rolling it correctly — with proper algorithm enforcement, key management, clock skew handling, JWE encryption, and zero security footguns — is anything but trivial. Today, we’re shipping bx-jwt, a production-ready JWT/JWE module for BoxLang that handles all of it out of the box, so you can focus on building, not fighting cryptography.

bx-jwt is part of the BoxLang+ and BoxLang++ subscription tiers — our enterprise-grade module collection built for teams that take security seriously.

BoxLang v1.13.0: Compatibility, Concurrency, and Formatter Maturity

Tue, 19 May 2026 12:11:19 +0000

BoxLang 1.13.0 is a stability-first release with deep compatibility work and runtime hardening. This build closes 48 issues, with the majority focused on CFML compatibility edge cases, concurrency correctness, formatting parity, and miniserver/runtime reliability under real production loads.

While this release is bug-fix heavy, it still introduces several meaningful features and quality-of-life improvements: character-aware trimming, class metadata lookup by absolute path, process environment control in SystemExecute(), SOAP headers, new query column rename capabilities, and safer miniserver routing/security defaults.

Don't Panic: The Thymeleaf Template Injection That Only Hurts If You Let It (CVE-2026-40478)

Fri, 15 May 2026 15:31:08 +0000

The Thymeleaf vulnerability with a CVSS score of 9.1 grabs your attention, as it should. But before you call the cavalry and claim this as the new Log4shell, read this first.

CVE-2026-40478 is a server-side template injection vulnerability in Thymeleaf discovered by pentester Dawid Bakaj . Thymeleaf is a templating engine in Java that is used for server-side webpage rendering. The sandbox that normally prevents arbitrary code execution got bypassed using a tab character. And yes, this can lead to a remote code execution if exploited.

Foojay Podcast #95: Is Your Java App Actually Secure, Or Does It Just Look That Way?

Mon, 11 May 2026 09:57:00 +0000

Is your Java application actually secure, or does it just look that way? In this episode of the Foojay Podcast, Frank is joined by Steve Poole and David Welch, both from HeroDevs , to dig deep into the state of Java security in 2025 and beyond.

Steve introduces the concept of zombie dependencies: end-of-life libraries that appear safely dormant but are quietly accumulating vulnerabilities waiting to bite you. David, a co-chair of the CVE Automation Working Group, explains what a CVE actually is, how the identification and disclosure process works in practice, and why AI tools like Mythos are dramatically accelerating the pace at which new vulnerabilities are found — on both sides of the wall.

Spring Boot 3.5 EOL — The CVE Blind Spot Nobody Talks About

Sun, 19 Apr 2026 13:37:13 +0000

Tomorrow I start (o so early) for JCON Europe in Cologne and then, at the tail end of the week, go to Devoxx France to give more talks. If you’re at either, come say hi. Herodevs has a booth at both.

After digging into the CVE stories behind Tomcat 8.5’s end of life , I turned my attention to Spring Boot 3.5. Same question, different framework: what actually happens to your security posture when a project crosses the EOL line?

Why Java Developers Over-Trust AI-Generated Code

Thu, 09 Apr 2026 10:45:36 +0000

This article is adapted from The Confidence Trap , part of the “2026 Supply Chain Reckoning” series on my No Regressions newsletter.

Your boss calls you on a Friday afternoon. He’s read all the available data, he tells you with absolute confidence, and he’s decided that migrating from Spring Boot 3.5 to 4.0 will be straightforward. Wants it done over the weekend.

You’d push back. You’d ask which data. You’d point out the breaking changes.

Best practices for Mastering AI Agents, Subagents, Skills & MCP

Mon, 30 Mar 2026 18:55:59 +0000

A practical guide to the five best practices every developer should apply when working with AI agents, subagents, skills and MCP servers — from choosing the right model and writing precise prompts, to defining agent behaviour with SDD, isolating context with Claude Code subagents, securing MCP calls, and guiding agent response quality with guardrails.

§0 📖 Where This Fits in the Series

This article assumes you already know what MCP is and have used or built at least one Agent.

DPoP: What It Is, How It Works, and Why Bearer Tokens Aren't Enough

Mon, 09 Mar 2026 08:08:06 +0000

DPoP is one of the most exciting developments in the IAM (Identity and Access Management) space in recent years. Yet many backend developers either have not heard of it or are unsure what it actually changes. In this article, I will break down what DPoP is, what problem it solves, and walk through a working implementation with Keycloak and Quarkus.

What is DPoP?

DPoP (Demonstration of Proof-of-Possession) is an OAuth 2.0 security mechanism defined in RFC 9449 . Its core purpose is simple: cryptographically bind an access token to the client that requested it. This way, even if a token is intercepted, it cannot be used by another client.

Tomcat TLSv1.3 cipher configuration

Thu, 26 Feb 2026 18:02:34 +0000

A recent update to Apache Tomcat introduced a subtle but significant change to how TLS cipher suites are configured. If your Spring Boot application explicitly configures TLS ciphers, particularly TLSv1.3 ciphers, and runs on Tomcat 9.0.115+ (Spring Boot 2.x), 10.1.52+ (Spring Boot 3.x), or 11.0.18+ (Spring Boot 4.x), your cipher configuration may be silently ignored.

Prior to the change, Tomcat used a single ciphers attribute on the SSL connector to configure cipher suites for all TLS versions. Starting with the versions of Tomcat listed above (Tomcat commit ), this attribute was split:

Shai-Hulud and the npm Worm: How Speed-Optimised Dev Ecosystems Made a Self-Propagating Supply Chain Attack Inevitable

Thu, 12 Feb 2026 11:47:48 +0000

first, a word about ecosystems

Before we dive into Shai-Hulud, before we label it “sophisticated” or “advanced” or “next generation,” we need to be honest about something.

The worm didn’t appear in a broken system. It appeared in the one we deliberately optimised.

In the book Dune, the worm is integral to the ecosystem. The planet, its environment, and the worms are deeply interconnected.

That’s true for the cyber-worm equivalent. The worm is an entirely predictable outcome of the ecosystem in which we, as developers, are part

Security Doesn’t Start at Liftoff

Fri, 23 Jan 2026 10:22:31 +0000

This is a follow-on to the article The Real Mechanics of Vulnerabilities in an Upstream/Downstream, Topsy-Turvy EOL World .

What you’ll learn in this article:

The Security Timeline Inversion: CVE disclosure is no longer the true start of the security timeline.
Security Outcomes: Routine maintenance decisions, not reaction speed or tooling, determine security outcomes.
Flawed Indicators: CVE scores, scanners, and compliance deadlines are not effective early-warning systems.
Vulnerability Distortion: Embedded, forked, and end-of-life components obscure vulnerability visibility and responsibility.
Your Mission: Governance and lifecycle changes are necessary to avoid being structurally late to “silent” vulnerabilities.

Are you sitting comfortably?

In February 2025, Apache Tomcat shipped a set of routine point releases. They arrived without urgency, without commentary, and without the kind of noise that can accompany significant security incidents.

SonarQube AI Code Assurance & MCP: Auto-Fix Java (Part 4)

Mon, 19 Jan 2026 15:27:14 +0000

Hola Java developers! 👋

Welcome to the Grand Finale of our series.

Part 1 : We turned your IDE into a fortress.
Part 2 : We synced the team with Connected Mode.
Part 3 : We secured the Supply Chain (dependencies).

We have become excellent at finding bugs. But let’s be honest: Finding them is only half the battle. Who is going to fix them?

We are drowning in a backlog of “Technical Debt,” “Code Smells,” and “Security Hotspots.” You don’t have enough hours in the day to refactor every complex method or research the perfect fix for a regex denial-of-service vulnerability.

Optimizing Java for the Cloud-Native Era with Quarkus

Tue, 06 Jan 2026 21:09:00 +0000

This article explores how Quarkus can help organizations reduce costs, streamline development, and modernize their Java applications for today’s cloud-native environments. It outlines the real-world benefits of adopting Quarkus and highlights how its core features address the performance and scalability challenges commonly associated with traditional Java frameworks.

Quarkus is already being adopted across industries. One example is Orange, a global telecom provider that selected Quarkus to support its 5G API initiative, and benefited from fast startup times, a lightweight footprint, and seamless integration with Kubernetes.

Quarkus: A Runtime and Framework for Cloud-Native Java

Tue, 06 Jan 2026 13:46:50 +0000

Public clouds such as AWS, Microsoft Azure, and Google Cloud, and platforms like Red Hat OpenShift, favor services that start fast and stay lean. Quarkus is engineered for exactly that.

Build time processing reduces runtime overhead and results in rapid startup, a small memory footprint, and frictionless deployment across Kubernetes, OpenShift, serverless, and managed container services in any cloud. If your Java services need to start in milliseconds, run dense on shared nodes, and still feel great to build, Quarkus was made for that job.

Stop the trojan horse in your pom : SonarQube Advace Security

Mon, 22 Dec 2025 10:42:41 +0000

Hola Java developers! 👋

Welcome to Part 3.

In Part 1 , we turned your IntelliJ into a security guard.
In Part 2 , we connected it to the server to enforce the Quality Gate.

We are feeling good. Our code is high quality. Our logic is sound. But here is the scary reality: In a modern Spring Boot application, you only wrote about 10% of the code.

The other 90%? It comes from Maven Central. It’s Hibernate, Jackson, Apache Commons, Spring Security… You are building a house, and you made sure your bricks are solid. But did you check if the foundation you bought from a stranger is made of explosive material? 🧨

The Real Mechanics of Vulnerabilities in an Upstream/Downstream, Topsy-Turvy EOL World

Fri, 19 Dec 2025 13:36:28 +0000

In this article you’ll learn

Why CVEs record that a vulnerability exists, not that a usable fix exists
How vulnerabilities are often discovered and fixed downstream before upstream ever acknowledges them
Why EOL branches continue to accumulate exploitable behaviour even when no CVEs appear
How downstream-only patches break the assumptions scanners and SBOMs rely on
What disclosure actually enables when “just upgrade” is not a viable option

Introduction

There is a tidy, almost academic version of how software security is supposed to work. It appears in conference talks, compliance documents and in the cheerful diagrams seen on marketing slides. It usually looks something like this:

The 5 Knights of the MCP Apocalypse 😱

Tue, 09 Dec 2025 15:55:41 +0000

Let’s talk about that new MCP (Model Context Protocol) Server your team is using to connect to your real data services. It’s awesome, right? It’s the “magic box” that gives your AI Agent access to the real world—live databases, internal APIs, and all your tools.

But here’s the catch: you don’t own the code. 🚫

It’s a vendor product, an open-source project, or another team’s platform. You can’t just change its code when you find a security hole, unless you have the code and recompile it and deploy it.

Java Security Starts with the JVM

Mon, 10 Nov 2025 12:37:20 +0000

When it comes to Java security, the first thing that comes to mind should be the JVM. If you’re relying on outdated, unpatched, or unsupported Java runtimes, you’re taking unnecessary risks.

In this article, you will learn:

Timely, predictable updates are critical for Java security
Long-term security hinges on long-term support
If your Java runtime is compromised, every application that runs on it could be compromised too
As environments become cluttered with multiple JDK versions and unpatched workloads, organizations lose visibility into what’s deployed

When it comes to securing your Java applications, the JVM might not be the first thing that comes to mind—but it should be. Your JDK isn’t just a runtime; it’s part of your software supply chain. If you’re relying on outdated, unpatched, or unsupported Java runtimes, you’re taking unnecessary risks.

JC-AI Newsletter #8

Thu, 30 Oct 2025 06:36:12 +0000

Fourteen days have passed, and it is time to present a fresh collection of readings that could influence developments in the field of artificial intelligence.

This newsletter focuses on examining how AI enhances productivity through enterprise studies, agentic system architecture, attack vectors, Model Context Protocol (MCP) implementation, Agent-to-Agent (A2A) protocol, Java code generation within IDEs, LLM benchmarking methodologies, and the security challenges arising from increased AI-LLM adoption.

The world influenced by LLM is changing very quickly, let’s start…

How Chat Memory Manipulation Can Ruin Your AI System

Thu, 16 Oct 2025 10:45:59 +0000

Do LLMs have any conversational memory?

With the use of ChatGPT, Claude, and Copilot, we are now quite used to chat-based AI assistants that can help us. We’ve all grown accustomed to chatbots that “remember” us and the conversation we had before.

From virtual assistants that recall our preferences to support bots that track our past issues, chat memory feels like a natural part of interacting with digital agents. It’s easy to assume that modern AI models like ChatGPT or other LLM-powered bots possess similar built-in memory.

Save Time and Money by Reducing False Positives

Mon, 23 Jun 2025 08:35:27 +0000

Recently Azul announced that AVD (Azul Vulnerability Detection), which is our solution to scan for security vulnerabilities in production, now comes with a new feature that only makes it possible to identify vulnerable components on a JAR file level but also on class file level.

The Production Scanning Challenge

So what does that mean? Usually, security scanners work in environments from development up to CI/CD, but not in production. The main reason for that is the fact that once you start scanning for vulnerabilities in production, the scanning process itself needs too many resources, which brings down the performance of the system. The performance decrease can be in the range of 10 to 30%, which explains why companies trust security scanners that scan in CI/CD and don’t add additional scans in production.

Ensuring Safe and Reliable AI Interactions with LLM Guardrails

Tue, 17 Jun 2025 07:11:24 +0000

Integrating Large Language Models (LLMs) into our applications is becoming increasingly popular. These models are extremely useful for creating content, searching documentation, and solving more complex problems. However, with great power comes great responsibility.

We know that LLMs can and will make mistakes, and while enriching your prompts with the proper context can help align results with your documents and information, risks still remain. Along with the rise of LLMs, new attack vectors are surfacing. Clever prompt injections can lead to misinformation and‌ escalate privacy-sensitive information.

Sonar Connect Amsterdam 2025

Mon, 16 Jun 2025 15:51:13 +0000

Code quality + Code security for Open Source & AI code

In the age of AI, ensuring code quality and code security is more critical than ever. Are you using the best methodologies to introduce GenAI in your company? do you know the risks? have you heard about AI MCP and the benefits ? what about using AI in the full SDLC? do you know the latest features of SonarQube regarding AI and SCA(dependencies vulnerabilities)?

What is RAG, and How to Secure It

Fri, 16 May 2025 11:48:16 +0000

Integrating large language models (LLMs) into your application is more accessible than ever. With a few API calls to OpenAI, Anthropic, or Cohere, you can instantly add ++AI capabilities++ to your stack. Using frameworks and libraries that abstract this away for you makes it even easier to create your own LLM-powered assistant. However, if you’ve shipped any real-world LLM features, you’ve hit the wall where these powerful models confidently make up facts, reference outdated information, or deliver answers that don’t take your context into account.

Time to panic? AI and Cybercrime legislation is on your doorstep now

Thu, 10 Apr 2025 07:25:52 +0000

As we settle into 2025, legislation around AI and cybercrime is no longer a distant threat or vague aspiration. It’s here, real, and it’s already changing how companies must build, deploy, and secure intelligent systems.

If you’re a developer, security engineer, or anyone responsible for the software supply chain, it’s time to recalibrate. Here’s what’s coming, who’s shaping it, and what tools are emerging to help navigate the new landscape.

Path Traversal Vulnerability in Deep Java Library (DJL)

Tue, 11 Mar 2025 12:21:50 +0000

Deep Java Library (++DJL++ ) is an open source deep learning framework that brings AI capabilities to Java developers without requiring a shift to Python.

It provides an intuitive, high-level API for building, training, and deploying machine learning models, supporting deep learning engines like TensorFlow, PyTorch, and MXNet.

While not as widely adopted as Python-based frameworks, DJL is gaining traction in Java-based AI applications, especially in enterprise software, cloud environments, and financial services.

Creating SBOMs with the Snyk CLI

Fri, 07 Mar 2025 12:25:36 +0000

The software bill of materials (SBOM) is quickly becoming an essential aspect of open source security and compliance. In this post, we’ll delve into what SBOMs are, why they’re necessary, and their role in open source security.

What are SBOMs?

A software Bill of Materials (SBOM) is a comprehensive inventory of all components used in a software product. They include all the necessary details about each component, such as their names, versions, and licensing information. SBOMs can be seen as the ingredients list for software, providing complete transparency into what makes up a software product.

Code Reviews with AI a developer guide

Fri, 07 Mar 2025 12:10:37 +0000

Code reviews are a cornerstone of software development. They’re where we share knowledge, catch bugs early, and ensure our code meets the highest standards.

But let’s be honest…

Traditional code reviews can be time-consuming and tedious and sometimes even miss subtle yet critical issues. Enter the age of AI-powered code review, a game-changer that addresses these challenges and elevates code quality to new heights.

This article dives into the common pitfalls of code reviews and explores how AI tools can revolutionize each phase of the development lifecycle.

Securing Vaadin Applications with Microsoft Entra

Wed, 26 Feb 2025 12:55:43 +0000

Many companies use Microsoft 365, so letting users log in with their Microsoft account is a good choice. This blog post shows how to secure your Vaadin applications using Microsoft Entra for authentication and authorization and explains how Karibu Testing must be configured.

Step 1: Create an Application in Entra

The first step is to create an application, configure roles, assign users, and set the redirect URI.

To create an application, log in to http://entra.microsoft.com and select “Applications” -> “Enterprise applications.” There, you can create a new application. Select “Register an application to integrate with Microsoft Entra ID (App you’re developing).”

Pseudorandom Number Generators - The Secret Behind Santa’s Gift Bag

Thu, 02 Jan 2025 14:51:10 +0000

On a snowy Christmas Eve, Santa sets off on his journey around the world, gliding through the night sky on his sleigh to deliver presents to children everywhere.

It’s one of the busiest nights of the year for Santa, as children eagerly await their special gifts. With his magical gift bag which provides an endless supply of presents, Santa ensures no one is ever disappointed. To those watching, the gifts might seem to appear randomly, but Santa knows precisely which gift to deliver next, following an order only he can understand.

Foojay Podcast #63: How do we keep your Java applications up to date and secure?

Mon, 16 Dec 2024 12:41:10 +0000

Last month, I published a Foojay article about the risks in systems that are stuck on old or outdated Java versions and got a lot of feedback from developers . Most of them want to move on but get stuck on management decisions, outdated production environments, or one of the many other reasons that keep systems stuck on old Java versions and dependencies.

Do you want to bring your system from Java 8 to 23? Did you know that Java 17 already has 13 security releases? And that you can use tools like OpenRewrite to help you update your code?

Prevent LDAP injection in #java 💥💉with #springboot

Wed, 04 Dec 2024 14:45:35 +0000

LDAP (Lightweight Directory Access Protocol) is essential for managing and accessing directory information in Java web applications. However, it’s crucial to understand and prevent LDAP Injection, a serious security vulnerability that can lead to unauthorized access and data breaches.

Following OWASP Recommendations , such as validating user inputs and using parameterized queries, is vital for securing your applications. In this article, we’ll dive into LDAP, explore LDAP Injection, share OWASP’s best practices, and demonstrate secure coding in Spring Boot.

Foojay Podcast #58: How Java Developers Can Secure Their Code

Mon, 30 Sep 2024 07:43:46 +0000

Three years after Log4Shell caused a significant security issue, we still struggle with insecure dependencies and injection problems.

In this podcast, we’ll discuss how developers can secure their code.

I talked with three authors who posted a security and code quality post on Foojay.io.

Video

Podcast Apps

You can listen and subscribe to the Foojay Podcast on:

The Persistent Threat: Why Major Vulnerabilities Like Log4Shell and Spring4Shell Remain Significant

Tue, 17 Sep 2024 16:17:07 +0000

This article was originally published at Snyk.io

As developers, we’re constantly juggling features, fixes, and deadlines. Yet, a lurking issue has been surprisingly overlooked: the continued use of vulnerable Log4j and Spring Framework versions in many projects.

Despite the high-profile exposure of Log4Shell and Spring4Shell vulnerabilities, a shocking number of applications are still running on these ticking time bombs. This isn’t just a minor oversight — it’s a major risk. We’re builders at heart, but part of building is ensuring our structures are safe.

Java: Where the Wild Code Isn't (On Security and Modularity)

Tue, 17 Sep 2024 08:41:00 +0000

In the last several years, the OpenJDK community has made Java significantly safer for users and developers while at the same time making it easier to design, build, and run applications quickly.

There are two core aspects that have led to this:

A secure JDK, where vulnerabilities are dealt with and patched.
A modular JDK, where different types or risk can be clearly delineated.
A Secure JDK {#h2-0-1-a-secure-jdk}

The core Java platform underlies all Java applications and is kept secure by a special OpenJDK Vulnerability Group. This group helps to perform different actions and security regression tests like fuzzing and ensuring old vulnerabilities do not recur.

Top Security Flaws hiding in your code right now

Thu, 05 Sep 2024 16:41:02 +0000

Recent years have seen numerous injection attacks causing significant damage, including a 2019 SQL injection breach in the Fortnite video game and a 2018 attack on Tesla’s systems.

Other serious incidents involve the Log4Shell logging injection and a deserialization attack on Atlassian Jira. These examples show that various code vulnerabilities can affect any organization. This article will examine the three most common attack types—SQL injection, Deserialization Injection, and Logging Injection—and discuss ways to prevent them.

Four Easy Ways to Analyze your Java and Kotlin Code for Security Problems

Fri, 30 Aug 2024 09:07:43 +0000

Originally published at Snyk.io .

Nowadays, the security of your applications is just as important as the functionality they provide. Therefore, analyzing your code for security vulnerabilities is a vital part of maintaining the integrity of your applications and protecting your users’ data. As developers, we are at the front lines of this battle. It’s our responsibility to ensure that the code we write is not just functional and efficient but also secure.

IBM Semeru Runtimes for Java includes FIPS 140-3 certified cryptography

Tue, 27 Aug 2024 08:55:26 +0000

IBM® Semeru Runtimes™ for Java™ 11, 17, 21+ now includes FIPS 140-3 cryptography (certified by the U.S. National Institute of Standards and Technology; NIST ) and is production-ready for Java deployments. FIPS 140-3 is also available in IBM SDK, Java Technology Edition, V8.

IBM first made FIPS 140-3 cryptography available as a technology preview more than a year ago, and users responded with helpful feedback on usage and configuration so that the IBM development team could improve its usability. With NIST certification, this capability is now generally available for production deployments on most platforms (with more to come).

Unsupported OpenJDK Distributions are at Risk of Non-Compliance with DORA

Mon, 26 Aug 2024 12:24:05 +0000

For the EU Digital Operations Resilience Act (DORA) to have any meaning at all in the context of OpenJDK (and surely it must have application there since it is explicitly focused on “ICT Assets”, which it defines as broadly as possible as “a software or hardware asset in the network and information systems used by a financial entity”), it can only be interpreted to, at the very least, very strongly encourage the usage of supported OpenJDK distributions.

Connecting Resilience to Performance in Relation to OpenJDK

Thu, 22 Aug 2024 08:22:37 +0000

When considering the connection between performance and resilience in Java, especially in the context of OpenJDK distributions, specific distributions—like Azul Platform Prime , which includes Azul Zing, an enhanced build of OpenJDK for superior performance, consistency, and efficiency—offer unique features that can significantly influence how these two aspects are managed.

The Digital Operational Resilience Act (DORA) by the European Union adds another layer of importance to these considerations, particularly for financial institutions operating within the EU, regardless of whether they are themselves EU-based institutions .

Are Critical Vulnerabilities Lurking in Your Java Ecosystem?

Mon, 19 Aug 2024 12:57:59 +0000

Java, the popular object-oriented language renowned for its portability, performance, and security, is often the preferred choice for organisations building everything from enterprise and cloud-native applications to Android apps.

However, despite these strengths, Java’s popularity and the complex ecosystem of third-party libraries it relies upon have also made it a prime target for malicious actors to exploit vulnerabilities. According to the Datadog “State of DevSecOps”[1] report, a staggering 90% of Java services are susceptible to one or more critical or high-severity vulnerabilities, often stemming from external dependencies, compared to an average of 47% for other technologies. This discrepancy is concerning and points to inherent issues within the Java ecosystem.

The Impact of the EU DORA Act on Non-EU Financial Organizations

Wed, 14 Aug 2024 05:33:09 +0000

The EU Digital Operational Resilience Act (DORA) is a significant regulatory framework designed to strengthen the digital resilience of financial institutions within the European Union.

While the primary focus of DORA is on EU-based entities, its impact extends beyond the EU’s borders, particularly to financial organizations outside the EU that have business ties with the region.

Here’s how DORA impacts financial organizations outside the EU.

1. Third-Party Service Providers

Scope of Regulation. DORA covers not just financial entities within the EU but also third-party service providers, including Cloud services, software providers, and IT services. If these providers serve EU financial institutions, they must comply with DORA’s requirements, even if they are based outside the EU.
Increased Compliance Costs. Non-EU service providers might need to invest in compliance infrastructure to meet DORA standards, which include stringent cybersecurity measures, operational resilience requirements, and incident reporting protocols.
Operational Changes. These providers may need to adapt their operations to comply with DORA’s requirements, potentially impacting service delivery, pricing, and contractual arrangements with their EU clients.

2. Cross-Border Operations

EU Subsidiaries. Non-EU financial organizations with subsidiaries or branches in the EU must ensure that these entities comply with DORA. This might require significant changes in internal processes, governance structures, and IT systems.
Data Protection and Transfer. DORA’s focus on operational resilience and cybersecurity intersects with data protection regulations. Non-EU organizations must ensure that data transfers and processing are compliant with EU standards, which could involve changes in data management practices.

3. Competitive Pressure

Market Access. To maintain or gain access to the EU market, non-EU financial organizations must align with DORA’s requirements. Failure to comply might restrict their ability to operate within the EU or provide services to EU-based clients.
Reputation and Trust. Organizations that proactively comply with DORA may gain a competitive edge by being seen as trustworthy and secure partners. Conversely, those that lag may face reputational risks, especially in a market increasingly focused on cybersecurity and operational resilience.

4. Indirect Impact Through Business Relationships

Supply Chain Scrutiny. DORA requires EU financial entities to ensure that their supply chain, including non-EU entities, adheres to operational resilience standards. Non-EU organizations in these supply chains may face increased scrutiny and pressure to comply with DORA, indirectly impacting their operations and costs.
Contractual Obligations. Financial institutions in the EU may impose new contractual obligations on non-EU partners to ensure DORA compliance. This could lead to renegotiation of contracts and increased legal and operational overheads for non-EU entities.

5. Global Regulatory Influence

Precedent for Other Jurisdictions. DORA could set a precedent, encouraging other jurisdictions to adopt similar regulatory frameworks. Non-EU financial organizations may find themselves needing to adapt to a broader wave of operational resilience regulations globally, beyond just the EU.

6. Impact on Financial Services Market

Barrier to Entry. DORA’s stringent requirements might act as a barrier to entry for smaller or less-resourced non-EU financial firms seeking to enter the EU market, potentially limiting competition.
Innovation and Fintech. While aiming to enhance security, DORA may also slow down innovation, as non-EU fintech firms might find the compliance burden heavy, possibly leading to a more cautious approach in launching new products or services in the EU.

Summary

The EU DORA Act significantly impacts financial organizations outside the EU, especially those providing services to or operating within the EU.

Trash Pandas Love Enterprise Java Garbage Code

Tue, 13 Aug 2024 08:16:55 +0000

If raccoons were software engineers, they would feel at home inside many enterprise systems. These systems are often full of unused and dead code that was written, fully tested, then altered in a way that prevents teams from ever running it.

This garbage code — a raccoon’s favorite — is a maintenance burden that developers must work around to keep passing tests while other major changes are made. This code often doesn’t end up in the trash because it’s hard to know what can be safely removed without breaking the application. But you can better identify bad code if you understand how to look for it.

Are Java Security Updates Important?

Sat, 03 Aug 2024 14:56:00 +0000

Recently, I was in discussion with a Java user at a bank about the possibilities of using Azul Platform Core (formerly known as Zulu) to run a range of applications. One of the most significant advantages for mission-critical enterprise applications is knowing that you have access to the latest security patches and bug fixes. With Platform Core, these are provided within a defined SLA after the embargo for updates is lifted (this is essentially the point in time when Oracle releases the update to their JDK).

Consequences of DORA on Java and OpenJDK with Azul

Fri, 02 Aug 2024 13:49:44 +0000

The EU’s Digital Operational Resilience Act (DORA) is a regulatory framework aimed at enhancing the digital operational resilience of financial institutions within the European Union.

Its primary goal is to ensure that financial entities can withstand, respond to, and recover from all types of ICT-related disruptions and threats, such as cyberattacks.

DORA establishes a uniform set of requirements for managing ICT risks across the financial sector, promoting a harmonized approach to digital resilience.

The Impact of the Digital Operational Resilience Act (DORA) on Java Investment with Azul

Sun, 14 Jul 2024 13:26:13 +0000

The Digital Operational Resilience Act (DORA) , Regulation (EU) 2022/2554 ,is a key piece of European Union legislation focused on strengthening the resilience of the financial sector against digital operational risks, such as cyber attacks and other ICT-related disruptions.

DORA is part of the broader Digital Finance Package introduced by the European Commission to enable innovation and competition in the financial sector while ensuring its security and resilience.

It is focused on enhancing ICT risk management, strengthening cybersecurity, ensuring continuity and recovery, managing risks arising from dependencies on third-party ICT service providers, and incident reporting.

Foojay Podcast #52 from JCON in Cologne!

Mon, 10 Jun 2024 09:32:12 +0000

This is part 4 of the JCON interviews!

In this episode, we have 5 new guests for you.

We start with garbage collectors and Intelligence Cloud, a tool created by Azul to find out which of your code is actually used in production and which dependencies are known to have vulnerabilities. My colleague Gerrit Grunwald was at JCON to give a talk about these subjects.
With Balkrishna Rawool we dove into Virtual Threads, a very interesting topic as concurrency and threads can be challenging…
Piotr Przybyl came to JCON to give a talk about Test Containers and how to test your application in an environment that is similar to your production environment. Another important topic related to testing is Flaky Tests. How do you handle tests that only fail from time to time and make your whole test report unreliable?
François Martin had a talk about this subject, and he came to the conference together with Annelore Egger, who was one of the many volunteers.

Video

Podcast Apps

You can listen and subscribe to the Foojay Podcast on:

Foojay Podcast #50: JCON Report, Part 2 - Maven, Software Security, Code Quality

Mon, 27 May 2024 08:07:54 +0000

This is part 2 of the interviews we recorded at the JCON conference earlier this month in Germany. In this episode, you get two main topics: Maven and Code Quality.

In the first part, you’ll hear Karl Heinz Marbaise and Steve Poole discuss the Maven project, the repository, Sonaytype, and the security impact of dependencies.

But next to security, we developers are also responsible for creating readable and maintainable code. Miro Wengner, Marit van Dijk, and Hinse ter Schuur dive into this topic, in the second part!

Improve DevOps Productivity with Azul Intelligence Cloud for Any JVM

Fri, 24 May 2024 09:46:34 +0000

For decades DevOps teams have been under pressure to do four things: make software faster, make it cheaper, keep it secure, and accelerate time to market.

But with fewer engineering resources, enterprises that use Java must find a way to speed up application innovation and fortify application security across their entire Java estate more efficiently.

The rewards (and costs of not doing so) are high – companies in the top quartile of McKinsey’s Developer Velocity Index (DVI) perform significantly higher than bottom-quartile companies:

Secure your API with these 16 Practices with Apache APISIX – part 2

Mon, 11 Mar 2024 09:39:24 +0000

We’ve listed 16 practices to help secure one’s APIs and described how to implement them with Apache APISIX.

~~Authentication 🕵️️ - Verifies the identity of users accessing APIs.~~

~~Authorization 🚦 - Determines permissions of authenticated users.~~

Data Redaction 🖍️ - Obscures sensitive data for protection.

Encryption 🔒 - Encodes data so only authorized parties can decode it.

Error Handling ❌ - Manages responses when things go wrong, avoiding revealing sensitive info.

~~Input Validation & Data Sanitization 🧹 - Checks input data and removes harmful parts.~~

Intrusion Detection Systems 👀 - Monitor networks for suspicious activities.

~~IP Whitelisting 📝 - Permits API access only from trusted IP addresses.~~

~~Logging and Monitoring 🖥️ - Keeps detailed logs and regularly monitors APIs.~~

~~Rate Limiting ⏱️ - Limits user requests to prevent overload.~~

Secure Dependencies 📦 - Ensures third-party code is free from vulnerabilities.

Security Headers 📋 - Enhances site security against types of attacks like XSS.

Token Expiry ⏳ - Regularly expiring and renewing tokens prevents unauthorized access.

Use of Security Standards and Frameworks 📘 - Guides your API security strategy.

Web Application Firewall 🔥 - Protects your site from HTTP-specific attacks.

API Versioning 🔄 - Maintains different versions of your API for seamless updates.

Let’s now look at the remaining practices.

Secure your API with these 16 Practices with Apache APISIX - part 1

Mon, 11 Mar 2024 09:35:51 +0000

A couple of months ago, I stumbled upon this list 16 practices to secure your API :

Authentication 🕵️️ - Verifies the identity of users accessing APIs.

Authorization 🚦 - Determines permissions of authenticated users.

Data Redaction 🖍️ - Obscures sensitive data for protection.

Encryption 🔒 - Encodes data so only authorized parties can decode it.

Error Handling ❌ - Manages responses when things go wrong, avoiding revealing sensitive info.

Input Validation & Data Sanitization 🧹 - Checks input data and removes harmful parts.

Intrusion Detection Systems 👀 - Monitor networks for suspicious activities.

IP Whitelisting 📝 - Permits API access only from trusted IP addresses.

Logging and Monitoring 🖥️ - Keeps detailed logs and regularly monitors APIs.

Rate Limiting ⏱️ - Limits user requests to prevent overload.

Secure Dependencies 📦 - Ensures third-party code is free from vulnerabilities.

Security Headers 📋 - Enhances site security against types of attacks like XSS.

Token Expiry ⏳ - Regularly expiring and renewing tokens prevents unauthorized access.

Use of Security Standards and Frameworks 📘 - Guides your API security strategy.

Web Application Firewall 🔥 - Protects your site from HTTP-specific attacks.

API Versioning 🔄 - Maintains different versions of your API for seamless updates.

While it’s debatable whether some points relate to security, e.g.,, versioning, the list is a good starting point anyway. In this two-post series, I’d like to describe how we can implement each point with Apache APISIX (or not).

Hardening Apache APISIX with the OWASP's Coraza and Core Ruleset

Tue, 20 Feb 2024 08:01:56 +0000

The Open Worldwide Application Security Project is an online community that produces freely available articles, methodologies, documentation, tools, and technologies in the fields of IoT, system software and web application security. The OWASP provides free and open resources. It is led by a non-profit called The OWASP Foundation. The OWASP Top 10 - 2021 is the published result of recent research based on comprehensive data compiled from over 40 partner organizations.

Migrate to Spring Boot 3.2 with OpenRewrite

Tue, 06 Feb 2024 08:17:07 +0000

As a developer, we frequently face the challenges of migrating to newer versions of frameworks and refactoring code. However, we can effortlessly achieve these tasks with the assistance of OpenRewrite . OpenRewrite provides a stack of recipes specifically designed for migration purposes. By utilizing the appropriate recipes and integrating with the rewrite plugin, we can effectively migrate our code.

Two months ago, the Spring Boot 3.2 version released, bringing numerous changes to the framework. If you are involved in multiple projects and require migrating to the latest version, developers may find manually updating all the code repositories with the necessary upgrade changes a challenging task.

Securing Symmetric Encryption Algorithms in Java

Fri, 29 Dec 2023 05:53:50 +0000

In our connected world, securing digital data has become an utmost priority. With the wide spread of Java applications in various sectors, from banking to healthcare, we must emphasize the importance of encryption. Encryption is converting readable data or plaintext into unreadable data or ciphertext, ensuring that even if encrypted data is intercepted, it remains inaccessible to unauthorized individuals.

The first choice you must make as a developer is whether you need encryption. Although this sounds like a strange question, the key principle of encryption is that the ciphertext can be reverted into the original text.

Handling security vulnerabilities in Spring Boot

Fri, 22 Dec 2023 14:59:10 +0000

In the world of software development, managing dependencies is a core part of creating strong and secure applications. Spring Boot, a favorite among Java developers, makes building applications easier, but there’s more to it than meets the eye. Keeping your dependencies in check is crucial to ensure that your Spring Boot projects run smoothly and remain resilient in the face of ever-evolving threats.

One critical aspect of Spring Boot dependency management is security. Software vulnerabilities are discovered frequently, and by keeping your project’s dependencies up to date, you’re essentially putting on your digital security armor. Outdated dependencies can be like unlocked doors, inviting trouble from potential threats, and that’s something we’d like to avoid.

State of the Software Supply Chain Report: Key Takeaways for Java Developers

Thu, 12 Oct 2023 08:19:25 +0000

Sonatype have just released the 9th edition of their State of the Software Supply Chain Report . It delves into the landscape of open source, software development, and software supply chain security. I thought I’d pull out some highlights for Java Developers!

Software Supply Chains and Open Source

Maven Central hits 1 Trillion downloads

Open source adoption continues to grow, with Java (Maven) being a significant ecosystem.

The report indicates that Java projects and their versions have seen substantial growth. a 28% year-over-year increase in total projects available on Maven Central - hitting the amazing 1 Trillion download number.

Using JLink to create smaller Docker images for Spring Boot apps

Thu, 21 Sep 2023 11:33:05 +0000

Containers bring new flexibility and agility to software development and deployment. However, they also introduce a new attack surface that malicious actors can exploit. A compromised container can give an attacker access to other containers and even the host system. Smaller images that contain fewer artifacts are already a great help in achieving a smaller attack surface.

In this article, we’ll present an in-depth exploration of utilizing JLink to optimize Docker image sizes, enhancing application security and performance. We’ll showcase how to use JLink and integrate it with Docker to efficiently deploy your Spring Boot or general Java applications.

Thread-Safe Counter in Java: A Comprehensive Guide

Thu, 17 Aug 2023 06:59:29 +0000

In this tutorial, we will explore the concept of thread safety in Java, specifically focusing on a simple counter.

We will start by understanding why a basic counter is not safe for multiple threads; then, we will progressively enhance its thread safety using different techniques such as synchronization, locks, Unsafe, VarHandle, and finally, AtomicInteger.

We will be referencing the code from this repository throughout the tutorial.

Before we dive into the different implementations, let’s define a Counter interface that all our counter classes will implement.

Book Review: "OpenJDK Migration for Dummies"

Fri, 04 Aug 2023 09:02:46 +0000

The subject of Java licensing and OpenJDK migration is complex and vital to many software engineers. I am no different. It’s a topic often shrouded in legal jargon and technicalities, making it difficult to approach.

“OpenJDK Migration for Dummies” bySimon Ritter offers a fresh perspective, breaking down these challenges into digestible segments. (Get it for free here. )

[

](https://www.azul.com/openjdk-migration-for-dummies/ )

The book directly speaks to my core expertise in Java, providing clarity and guidance.

SnakeYaml 2.0: Solving the unsafe deserialization vulnerability

Thu, 20 Jul 2023 07:17:16 +0000

In December of last year, we reported ++CVE-2022-1471++ to you. This unsafe deserialization problem could easily lead to arbitrary code execution under the right circumstances.

In the deep-dive blog post “++Unsafe deserialization vulnerability in SnakeYaml (CVE-2022-1471)++ ”, I explained the problems in this library and how it could be executed. The gist of the problem was that by default SnakeYaml parsed the incoming yaml to the generic object type.

Understanding Security Vulnerabilities: Preventing Attacks

Thu, 06 Jul 2023 12:49:42 +0000

When I was a teenager, our local telephone company introduced a new service - the premium phone calls (AKA 1-900 numbers).

The fun part was that we discovered a workaround to these charges by dialing the sequential local numbers which these 1-900 numbers would redirect to.

If the “support number” for the 1-900 was 555-555 we would dial every number between 555-455 and 555-655 until we hit the jackpot…

Hours were spent dialing these numbers, leading us to make numerous calls for free. This attack is still prevalent today, and it’s called Insecure Direct Object References (IDOR).

Preventing Cross-Site Scripting (XSS) in Java with Snyk Code

Fri, 09 Jun 2023 15:23:39 +0000

Java is a powerful backend programming language that can also be used to write HTML pages for web applications. However, developers must know the potential security risks associated with Cross-Site Scripting (XSS) attacks when creating these pages.

With the rise of modern templating frameworks, preventing security attacks through proper input validation and encoding techniques has become easier.

However, when developers choose to create their own HTML pages without using a templating framework, there is an increased risk of introducing vulnerabilities.

State of Java Survey

Tue, 23 May 2023 05:47:41 +0000

Do you ever wonder what OpenJDK distributions and what Java versions your peers are using? Java-based infrastructures and languages? How many are running Java applications in public clouds?

THE SURVEY DESCRIBED BELOW IS NOW COMPLETE, NO MORE RESPONSES CAN BE ACCEPTED.

Azul has been gathering all that data from a survey of Java users, running until 6:30pm CT on June 15, 2023. If you want to participate, the survey takes about 10 minutes, and we’ll hook you up with the report after the survey is complete. Plus you’ll be helping to add to our collective knowledge. Plus you’ll be entered into a drawing to win prizes like an Apple MacBook Pro laptop or a set of AirPods.

Analyzing dependencies in IntelliJ IDEA

Thu, 11 May 2023 09:33:40 +0000

If you’re working on a real world project, you’re probably using external dependencies.

You might need to analyze which dependencies your application uses.

For example, you may want to find out how a particular version of a dependency ended up in your application.

Let’s take a look at how IntelliJ IDEA can help you to analyze dependencies.

We can view our dependencies in the Maven or Gradle tool window.

Here, we can expand dependencies to show their transitive dependencies, or collapse them again.

Using Bots to Keep Dependencies Updated

Mon, 27 Mar 2023 15:18:33 +0000

Any real world Java project will likely use external dependencies.

As we’ve seen over the last few years, it’s important to keep these dependencies up to date. We used to have to manually check for updates, but fortunately these days there are tools available that can help us with this. Because, let’s be honest, most developers don’t enjoy maintaining applications.

We’d much rather be using cool new tools and/or language features, and solving interesting problems. Sorry, I mean: delivering business value! But we are responsible for keeping our dependencies up to date, so let’s make that as easy as possible.

Java Security: Log4J, the SecurityManager, and Funding

Fri, 24 Mar 2023 09:28:00 +0000

A demonstration of log4j exploits, which defenses people tried, and which worked.

We’ll cover how groups responded effectively to patch to see what was common.

We’ll also look at open source funding models, subscriptions, and bug bounty programs to see why it’s sometimes hard to donate.

This talk uses actual exploit code that takes over systems through their log messages to open calculators.

Mitigating Path Traversal Vulnerabilities in Java

Fri, 24 Mar 2023 07:57:06 +0000

Path traversal is a type of security vulnerability that can occur when a web application or service allows an attacker to access server files or directories that are outside the intended directory structure.

This can lead to the unauthorized reading or modification of sensitive data.

In the context of file uploads, a path traversal vulnerability can occur when an application fails to properly validate the file path specified by the user, which can allow the attacker to upload a malicious file with a filename that gives them access to restricted files on the server.

Predicting Secure Java Projects on Maven Central

Thu, 23 Mar 2023 14:10:02 +0000

If you’ve searched for Maven Central components in the last six months, you may have noticed some pretty big changes to the website, including a UI facelift and some new component analysis tools like BOM Doctor and the Sonatype Safety Rating.

It’s no coincidence that many of these changes are security related. Maven Central, along with public code repositories, are the first line of defense when it comes to supply chain security.

How to create SBOMs in Java with Maven and Gradle

Fri, 17 Mar 2023 09:08:28 +0000

When building applications in Java, we highly depend on external libraries and frameworks. And each Java package that is imported likely also depends on more libraries. This means that the amount of Java packages included in your application is often not really transparent.

As a developer, these nested (transitive) dependencies create the problem that you probably do not know all the libraries you are actually using.

Recently, we discussed why and how we should maintain our dependencies carefully. In the article Best practices for managing Java dependencies , I discussed the options and tools available for setting up a dependency management strategy.

Authenticate with OpenID Connect and Apache APISIX

Thu, 09 Mar 2023 07:51:47 +0000

Lots of companies are eager to provide their identity provider: Twitter, Facebook, Google, etc. For smaller businesses, not having to manage identities is a benefit. However, we want to avoid being locked into one provider.

In this article, I want to demo how to use OpenID Connect using Google underneath and then switch to Azure.

OpenID Connect

The idea of an authorization open standard started with OAuth around 2006. Because of a security issue, OAuth 2.0 superseded the initial version. OAuth 2.0 became an in 2012:

Making SBOMs, Threats, and Modelling Them a Piece of Cake!

Tue, 07 Mar 2023 09:15:56 +0000

The third in a series of SBOMs, software supply chains, the government and you (you too, no exceptions).

Yes, just like the previous articles, we have cake this time too - this one is a three tiered extravaganza!

So… still with us? Good!

Earlier, Steve Poole showed us his digital mixing bowl, telling us how applications and their dependencies were like ingredients to a fancy cake .

Jamie Coleman then made sure there were no soggy bottoms (one for the Mary Berry fans), by explaining how SCA tools and SBOMs can work together to prevent vulnerabilities .

Java Serialization Filtering: Prevent 0-day Security Vulnerabilities

Fri, 03 Mar 2023 16:04:53 +0000

I’ve been a Java developer long enough to remember the excitement when Sun introduced the concept of serialization in the JVM.

In the world of C, we could just write a struct into a file but this was always problematic. It wasn’t portable and had many issues. But for Java we could just write the class and it “worked”. This was pure magic!

Java was still mostly in use in the client side and when we thought about security, we had different vulnerabilities in mind. The sandbox occupied most of our security discussions.

Make Your Security Policy Auditable

Tue, 28 Feb 2023 11:14:22 +0000

Following from my previous article, I wrote about putting the right feature at the right place .

I used rate limiting as an example, moving it from a library inside the application to the API Gateway.

Today, I’ll use another example: authentication and authorization.

Securing a Spring Boot application

I’ll keep using Spring Boot in the following because I’m familiar with it. The Spring Boot application offers a REST endpoint to check employees’ salaries.

SBOMs and Software Composition Analysis │ Foojay.io

Mon, 27 Feb 2023 08:11:28 +0000

This article is the second in a series about SBOMs, software supply chains, the government and you.

I hope you are still hungry after the first article as more cake is available below!

If you have read the first article in this series that introduces SBOMs SBOMs: First Steps in a New Journey for Developers | Foojay.io then you already know how important they are and will be increasingly going forward.

Update or Upgrade Java... and Which Version Should You Use?

Thu, 23 Feb 2023 09:12:39 +0000

Update versus Upgrade: what’s the difference and what are the consequences of your decision?

Since 2018, every six months we get an upgrade to a new OpenJDK version, and this year versions 20 and 21 will be released.

Next to these six-month releases, OpenJDK distributor Azul, amongst others, provides four critical patch updates (CPU) and patch set updates (PSU) per year.

So what’s the difference between a Java upgrade and an update?

Moving Security into the JVM

Fri, 17 Feb 2023 11:15:35 +0000

The threat model for Java applications is changing, with modern risk coming from the widespread scope and usage of Java and library vulnerabilities.

There are so many different versions of Java (both major and minor versions) and so many systems and libraries that it’s complex to know what everything is, where everything is, and if it’s what’s “out there” poses any security risk.

The new Azul Vulnerability Detection product by Azul is designed to help organizations deal with this evolving threat and manage the large scope of their Java environments.

SBOMs: First Steps in a New Journey for Developers

Tue, 14 Feb 2023 10:01:28 +0000

This article is the first in a series about SBOMs, software supply chains, the government and you. Buckle up - it’s going to be a wild ride. Luckily there is cake to see you through.

Software bill of materials, anyone? A year ago, most developers had not heard of the ‘SBOM’ acronym.

Indeed, related terms like “software supply chain” or “security hygiene” were absent from most developers’ vocabularies.

Things are about to change! This year is already shaping up to be the year of SBOMs, of securing the software supply chain, and of the appearance of legislation that enforces better security practices among those involved in software. Whether in creation, testing, deploying, securing or operating, we all have specific security responsibilities in protecting our part of the software supply chain.

How to Find & Fix Vulnerabilities with IntelliJ IDEA Ultimate

Mon, 13 Feb 2023 09:09:39 +0000

In this article, we’re going to take a look at the Package Checker plugin , that’s bundled with IntelliJ IDEA Ultimate .

We’ll have a look at how to view known vulnerabilities in your Maven or Gradle projects, how to get more information about the known vulnerabilities in a specific dependency and how to remediate these vulnerabilities inside IntelliJ IDEA Ultimate if a new version with a fix is available.

Securing Admin Access to Apache APISIX

Sat, 11 Feb 2023 16:34:59 +0000

API Gateways are critical components in one’s infrastructure.

If an attacker could change the configuration of routes, they could direct traffic to their infrastructure.

Consequences could range from data theft to financial losses.

Worse, data theft could only be noticed after a long time by mirroring the load.

Hence, protecting your API Gateway is of utmost importance.

In this short article, I’ll list a couple of ways to secure your Apache APISIX admin access.

Vaadin, OAuth2, and Keycloak

Tue, 24 Jan 2023 09:34:41 +0000

This article shows how to configure Vaadin and Spring Security to use OAuth2 with Keycloak.

Keycloak

First, we must start Keycloak and configure a realm. The easiest way is to start Keycloak with Docker.
Caution: This is just for development purposes. Don’t use the setup in production.

docker run -d -p 8180:8080 -e KEYCLOAK_ADMIN=admin -e KEYCLOAK_ADMIN_PASSWORD=admin \ 
 quay.io/keycloak/keycloak:20.0.1 start-dev

Now you can log in to the admin console: http://localhost:8180/admin (user: admin, password: admin)

Unsafe Deserialization Vulnerability in SnakeYaml

Thu, 12 Jan 2023 13:19:29 +0000

SnakeYaml is a well-known YAML 1.1 parser and emitter for Java.

Recently, a vulnerability — CVE-2022-1471 — was reported for this package. This vulnerability can lead to arbitrary code execution.

The org.yaml:snakeyaml package is widely used in the Java ecosystem, in part because it is packaged by default with Spring Boot in the spring-boot-starter.

In this article, we look into the security vulnerability affecting this Java library, discuss the potential hazardous impact it may have on your applications, and weigh the actual risks.

Foojay Podcast #7: Security in Java -- what do we need to know?

Mon, 21 Nov 2022 10:22:14 +0000

For this Foojay Podcast**,** we invited security experts to dive into the fascinating world of secure coding and detecting vulnerabilities in your Java applications.

How can you make and keep your systems safe?

That’s what we want to find out…

Podcast Apps

You can listen and subscribe to the Foojay Podcast on:

Internal Security: Hardening Internal Systems

Fri, 18 Nov 2022 15:08:28 +0000

60% of security breaches are internal to the organization and yet when we think about security we usually think about vulnerabilities, exploits, etc. All the while, 60% of hacks are just from a person just logging into the system and taking whatever the hell they want.

I’ve been thinking about this quite a bit recently. I spent a great deal of time researching security-related issues for a chapter of my upcoming book and unfortunately found very little on hardening internal systems.

CVE-2022-42889: Apache Commons Text (Text4Shell) Vulnerability

Thu, 03 Nov 2022 14:56:24 +0000

First things first, let’s be clear that this is NOT a new Log4Shell or Spring4Shell vulnerability.

Although it is a remote code execution issue, the impact is neither as severe nor as easily exploitable as the issue in Log4j from December 2021.

Similar to the Log4j issue, the essence of the problem is that you can perform a lookup that can then be misused.

However, the Log4shell vulnerability was very easy to exploit — which is not necessarily the case this time.

How to Use Java DTOs to Stay Secure

Fri, 21 Oct 2022 07:29:57 +0000

~~This article was orignally posted on Snyk.io and is reused with permission.~~

Data Transfer Objects (DTOs) in Java are objects that transport data between subsystems.

It is an enterprise design pattern to aggregate data.

The main purpose is to reduce the number of system calls needed between the subsystems, reducing the amount of overhead created.

In this article, I will explain how DTOs are used in modern Java applications, ways your application can benefit, and how Java DTOs can help you be more secure by preventing accidental data leaks.

Best Practices for Managing Java Dependencies

Thu, 15 Sep 2022 08:21:10 +0000

Creating Java applications is great, and many resources are available.

To speed up development, many folks use frameworks and libraries that do some of the heavy lifting.

When looking at modern Java applications, almost all of them contain dependencies from libraries developed by someone else.

Dependencies take up about 80 to 90 percent of the binary — so, we should take good care of them when creating a Java project.

Controlling your Server with a Reverse Shell Attack

Thu, 08 Sep 2022 13:00:22 +0000

Creating and running an application in your favorite language is usually pretty simple. After you create your application, deploying it and showing it to the world is also quite straightforward.

The last thing you need is someone to take over your system and fully control your brand new application.

In this article, I’ll explain how this can happen with a remote shell attack.

Note: The code examples in this article are for educational purposes only. I mainly try to explain what a remote shell attack is and how it can occur in your applications. Using this or any other example to hack someone is not advised. In most countries, hacking without the consent of the target is illegal, even if you have the best intentions.

Learning by Auditing Kubernetes Manifests

Mon, 05 Sep 2022 08:44:17 +0000

Last year, I spoke at the National DevOps Conference that took place at the British Museum. I had already visited the museum before, but speaking there was a fantastic experience. Besides, we had the museum all for ourselves for a couple of hours. If you’ve ever visited the place, you know what I mean.

Anyway, I also attended a talk about Checkov :

Checkov scans cloud infrastructure configurations to find misconfigurations before they’re deployed.

Exploring the Apache Commons Configuration RCE Vulnerability

Thu, 18 Aug 2022 10:10:37 +0000

This article was originally posted on Snyk.io and is co-written by Kyle Suero and Brian Vermeer

Before we dive into the details of this vulnerability, we want to make it clear that there’s no need for panic.

Many systems permit the use of various types of code in configuration files, and there are legitimate use cases to include string and variable interpolation in the configuration of applications and systems.

This is not Log4Shell all over again.

Secure CI/CD Pipelines with GitHub Actions for Your Java Apps

Thu, 11 Aug 2022 06:28:38 +0000

This article was originally post atSnyk.io and is used with permission

GitHub Actions has made it easier than ever to build a secure continuous integration and continuous delivery (CI/CD) pipeline for your GitHub projects.

By integrating your CI/CD pipeline and GitHub repository, GitHub Actions allows you to automate your build, test, and deployment pipeline.

You can create workflows that build and test every pull request to your repository or deploy merged pull requests to production.

How to Secure Your Web Apps With An API Gateway

Mon, 18 Jul 2022 18:50:10 +0000

API management solutions, also known as API gateways, are a must in this day and age of APIs.

However, once you’ve set up such a gateway, you can use it for different purposes unrelated to APIs.

Today, I want to show you how to improve the security of web apps.

Prevent sniffing

Browsers are fantastic pieces of technology that try to make the life of users as comfortable as possible.

Deserialization exploits in Java: why should I Care?

Thu, 14 Jul 2022 07:39:03 +0000

Hackers refer to deserialization in Java as “the gift that keeps on giving”. But what is actually the problem? In most cases, it is not even your own code that creates this security vulnerability. This problem is also not restricted to Java’s custom serialization framework. When deserializing JSON, XML, or YAML, similar issues can occur as well.

I recently gave a talk about this during Devoxx UK , the largest and most prestigious Java community conference in the United Kingdom. In this talk, I explain how deserialization vulnerabilities work natively in Java and how attack chains are created. This was loosely based on my blog post: “Serialization and deserialization in Java: explaining the Java deserialize vulnerability” .

How to do password hashing in Java applications the right way

Thu, 12 May 2022 15:04:55 +0000

There are multiple ways to store sensitive passwords. And while having choices can be great, in the context of password storage, picking wrong can be a security nightmare. With that in mind, let’s hash out some of your options 🥁🥁.In this article we’ll discuss how you should hash passwords in your Java applications. While you can apply these principles to any ecosystem, we’ll specifically showcase the best way to handle password hashing in Java.

Does Java 18 Finally Have A Better Alternative To JNI?

Tue, 19 Apr 2022 21:01:50 +0000

Java 18 was released last month (March 2022), and with it comes the second incubator of the Foreign Function & Memory API, so let us look at the state of Foreign Function Interface (FFI) in Java.

If you would prefer to follow along by watching a video, here’s the recording of my FOSDEM'22 talk on this topic, from the the OktaDev YouTube channel .

What is a Foreign Function Interface?

A foreign function interface is the ability to call functions or routines written in one programming language from another programming language.

Spring4Shell: The zero-day RCE in the Spring Framework explained

Fri, 08 Apr 2022 04:17:45 +0000

On March 30, 2022, a critical remote code execution (RCE) vulnerability was found in the Spring Framework. More specifically, it is part of the spring-beans package, a transitive dependency in both spring-webmvc and spring-webflux. This vulnerability is another example of why securing the software supply chain is important to open source.

Security resources like Lunasec , Rapid7 and Praetorian confirmed that the vulnerability is real, and in the meantime, Spring has already released a new version that mitigates this problem, so we recommend updating . While Spring4Shell does not appear to have the same impact as the recent Log4Shell vulnerability, it should still be evaluated and prioritized by every organization using the Spring Framework. In this post, we’ll explore how the RCE works.

Spring Remote Code Execution Vulnerability

Thu, 31 Mar 2022 14:54:49 +0000

I’d like to start by saying that I’m not a security expert. I also won’t link to the exploit. This is a very fresh take on a new vulnerability but there’s already confirmation from Sonatype . The current exploit seems to be limited to Spring on top of Tomcat but it probably can be adapted since the underlying vulnerability seems general enough.

The vulnerability only impacts Java 9 or newer so if you have an older version you should be safe from this specific exploit.

Quick Fire Java: Java After Log4j

Thu, 31 Mar 2022 08:23:36 +0000

In this episode of the Quick Fire Java video series, Rudy De Busscher and Priya Khaira-Hanks discuss Log4j, security processes and prioritization, and how Payara dealt with the vulnerability.

All in a concise 10-minute video!

The Log4j vulnerability, Log4Shell , was disclosed in early December 2021 and the repercussions have been far-reaching.

Rudy explains more about what this actually means and about the wider implications of the incident. He also responds to BreachQuest’s Jake Williams for Threatpost , who claimed “being exploited through an internet-facing system running vulnerable log4j at this point is a leadership failure, not a technical one.”

Security Warning: Your Java Attack Surface Just Got Bigger

Thu, 17 Mar 2022 16:35:38 +0000

Building cloud-native Java applications is undoubtedly awesome.

However, it comes with undeniable new risks. Next to your own code, you are relying on so many other things.

Blindly depending on open-source libraries and Docker images can form a massive risk for your application. The wrong package can introduce severe vulnerabilities into your application, exposing your application and your user’s data.

In the talk below we’ll show common threats, vulnerabilities, and misconfiguration including the recently disclosed issues in Log4j. Most importantly, you’ll learn how to protect your application with actionable remediation and best practices.

Detect, Track, Verify Security Issues & 0-Days

Thu, 10 Mar 2022 12:25:09 +0000

Important: You can use Lightrun for free on your servers.

I’m not a security expert. I’d like to think of myself as a security conscious developer, but this is a vast subject with depth and breadth. What I understand is Lightrun and Debugging . In that capacity, I can show some creative ways you can use it as a security tool. A “proper” security expert could take this to the next level.

Treat Security as a Risk

Thu, 27 Jan 2022 11:26:57 +0000

Security is the poster child of a Non-Functional Requirement: most people don’t care until the proverbial matter hits the rotary propeller.

Consequences can range from losing reputation to legal liability to putting the business out. In my post on running unsecured code , I concluded that you should treat security as a risk - and left it at that. I think it warrants a dedicated post.

Risk management is pretty much documented . You can find it in many engineering disciplines, if not every one of them. A risk management process consists of the following steps:

The State of Java in 2022

Tue, 25 Jan 2022 10:24:08 +0000

You're Running Untrusted Code!

Mon, 17 Jan 2022 08:28:24 +0000

Last December, Log4Shell shortened the nights of many people in the JVM world. Worse, using the earthquake analogy caused many aftershocks after the initial quake.

I immediately made the connection between Log4Shell and the Security Manager. At first, I didn’t want to write about it, but I’ve received requests to do so, and I couldn’t walk away.

[

](https://twitter.com/nicolas_frankel/status/1471140080366632968 )

As a reminder, the Oracle team deprecated the Security Manager in Java 17. One of the arguments it based its decision on is that it was initially designed to protect against applets. Applets were downloaded from the Internet, so they had to be considered untrusted code. Hence, we had to run them in a sandbox.

Log4Shell Shows The Need for "Trustworthy Java"

Mon, 10 Jan 2022 10:03:24 +0000

What Just Happened?

I believe Log4Shell is Java’s biggest crisis. I reported on it in the “New & Noteworthy ” section of my newsletter . A quick recap: The US cybersecurity and infrastructure agency director called Log4Shell “one of the most serious that I’ve seen in my entire career, if not the most serious”. Exploiting it may be as easy as sending an HTTP request to a Java application, with a JNDI link in the HTTP header. The last wide-spread software vulnerability of this magnitude scored 7.5 - Log4Shell scored a 10 .

Java Logging: What To Log & What Not To Log?

Sat, 18 Dec 2021 11:29:33 +0000

Logs are a handy tool to spot mistakes and debug code. For engineers and, specifically, in a DevOps environment, the logs are a very valuable tool.

In addition to the functional aspect of logging, logs are also critical from a Java security perspective. When a security breach occurs, your log files are the first place to look for clues about what happened. But with a large number of different frameworks available for logging in Java applications, how do you pick the right one? More importantly, how to do Java logging right?

Log4Shell / Leak4J

Wed, 15 Dec 2021 12:49:15 +0000

Over the last couple of days (and nights) I’ve been studying the new (extremely dangerous) vulnerability in log4j2 called Log4Shell ).

All versions of log4j-core from 2.0-beta9 to 2.14.1 are affected by this, and it’s a big one.

This vulnerability allows the attacker to remotely execute code on your system, with the ability to get complete control of the underlying servers.

Log4J has, for a long time, been the most used logging framework in the Java landscape. It’s extremely widely used and this attack has the most broad trigger you can imagine: It needs to log something.

Log4j2 Isn’t Killing Java

Mon, 13 Dec 2021 18:51:34 +0000

In the season of resurrection, I’d like to join the ranks of those who have made long careers announcing the death of Java who follow up each obituary with an equally shocking revelation that it is alive again as one of the top programming languages 25 years running . Even before the recent log4j2 vulnerability allegedly “killing” it yet again, we have a joke in the Foojay chat that a Java museum would be called a cemetery for the number of times this has happened .

Log4Shell: Critical Log4j RCE Vulnerabilty -- Update to Version 2.15.0

Mon, 13 Dec 2021 07:16:56 +0000

On Dec.10, 2021, a new, critical Log4j vulnerability was disclosed: Log4Shell .

This vulnerability within the popular Java logging framework was published as CVE-2021-44228 and categorized as Critical with a CVSS score of 10, which is the highest score possible. The vulnerability was discovered by Chen Zhaojun from Alibaba’s Cloud Security team.

All current versions of log4j2 up to and including 2.14.1 are vulnerable. You can remediate this vulnerability by updating to version 2.15.0 or later .

New Java 17 Features for Improved Security and Serialization

Thu, 02 Dec 2021 08:06:36 +0000

In December 2020, I wrote the articleSerialization and deserialization in Java: explaining the Java deserialize vulnerability about the problems Java has with its custom serialization implementation. The serialization framework is so deeply embedded inside Java that knowing how dangerous some implementation can be is important. Insecure deserialization can lead to arbitrary code executions if a gadget chain is created from your classpath classes.

Recently, Java 17 — the new LTS version — was released. But how do the new features impact this problem, and can we prevent deserialization vulnerabilities better using these features?

How Social Trends Help Me Fix Essential Vulnerabilities

Thu, 04 Nov 2021 14:14:55 +0000

Recently, Snyk added social trends to its vulnerability data . This new indicator shows you what vulnerabilities are trending so you can better prioritize remediation. Our research team found a strong correlation between socially trending vulnerabilities and the existence of exploits that can actually harm your application.

Following the social trends of security vulnerabilities makes practical sense. When a specific vulnerability is gaining a lot of interest in social — Twitter, for instance — it means a lot of people are aware of the problem. Statistically, this also means more people that want to do you harm. Therefore, it can be important to put some extra focus on the vulnerabilities in your system that are socially trending.

PSA: The Risks of Remote JDWP Debugging: It's Like a Wide Open Door

Wed, 20 Oct 2021 08:13:29 +0000

It isn’t so much a security risk as it is a wide open door with everything labeled for anyone to take freely and matches to burn it all down…

When I teach or lecture and mention security, I always love the analogy of security as an onion. This is a common cliché yet it’s still a powerful analogy for people who are new to the concepts. The equivalent analogy I would pick for remote debugging is like leaving your front door open with all your valuables piled in easy to spot and well labeled boxes. Calling JDWP insecure doesn’t make any sense. It wasn’t designed to be secure so it isn’t…

SolarWinds Hack: What Does This Mean For Us?

Thu, 19 Aug 2021 08:19:56 +0000

In the past two years, we have had to learn a lot about cybersecurity. New attack vectors are becoming more and more sophisticated and are directed more and more against the value chain in general.

But what does that mean for us? What can be done about it, and what reactions have the state already taken?

Let’s start with the story that got all of this rolling and made sure that the general attention was drawn to the vulnerabilities of the available IT infrastructure.

Why You Should Upgrade to Maven Version 3.8.1 Today or Very Soon

Wed, 11 Aug 2021 08:06:09 +0000

If you are working in the Java ecosystem and building your applications with an older Maven version, this message is for you.

Check your Maven version by typing mvn -version! If you are still running on an old Maven version like 3.6.3 or below you definitely need to upgrade to version 3.8.1 because of security reasons. Be aware that to run Maven 3.8.1, Java 7+ is required.

Luckily we found out in the JVM Ecosystem report 2021 that not many people work with Java 6 or below. We do see that a lot of people use Maven so not upgrading can end up in serious issues for a large part of the ecosystem.

Introducing SAST, DAST, IAST and RASP

Thu, 05 Aug 2021 08:28:52 +0000

In this article, we’re going to look at the differences between the various cybersecurity defence techniques. Here you can identify four main groups, which we will go through briefly one after another to illustrate the advantages and disadvantages.

SAST: Static Application Security Testing

SAST describes the process in which the components of an application are subjected to a static analysis. This approach not only searches for security gaps but also determines the licenses for the individual elements. In the following, however, I will only deal with the consideration of vulnerabilities.

Getting Started with Snyk for Secure Java Development

Thu, 29 Jul 2021 06:39:02 +0000

If you’re a Java developer who wants to develop your applications more securely, you’ve come to the right place. Snyk can help you with that mission.

This article will explain how to begin with Snyk for secure Java development so you can be more secure from the get-go.

If you’re new to Snyk, it’s important to know that we offer a variety of developer-focused products and tools. Some of these tools, like our CLI and some IDE integration, support multiple products. However, we can distinguish four different products within Snyk:

CVSS 101: First Steps with Common Vulnerability Scoring System

Wed, 14 Jul 2021 06:56:13 +0000

What is the Common Vulnerability Scoring System (CVSS), who is behind it, what are we doing with it, and what does a CVSS Value mean for you?

On Foojay, you can apply the insights below to understand the Security/CVE Views in the OpenJDK Update & Release Details pages , such as the one shown here:

I will explain how a CVSS Score is calculated, what the different elements of it mean, and what are the differences between the different CVSS versions.

About The Lifecycle of a Security Vulnerability

Thu, 08 Jul 2021 08:40:56 +0000

Again and again, we read in the IT news about new security gaps that have been identified. The more severe the classification of the loophole, the more attention the information receives in the general press. Most of the time, you don’t even hear or read anything about all the security holes found that are not as well known as the SolarWinds Hack, for example.

But what is the typical lifecycle of such a security gap?

Learn All About Java Encryption and Hashing

Thu, 10 Jun 2021 08:04:22 +0000

If you need to store sensitive data in your system, you have to be sure that you have proper encryption in place. First of all, you need to decide what kind of encryption you need —for instance, symmetric or asymmetric. Also, you need to choose how secure it needs to be. Stronger encryption takes more time and consumes more CPU. The most important part is that you don’t need to implement the encryption algorithms yourself. Encryption is hard and a trusted library solves encryption for you.

JEP 411: Java's Security Model and the Principle of Least Privilege

Thu, 03 Jun 2021 07:47:51 +0000

Java, like most platforms or languages has layers of security, this article intends to look at Java’s Authorization layer, which is unlike in other languages, and to distinguish between two different ways this layer is typically utilized, why one is effective while the other isn’t and investigate why JEP 411 only considers the least effective method and hopefully increase awareness of the Principle of Least Privilege as it’s applied to Java Authorization, improve adoption, encourage people to take advantage of the improved security it provides, as well as prolong its support and possibly even improve it in future.

Getting Started Hacking Third-Party APIs on the JVM

Thu, 27 May 2021 06:27:58 +0000

The JVM ecosystem is mature and offers plenty of libraries, so you don’t need to reinvent the wheel. Basic - and not so basic - functionalities are just a dependency away. Sometimes, however, the dependency and your use-case are slightly misaligned.

The correct way to fix this would be to create a Pull Request. But your deadline is tomorrow: you need to make it work now! It’s time to hack the provided API.

Why JEP 411 Will Have a Negative Impact on Java Security

Sat, 22 May 2021 07:43:06 +0000

JEP 411 specifies the “deprecation of the Security Manager for removal in a future release. The Security Manager dates from Java 1.0. It has not been the primary means of securing client-side Java code for many years, and it has rarely been used to secure server-side code. To move Java forward, we intend to deprecate the Security Manager for removal in concert with the legacy Applet API (JEP 398).” Below, Peter Firmstone describes how this relates to the principle of least privilege and what the impact of this JEP will be. Agree or disagree, add your comments, or your full articles on this topic are also welcome here on Foojay.

Sanitize All Input! Sanitize All Input! Sanitize All Input!

Thu, 13 May 2021 07:23:33 +0000

Cross-site scripting (XSS) is a well-known issue and mostly utilized in JavaScript applications. However, Java is not immune to this. XSS is nothing more than an injection of JavaScript code that’s executed remotely. Rule #0 for preventing XSS, according to OWASP, is “Never insert untrusted data except in allowed locations.” The basic solution to this Java security risk is to prevent untrusted data, as much as possible, and sanitize everything else before using the data.

Preventing YAML Parsing Vulnerabilities in Java

Thu, 06 May 2021 16:09:24 +0000

YAML is a human-readable language to serialize data that’s commonly used for config files. The word YAML is an acronym for “YAML ain’t a markup language” and was first released in 2001. You can compare YAML to JSON or XML as all of them are text-based structured formats.

YAML files are often used to configure applications, application servers, or clusters. It is a very common format in Spring Boot applications and, of course, to configure Kubernetes. However, similarly to JSON and XML, you can use YAML to serialize and deserialize data.

Fix Java Security Issues While Coding in IntelliJ IDEA

Thu, 29 Apr 2021 17:10:33 +0000

Nowadays, developers are responsible for more than just creating the application. Besides working on features, developers have to focus on their applications’ maintainability, scalability, reliability, and security. Many developers are unsure of where to start with security. In addition, most companies still work with a dedicated security team instead of having security expertise inside the team.

A lot of developers practically live in their integrated development environment (IDE). A good IDE is like a swiss army knife: it is your go-to tool to do almost everything. Having everything I need to build, run, test, debug, andsecure my application, makes a good IDE invaluable for many developers.

Namespace Shadowing (a.k.a. “Dependency Confusion”) Attack

Thu, 22 Apr 2021 06:31:08 +0000

TL;DR: Yet Another Case for Using Exclude Patterns in Remote Repositories

The npm Registry is vulnerable to supply chain namespace shadowing, also known as “Dependency Confusion” attacks. Make sure you create npm scoped packages and force exclude patterns.

Long-time Obsession with Exclude Patterns

I remember the first JFrog customer training I delivered in February 2012. This slide was the one where I explained the importance of setting exclude patterns on your repositories (you can see it is 2012 by the slide design, right? Also, Ant was a thing.):

8 Best Practices to Prevent SQL Injection Attacks

Thu, 15 Apr 2021 08:33:39 +0000

SQL injection is one of the most dangerous vulnerabilities for online applications. It occurs when a user adds untrusted data to a database query. For instance, when filling in a web form. If SQL injection is possible, smart attackers can create user input to steal valuable data, bypass authentication, or corrupt the records in your database.

There are different types of SQL injection attacks, but in general, they all have a similar cause. The untrusted data that the user enters is concatenated with the query string. Therefore the user’s input can alter the query’s original intent.

Secure Code Review Best Practices (Part 2)

Thu, 18 Mar 2021 15:14:31 +0000

Code reviews are hard to do well. Particularly when you’re not entirely sure about the errors you should be looking for!

In part 1 of this series , we focused on four best practices, such as sanitization , storing secrets, and scanning your application are explained so take a quick look if you missed the first part.

Let’s move on to the second and final part of this topic, tips 5 through 8!

Secure Code Review Best Practices (Part 1)

Thu, 11 Mar 2021 16:58:46 +0000

Code reviews are hard to do well. Particularly when you’re not entirely sure about the errors you should be looking for!

Be sure when you’re reviewing code to understand that all code isn’t written equal! Think also about what lies behind the code that you’re reviewing and thus the data and assets you are trying to protect. This working knowledge is something that isn’t easy to add into a checklist.

Safe Writing to Files in IoT and Industrial Systems

Thu, 11 Feb 2021 09:12:23 +0000

Especially on IoT devices, file corruption on shutdown is a common concern. This article discusses how to write to disk safely in Java, combining disk sync, shutdown hooks, and atomic renaming of files.

Files On Disk Can Still Easily Become Corrupted

For performance optimization, file systems write to disks asynchronously resulting in potential corruption when a hard system shutdowns occurs through power off or crashes.

As this has become a rare experience for desktop and server users, it comes as a surprise to many developers working on IoT devices and industrial computers that hard power cuts are a common operational scenario and storage is far less robust than expected.

The SolarWinds Hack for Java Developers

Tue, 09 Feb 2021 07:39:53 +0000

In December 2020, an advanced persistent threat attacked many companies by injecting malicious code into a vendor application that belonged to SolarWinds. This technique is called a “supply chain attack,” because instead of targeting the victim directly, the attacker damaged something higher up the supply chain and simply waited. The US government uses SolarWinds, so by attacking SolarWinds in a way that would infiltrate the US government, the attacker effectively got their target.

OIDC Client with Mutual TLS Client Authentication

Thu, 04 Feb 2021 08:48:06 +0000

It is common to authenticate OAuth and OpenID Connect (OIDC) clients with secrets. When you register a client in the Authorization Server (i.e., the OpenID Connect Provider, OP), you typically get a client ID and a secret. These are then used as credentials whenever your client sends requests to the Authorization Server. Often, this type of credential will provide a sufficient level of security for a deployment; other times, however, this simply is not enough. Authenticating with client ID and secret means that if anyone manages to steal or guess your application’s credentials, they will be able to use them to impersonate it. The attacker does not even have to intercept the credentials themselves. They may be able to capture a request sent to the Authorization Server and replay it. The Authorization Server does not know who is sending the request; it can only check whether the credentials are valid. (This is why it’s also important to use TLS and unguessable client secrets when using this type of credential.)

Quick Security Wins and Getting Started with DevSecOps

Wed, 03 Feb 2021 17:41:45 +0000

Hello and welcome to my first DevSecOps article! Here in Germany, it’s winter right now, and the forests are quiet. The snow slows down everything and it’s a beautiful time to move undisturbed through the woods. Here you can pursue your thoughts, and I started thinking about a subject that customers or participants at conferences ask me repeatedly.

The question I am asked is almost always: “What are the quick wins or low hanging fruits if you want to deal more with the topic of security in software development? And I want you to answer this question right now!”

Explaining Java Deserialization Vulnerabilities (Part 2)

Thu, 28 Jan 2021 08:23:00 +0000

Java serialization is a mechanism to transform an object into a byte stream. Java deserialization is exactly the other way around and allows us to recreate an object from a byte stream. Java serialization—and more specifically deserialization in Java—is also known as “the gift that keeps on giving”. This relates to the many security issues and other problems it has produced over the years.

Explaining Java Deserialization Vulnerabilities (Part 1)

Earlier, in part 1, the basics of Java serialization and deserialization were explained and how to tamper with data in serialized objects. In this part, we continue with even more harmful attacks and show you how you can prevent this in your own code.

A Compendium of 2021 Java & OpenJDK Predictions

Fri, 22 Jan 2021 08:03:25 +0000

Now that 2021 is well underway, many prominent Java developers have taken the time to predict what 2021 may bring to the Java universe.

In December, here on Foojay.io, several articles were published on this theme, such as Java Predictions for 2021 , Java Predictions for 2021: Jakarta EE , and Java Predictions for 2021: Raspberry Pi . In early January, Simon Ritter published Staring Into My Java Snow Globe 2021 . Separately, I conversed with another six developers about their visions for the coming year.

Explaining Java Deserialization Vulnerabilities (Part 1)

Thu, 21 Jan 2021 10:12:19 +0000

Java serialization is a mechanism to transform an object into a byte stream. Java deserialization is exactly the other way around and allows us to recreate an object from a byte stream.

Java serialization—and more specifically deserialization in Java—is also known as “the gift that keeps on giving”. This relates to the many security issues and other problems it has produced over the years.

Serialization and Deserialization in Java?

In Java, we create objects. These objects live in memory and are removed by the garbage collector once they are not used anymore. If we want to transfer an object, for instance, store it on a disk or send it over a network, we need to transform it into a byte stream. To do this, the class of that object needs to implement the interface Serializable. Serialization is converting the state of an object into a byte stream. This byte stream does not contain the actual code.

Hacking Java XML Input via External Entity Injection

Thu, 14 Jan 2021 08:37:10 +0000

Java natively supplies many different options to parse XML. However, all available parsers in Java have XML eXternal Entity (XXE) enabled by default. This makes Java XML libraries particularly vulnerable to XXE injection.

We already briefly went into XXE injection problem in an earlier blog post on foojay.io. However, let’s go a little deeper. In the video below, I explain and demonstrate how an XXE injection attack works by extracting system data that should not be exposed. I also show you how you can solve this in your Java code in multiple ways.

Let's Do Some Java Syntax Puzzlers Today

Wed, 06 Jan 2021 09:26:04 +0000

Roughly 12 years ago, I started to contribute to the Eclipse ecosystem in various functions. One of the most interesting experiences to this date was to work on developer tooling and handling the edge cases so others don’t have to struggle. Though I stepped down as an Eclipse committer in the meantime, I’m still attached to working on productivity tooling nowadays as a member of the Gradle Build Tool .

While working on Eclipse, I fondly remember working on various parts of the Java Tooling (JDT) and while working on refactorings and quick fixes. And not surprisingly, working on language-intensive pieces turned out to have the same hiccups as other non-trivial algorithms - the transition from “this is gonna be easy” to “why am I up at 3 am reading the Java Language Specification”.

5 Tips to Create Secure Docker Images for Java Applications

Fri, 25 Dec 2020 10:41:54 +0000

Docker is the most widely used way to containerize your application. With Docker Hub, it is easy to create and pull pre-created images. This is very convenient as you can use these images from Docker Hub to quickly build an image for your Java application.

However, the naive way of creating custom Docker images for your Java applications comes with many security concerns. So, how do we make security an essential part of Docker images for Java?

Minimizing Security Risks in Application Development

Tue, 08 Dec 2020 11:02:28 +0000

United by their passion for open source, Payara and IBM recently teamed up for a panel discussion on security in Java application development.

Security is something that is considered extremely important, however, it is not always something that is a priority for many development teams. The main question is—how to minimize security risks while developing Java applications.

In this panel discussion, our experts addressed a variety of topics related to secure application development. Most of the topics were introduced by questions from the audience.

Use Query Parameterization to Prevent Injection

Mon, 23 Nov 2020 08:14:52 +0000

In the 2017 version of the OWASP Top 10 vulnerabilities, injection appeared at the top of the list as the number one vulnerability that year.

When looking at a typical SQL injection in Java, the parameters of a sequel query are naively concatenated to the static part of the query. The following is an unsafe execution of SQL in Java, which can be used by an attacker to gain more information than otherwise intended:

Avoid Java Serialization: The Gift That Keeps On Giving

Wed, 11 Nov 2020 08:48:37 +0000

Serialization in Java allows us to transform an object to a byte stream. This byte stream is either saved to disk or transported to another system. The other way around, a byte stream can be deserialized and allows us to recreate the original object.

The biggest problem is with the deserializing part. Typically it looks something like this:

ObjectInputStream in = new ObjectInputStream( inputStream );
return (Data)in.readObject();

There’s no way to know what you’re deserializing before you decoded it. Possibly, an attacker serialized a malicious object and sent it to your application. Once you call readObject(), the malicious objects have already been instantiated. You might believe that these kinds of attacks are impossible because you need to have a vulnerable class on you classpath. However, if you consider the amount of classes on your classpath—that includes your own code, Java libraries, third-party libraries and frameworks—it is very likely that there is a vulnerable class available.

How to Configure Your Java XML Parsers to Prevent XXE Attacks

Fri, 06 Nov 2020 11:27:18 +0000

With XML eXternal Entity (XXE) enabled, it is possible to create a malicious XML, as shown below, and read the content of an arbitrary file on the machine. It’s not a surprise that XXE attacks are part of the OWASP Top 10 vulnerabilities. Java XML libraries are particularly vulnerable to XXE injection because most XML parsers have external entities by default enabled.

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<!DOCTYPE bar [
 <!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<song>
 <artist>&xxe;</artist>
 <title>Bohemian Rhapsody</title>
 <album>A Night at the Opera</album>
</song>

A naive implementation of the DefaultHandler and the Java SAX parser, like that shown below, parses this XML file and reveals the content of the passwd file. The Java SAX parser case is used as the main example here but other parsers, like DocumentBuilder and DOM4J, have similar default behaviour.

Securing Microservices with Auth0 and MicroProfile in Kubernetes

Tue, 03 Nov 2020 15:38:00 +0000

In this day and age, securing enterprise platforms is a challenge that developers and consultants tackle in an uninformed manner, producing subpar solutions in most cases.

To combat this pattern, third-party security services such as Auth0 have been devised to externalize the security of services, and they focus on stable implementations of common enterprise use cases (identity management, OAuth compatibility, and so on), and platforms such as Eclipse MicroProfile allow for their easy integration with enterprise Java microservices.

Fixing Vulnerabilities in Maven-Based Projects

Tue, 20 Oct 2020 06:40:22 +0000

Maven is still the most used build system in the Java ecosystem. According to the JVM report 2020 , Maven is the number one build tool in the ecosystem with two-thirds of the share.

Therefore, it is important to know how Maven works. For instance, if you find vulnerabilities in your Maven project using Snyk, how can you fix them?

In this article, I will explain how you can fix vulnerabilities in third-party libraries when using Maven, even when it is not obvious.

foojay: A Place for Friends of OpenJDK

Sat, 25 Apr 2020 15:09:00 +0000

Welcome to foojay, a place for f riends o f O penJ DK, sponsored by Azul . Foojay’s user-focused Java and OpenJDK technical dashboards provide free data for everyday Java developers. Right away you have access to updated analysis, selected highlights, and categorized lists arranged for easy consumption.

Java Technologist Dashboards

Together with Java enthusiasts around the world, the foojay team works to identify critical aspects of each new OpenJDK release and update – with related information such as OpenJDK distributions, download locations, and JVM command line arguments – and brings to the fore precisely the content and services that have value and relevance to those that use Java on a daily basis throughout the industry. OpenJDK Update Release Details