Oxeye | Research

Nov 1, 2023

How Application Security Posture Management (ASPM) Helps Prevent Security Silos

Ensuring that our software (or applications) is secure has become essential for organizations, mainly since we use more complex applications in various industries. However, a big challenge arises with the creation of security silos.

Oct 5, 2023

What Is A Better Way To Do Software Composition Analysis (SCA)?

Software Composition Analysis (SCA) is a fundamental component of application security, aiming to identify vulnerabilities within third-party libraries and dependencies. However, while SCA tools have come a long way, they are not always accurate enough on their own.

Sep 29, 2023

Cheat Sheet for WebP (libwebp library) 0-day Vulnerability

Learn about the WebP/libwebp library 0-day vulnerability in 2 minutes

Sep 28, 2023

Announcing Github SCM Integration for SAST, SCA, and Personalized AppSec Risk Analysis

Today, we’re announcing our Github SCM integration for SAST and SCA, which will help organizations to find custom code vulnerabilities (SAST) and vulnerable packages (SCA) in their applications during the development phase. These additions to the Oxeye Application Security Platform complement our runtime-fueled AppSec engine to deliver security across the entire software development lifecycle (SDLC), and to automatically prioritize your remediation efforts.

Sep 19, 2023

What is Application Security Posture Management?

Application Security Posture Management (ASPM) is your ultimate watchtower in this fast-paced digital world. This article will take you through the critical components of ASPM, from asset and vulnerability management to risk mitigation and assessment and beyond.

Aug 2, 2023

Take Me to Prom - Exploiting an RCE in openTSDB through Prometheus

The Oxeye research team has found a critical unauthenticated Remote Code Execution vulnerability in the popular Time Series database - OpenTSDB.

Jul 19, 2023

Fortifying the Fort: A Story of How a Security Company Purged Its Container Vulnerabilities

Oxeye is an AppSec platform that detects code vulnerabilities and issues in open source and third party packages. But how do we ensure that the tool that detects these vulnerabilities is itself not vulnerable?

Jul 3, 2023

Gophers & Bees - Parsing Golang Structures in Memory with eBPF

OpenTelemetry is a collection of APIs, libraries, agents, and instrumentation that standardize the collection and transfer of telemetry data (metrics, logs, and traces) from your services and applications. It is an incubating project of the Cloud Native Computing Foundation (CNCF) that aims to make robust, portable telemetry a built-in feature of cloud-native software.

Jun 29, 2023

Chess and Application Security

It’s not a secret that we’re big chess fans here at Oxeye. Our engineering team and marketing team are locked in a battle for chess supremacy, asynchronously, across the Atlantic Ocean, via a chess app. It should come as no surprise then, that we see many analogies between application security and chess.

Jun 21, 2023

Introducing "The Storm and the Light" - a podcast from Oxeye

We announce the launch of The Storm and the Light - a podcast from Oxeye

Jun 8, 2023

Using Kubernetes Data to Enhance Incomplete HTTP OpenTelemetry Traces

Using OpenTelemetry has become a popular method for tracking, collecting, and analyzing telemetry data for applications that are built using microservice architecture. It helps us understand how software performs and behaves.

May 11, 2023

Using OpenTelemetry for Application Security, with a Real Life Example

Oxeye's CTO and co-founder, Ron Vider, presents to a crowd of over 1200 people on how to use Open Telemetry for application security

May 10, 2023

The Story of a Backstage RCE - Oxeye Presentation at Blue Hat IL

Daniel Abeles and Gal Goldshtein from Oxeye present on their discovery of a remote code execution (RCE) vulnerability in the popular developer portal, Backstage, developed by Spotify, at BlueHat IL

May 9, 2023

The Fosbury Flop, Observability and Application Security for Cloud-Native Applications

When Dick Fosbury won the Olympic gold medal in the high jump in Mexico City in 1968, it was the first time that most of the world had ever seen his style of jumping, and it revolutionized the sport. What appeared to be novel at the time - jumping while leading with his back, instead of the conventional forward-facing straddle or roll - was soon copied pervasively. How does that apply to AppSec? Read on....

May 8, 2023

OWASP Cloud-Native Application Security Top 10 Flagship Project

Oxeye's CTO and co-founder, Ron Vider, presents on the OWASP Cloud-Native Application Security Top 10 Flagship Project

Apr 21, 2023

Webinar: Shift Left in 2023 - What's Changed and What Can We Improve?

Chris Romeo joins our CEO, Dean Agron to discuss the modern-day role and relevance of 'Shift Left', and the need for a more contemporary look at people, processes and technologies that will enable more effective and efficient AppSec for developers and security engineers

Apr 12, 2023

RCE through SQL Injection Vulnerability in Hashicorp's Vault

Hashicorp's Vault is a secure, open-source secrets management tool that stores and provides access to sensitive information like API keys, passwords, and certificates. The Oxeye AppSec platform automatically found a vulnerability in Hashicorp's Vault project without any manual input. In certain conditions, it allows attackers to execute code remotely on the target system through an SQL injection attack.

Application vulnerabilities will be multi-layered and multi-dimensional

Apr 5, 2023

'Inception': The Future of Vulnerabilities & Security for Cloud-Native Applications

The 'Inception' movie provides a cautionary tale about the future of software vulnerabilities. We dive into the why and how in this blog post.

Mar 21, 2023

3 Key Takeaways From Gartner®'s Market Guide™ For Cloud Native Applications Protection Platform (CNAPP), 2023

We provide a list of three key takeaways from the latest market report for Cloud Native Application Protection Platforms (CNAPP) from Gartner

Feb 28, 2023

Webinar: Why the 'A' in CNAPP is So Important - Application Security in the Age of Cloud Native Applications

Ory Segal, CTO of Prisma Cloud at Palo Alto Networks and Ron Vider, CTO of Oxeye, talk about CNAPP, and the convergence of application security and cloud security

Future of Application Security and why current SAST and DAST don't work anymore

Jan 27, 2023

Webinar: Stop Flying Blind in AppSec with Jim Manico and Dean Agron

Jim Manico and Dean Agron discuss the future of application security and why legacy SAST and DAST tools do not work for modern, distributed applications

Dec 20, 2022

5 Application Security (AppSec) Predictions for 2023

We talked to a lot of application security and cloud security owners this year. Here are our predictions based on those conversations.

Nov 28, 2022

Why Software Composition Analysis (SCA) Tools Must Transform to Enable Stronger Software Supply Chain Security

For many years, traditional Software Composition Analysis (SCA) tools have been the go-to for dealing with vulnerabilities in open source packages.

Nov 15, 2022

Remote Code Execution in Spotify’s Backstage via vm2 Sandbox Escape (CVSS Score of 9.8)

The Oxeye research team has found a critical vulnerability in Spotify’s open source, CNCF-incubated project — Backstage. We reported this via Spotify’s bug bounty program and it was rapidly patched in version 1.5.1. It ranked this critical vulnerability with a CVSS score of 9.8.

Sandbreak vm2 sandbox vulnerability - CVE-2022-36067

Oct 10, 2022

Enter "Sandbreak" - Vulnerability In vm2 Sandbox Module Enables Remote Code Execution (CVE-2022-36067)

The Oxeye research team has found a critical remote code execution vulnerability in the popular sandbox library VM2 - CVE-2022-36067

Sep 11, 2022

Guess Who’s (R)BAC?

The Oxeye research team recently found several high severity insecure direct object reference (IDOR) vulnerabilities in Harbor – a CNCF-graduated, open source artifact registry.

Aug 28, 2022

Oxeye Now Integrates with Jira

Bridging the gap between security findings and developers has never been easier.

Jul 28, 2022

“ParseThru” – Exploiting HTTP Parameter Smuggling in Golang - Updated October 10, 2022

Oxeye’s security research team has found a security vulnerability in Golang-based applications. Under certain conditions, it lets a threat actor bypass validations based on HTTP request parameters due to the use of unsafe URL parsing.

Jul 14, 2022

Diving Into OpenTelemetry’s Specs – The Story of How I Wrote Another Instrumentation

An unraveling of OpenTelemetry’ internals through a hands-on experience.

Jun 15, 2022

Runtime SBOM – Secure Microservices with Runtime Visibility

A software bill of materials is a list of all building blocks comprising an application – both the open source and commercial libraries.

Mar 20, 2022

Essential Takeaways for Cloud-Native Application Security Testing

The shift to cloud-native development affects several important aspects related to application security.

Mar 9, 2022

Software Composition Analysis (SCA) & Cloud-Native Application Security

Software Composition Analysis (SCA), identifies known vulnerabilities in 3rd party open source software components. It is not enough to assure that your apps are free from application layer vulnerabilities.

Mar 1, 2022

You Can’t IAST Your Way Out of This One

Why Legacy IAST Tools Will Fail Miserably When Testing Cloud-Native Web Applications.

Who owns cloud native application’s security

Jan 31, 2022

Who is responsible for Cloud Native Security?

Responsibility for App Security is no longer in the hands of one-owner, it’s a joint effort. App security is distributed to many groups and to different roles - Developers, AppSec and DevOps. So who’s incharge of security? And how to do it right.

Competitive analysis chart of SAST, DAST, SCA, IAST, and API testings and fuzzers

Jan 24, 2022

Why SAST doesn’t work in a cloudy world: 3 reasons SAST can’t support cloud native apps

Static application security testing tools (SAST), fail to provide the security measures required for cloud native apps. They lack context and are often limited to only one programming language, framework, or sets of libraries.

Jan 4, 2022

DAST & Cloud-Native Web Apps - Like Bringing a Knife to a Gunfight

Dynamic Application Security Testing tools (DAST), and why they fail to successfully test cloud native apps for code vulnerabilities. DAST tools lack the visibility into the communication layer of both app, container and cloud.

Dec 22, 2021

How insecure application tracing and telemetry may lead to sensitive data and PII leakage

Recently, Oxeye’s research team discovered several scenarios where sensitive data was leaked through tracing and telemetry collection within cloud-native applications.

Dec 21, 2021

How Legacy AST Tools Fail to Secure Cloud Native Applications

Herein is an overview of AST and the challenges that DAST, SAST, IAST, and SCA tools face when assessing vulnerabilities in cloud native applications.

Dec 14, 2021

How Contextual Risk Analysis Helps AppSec Teams Better Mitigate Log4Shell (CVE-2021-44228)

Which approach should application security teams take to protect against log4shell. Oxeye helps identify, mitigate and provides context to the Java logging package Log4j vulnerability also called LogJam CVE-2021-44228.

Nov 24, 2021

Cloud Native Apps & Microservices Need a New Security Testing Approach

Given the intricacies of cloud native apps, it's critical for organizations to prioritize security during their build phase

Nov 9, 2021

Contributing Open Source Code to the OpenTelemetry Project

OpenTelemetry is an open-source project by the Cloud Native Computing Foundation (CNCF).

Oct 28, 2021

When Cloud Native Application Security Testing Fails: A Real-World Analysis

Cloud native application vulnerabilities are not singular events, but rather complex flows. Our blog brings a few real-life examples from Shopify.

Oct 18, 2021

The Cloud Native Application Security Challenges and How to Avoid Them

Over 500 million applications will be deployed using cloud-native approaches by 2023, according to IDC.

Oct 10, 2021

Introducing Oxeye - Cloud-Native Application Security Testing, Here We Come

Cloud-native has evolved from a marketing term into a highly desirable and useful architecture choice, yielding significant benefits for designing.

How Application Security Posture Management (ASPM) Helps Prevent Security Silos

What Is A Better Way To Do Software Composition Analysis (SCA)?

Cheat Sheet for WebP (libwebp library) 0-day Vulnerability

Announcing Github SCM Integration for SAST, SCA, and Personalized AppSec Risk Analysis

What is Application Security Posture Management?

Take Me to Prom - Exploiting an RCE in openTSDB through Prometheus

Fortifying the Fort: A Story of How a Security Company Purged Its Container Vulnerabilities

Gophers & Bees - Parsing Golang Structures in Memory with eBPF

Chess and Application Security

Introducing "The Storm and the Light" - a podcast from Oxeye

Using Kubernetes Data to Enhance Incomplete HTTP OpenTelemetry Traces

Using OpenTelemetry for Application Security, with a Real Life Example

The Story of a Backstage RCE - Oxeye Presentation at Blue Hat IL

The Fosbury Flop, Observability and Application Security for Cloud-Native Applications

OWASP Cloud-Native Application Security Top 10 Flagship Project

Webinar: Shift Left in 2023 - What's Changed and What Can We Improve?

RCE through SQL Injection Vulnerability in Hashicorp's Vault

'Inception': The Future of Vulnerabilities & Security for Cloud-Native Applications

3 Key Takeaways From Gartner®'s Market Guide™ For Cloud Native Applications Protection Platform (CNAPP), 2023

Webinar: Why the 'A' in CNAPP is So Important - Application Security in the Age of Cloud Native Applications

Webinar: Stop Flying Blind in AppSec with Jim Manico and Dean Agron

5 Application Security (AppSec) Predictions for 2023

Why Software Composition Analysis (SCA) Tools Must Transform to Enable Stronger Software Supply Chain Security

Remote Code Execution in Spotify’s Backstage via vm2 Sandbox Escape (CVSS Score of 9.8)

Enter "Sandbreak" - Vulnerability In vm2 Sandbox Module Enables Remote Code Execution (CVE-2022-36067)

Guess Who’s (R)BAC?

Oxeye Now Integrates with Jira

“ParseThru” – Exploiting HTTP Parameter Smuggling in Golang - Updated October 10, 2022

Diving Into OpenTelemetry’s Specs – The Story of How I Wrote Another Instrumentation

Runtime SBOM – Secure Microservices with Runtime Visibility

Essential Takeaways for Cloud-Native Application Security Testing

Software Composition Analysis (SCA) & Cloud-Native Application Security

You Can’t IAST Your Way Out of This One

Who is responsible for Cloud Native Security?

Why SAST doesn’t work in a cloudy world: 3 reasons SAST can’t support cloud native apps

DAST & Cloud-Native Web Apps - Like Bringing a Knife to a Gunfight

How insecure application tracing and telemetry may lead to sensitive data and PII leakage

How Legacy AST Tools Fail to Secure Cloud Native Applications

How Contextual Risk Analysis Helps AppSec Teams Better Mitigate Log4Shell (CVE-2021-44228)

Cloud Native Apps & Microservices Need a New Security Testing Approach

Contributing Open Source Code to the OpenTelemetry Project

When Cloud Native Application Security Testing Fails: A Real-World Analysis

The Cloud Native Application Security Challenges and How to Avoid Them

Introducing Oxeye - Cloud-Native Application Security Testing, Here We Come

Oxeye Blog

Take Me to Prom - Exploiting an RCE in openTSDB through Prometheus

Take Me to Prom - Exploiting an RCE in openTSDB through Prometheus

RCE through SQL Injection Vulnerability in Hashicorp's Vault

"BreakStage" – an Unauthenticated Remote Code Execution in Spotify’s Backstage

Enter "Sandbreak" - Vulnerability In vm2 Sandbox Module Enables Remote Code Execution (CVE-2022-36067)

Guess Who’s (R)BAC?

“ParseThru” – Exploiting HTTP Parameter Smuggling in Golang - (Updated October 10, 2022)