It seems not a day goes by without another open source supply chain attack.
The latest, uncovered by the security researcher "JK" is called "Instant Thought" and was noticed in the most popular Java IDE, combined the the very popular build system Gradle.
One might assume that just opening a Gradle project to read the source code is a safe operation, but Instant Thought shows this is not the case.
Gradle projects might have an unassuming settings.gradle file with a tiny block which gets executed by the IDE as soon as the project is loaded.
Root cause analysis showed the problem is the gradle.projectsLoaded hook which is able to run code with the full permissions of the user account:
gradle.projectsLoaded { g ->
// do bad things
}
"This is not unlike the Word macro viruses seen in late '90s" said another analyst. "Which just shows how behind the times the IDEs are with security".
It is not clear how widespread Instant Thought is but suffice to say developers have to think long and hard before executing or even opening unknown projects.
According to the vendor, this is a low priority issue: "[Our IDE] automatically configures the project during the import (which is quite similar to executing gradle command) and it causes the code execution. The current behaviour seems not to be a high severity security problem thus it won't be fixed in the near future."
The latest, uncovered by the security researcher "JK" is called "Instant Thought" and was noticed in the most popular Java IDE, combined the the very popular build system Gradle.
One might assume that just opening a Gradle project to read the source code is a safe operation, but Instant Thought shows this is not the case.
Gradle projects might have an unassuming settings.gradle file with a tiny block which gets executed by the IDE as soon as the project is loaded.
Root cause analysis showed the problem is the gradle.projectsLoaded hook which is able to run code with the full permissions of the user account:
gradle.projectsLoaded { g ->
// do bad things
}
"This is not unlike the Word macro viruses seen in late '90s" said another analyst. "Which just shows how behind the times the IDEs are with security".
It is not clear how widespread Instant Thought is but suffice to say developers have to think long and hard before executing or even opening unknown projects.
According to the vendor, this is a low priority issue: "[Our IDE] automatically configures the project during the import (which is quite similar to executing gradle command) and it causes the code execution. The current behaviour seems not to be a high severity security problem thus it won't be fixed in the near future."
No comments:
Post a Comment