Even we who deal with code security on a daily basis were surprised by the results. We’ll let you read the details, but here’s the short-run:
It wouldn’t be a stretch to assume that a similar percentage of all the other plugins contain these vulnerabilities.
These findings emphasize, however, a deeper problem than risky plugins. At the root of the problem is the lack of security standards that PaaS-providers (aka app marketplaces) enforce on the apps that they distribute. After all, a developer in a rush will most likely not consider security aspects during the demands of a release. Web admins cannot necessarily schedule immediate updates whether due to lack of security knowledge, admin resources and other scheduling priorities. Unfortunately, the end-user carries the brunt- which undoubtedly is not their responsibility.
So who’s responsible? The app marketplace.
The app marketplaces are in that unique position to set a security policy on the apps that they distribute. The marketplace needs to ensure that only those apps which passed its specific security bar are authorized for the public.
The world is shifting towards software distribution platforms. App marketplaces continue to tell us that their platforms are secure, but don’t buy into those word games. Only if they start enforcing the security of the apps they distribute, we could seriously talk about the security of distribution platforms.
Sign up today & never miss an update from the Checkmarx blog
Interested in trying CxSAST on your own code? You can now use Checkmarx's solution to scan uncompiled / unbuilt source code in 18 coding and scripting languages and identify the vulnerable lines of code. CxSAST will even find the best-fix locations for you and suggest the best remediation techniques. Sign up for your FREE trial now.
Checkmarx is now offering you the opportunity to see how CxSAST identifies application-layer vulnerabilities in real-time. Our in-house security experts will run the scan and demonstrate how the solution's queries can be tweaked as per your specific needs and requirements. Fill in your details and we'll schedule a FREE live demo with you.