18 Apr 2017 by Martin Bednorz
We are happy to announce the next iteration of our static analysis software for PHP! The new release RIPS 2.0.0 includes the following major changes:
- A complete new interface with optimized performance (demo.ripstech.com)
- A new extensive REST API for full feature automation (api.ripstech.com)
- Team and user privilege management
- Application-specific analysis profiles
- More detailed code summaries and issue descriptions
- Issue categorization for PCI DSS compliance requirements
- Improved analysis precision and performance
- Detection of Cookie Misconfiguration issues (CWE-613, CWE-614, CWE-1004)
- Detection of Insufficient Certificate Validation issues (CWE-295, CWE-297)
Find out more about the top 5 new features in this blog post.Read More ...
24 Dec 2016 by Johannes Dahse
In this years Advent of PHP Application Vulnerabilities (APAV), we examined 36 critical security issues which were detected in 19 different PHP applications by our code analysis solution RIPS. In our final post, we would like to summarize what we learned during this thrilling advent time. We reveal how the affected vendors reacted to our reportings behind the scenes. Was it right to publish all these sensitive issues? What conclusions can we draw about the security state of PHP applications from our findings?Read More ...
The 23rd gift in our advent calendar presents security issues in e107, a content management system that is in development since 2013. Among others, we identified a critical issue that allows any user to update his permissions and to extract sensitive information from the database by exploiting a PHP object injection vulnerability.Read More ...
22 Dec 2016 by Daniel Peeren
Compliance describes the adherence to regulations and commitments organizations have to fulfill in certain sectors. Security is an integral part of many regulations. In general, a company is compliant if a snapshot of the current security arrangements meets a specific set of requirements. These requirements are defined by several regulatory organizations or standards, for example PCI DSS, HIPAA, or the ISO27k-series. If your company is bound to - or would like to - comply to these standards, read on and learn how the security requirements can be achived with a SAST tool.Read More ...
21 Dec 2016 by Martin Bednorz
In our 21st advent calendar gift, we cover AbanteCart, a very popular e-commerce solution that just turned 5 years old last month. RIPS found multiple SQL injections, PHP object injections, and the complementary cross-site scriptings so that the more severe vulnerabilities can be exploited. Interestingly, the AbanteCart website was defaced just moments before we send out our analysis report to the development team.Read More ...