Sonar AI Agent Discovers Vulnerabilities Hidden in Business Logic Workflows

Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

Sonar today made available an artificial intelligence (AI) agent designed to discover vulnerabilities and business logic flaws that pose the greatest risk to an organization should they be exploited. The SonarQube Hunter Agent first analyzes an entire codebase to find three categories of flaws: broken access control, business-logic vulnerabilities, and authentication or session-management issues. Satinder Khasriya, a technical product marketing manager for Sonar, said that, historically, discovering these issues would have required manual testing or a penetration test. The AI agent developed by Sonar automates those investigations by tracing how code and data move through a system in a way that can now run on demand, he added. Additionally, SonarQube Hunter Agent is able to identify the developer who created any piece of code, with verified issues that are surfaced within a DevSecOps workflow via integrations with continuous integration/continuous delivery (CI/CD) platforms. That’s critical because as advances in AI now make it possible for cybercriminals to discover and exploit vulnerabilities in a matter of hours, DevSecOps teams need to be able to identify issues at machine speed versus waiting until they might be discovered using legacy scanning tools, noted Khasriya. The time to exploitation after a vulnerability has dramatically shrunk, he added. Deterministic scanning tools are good for catching flaws that look wrong in the code, such as injection vulnerabilities, unsafe data flows, and insecure patterns, but some vulnerabilities aren’t detectable in code, he added. …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen: Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://devops.com/sonar-ai-agent-discovers-vulnerabilities-hidden-in-business-logic-workflows/
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.