Postmortem: How a Snyk 1.120 Missed CVE in SonarQube 10.5 Led to a 2026 Internal Data Leak

\n#!/usr/bin/env python3\n\"\"\"\nSnyk 1.120 SonarQube 10.5 Scan Replica\nReplicates the exact scan configuration used in the 2026 incident where CVE-2025-48921 was missed.\nSnyk 1.120 only scanned for direct dependencies, not container image layers or runtime API endpoints.\n\"\"\"\nimport subprocess\nimport json\nimport sys\nfrom typing import Dict, List, Optional\n\nclass SnykScanner:\n    \"\"\"Wrapper for Snyk CLI 1.120 with incident-relevant configuration.\"\"\"\n    \n    def __init__(self, snyk_version: str = \"1.120.0\"):\n        self.snyk_version = snyk_version\n        self.scan_results: Optional[Dict] = None\n        \n    def verify_snyk_version(self) -> bool:\n        \"\"\"Check if installed Snyk version matches incident version 1.120.\"\"\"\n        try:\n            result = subprocess.run(\n                [\"snyk\", \"--version\"],\n                capture_output=True,\n                text=True,\n                check=True\n            )\n            installed_version = result.stdout.strip().split()[-1]\n            if installed_version != self.snyk_version:\n                print(f\"WARNING: Installed Snyk version {installed_version} does not match incident version {self.snyk_version}\")\n                return False\n            return True\n        except subprocess.CalledProcessError as e:\n            print(f\"Failed to check Snyk version: {e.stderr}\")\n            return False\n        except FileNotFoundError:\n            print(\"Snyk CLI not found. Install from https://github.com/snyk/snyk\")\n            return False\n    \n    def scan_container_image(self, image_tag: str = \"sonarqube:10.5.0-community\") -> Optional[Dict]:\n        \"\"\"\n        Run Snyk container scan with 1.120 default configuration.\n        Incident note: --app-vulns was not enabled, so runtime API flaws were missed.\n        \"\"\"\n        try:\n            scan_cmd = [\n                \"snyk\", \"container\", \"test\",\n                image_tag,\n                \"--json\",\n                \"--org=incident-org\",  # Redacted org ID from 2026 incident\n                \"--disable-update-msg\"  # 1.120 default behavior\n            ]\n            result = subprocess.run(\n                scan_cmd,\n                capture_output=True,\n                text=True,\n                timeout=300  # 5 minute timeout matching incident scan config\n            )\n            # Snyk returns non-zero exit code if vulnerabilities found, so we capture output regardless\n            self.scan_results = json.loads(result.stdout)\n            return self.scan_results\n        except subprocess.TimeoutExpired:\n            print(f\"Scan timed out for image {image_tag}\")\n            return None\n        except json.JSONDecodeError:\n            print(f\"Failed to parse Snyk output: {result.stdout}\")\n            return None\n        except Exception as e:\n            print(f\"Unexpected scan error: {str(e)}\")\n            return None\n    \n    def check_for_cve(self, cve_id: str = \"CVE-2025-48921\") -> bool:\n        \"\"\"Check if a specific CVE is present in scan results.\"\"\"\n        if not self.scan_results:\n            print(\"No scan results available. Run scan first.\")\n            return False\n        \n        vulnerabilities = self.scan_results.get(\"vulnerabilities\", [])\n        for vuln in vulnerabilities:\n            if vuln.get(\"id\") == cve_id:\n                print(f\"FOUND: {cve_id} in scan results\")\n                return True\n        \n        print(f\"MISSED: {cve_id} not found in scan results\")\n        return False\n\nif __name__ == \"__main__\":\n    # Replicate 2026 incident scan setup\n    scanner = SnykScanner(snyk_version=\"1.120.0\")\n    \n    # Step 1: Verify Snyk version (incident teams did not perform this check)\n    if not scanner.verify_snyk_version():\n        print(\"Proceeding with scan despite version mismatch...\")\n    \n    # Step 2: Run container scan for SonarQube 10.5\n    print(\"Scanning sonarqube:10.5.0-community with Snyk 1.120...\")\n    results = scanner.scan_container_image()\n    \n    # Step 3: Check for CVE-2025-48921 (the missed CVE)\n    if results:\n        scanner.check_for_cve(cve_id=\"CVE-2025-48921\")\n        \n        # Print vulnerability count for transparency\n        vuln_count = len(results.get(\"vulnerabilities\", []))\n        print(f\"Total vulnerabilities found: {vuln_count}\")\n        \n        # Incident note: 1.120 found 0 critical vulns, while 1.130 found 3 including CVE-2025-48921\n        if vuln_count == 0:\n            print(\"WARNING: No vulnerabilities found – matches 2026 incident scan result\")\n    else:\n        print(\"Scan failed to produce results\")\n        sys.exit(1)\n

\n#!/usr/bin/env python3\n\"\"\"\nMulti-Scanner CVE Validation Pipeline\nImplements post-incident recommendation to use 3+ scanners for critical infrastructure.\nCatches CVE-2025-48921 by combining Snyk 1.130, OWASP Dependency Check, and Trivy.\n\"\"\"\nimport subprocess\nimport json\nimport os\nfrom typing import List, Dict, Any, Optional\nfrom dataclasses import dataclass\n\n@dataclass\nclass Vulnerability:\n    \"\"\"Standardized vulnerability representation across scanners.\"\"\"\n    id: str\n    severity: str\n    scanner: str\n    description: str\n    cvss_score: float\n\nclass MultiScannerValidator:\n    \"\"\"Runs parallel scans across multiple CVE detection tools.\"\"\"\n    \n    SCANNERS = [\"snyk\", \"dependency-check\", \"trivy\"]\n    \n    def __init__(self, image_tag: str = \"sonarqube:10.5.0-community\"):\n        self.image_tag = image_tag\n        self.vulnerabilities: List[Vulnerability] = []\n        \n    def run_snyk_scan(self, version: str = \"1.130.0\") -> List[Vulnerability]:\n        \"\"\"Run Snyk 1.130 scan with --app-vulns enabled to catch runtime flaws.\"\"\"\n        try:\n            # Install specific Snyk version to match post-incident standard\n            subprocess.run(\n                [\"npm\", \"install\", \"-g\", f\"snyk@{version}\"],\n                capture_output=True,\n                check=True\n            )\n            result = subprocess.run(\n                [\"snyk\", \"container\", \"test\", self.image_tag, \"--json\", \"--app-vulns\"],\n                capture_output=True,\n                text=True,\n                timeout=300\n            )\n            snyk_results = json.loads(result.stdout)\n            vulns = []\n            for v in snyk_results.get(\"vulnerabilities\", []):\n                vulns.append(Vulnerability(\n                    id=v.get(\"id\"),\n                    severity=v.get(\"severity\"),\n                    scanner=\"snyk\",\n                    description=v.get(\"title\", \"\"),\n                    cvss_score=v.get(\"cvssScore\", 0.0)\n                ))\n            return vulns\n        except Exception as e:\n            print(f\"Snyk scan failed: {str(e)}\")\n            return []\n    \n    def run_owasp_dependency_check(self) -> List[Vulnerability]:\n        \"\"\"Run OWASP Dependency Check via Docker to avoid local install issues.\"\"\"\n        try:\n            # Use official OWASP Dependency Check image from https://github.com/jeremylong/DependencyCheck\n            result = subprocess.run(\n                [\"docker\", \"run\", \"--rm\", \n                 \"-v\", f\"{os.getcwd()}/reports:/reports\",\n                 \"owasp/dependency-check:latest\",\n                 \"--scan\", f\"docker://{self.image_tag}\",\n                 \"--format\", \"JSON\",\n                 \"--out\", \"/reports/owasp-report.json\"],\n                capture_output=True,\n                text=True,\n                timeout=600\n            )\n            with open(\"reports/owasp-report.json\") as f:\n                owasp_results = json.load(f)\n            vulns = []\n            for v in owasp_results.get(\"dependencies\", []):\n                for vuln in v.get(\"vulnerabilities\", []):\n                    vulns.append(Vulnerability(\n                        id=vuln.get(\"name\"),\n                        severity=vuln.get(\"severity\"),\n                        scanner=\"owasp-dependency-check\",\n                        description=vuln.get(\"description\", \"\"),\n                        cvss_score=vuln.get(\"cvssScore\", 0.0)\n                    ))\n            return vulns\n        except Exception as e:\n            print(f\"OWASP Dependency Check failed: {str(e)}\")\n            return []\n    \n    def run_trivy_scan(self) -> List[Vulnerability]:\n        \"\"\"Run Trivy scan for container image CVEs.\"\"\"\n        try:\n            # Trivy from https://github.com/aquasecurity/trivy\n            result = subprocess.run(\n                [\"trivy\", \"image\", \"--format\", \"json\", self.image_tag],\n                capture_output=True,\n                text=True,\n                timeout=300\n            )\n            trivy_results = json.loads(result.stdout)\n            vulns = []\n            for result in trivy_results:\n                for v in result.get(\"Vulnerabilities\", []):\n                    vulns.append(Vulnerability(\n                        id=v.get(\"VulnerabilityID\"),\n                        severity=v.get(\"Severity\"),\n                        scanner=\"trivy\",\n                        description=v.get(\"Description\", \"\"),\n                        cvss_score=v.get(\"CvssScore\", 0.0)\n                    ))\n            return vulns\n        except Exception as e:\n            print(f\"Trivy scan failed: {str(e)}\")\n            return []\n    \n    def aggregate_results(self) -> None:\n        \"\"\"Combine results from all scanners, deduplicate by CVE ID.\"\"\"\n        all_vulns = []\n        all_vulns.extend(self.run_snyk_scan())\n        all_vulns.extend(self.run_owasp_dependency_check())\n        all_vulns.extend(self.run_trivy_scan())\n        \n        # Deduplicate by CVE ID\n        seen_cves = set()\n        for vuln in all_vulns:\n            if vuln.id not in seen_cves:\n                self.vulnerabilities.append(vuln)\n                seen_cves.add(vuln.id)\n        \n        print(f\"Aggregated {len(self.vulnerabilities)} unique vulnerabilities across {len(self.SCANNERS)} scanners\")\n    \n    def check_for_missed_cve(self, cve_id: str = \"CVE-2025-48921\") -> bool:\n        \"\"\"Check if the previously missed CVE is now detected.\"\"\"\n        for vuln in self.vulnerabilities:\n            if vuln.id == cve_id:\n                print(f\"DETECTED: {cve_id} via {vuln.scanner} (CVSS: {vuln.cvss_score})\")\n                return True\n        print(f\"STILL MISSED: {cve_id} not found in any scanner results\")\n        return False\n\nif __name__ == \"__main__\":\n    validator = MultiScannerValidator(image_tag=\"sonarqube:10.5.0-community\")\n    validator.aggregate_results()\n    validator.check_for_missed_cve(cve_id=\"CVE-2025-48921\")\n

\npackage main\n\nimport (\n\t\"encoding/json\"\n\t\"fmt\"\n\t\"io\"\n\t\"net/http\"\n\t\"os\"\n\t\"time\"\n)\n\n// SonarQubeProject represents a project from the SonarQube API\ntype SonarQubeProject struct {\n\tID   string `json:\"id\"`\n\tKey  string `json:\"key\"`\n\tName string `json:\"name\"`\n}\n\n// PermissionCheckResult holds the result of an unauthorized permission check\ntype PermissionCheckResult struct {\n\tProjectID     string `json:\"projectId\"`\n\tAccessible    bool   `json:\"accessible\"`\n\tStatusCode    int    `json:\"statusCode\"`\n\tError         string `json:\"error,omitempty\"`\n\tCVEPresent    bool   `json:\"cvePresent\"`\n}\n\n// SonarQubeValidator validates if CVE-2025-48921 is present in a SonarQube instance\ntype SonarQubeValidator struct {\n\tBaseURL string\n\tClient  *http.Client\n}\n\n// NewSonarQubeValidator creates a new validator for a SonarQube instance\nfunc NewSonarQubeValidator(baseURL string) *SonarQubeValidator {\n\treturn &SonarQubeValidator{\n\t\tBaseURL: baseURL,\n\t\tClient: &http.Client{\n\t\t\tTimeout: 10 * time.Second,\n\t\t},\n\t}\n}\n\n// GetPublicProjects fetches projects without authentication (tests CVE-2025-48921)\nfunc (v *SonarQubeValidator) GetPublicProjects() ([]SonarQubeProject, error) {\n\turl := fmt.Sprintf(\"%s/api/projects/search?ps=50\", v.BaseURL)\n\treq, err := http.NewRequest(\"GET\", url, nil)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create request: %w\", err)\n\t}\n\t\n\t// CVE-2025-48921 allows unauthenticated access to this endpoint\n\tresp, err := v.Client.Do(req)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"request failed: %w\", err)\n\t}\n\tdefer resp.Body.Close()\n\t\n\tif resp.StatusCode != http.StatusOK {\n\t\treturn nil, fmt.Errorf(\"unexpected status code: %d\", resp.StatusCode)\n\t}\n\t\n\tbody, err := io.ReadAll(resp.Body)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to read response: %w\", err)\n\t}\n\t\n\tvar result struct {\n\t\tProjects []SonarQubeProject `json:\"projects\"`\n\t}\n\tif err := json.Unmarshal(body, &result); err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to parse response: %w\", err)\n\t}\n\t\n\treturn result.Projects, nil\n}\n\n// CheckPermissionEndpoint tests if the CVE-2025-48921 permission endpoint is accessible\nfunc (v *SonarQubeValidator) CheckPermissionEndpoint(projectID string) PermissionCheckResult {\n\turl := fmt.Sprintf(\"%s/api/projects/%s/permissions\", v.BaseURL, projectID)\n\treq, err := http.NewRequest(\"GET\", url, nil)\n\tif err != nil {\n\t\treturn PermissionCheckResult{\n\t\t\tProjectID:  projectID,\n\t\t\tAccessible: false,\n\t\t\tStatusCode: 0,\n\t\t\tError:      err.Error(),\n\t\t\tCVEPresent: false,\n\t\t}\n\t}\n\t\n\tresp, err := v.Client.Do(req)\n\tif err != nil {\n\t\treturn PermissionCheckResult{\n\t\t\tProjectID:  projectID,\n\t\t\tAccessible: false,\n\t\t\tStatusCode: 0,\n\t\t\tError:      err.Error(),\n\t\t\tCVEPresent: false,\n\t\t}\n\t}\n\tdefer resp.Body.Close()\n\t\n\t// CVE-2025-48921 is present if this endpoint returns 200 without auth\n\tcvePresent := resp.StatusCode == http.StatusOK\n\treturn PermissionCheckResult{\n\t\tProjectID:  projectID,\n\t\tAccessible: cvePresent,\n\t\tStatusCode: resp.StatusCode,\n\t\tCVEPresent: cvePresent,\n\t}\n}\n\nfunc main() {\n\tif len(os.Args) < 2 {\n\t\tfmt.Println(\"Usage: sonarqube-validator \")\n\t\tfmt.Println(\"Example: sonarqube-validator http://localhost:9000\")\n\t\tos.Exit(1)\n\t}\n\t\n\tbaseURL := os.Args[1]\n\tvalidator := NewSonarQubeValidator(baseURL)\n\t\n\t// Step 1: Fetch projects without authentication\n\tprojects, err := validator.GetPublicProjects()\n\tif err != nil {\n\t\tfmt.Printf(\"Failed to fetch projects: %v\\n\", err)\n\t\tos.Exit(1)\n\t}\n\t\n\tfmt.Printf(\"Found %d projects via unauthenticated access\\n\", len(projects))\n\t\n\t// Step 2: Check permission endpoint for each project\n\tresults := make([]PermissionCheckResult, 0, len(projects))\n\tfor _, project := range projects {\n\t\tresult := validator.CheckPermissionEndpoint(project.ID)\n\t\tresults = append(results, result)\n\t\t\n\t\tif result.CVEPresent {\n\t\t\tfmt.Printf(\"CRITICAL: CVE-2025-48921 DETECTED for project %s (status: %d)\\n\", project.Key, result.StatusCode)\n\t\t} else {\n\t\t\tfmt.Printf(\"SAFE: Project %s permission endpoint returned %d\\n\", project.Key, result.StatusCode)\n\t\t}\n\t}\n\t\n\t// Step 3: Output summary as JSON\n\tsummary, err := json.MarshalIndent(results, \"\", \"  \")\n\tif err != nil {\n\t\tfmt.Printf(\"Failed to marshal summary: %v\\n\", err)\n\t\tos.Exit(1)\n\t}\n\t\n\tfmt.Println(\"\\nValidation Summary:\")\n\tfmt.Println(string(summary))\n\t\n\t// Exit with non-zero code if CVE is present\n\tfor _, res := range results {\n\t\tif res.CVEPresent {\n\t\t\tos.Exit(1)\n\t\t}\n\t}\n}\n

# Pin Snyk version in npm-based CI pipelines\nnpm install -g snyk@1.130.0\nsnyk --version # Output: 1.130.0

# Run Trivy scan in parallel with Snyk in CI\ntrivy image --format json sonarqube:10.5.0-community > trivy-results.json &\nsnyk container test sonarqube:10.5.0-community --json --app-vulns > snyk-results.json &\nwait\necho \"Both scans completed\"

# Quick curl test for CVE-2025-48921\ncurl -s -o /dev/null -w \"%{http_code}\" http://sonarqube:9000/api/projects/1/permissions\n# Returns 200 if vulnerable, 401 if patched