Azure Active Directory V2 Preview Module.
This is a Public Preview release of Azure Active Directory V2 PowerShell Module.
For detailed information on how to install and run this module from the PowerShell Gallery including prerequisites, please refer to https://docs.microsoft.com/en-us/powershell/scripting/gallery/overview
List of software quality issues with the number of affected components.
category ALL
Policies
Info
Category
Problem
Data Execution Prevention (DEP/NX) is a vulnerability mitigation option that prevents data from being interpreted as code anywhere within the application. This mitigation protects the application stack, heap and other memory data ranges. Executable files that fail to implement this mitigation expose the user to increased risks of malicious code injection.
Prevalence in PowerShell Gallery community
0 packages
found in
Top 100
32 packages
found in
Top 1k
109 packages
found in
Top 10k
184 packages
in community
Next steps
It's highly recommended to enable this option for all software components used at security boundaries, or those that process user controlled inputs.
To enable this mitigation, refer to your programming language linker documentation.
In Microsoft VisualStudio, you can enable DEP mitigation by setting the linker option /NXCOMPAT to ON.
Problem
Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Software developers publish components they have authored to public repositories. Open source projects are the intellectual property of their respective authors. At any time, the authors may choose to completely remove the software component from a public repository. This often occurs when a software project reaches its end-of-life stage, or when the software authors lose interest in maintaining the project. This kind of removal frees up the software package name, its unique software identifier in the public repository, for other developers to use. However, new software project owners might have malicious intent. Threat actors are continuously monitoring popular package names in case their unique identifiers suddenly become available for hijacking. Once the software projects falls under new ownership, the new maintainers may opt to use the project popularity to spread malware to unsuspecting users.
Prevalence in PowerShell Gallery community
4 packages
found in
Top 100
26 packages
found in
Top 1k
483 packages
found in
Top 10k
3.71k packages
in community
Next steps
Inspect behaviors exhibited by the detected software components.
If the software behaviors differ from expected, investigate the build and release environment for software supply chain compromise.
Revise the use of components that raise these alarms. If you can't deprecate those components, make sure that their versions are pinned.
Avoid using this software package until it is vetted as safe.
Problem
Program database (PDB) files are typically only used during software development. They contain private debug symbols that make it significantly easier to reverse engineer a closed source application. In some cases, having a program database file is equivalent to having access to the source code. Presence of program databases could indicate that one or more software components have been built using a debug profile, instead of the release.
Prevalence in PowerShell Gallery community
3 packages
found in
Top 100
106 packages
found in
Top 1k
237 packages
found in
Top 10k
436 packages
in community
Next steps
Remove private debug database files from the software package before you release it.
Problem
Address Space Layout Randomization (ASLR) is a vulnerability mitigation option that forces software components to load on a different memory base address each time they are used. This makes the memory layout unpredictable, and it is therefore harder for malicious code to be reliably injected during application runtime. Although enabling ASLR is an opt-in setting during program linking, some operating system configurations can still enforce its use if the vulnerability mitigation requirements are met. This is possible even if the application hasn't been explicitly marked as ASLR-compatible. While this generally improves security posture, the limitation of ASLR enforcement is that the application load addresses are not truly randomized. In most cases, the application load base is different than the default, but it remains the same for the entire duration of device uptime.
Prevalence in PowerShell Gallery community
0 packages
found in
Top 100
33 packages
found in
Top 1k
73 packages
found in
Top 10k
139 packages
in community
Next steps
In Microsoft VisualStudio, you should explicitly enable ASLR mitigation by setting the linker option /DYNAMICBASE to ON.
Problem
Uniform Resource Locators (URLs) are structured addresses that point to locations and assets on the internet. URLs allow software developers to build complex applications that exchange data with servers that can be hosted in multiple geographical regions. URLs can commonly be found embedded in documentation, configuration files, source code and compiled binaries. A port number is associated with a network address of a host, such as an IP address, and the type of network protocol used for communication. Within URLs, the ports are optional. Ports can be specified in a URL immediately following the domain name. Each network protocol, or schema, has a set of standard ports on which the service operates. This issue is raised when a mismatch between a network protocol and its expected port number is detected. While the presence of non-standard ports does not imply malicious intent, all of their uses in a software package should be documented and approved.
Prevalence in PowerShell Gallery community
12 packages
found in
Top 100
105 packages
found in
Top 1k
405 packages
found in
Top 10k
770 packages
in community
Next steps
Investigate reported detections.
If the software should not include these network references, investigate your build and release environment for software supply chain compromise.
You should delay the software release until the investigation is completed, or until the issue is risk accepted.
Consider changing the port to one that is standard for the networking protocol.
Problem
Private keys and certificates are considered sensitive information that should not be included in released software packages. However, developers frequently release sensitive information alongside their applications to facilitate automated software testing. Testing keys and certificates often proliferate through the software supply chain. When such information gets shared publicly, it is catalogued by file reputation databases. Any private key and certificate files seen by a file reputation database prior to configured time threshold can be automatically suppressed. Commonly shared sensitive information is not considered to be secret.
Prevalence in PowerShell Gallery community
6 packages
found in
Top 100
125 packages
found in
Top 1k
396 packages
found in
Top 10k
730 packages
in community
Next steps
Review the commonly shared sensitive information for evidence of inadvertently exposed secrets.
If the keys were published unintentionally and the software has been made public, you should revoke the keys and file a security incident.
Problem
Operating systems allow multiple user accounts to coexist on a single computer system. Each registered user has identity information associated with their account. At the very least, user accounts consist of a user name and an optional password. In some cases, user account data may also include personally identifiable information. Extended personal information may include user's given and last name, their email and mailing address, personal photo and their telephone number. Financially motivated attackers may seek to collect personal information for purposes of selling the private data to a third-party. Malicious code that typically exhibits these behavior traits is commonly referred to as an information stealer. While the presence of code that accesses identity information does not necessarily imply malicious intent, all of its uses in a software package should be documented and approved. Accessing identity information is a very common behavior for software packages. One example of acceptable use for such functions is verifying that the active user has purchased a software license that allows them to run the application.
Prevalence in PowerShell Gallery community
9 packages
found in
Top 100
176 packages
found in
Top 1k
972 packages
found in
Top 10k
1.9k packages
in community
Next steps
Investigate reported detections as indicators of software tampering.
Consult Mitre ATT&CK documentation: T1033 - System Owner/User Discovery.