Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.deCure53 Security Assessment of SonarQube DataCenter Edition, Management Summary, 04.2021
Cure53, Dr.-Ing. M. Heiderich, N. Hippert, BSc. J. Hector, BSc. C. KeanCure53, which is a Berlin-based IT security consultancy, completed a security assessment ofthe SonarQube DataCenter Edition Software in early 2021. The core aim of the project was tothoroughly examine and evaluate the security posture exposed by the SonarQube DataCenter
Edition Software web UI, backend and API, with key focus on several specifically chosenfeatures.
To be able to issue a reliable verdict about the components in scope, the Cure53 team carriedout a penetration test and broader security assessment. In addition, in final phase of the project,
the testing team verified fixes that the SonarSource team crafted in response to the identified
shortcomings and recommendations proposed by Cure53.
In terms of resources, methods and timeline, it should be clarified that four members of theCure53 team were tasked with this project, based on their skills and expertise matching theexamination’s goals. They spent fifteen person-days on the scope, investing time into testing
during Calendar Week 14, that is in early April 2021. It has been agreed that a so-called greybox methodology fitted best with the objectives that the SonarSource team wished to achievewith this engagement. The Cure53 testing team investigated a dedicated instance rolled out for
security testing, as well as benefitted from dedicated test-user accounts and additional testsupporting documentation.
In order to make sure that all aspects of the scope receive proper attention, the work was split
into two Work Packages (WPs). In WP1, Cure53 completed grey-box penetration tests against
the SonarQube Data Center Web UI and frontend, whereas WP2 was dedicated to the backend
and API endpoints of the SonarQube Data Center API & Setup, with the same methodologies
deployed.
The test started on time and moved forward at a speedy pace, thanks in part to all preparations
comprehensively completed by SonarSource in CW13. The relevant members of theSonarSource and the Cure53 teams were connected through a shared Slack channel, which
had been created by connecting workspaces of the two entities. Cure53 issued regular status
updates, therefore making it possible for the SonarSource team to consult on the optimal
mitigation strategies.

Cure53, Berlin · 04/23/21

1/2

Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de

The coverage reached in this test was very good. While five security-relevant issues have beenspotted and documented, it is important to underline that only one was confirmed as an actual
security vulnerability of low severity. The remaining items - four of them to be precise - belong to
the array of general weaknesses with lower exploitation potential. In fact, the highest risk-scoreascribed to a problem during this project stood at “Low” and the findings – also given their lowscores and total number - do not point to any anti-patterns. Further of note is the fact thatseveral issues, including the one spotted vulnerability, have already been addressed andverified as fixed by Cure53 in the weeks following the project.
In Cure53’s expert opinion, this project confirmed a very solid security premise at SonarSource
for the SonarQube DataCenter Edition Software. The application compound is currently wellprotected against a broad number of web application attack vectors.
One can argue that the outcome highlights the development team’s commitment to maintaining
security features with due diligence and adherence to best practices. Despite extensive deepdives and exemplary coverage toward a plethora of application features by the Cure53 testers,
no serious issues were detected.
Cure53 would like to thank Belén Pruvost, Christophe Levis, Malena Ebert, Andrea Malagodi,
Tobias Trabelsi and Nicolas Peru from the SonarQube team for their excellent project
coordination, support and assistance, both before and during this assignment.

Cure53, Berlin · 04/23/21

2/2