Security Scanners Turned Against Us: The Dark Side of AppSec Tools
A growing concern in the cybersecurity world is emerging as researchers uncover a new vulnerability in the software supply chain. Application security (AppSec) scanners, designed to strengthen code and protect against attacks, are being exploited by attackers to gain access to development environments and launch downstream attacks.
This alarming trend was recently highlighted by ZeroPath’s research team, which investigated the susceptibility of 20 unnamed security vendors’ products. The findings were startling: five of these top-tier AppSec tools had significant vulnerabilities that could be exploited to obtain sensitive secrets, including cloud credentials, production databases, and even developers’ personal access tokens.
The researchers discovered that attackers can use these scanners as a gateway for attacks by crafting malicious code repositories specifically designed to test the limits of the scanning tool. By pointing the scanner at a specially crafted repository, an attacker can execute malicious code, potentially leading to credential theft, data breaches, or other devastating consequences.
What’s more concerning is that this attack vector doesn’t require full compromise of the vendor’s development environment, making it even more accessible to attackers. As Raphael Karger, co-founder and CTO of ZeroPath, explained, “These instances could have reached customers who thought they were secure.”
The genesis of this research began with an alert in ZeroPath’s own production monitoring software. An attacker had been probing their scanning tools, testing the boundaries of how they processed files and dependencies. Intrigued by the suspicious activity, Karger’s team decided to build a tool that would simulate these attacks and test their environment for vulnerabilities.
Their findings revealed that many AppSec scanners execute code without proper isolation, making them susceptible to “untrusted content” processing issues. This is where an attacker can plant malicious code in a repository being scanned, which the scanner will then execute, leading to unexpected consequences.
As Karger put it, “If the scanner processes files without isolation, that could allow an attacker to present unexpected content that causes the scanner to not only read a file but also run malicious code.”
The implications of this research are far-reaching. If attackers can exploit AppSec scanners to gain access to sensitive data and systems, the consequences will be devastating for organizations relying on these tools to secure their software supply chain.
In light of this discovery, it’s essential that developers and security teams take a closer look at their AppSec scanning practices. They should ensure that their scanning tools are properly configured, isolated from potential vulnerabilities, and regularly updated with the latest security patches.
Ultimately, this research highlights the importance of continuous vigilance in the cybersecurity landscape. By staying one step ahead of attackers and addressing these emerging threats proactively, we can mitigate the risks associated with AppSec scanners turned against us.
Source: Dark Reading — 2026-07-29