Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

5/19/2020
04:10 PM
50%
50%

Unpatched Open Source Libraries Leave 71% of Apps Vulnerable

PHP and JavaScript developers need to pay close attention because different languages and frameworks have different rates of vulnerability, research finds.

The management of open source libraries poses a major challenge for secure development. That's because seven in 10 applications use at least one flawed open source library, inheriting vulnerabilities that could potentially be exploited, according to a new study of more than 81,000 applications.

The vulnerability of open source libraries varies across languages and frameworks, and developers should take into consideration the characteristics of the framework they are working with, according to application security firm Veracode, which published the analysis. PHP applications, for example, have a modest number of imported open source components — an average of 34 — but a larger share of vulnerable libraries. On the other hand, while JavaScript typically has a relatively low number of vulnerable libraries, the typical application has a massive number of imported libraries — 377 on average — resulting in a large number of vulnerabilities, Veracode found.

Developers need to not just focus on patching, but also on approaching application security in a way that is right for the frameworks with which they are working, says Chris Eng, chief research officer at Veracode.  

"Open source software has a surprising variety of flaws," he says. "The attack surface of many applications is much larger than developers may expect due to the fact that open source libraries have dependencies on other libraries. Developers must be aware of this and the fact that language selection makes a difference in terms of the size of the ecosystem and in the prevalence of flaws in those ecosystems."

The report underscores that a lack of patching continues to be the No. 1 problem for application-security programs. Fixes exist for more than 90% of the vulnerabilities that have a published proof-of-concept, according to Veracode's report. Fixing such issues is critical because attackers regularly use older vulnerabilities to attack systems and applications, the US Cybersecurity and Infrastructure Security Agency said in a recent advisory.

"Open source software gives companies tremendous advantages, but there's no free lunch here, and all code must be managed to avoid your own contributions — whether open or closed source in nature — from exposing your users to vulnerabilities," Veracode stated in the report.

Overall, the research suggests that developers who know the security characteristics of the open source libraries supporting their particular language and framework will have a greater likelihood of producing secure code. 

For example, one attribute of open source libraries, known as transitive dependencies — where a library pulls in code from other libraries — can result in an application relying on code that a developer may not know about because they did not explicitly import the library. More than 80% of the applications written in JavaScript, PHP, and Ruby import more than two-thirds of their libraries through such transitive dependencies, according to Veracode. On the other end of the spectrum, less than 10% of applications written in Microsoft's .NET and Apple's Swift have transitive dependencies. Go, Java, and Python applications straddle the middle ground with a balanced mix.

The approach each language and its core developers take to libraries can also have an impact. 

PHP applications, for example, typically import a modest number of libraries but gain a significant attack surface area through this friend-of-a-friend method of importing components, which exposes vulnerabilities that might not otherwise be anticipated by developers. Combined with the finding that 27% of all PHP libraries have an exploitable flaw, the framework can be a source of hidden dangers for developers, says Veracode's Eng.

JavaScript applications, on the other hand, tend to import a large number of small libraries — one, for example, consists only of four lines of code — but relatively few libraries include a vulnerability. Because each application includes more than 300 libraries, however, the probability of including one of the vulnerable open source components is high, he says.

"More than any of the languages we've looked at, JavaScript encourages the creation and use of very, very, small libraries that do one task," Eng says. "With JavaScript, PHP, and Ruby, developers need to make sure they are managing transitive inclusions."

The most numerous vulnerability classes are not the ones that developers should necessarily spend the most time eradicating, according to Veracode. While 29% of all flaws are cross-site scripting vulnerabilities, only about 8% of flawed libraries have an exploitable version of the vulnerability. Two other classes of vulnerabilities from the OWASP Top 10 — insecure deserialization and broken access controls — are much more likely to be exploitable, with 30% of flawed libraries having an exploitable version of the vulnerability.

But the good news for developers is that a minor update or patch could fix more than 90% of vulnerabilities with published exploits, Eng says. 

"Open source software offers a lot of advantages, and it's only growing from here," he says. "My recommendation is that developers and their organizations increase their knowledge and ability to test for flaws in the libraries they are pulling into their applications. The fixes are usually minor and can have a big impact on reducing exposure."

Related Content:

 
Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/27/2020
6 Ways Passwords Fail Basic Security Tests
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/28/2020
'Act of War' Clause Could Nix Cyber Insurance Payouts
Robert Lemos, Contributing Writer,  10/29/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How to Measure and Reduce Cybersecurity Risk in Your Organization
In this Tech Digest, we examine the difficult practice of measuring cyber-risk that has long been an elusive target for enterprises. Download it today!
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-27014
PUBLISHED: 2020-10-30
Trend Micro Antivirus for Mac 2020 (Consumer) contains a race condition vulnerability in the Web Threat Protection Blocklist component, that if exploited, could allow an attacker to case a kernel panic or crash. An attacker must first obtain the ability to execute high-privileged code on the targ...
CVE-2020-27015
PUBLISHED: 2020-10-30
Trend Micro Antivirus for Mac 2020 (Consumer) contains an Error Message Information Disclosure vulnerability that if exploited, could allow kernel pointers and debug messages to leak to userland. An attacker must first obtain the ability to execute high-privi...
CVE-2020-27885
PUBLISHED: 2020-10-29
Cross-Site Scripting (XSS) vulnerability on WSO2 API Manager 3.1.0. By exploiting a Cross-site scripting vulnerability the attacker can hijack a logged-in user’s session by stealing cookies which means that a malicious hacker can change the logged-in user’s pass...
CVE-2020-25646
PUBLISHED: 2020-10-29
A flaw was found in Ansible Collection community.crypto. openssl_privatekey_info exposes private key in logs. This directly impacts confidentiality
CVE-2020-26205
PUBLISHED: 2020-10-29
Sal is a multi-tenanted reporting dashboard for Munki with the ability to display information from Facter. In Sal through version 4.1.6 there is an XSS vulnerability on the machine_list view.