This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Top 10-2017 A9-Using Components with Known Vulnerabilities"
(OWASP Top 10-2017 RC1: A9-Using Components with Known Vulnerabilities) |
Tanyajanca (talk | contribs) m (Updated broken link to Mitre article: https://cdn2.hubspot.net/hub/203759/file-1100864196-pdf/docs/Contrast_-_Insecure_Libraries_2014.pdf) (Tag: Visual edit) |
||
(5 intermediate revisions by one other user not shown) | |||
Line 1: | Line 1: | ||
{{Top_10_2013:TopTemplate | {{Top_10_2013:TopTemplate | ||
− | |usenext= | + | |useprev=2017PrevLink |
+ | |prev=A8-{{Top_10_2010:ByTheNumbers | ||
+ | |8 | ||
+ | |year=2017 | ||
+ | |language=en | ||
+ | }} | ||
+ | |usenext=2017NextLink | ||
|next=A10-{{Top_10_2010:ByTheNumbers | |next=A10-{{Top_10_2010:ByTheNumbers | ||
− | + | |10 | |
− | + | |year=2017 | |
− | + | |language=en | |
− | + | }} | |
− | |||
− | |||
− | |||
− | |||
|year=2017 | |year=2017 | ||
|language=en | |language=en | ||
}} | }} | ||
− | + | <!--- 2017 Using Components with Known Vulnerabilities ---> | |
{{Top_10_2010:SummaryTableHeaderBeginTemplate|year=2017|language=en}} | {{Top_10_2010:SummaryTableHeaderBeginTemplate|year=2017|language=en}} | ||
− | + | {{Top_10-2017:SummaryTableTemplate|exploitability=2 |prevalence=3 |detectability=2 |impact=2 |year=2017|language=en}} | |
{{Top_10_2010:SummaryTableHeaderEndTemplate|year=2017}} | {{Top_10_2010:SummaryTableHeaderEndTemplate|year=2017}} | ||
− | + | <td colspan=2 {{Template:Top_10_2010:SummaryTableRowStyleTemplate|year=2017}}> | |
− | <!--- Threat | + | <!--- Threat Agent: ---> |
− | + | While it is easy to find already-written exploits for many known vulnerabilities, other vulnerabilities require concentrated effort to develop a custom exploit. </td> | |
− | + | <td colspan=2 {{Template:Top_10_2010:SummaryTableRowStyleTemplate|year=2017}}> | |
− | + | <!--- Security Weakness: ---> | |
− | </td> | + | Prevalence of this issue is very widespread. Component-heavy development patterns can lead to development teams not even understanding which components they use in their application or API, much less keeping them up to date.<br/>Some scanners such as retire.js help in detection, but determining exploitability requires additional effort. </td> |
− | + | <td colspan=2 {{Template:Top_10_2010:SummaryTableRowStyleTemplate|year=2017}}> | |
− | <!--- Security Weakness ---> | + | <!--- Impacts: ---> |
− | </ | + | While some known vulnerabilities lead to only minor impacts, some of the largest breaches to date have relied on exploiting known vulnerabilities in components. Depending on the assets you are protecting, perhaps this risk should be at the top of the list. </td> |
− | |||
− | |||
− | </td> | ||
− | |||
− | <!--- | ||
− | </td> | ||
{{Top_10_2010:SummaryTableEndTemplate|year=2017}} | {{Top_10_2010:SummaryTableEndTemplate|year=2017}} | ||
− | {{Top_10:SubsectionTableBeginTemplate | + | {{Top_10:SubsectionTableBeginTemplate|type=main}} |
− | + | {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=isTheApplicationVulnerable|position=firstLeft|year=2017|language=en}} | |
− | + | You are likely vulnerable: | |
− | + | * If you do not know the versions of all components you use (both client-side and server-side). This includes components you directly use as well as nested dependencies. | |
− | + | * If software is vulnerable, unsupported, or out of date. This includes the OS, web/application server, database management system (DBMS), applications, APIs and all components, runtime environments, and libraries. | |
− | + | * If you do not scan for vulnerabilities regularly and subscribe to security bulletins related to the components you use. | |
− | + | * If you do not fix or upgrade the underlying platform, frameworks, and dependencies in a risk-based, timely fashion. This commonly happens in environments when patching is a monthly or quarterly task under change control, which leaves organizations open to many days or months of unnecessary exposure to fixed vulnerabilities. | |
− | + | * If software developers do not test the compatibility of updated, upgraded, or patched libraries. | |
− | + | * If you do not secure the components' configurations (see <b><u>[[{{Top_10:LanguageFile|text=documentRootTop10New|language=en|year=2017 }}_A6-{{Top_10_2010:ByTheNumbers|6|year=2017|language=en}} | A6:2017-{{Top_10_2010:ByTheNumbers|6|year=2017|language=en}}]]</u></b>). | |
− | |||
− | |||
− | |||
− | {{ | ||
− | |||
− | * [ | + | {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=howToPrevent|position=right|year=2017|language=en}} |
− | + | There should be a patch management process in place to: | |
+ | * Remove unused dependencies, unnecessary features, components, files, and documentation. | ||
+ | * Continuously inventory the versions of both client-side and server-side components (e.g. frameworks, libraries) and their dependencies using tools like <u>[http://www.mojohaus.org/versions-maven-plugin/ versions]</u>, <u>[[OWASP_Dependency_Check|DependencyCheck]]</u>, <u>[https://github.com/retirejs/retire.js/ retire.js]</u>, etc. Continuously monitor sources like <u>[https://cve.mitre.org/ CVE]</u> and <u>[https://nvd.nist.gov/ NVD]</u> for vulnerabilities in the components. Use software composition analysis tools to automate the process. Subscribe to email alerts for security vulnerabilities related to components you use. | ||
+ | * Only obtain components from official sources over secure links. Prefer signed packages to reduce the chance of including a modified, malicious component. | ||
+ | * Monitor for libraries and components that are unmaintained or do not create security patches for older versions. If patching is not possible, consider deploying a <u>[[Virtual_Patching_Best_Practices#What_is_a_Virtual_Patch.3F | virtual patch]]</u> to monitor, detect, or protect against the discovered issue. | ||
+ | Every organization must ensure that there is an ongoing plan for monitoring, triaging, and applying updates or configuration changes for the lifetime of the application or portfolio. | ||
− | + | {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=exampleAttackScenarios|position=left|year=2017|language=en}} | |
+ | <b>Scenario #1</b>: Components typically run with the same privileges as the application itself, so flaws in any component can result in serious impact. Such flaws can be accidental (e.g. coding error) or intentional (e.g. backdoor in component). Some example exploitable component vulnerabilities discovered are: | ||
+ | * <u>[https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5638 CVE-2017-5638]</u>, a Struts 2 remote code execution vulnerability that enables execution of arbitrary code on the server, has been blamed for significant breaches. | ||
+ | * While <u>[https://en.wikipedia.org/wiki/Internet_of_things internet of things (IoT)]</u> are frequently difficult or impossible to patch, the importance of patching them can be great (e.g. biomedical devices). | ||
+ | There are automated tools to help attackers find unpatched or misconfigured systems. For example, the <u>[https://www.shodan.io/report/89bnfUyJ Shodan IoT search engine]</u> can help you find devices that still suffer from <u>[https://en.wikipedia.org/wiki/Heartbleed Heartbleed]</u> vulnerability that was patched in April 2014. | ||
− | {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=references|position=right | + | {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=references|position=right|year=2017|language=en}} |
− | {{Top_10_2010:SubSubsectionOWASPReferencesTemplate|year=2017}} | + | {{Top_10_2010:SubSubsectionOWASPReferencesTemplate|year=2017|language=en}} |
+ | * <u>[[ASVS_V1_Architecture|OWASP Application Security Verification Standard: V1 Architecture, design and threat modelling]]</u> | ||
* <u>[[OWASP_Dependency_Check|OWASP Dependency Check (for Java and .NET libraries)]]</u> | * <u>[[OWASP_Dependency_Check|OWASP Dependency Check (for Java and .NET libraries)]]</u> | ||
+ | * <u>[[Map_Application_Architecture_(OTG-INFO-010)|OWASP Testing Guide - Map Application Architecture (OTG-INFO-010)]]</u> | ||
* <u>[[Virtual_Patching_Best_Practices|OWASP Virtual Patching Best Practices]]</u> | * <u>[[Virtual_Patching_Best_Practices|OWASP Virtual Patching Best Practices]]</u> | ||
{{Top_10_2010:SubSubsectionExternalReferencesTemplate|year=2017|language=en}} | {{Top_10_2010:SubSubsectionExternalReferencesTemplate|year=2017|language=en}} | ||
− | * <u>[ | + | * <u>[https://cdn2.hubspot.net/hub/203759/file-1100864196-pdf/docs/Contrast_-_Insecure_Libraries_2014.pdf The Unfortunate Reality of Insecure Libraries]</u> |
− | * <u>[ | + | * <u>[https://www.cvedetails.com/version-search.php MITRE Common Vulnerabilities and Exposures (CVE) search]</u> |
* <u>[https://nvd.nist.gov/ National Vulnerability Database (NVD)]</u> | * <u>[https://nvd.nist.gov/ National Vulnerability Database (NVD)]</u> | ||
* <u>[https://github.com/retirejs/retire.js/ Retire.js for detecting known vulnerable JavaScript libraries]</u> | * <u>[https://github.com/retirejs/retire.js/ Retire.js for detecting known vulnerable JavaScript libraries]</u> | ||
* <u>[https://nodesecurity.io/advisories Node Libraries Security Advisories]</u> | * <u>[https://nodesecurity.io/advisories Node Libraries Security Advisories]</u> | ||
− | * <u>[https://rubysec.com/ Ruby Libraries Security Advisory Database and Tools]</u> | + | * <u>[https://rubysec.com/ Ruby Libraries Security Advisory Database and Tools]</u> |
{{Top_10_2013:BottomAdvancedTemplate | {{Top_10_2013:BottomAdvancedTemplate | ||
− | |type={{Top_10_2010: | + | |type=box |
− | |usenext= | + | |useprev=2017PrevLink |
+ | |prev=A8-{{Top_10_2010:ByTheNumbers | ||
+ | |8 | ||
+ | |year=2017 | ||
+ | |language=en | ||
+ | }} | ||
+ | |usenext=2017NextLink | ||
|next=A10-{{Top_10_2010:ByTheNumbers | |next=A10-{{Top_10_2010:ByTheNumbers | ||
− | + | |10 | |
− | + | |year=2017 | |
− | + | |language=en | |
− | + | }} | |
− | |||
− | |||
− | |||
− | |||
|year=2017 | |year=2017 | ||
|language=en | |language=en | ||
}} | }} | ||
+ | <!-- [[Category:OWASP Top Ten Project]] --> |
Latest revision as of 16:30, 5 December 2018
Threat Agents / Attack Vectors | Security Weakness | Impacts | |||
---|---|---|---|---|---|
App Specific | Exploitability: 2 |
Prevalence: 3 |
Detectability: 2 |
Technical: 2 |
Business ? |
While it is easy to find already-written exploits for many known vulnerabilities, other vulnerabilities require concentrated effort to develop a custom exploit. |
Prevalence of this issue is very widespread. Component-heavy development patterns can lead to development teams not even understanding which components they use in their application or API, much less keeping them up to date. Some scanners such as retire.js help in detection, but determining exploitability requires additional effort. |
While some known vulnerabilities lead to only minor impacts, some of the largest breaches to date have relied on exploiting known vulnerabilities in components. Depending on the assets you are protecting, perhaps this risk should be at the top of the list. |
Is the Application Vulnerable?
You are likely vulnerable:
|
How to Prevent
There should be a patch management process in place to:
Every organization must ensure that there is an ongoing plan for monitoring, triaging, and applying updates or configuration changes for the lifetime of the application or portfolio. |
Example Attack Scenarios
Scenario #1: Components typically run with the same privileges as the application itself, so flaws in any component can result in serious impact. Such flaws can be accidental (e.g. coding error) or intentional (e.g. backdoor in component). Some example exploitable component vulnerabilities discovered are:
There are automated tools to help attackers find unpatched or misconfigured systems. For example, the Shodan IoT search engine can help you find devices that still suffer from Heartbleed vulnerability that was patched in April 2014. |
References
OWASP
External |