Dependency on Vulnerable Third-Party Component

Description

Dependency on Vulnerable Third-Party Component occurs when a product has a dependency on a third-party component that contains one or more known vulnerabilities. Products often rely on third-party libraries, modules, or components developed by external parties. These dependencies—whether in open or closed source form—may contain publicly disclosed vulnerabilities that adversaries could exploit to compromise the product. The impact varies depending on the specific vulnerabilities present, how adversaries can access them, and the criticality of the features relying on that component.

Risk

Vulnerable dependencies have severe implications. Inherited vulnerabilities from third-party code. Supply chain attacks. Zero-day exploitation via transitive dependencies. Exploitation of publicly disclosed CVEs. Remote code execution through library vulnerabilities. Data breaches. Service disruption. Cascading failures across dependent products. High likelihood as dependency scanning tools readily identify vulnerable components.

Solution

Clarify organizational roles and responsibilities for applying patches. Require a Software Bill of Materials (SBOM) documenting all components. Actively monitor vendor announcements for vulnerability patches. Continuously track changes in product components, especially vulnerability disclosures and end-of-life notices. Implement rapid patching procedures for third-party vulnerabilities.

Common Consequences

Impact	Details
Confidentiality	Scope: Confidentiality Data exposure through exploitation of vulnerabilities in third-party components.
Integrity	Scope: Integrity System compromise through remote code execution in vulnerable dependencies.
Availability	Scope: Availability Service disruption through denial-of-service vulnerabilities in dependencies.

Example Code

Vulnerable Code

// Vulnerable: package.json with known vulnerable dependencies

{
  "name": "vulnerable-app",
  "version": "1.0.0",
  "dependencies": {
    // VULNERABLE: Log4j with Log4Shell (CVE-2021-44228)
    "log4j-core": "2.14.1",

    // VULNERABLE: Lodash prototype pollution (CVE-2020-8203)
    "lodash": "4.17.15",

    // VULNERABLE: Express with ReDoS (various CVEs)
    "express": "4.16.0",

    // VULNERABLE: Axios SSRF (CVE-2020-28168)
    "axios": "0.19.0",

    // VULNERABLE: Moment.js ReDoS and deprecated
    "moment": "2.24.0",

    // VULNERABLE: serialize-javascript XSS (CVE-2020-7660)
    "serialize-javascript": "2.1.0",

    // VULNERABLE: minimist prototype pollution (CVE-2020-7598)
    "minimist": "1.2.0",

    // VULNERABLE: node-fetch open redirect
    "node-fetch": "2.6.0",

    // VULNERABLE: Transitive dependency through old package
    "some-old-package": "1.0.0"
  }
}

<!-- Vulnerable: pom.xml with known vulnerable dependencies -->

<project>
    <dependencies>
        <!-- VULNERABLE: Log4j 2.x before 2.17.0 (Log4Shell) -->
        <dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-core</artifactId>
            <version>2.14.1</version>
        </dependency>

        <!-- VULNERABLE: Spring Framework RCE (Spring4Shell) -->
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-core</artifactId>
            <version>5.3.17</version>
        </dependency>

        <!-- VULNERABLE: Apache Struts RCE (CVE-2017-5638) -->
        <dependency>
            <groupId>org.apache.struts</groupId>
            <artifactId>struts2-core</artifactId>
            <version>2.3.30</version>
        </dependency>

        <!-- VULNERABLE: Jackson deserialization (many CVEs) -->
        <dependency>
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-databind</artifactId>
            <version>2.9.8</version>
        </dependency>

        <!-- VULNERABLE: Apache Commons Collections gadget chain -->
        <dependency>
            <groupId>commons-collections</groupId>
            <artifactId>commons-collections</artifactId>
            <version>3.2.1</version>
        </dependency>

        <!-- VULNERABLE: Hibernate ORM SQL injection -->
        <dependency>
            <groupId>org.hibernate</groupId>
            <artifactId>hibernate-core</artifactId>
            <version>5.3.0.Final</version>
        </dependency>
    </dependencies>
</project>

# Vulnerable: requirements.txt with vulnerable packages

# VULNERABLE: PyYAML arbitrary code execution (CVE-2020-14343)
PyYAML==5.3

# VULNERABLE: Pillow buffer overflow (multiple CVEs)
Pillow==6.2.0

# VULNERABLE: Django SQL injection, XSS
Django==2.2.0

# VULNERABLE: Flask debug mode vulnerability
Flask==0.12.0

# VULNERABLE: Requests CRLF injection
requests==2.20.0

# VULNERABLE: Jinja2 sandbox escape
Jinja2==2.10

# VULNERABLE: Paramiko auth bypass
paramiko==2.4.0

# VULNERABLE: NumPy buffer overflow
numpy==1.16.0

# VULNERABLE: cryptography library vulnerability
cryptography==2.3

# VULNERABLE: urllib3 CRLF injection
urllib3==1.24.0

Fixed Code

// Fixed: package.json with secure dependency management

{
  "name": "secure-app",
  "version": "1.0.0",
  "dependencies": {
    // FIXED: Updated to patched versions
    "express": "4.18.2",
    "axios": "1.6.0",
    "lodash": "4.17.21",
    "node-fetch": "3.3.2"
  },
  "devDependencies": {
    // FIXED: Security scanning tools
    "npm-audit-fix": "^1.0.0",
    "snyk": "^1.1000.0",
    "audit-ci": "^6.0.0"
  },
  "scripts": {
    // FIXED: Security checks in CI/CD
    "security": "npm audit --audit-level=high && snyk test",
    "preinstall": "npm audit",
    "postinstall": "npm audit"
  },
  "overrides": {
    // FIXED: Force patched versions of transitive dependencies
    "minimist": "1.2.8",
    "glob-parent": "5.1.2"
  }
}

# Fixed: Comprehensive dependency security management

import subprocess
import json
import sys
from typing import List, Dict, Optional
from datetime import datetime

class DependencySecurityManager:
    """FIXED: Manage and audit dependencies for vulnerabilities."""

    def __init__(self, requirements_file: str = 'requirements.txt'):
        self.requirements_file = requirements_file
        self.sbom = None

    def audit_dependencies(self) -> List[Dict]:
        """FIXED: Scan dependencies for known vulnerabilities."""
        vulnerabilities = []

        # FIXED: Use safety for Python vulnerability scanning
        result = subprocess.run(
            ['safety', 'check', '-r', self.requirements_file, '--json'],
            capture_output=True,
            text=True
        )

        if result.returncode != 0:
            vulns = json.loads(result.stdout)
            for vuln in vulns.get('vulnerabilities', []):
                vulnerabilities.append({
                    'package': vuln['package_name'],
                    'installed': vuln['analyzed_version'],
                    'vulnerable_versions': vuln['vulnerable_versions'],
                    'cve': vuln.get('CVE'),
                    'severity': vuln.get('severity', 'unknown'),
                    'advisory': vuln.get('advisory')
                })

        # FIXED: Also use pip-audit
        result = subprocess.run(
            ['pip-audit', '-r', self.requirements_file, '-f', 'json'],
            capture_output=True,
            text=True
        )

        if result.stdout:
            audit_results = json.loads(result.stdout)
            for pkg in audit_results.get('dependencies', []):
                for vuln in pkg.get('vulns', []):
                    vulnerabilities.append({
                        'package': pkg['name'],
                        'installed': pkg['version'],
                        'cve': vuln.get('id'),
                        'fix_versions': vuln.get('fix_versions', [])
                    })

        return vulnerabilities

    def generate_sbom(self, output_file: str = 'sbom.json'):
        """FIXED: Generate Software Bill of Materials."""
        subprocess.run([
            'cyclonedx-py', 'requirements',
            '-i', self.requirements_file,
            '-o', output_file,
            '--format', 'json'
        ], check=True)

        with open(output_file) as f:
            self.sbom = json.load(f)

        return self.sbom

    def check_for_updates(self) -> List[Dict]:
        """FIXED: Check for available security updates."""
        updates = []

        result = subprocess.run(
            ['pip', 'list', '--outdated', '--format=json'],
            capture_output=True,
            text=True
        )

        if result.stdout:
            outdated = json.loads(result.stdout)
            for pkg in outdated:
                updates.append({
                    'package': pkg['name'],
                    'current': pkg['version'],
                    'latest': pkg['latest_version']
                })

        return updates

    def enforce_security_policy(self) -> bool:
        """FIXED: Enforce security policy - fail on high/critical vulns."""
        vulns = self.audit_dependencies()

        critical_vulns = [v for v in vulns
                        if v.get('severity', '').lower() in ['critical', 'high']]

        if critical_vulns:
            print("SECURITY POLICY VIOLATION: Critical vulnerabilities found")
            for v in critical_vulns:
                print(f"  - {v['package']}: {v.get('cve', 'Unknown CVE')}")
            return False

        return True

# FIXED: CI/CD integration
def security_check():
    """FIXED: Run security checks in CI/CD pipeline."""
    manager = DependencySecurityManager()

    # Generate SBOM
    print("Generating SBOM...")
    manager.generate_sbom()

    # Check for vulnerabilities
    print("Scanning for vulnerabilities...")
    if not manager.enforce_security_policy():
        sys.exit(1)

    print("Security check passed!")

if __name__ == '__main__':
    security_check()

// Fixed: Java with comprehensive dependency security

/*
 * FIXED: pom.xml with security scanning and patched dependencies
 */

/*
<project>
    <properties>
        <!-- FIXED: Centralized version management -->
        <log4j.version>2.21.1</log4j.version>
        <spring.version>6.1.1</spring.version>
        <jackson.version>2.16.0</jackson.version>
    </properties>

    <dependencies>
        <!-- FIXED: Updated Log4j to patched version -->
        <dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-core</artifactId>
            <version>${log4j.version}</version>
        </dependency>

        <!-- FIXED: Updated Spring to patched version -->
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-core</artifactId>
            <version>${spring.version}</version>
        </dependency>

        <!-- FIXED: Updated Jackson -->
        <dependency>
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-databind</artifactId>
            <version>${jackson.version}</version>
        </dependency>

        <!-- FIXED: Use safe Commons Collections 4 -->
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-collections4</artifactId>
            <version>4.4</version>
        </dependency>
    </dependencies>

    <build>
        <plugins>
            <!-- FIXED: OWASP Dependency Check -->
            <plugin>
                <groupId>org.owasp</groupId>
                <artifactId>dependency-check-maven</artifactId>
                <version>9.0.0</version>
                <configuration>
                    <failBuildOnCVSS>7</failBuildOnCVSS>
                    <suppressionFile>dependency-check-suppressions.xml</suppressionFile>
                </configuration>
                <executions>
                    <execution>
                        <goals>
                            <goal>check</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>

            <!-- FIXED: CycloneDX SBOM generation -->
            <plugin>
                <groupId>org.cyclonedx</groupId>
                <artifactId>cyclonedx-maven-plugin</artifactId>
                <version>2.7.10</version>
                <executions>
                    <execution>
                        <phase>package</phase>
                        <goals>
                            <goal>makeAggregateBom</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>

            <!-- FIXED: Enforce dependency convergence -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-enforcer-plugin</artifactId>
                <version>3.4.1</version>
                <executions>
                    <execution>
                        <id>enforce</id>
                        <goals>
                            <goal>enforce</goal>
                        </goals>
                        <configuration>
                            <rules>
                                <banDuplicatePomDependencyVersions/>
                                <dependencyConvergence/>
                                <banVulnerable>
                                    <searchTransitive>true</searchTransitive>
                                </banVulnerable>
                            </rules>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
        </plugins>
    </build>
</project>
*/

# Fixed: GitHub Actions workflow for dependency security

# .github/workflows/security.yml

name: Dependency Security Check

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]
  schedule:
    # FIXED: Daily vulnerability scans
    - cron: '0 6 * * *'

jobs:
  security-scan:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      # FIXED: Snyk vulnerability scanning
      - name: Run Snyk Security Scan
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high

      # FIXED: npm audit
      - name: npm audit
        run: npm audit --audit-level=high

      # FIXED: Generate SBOM
      - name: Generate SBOM
        run: npx @cyclonedx/cdxgen -o sbom.json

      # FIXED: Upload SBOM as artifact
      - name: Upload SBOM
        uses: actions/upload-artifact@v3
        with:
          name: sbom
          path: sbom.json

      # FIXED: Dependency review for PRs
      - name: Dependency Review
        if: github.event_name == 'pull_request'
        uses: actions/dependency-review-action@v3
        with:
          fail-on-severity: high
          deny-licenses: GPL-3.0, AGPL-3.0

  python-security:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.11'

      # FIXED: Safety check
      - name: Safety Check
        run: |
          pip install safety
          safety check -r requirements.txt

      # FIXED: pip-audit
      - name: pip-audit
        run: |
          pip install pip-audit
          pip-audit -r requirements.txt

  java-security:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Set up JDK
        uses: actions/setup-java@v3
        with:
          java-version: '17'
          distribution: 'temurin'

      # FIXED: OWASP Dependency Check
      - name: OWASP Dependency Check
        run: mvn dependency-check:check

CVE Examples

CVE-2021-44228: Log4Shell - Critical RCE in Apache Log4j affecting billions of devices.
CVE-2017-5638: Apache Struts RCE exploited in Equifax breach.
CVE-2020-8203: Lodash prototype pollution affecting millions of applications.
CVE-2022-22965: Spring4Shell - RCE in Spring Framework.

CWE-657: Violation of Secure Design Principles (parent)
CWE-1357: Reliance on Insufficiently Trustworthy Component (related)
CWE-1104: Use of Unmaintained Third Party Components (related)

References

MITRE Corporation. "CWE-1395: Dependency on Vulnerable Third-Party Component." https://cwe.mitre.org/data/definitions/1395.html
OWASP. "A06:2021-Vulnerable and Outdated Components"
NTIA. "Software Bill of Materials (SBOM)"

Dependency on Vulnerable Third-Party Component

Description

Risk

Solution

Common Consequences

Example Code

Vulnerable Code

Fixed Code

CVE Examples

References

Cyber Security Consulting

Industries

Company

Recent Posts

Dependency on Vulnerable Third-Party Component

Description

Risk

Solution

Common Consequences

Example Code

Vulnerable Code

Fixed Code

CVE Examples

Related CWEs

References