Applications

Vulnerable Dependencies

Third-party libraries introduce vulnerabilities that the application owner did not write and may not know about.

What it is

Modern applications depend on hundreds of open-source libraries. Each library is a potential vulnerability source. Log4Shell (CVE-2021-44228) affected thousands of organisations through a logging library. Supply chain attacks — where a malicious package is substituted for a legitimate one — have increased significantly. Dependency confusion attacks exploit package manager resolution behaviour to inject malicious packages.

Attack techniques

  • Exploit of known CVE in dependency (T1190)
  • Dependency confusion attack
  • Typosquatting malicious packages
  • Compromised upstream package (supply chain)
  • Transitive dependency vulnerabilities

Business impact

A critical vulnerability in a widely-used library can affect all applications using it simultaneously. Time to exploit after public disclosure is now measured in hours, not days.