Applications
Vulnerable Dependencies
Third-party libraries introduce vulnerabilities that the application owner did not write and may not know about.
What it is
Modern applications depend on hundreds of open-source libraries. Each library is a potential vulnerability source. Log4Shell (CVE-2021-44228) affected thousands of organisations through a logging library. Supply chain attacks — where a malicious package is substituted for a legitimate one — have increased significantly. Dependency confusion attacks exploit package manager resolution behaviour to inject malicious packages.
Attack techniques
- Exploit of known CVE in dependency (T1190)
- Dependency confusion attack
- Typosquatting malicious packages
- Compromised upstream package (supply chain)
- Transitive dependency vulnerabilities
Business impact
A critical vulnerability in a widely-used library can affect all applications using it simultaneously. Time to exploit after public disclosure is now measured in hours, not days.