Back to Cheat Sheets

🛡️ Using Components with Known VulnerabilitiesOWASP 2017

OWASP WEB Top 10 2017 - #9

HIGH RISK

📋 What Is It?

Using Components with Known Vulnerabilities - Components, such as libraries, frameworks, and other software modules, run with the same privileges as the application. If a vulnerable component is exploited, such an attack can facilitate serious data loss or server takeover.

#9 OWASP Rank 2017
8% Apps Tested
132K Occurrences

⚠️ Common Exploits

  • CVE Exploitation: Exploit known vulnerabilities
  • Dependency Confusion: Inject malicious packages
  • Supply Chain Attacks: Compromise dependencies
  • Outdated Libraries: Use unpatched components
  • Transitive Dependencies: Exploit nested dependencies

🔴 Attack Flow

1. Attacker identifies vulnerable component version

2. Searches for public exploits (CVE databases)

3. Crafts exploit targeting the vulnerability

4. Application processes malicious request

5. BREACH: System compromised via component!

✓ Prevention Checklist

  • Remove unused dependencies and features
  • Continuously inventory component versions
  • Monitor CVE databases for vulnerabilities
  • Use Software Composition Analysis (SCA) tools
  • Obtain components from official sources only

📌 Quick Reference

Risk Level: HIGH RISK
Year: OWASP Top 10 2017
Category: WEB
Ranking: #9 in 2017