📋 What Is It?
Using Components with Known Vulnerabilities - Components, such as libraries, frameworks, and other software modules, run with the same privileges as the application. If a vulnerable component is exploited, such an attack can facilitate serious data loss or server takeover.
#9
OWASP Rank 2017
8%
Apps Tested
132K
Occurrences
⚠️ Common Exploits
- CVE Exploitation: Exploit known vulnerabilities
- Dependency Confusion: Inject malicious packages
- Supply Chain Attacks: Compromise dependencies
- Outdated Libraries: Use unpatched components
- Transitive Dependencies: Exploit nested dependencies
🔴 Attack Flow
1. Attacker identifies vulnerable component version
↓
2. Searches for public exploits (CVE databases)
↓
3. Crafts exploit targeting the vulnerability
↓
4. Application processes malicious request
↓
5. BREACH: System compromised via component!
↓
2. Searches for public exploits (CVE databases)
↓
3. Crafts exploit targeting the vulnerability
↓
4. Application processes malicious request
↓
5. BREACH: System compromised via component!
✓ Prevention Checklist
- Remove unused dependencies and features
- Continuously inventory component versions
- Monitor CVE databases for vulnerabilities
- Use Software Composition Analysis (SCA) tools
- Obtain components from official sources only
📌 Quick Reference
Risk Level: HIGH RISK
Year: OWASP Top 10 2017
Category: WEB
Ranking: #9 in 2017