Welcome to the third and last part of using components with known vulnerabilities session.
In this part. We will
discuss mitigation. We will start discussing what
makes an application vulnerable. And then, we will
hunt all a spittoon strop, vulnerable source code. Before
closing, this session. We will discuss how to avoid such
vulnerabilities. Not knowing what components in
the respective versions. Your application depends upon directly
or indirectly both client
and server side makes it.
Vulnerable software, that is vulnerable and supported
or out of date with the application, vulnerable
Frameworks, libraries and modules tend
to run with the same level of privileges than the application itself. If
components configurations are
not set to secure values. Then your application is at
risk. We have discussed security misconfigurations already.
If Wilmer ability scanning is
not performed frequently. Then components, Wilner abilities,
may pass unnoticed. The same is
Valid. If you do not, subscribe security bulletins related to
components in use new vulnerabilities and exploits are
found in published all the time. Of
course, if you do not patch update or
upgrade components in a timely fashion, then your application
is at risk performing such tasks without
proper compatibility. Testing may also put
application at risk.
Let's have a look at the source code from
Juice Shop project page. We will jump to the GitHub repo.
We're looking for the server.js file. Where application setup
is performed.
We are now looking for some authenticated route, since
this is what Juice Shop. Use JW T 4.
The is authorized method from insecurity. Looks
to be what we are looking for. Let's have a
look at the implementation.
The is authorized method is just a wrapper around the
express gwd function.
Express JWT is provided by the express. Dash
JWT package. Let's first check
what version is used by Jewelers shop? Checking the package.json file
in the root folder.
The package.json file has the inventory of
required dependencies and we should find here. The
express Dash. JWT.
Joyce shop uses the Old Dot 1.3 version.
Let's now check packages documentation.
Juice Shop is definitely using a very old version
of this package. Current version is
Let's check packages issues on GitHub searching for security
related ones.
This one seems to be exactly. The reason why Juice Shop is
vulnerable expressed sjw versions prior
to 0.2. 0.2 were vulnerable. And we
saw that Juice Shop, still uses one of those versions.
Let's talk about how to mitigate these issues restrict
your dependencies to the bare minimum. I'll
do it every dependency before adding it
to your application. Remove a news dependencies and
necessary feature components files and documentation. What
is not there? Cannot hurt your application. Continuously
inventory client and server-side components in
their versions as well. There won't dependencies monitor
sources like CV and nvd for
vulnerabilities in
Bonus that belong to your inventory.
Obtain components, only from trusted sources over
a secure connection, prefers sign packages to
avoid installing modified, malicious components, Monitor
and maintain libraries and components, as
well as those that do not provide security, patches, for
old versions belonging to your inventory.
In our next session, we will discuss insufficient logging and
monitoring until then take your time to carefully. Read
the using components with known vulnerabilities section of
a wasp, top 10.