Open source code flaws may lead to a new Heartbleed
Open source security flaws found in 70 percent of applications.
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
The majority of open source applications contain potentially dangerous security flaws, a new report has found.
Application security testing providerVeracodediscovered that after an initial scan, seven in ten applications contain a security flaw in an open source library.
The company’s research highlights how usingopen sourcecan introduce flaws, increase risk and add to security debt. Veracode analyzed the component open source libraries across its platform database of 85,000 applications which account for 351,000 unique external libraries.
Almost all modern applications and even those that are sold commercially are built using some open source components. However, a single flaw in one library will cascade to all applications that leverage that code.
Chief research officer at Veracode, Chris Eng explained how using open source libraries can expand an application’s attack surface, saying:
“Open source software has a surprising variety of flaws. An application’s attack surface is not limited to its own code and the code of explicitly included libraries, because those libraries have their own dependencies. In reality, developers are introducing much more code, but if they are aware and apply fixes appropriately, they can reduce risk exposure.”
Open source libraries
According to Veracode, commonly included libraries are present in over 75 percent of applications for each programming language. The company’s research also found that flawed libraries end up in code indirectly as 47 percent of them found in applications are transitive and not pulled in directly by developers but by upstream libraries.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Thankfully though, library-introduced flaws in most applications can be fixed with only a minor version update as major library upgrades are not usually required. However, developers can’t rely on CVEs (Common Vulnerabilities and Exposures) to understand library flaws as not all libraries have them. For example, more than 61 percent of flawed libraries inJavaScriptdon’t have corresponding CVEs.
The report also revealed that some programming language ecosystems tend to pull in many more transitive dependencies than others. In more than 80 percent of JavaScript, Ruby and PHP applications, the majority of libraries are transitive dependencies.
Programming languageselection also plays a factor in both terms of the size of the ecosystem and in the prevalence of flaws in those ecosystems. For instance, including any given PHP library has a greater than 50 percent chance of bringing a security flaw along with it.
Of theOWASP Top Tenflaws, weaknesses around access control are the most common and represent over 25 percent of all flaws. Cross-Site Scripting (XSS) is the most common vulnerability category found in open source libraries (30%) followed by insecure deserialization (23.5%) and broken access control (20.3%).
After working with the TechRadar Pro team for the last several years, Anthony is now the security and networking editor at Tom’s Guide where he covers everything from data breaches and ransomware gangs to the best way to cover your whole home or business with Wi-Fi. When not writing, you can find him tinkering with PCs and game consoles, managing cables and upgrading his smart home.
Cisco issues patch to fix serious flaw allowing possible industrial systems takeover
Washington state court systems taken offline following cyberattack
Owl Labs Meeting Owl 4+ review
