Dependency on Vulnerable Third-Party Component

Incomplete Class

Structure: Simple

Description

This vulnerability occurs when your software relies on an external library, framework, or module that contains known security flaws.

Extended Description

Modern software development heavily depends on third-party components—from open-source libraries to commercial SDKs and entire operating systems. While this accelerates development, it introduces risk: your application inherits every security weakness present in those dependencies. Attackers actively scan for applications using vulnerable versions of popular components, as they provide a reliable and often easy path to compromise. Managing this risk requires proactive vigilance. You cannot assume that external code, whether open or closed source, is secure. A vulnerability in a single small library can jeopardize the entire application. Therefore, a core part of your security process must be continuously identifying, tracking, and updating these external dependencies to patch known issues before they can be exploited.

Common Consequences 1

Scope: ConfidentialityIntegrityAvailability

Impact: Varies by Context

The consequences vary widely, depending on the vulnerabilities that exist in the component; how those vulnerabilities can be "reached" by adversaries, as the exploitation paths and attack surface will vary depending on how the component is used; and the criticality of the privilege levels and features for which the product relies on the component.

Detection Methods 1

Automated AnalysisHigh

For software, use Software Composition Analysis (SCA) tools, which automatically analyze products to identify third-party dependencies. Often, SCA tools can be used to link with known vulnerabilities in the dependencies that they detect. There are commercial and open-source alternatives, such as OWASP Dependency-Check [REF-1312]. Many languages or frameworks have package managers with similar capabilities, such as npm audit for JavaScript, pip-audit for Python, govulncheck for Go, and many others. Dynamic methods can detect loading of third-party components.

Potential Mitigations 5

Phase: RequirementsPolicy

In some industries such as healthcare [REF-1320] [REF-1322] or technologies such as the cloud [REF-1321], it might be unclear about who is responsible for applying patches for third-party vulnerabilities: the vendor, the operator/customer, or a separate service. Clarifying roles and responsibilities can be important to minimize confusion or unnecessary delay when third-party vulnerabilities are disclosed.

Phase: Requirements

Require a Bill of Materials for all components and sub-components of the product. For software, require a Software Bill of Materials (SBOM) [REF-1247] [REF-1311].

Phase: Architecture and DesignImplementationIntegrationManufacturing

Maintain a Bill of Materials for all components and sub-components of the product. For software, maintain a Software Bill of Materials (SBOM). According to [REF-1247], "An SBOM is a formal, machine-readable inventory of software components and dependencies, information about those components, and their hierarchical relationships."

Phase: OperationPatching and Maintenance

Actively monitor when a third-party component vendor announces vulnerability patches; fix the third-party component as soon as possible; and make it easy for operators/customers to obtain and apply the patch.

Phase: OperationPatching and Maintenance

Continuously monitor changes in each of the product's components, especially when the changes indicate new vulnerabilities, end-of-life (EOL) plans, etc.

Demonstrative Examples 2

ID : DX-169

The "SweynTooth" vulnerabilities in Bluetooth Low Energy (BLE) software development kits (SDK) were found to affect multiple Bluetooth System-on-Chip (SoC) manufacturers. These SoCs were used by many products such as medical devices, Smart Home devices, wearables, and other IoT devices. [REF-1314] [REF-1315]

log4j, a Java-based logging framework, is used in a large number of products, with estimates in the range of 3 billion affected devices [REF-1317]. When the "log4shell" (CVE-2021-44228) vulnerability was initially announced, it was actively exploited for remote code execution, requiring urgent mitigation in many organizations. However, it was unclear how many products were affected, as Log4j would sometimes be part of a long sequence of transitive dependencies. [REF-1316]

References 12

The Unfortunate Reality of Insecure Libraries

Jeff Williams, Arshan Dabirsiaghi

2014

https://owasp.org/www-project-dependency-check/(2023-01-25)

ID: REF-1313

A06:2021 - Vulnerable and Outdated Components

OWASP

24-09-2021

https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components/

ID: REF-1212

Framing Software Component Transparency: Establishing a Common Software Bill of Materials (SBOM)