Modern applications are assembled more than they are written. A developer rarely writes every function from scratch; instead they declare dependencies — third-party libraries that do common work such as parsing dates, validating email addresses, or rendering HTML safely. Each of those libraries may in turn depend on other libraries, and those on others still. The ones the developer lists directly are called direct dependencies; everything pulled in automatically behind them is called transitive dependencies. A typical project has a few dozen direct dependencies and hundreds of transitive ones — most of them never looked at by a human on the project team. Every one of them runs with the application's own privileges. When a vulnerability is publicly disclosed in a popular library, every application still shipping the affected version becomes exploitable that day — using an exploit the attacker never had to discover.
A publicly disclosed vulnerability is assigned a CVE (Common Vulnerabilities and Exposures) identifier — a unique reference number in the form CVE-YEAR-NUMBER, for example CVE-2019-10744. CVE identifiers are the language researchers, vendors, and defenders use to refer to the same flaw unambiguously. Each CVE entry records the affected software, the affected version range, and a severity score so teams can decide how urgently to patch.
This is A06:2021 - Vulnerable and Outdated Components.
In this lesson you will:
- Build an inventory of the application's dependencies from an exposed
package.json.bakbackup file and from the libraries loaded in your browser. - Match one component against a public advisory by naming a known-vulnerable library or its CVE identifier.
- Learn why automated software composition analysis and timely patching are the durable controls, and why hiding version information is not.
Estimated time: 10 to 15 minutes.
Prerequisite: this lesson reuses the /ftp/ foothold from security-misconfig-exposed-files. You do not need an account; the backup file is served to unauthenticated visitors.
Course position: the earlier lesson found the exposed file. This one turns that file into dependency inventory, advisory lookup, and patch triage that later scanner and reporting lessons will formalize.
When you are ready, send the Continue signal.