Vulnerable Components

What it is

Vulnerable and Outdated Components vulnerabilities (OWASP A06) arise when applications use libraries, frameworks, and software components with known security vulnerabilities. These range from minor information disclosures to critical CVEs with public exploit code. Component versions are often discoverable through response headers, JavaScript bundle comments, or error pages.

Attack Vectors

• JavaScript frontend libraries (jQuery, Angular, React)
• Backend frameworks (Express, Spring, Django, Rails)
• CMS installations (WordPress, Joomla, Drupal)
• Server software (Apache, Nginx, OpenSSL)
• Dependencies declared in package.json, requirements.txt, pom.xml

Testing Methodology

1. Identify component versions from HTTP headers, HTML comments, and error messages
2. Check identified versions against CVE databases (NVD, Snyk)
3. Use automated scanners: retire.js (JS), npm audit, OWASP Dependency-Check
4. Attempt known CVE PoCs against identified vulnerable versions

Indicators of Vulnerability

• Component version matches a known CVE in NVD or Snyk database
• npm audit or similar tool reports high/critical vulnerabilities
• CVE PoC exploit succeeds against the identified version

Detection Guidance

Integrate software composition analysis (SCA) tools into CI/CD pipelines. Subscribe to security advisories for used components. Maintain a software bill of materials (SBOM).

Mitigation & Remediation

• Keep all dependencies updated to the latest patched versions
• Subscribe to security advisories for critical components
• Run SCA tools in CI/CD and block builds with critical vulnerabilities
• Remove unused dependencies to minimize attack surface
• Generate and maintain an SBOM for all applications

References

• OWASP Vulnerable and Outdated Components
• OWASP Dependency-Check
• OWASP Hunting — Vulnerable Components (upstream)