Securing Node Applications

Chapter 9. Using Components with Known Vulnerabilities

This Open Web Application Security Project (OWASP) Top 10 risk highlights the threats from using external dependencies in an application. For Node applications, these dependencies range from Node.js binary itself to frameworks such as Express and thousands of modules available on npm. Security vulnerabilities in these dependencies directly affect the application. As a result, it is a critical task for Node developers to stay aware of any vulnerabilities discovered in an application’s external dependencies and diligently keep the application safe against it.

Attack Mechanics

Let’s review how attackers can exploit these vulnerabilities.

Exploit Publicly Known Vulnerabilities

As a first step of an attack, malicious actors typically perform application foot-printing to discover the platform, frameworks, and server on which the application is built. When this is known, an attacker can look up publicly known common vulnerabilities and exposures (CVEs) published for that platform and apply them toward the target application. In other cases, attackers automate exploits based on CVEs and spray them across the internet to catch the prey.

Exploiting publicly known vulnerabilities often yields success for attackers. As per a research study done by Verizon, 99 percent of close to 80,000 security incidents in the year 2014 involved exploiting vulnerabilities for which CVEs were published at least a year earlier, some published as far ...