O'Reilly logo

Securing Node Applications by Chetan Karande

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Chapter 9. Using Components with Known Vulnerabilities

This Open Web Application Security Project (OWASP) Top 10 risk highlights the threats from using external dependencies in an application. For Node applications, these dependencies range from Node.js binary itself to frameworks such as Express and thousands of modules available on npm. Security vulnerabilities in these dependencies directly affect the application. As a result, it is a critical task for Node developers to stay aware of any vulnerabilities discovered in an application’s external dependencies and diligently keep the application safe against it.

Attack Mechanics

Let’s review how attackers can exploit these vulnerabilities.

Exploit Publicly Known Vulnerabilities

As a first step of an attack, malicious actors typically perform application foot-printing to discover the platform, frameworks, and server on which the application is built. When this is known, an attacker can look up publicly known common vulnerabilities and exposures (CVEs) published for that platform and apply them toward the target application. In other cases, attackers automate exploits based on CVEs and spray them across the internet to catch the prey.

Exploiting publicly known vulnerabilities often yields success for attackers. As per a research study done by Verizon, 99 percent of close to 80,000 security incidents in the year 2014 involved exploiting vulnerabilities for which CVEs were published at least a year earlier, some published as far ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required