Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Are Your Web Apps Protected Against Component Vulnerabilities?

Third-party components are used to build most new web applications, and these components are highly vulnerable. Here’s how you can use Tenable.io Web Application Scanning (WAS) to assess common vulnerabilities in custom code.

Today’s web applications are highly complex in terms of business features and technical architecture. This complexity leads to a dramatically expanded attack surface requiring a new approach to web application scanning.

Limitations with traditional web application scanning

Web application scanning has been traditionally focused on generic web app vulnerability detection. This is a mandatory requirement to discover and remediate common vulnerabilities, such as injection, cross-site scripting, broken authentication or insecure deserialization (see OWASP and CWE for more information). However, traditional web application scanning alone can often miss component vulnerabilities, which can be exploited in real world attacks.

The complexity of web applications ranges widely - from a single static page to a full transactional business platform. However, even a simple web application is built with multiple layered third-party components, like web servers, web application servers, web frameworks, programming languages and JavaScript libraries. The problem for security teams is that many of these components are outdated and contain multiple high-risk vulnerabilities.

Third-party components are creating growing cyber risk

While common web vulnerabilities - like those identified by OWASP - are often used for targeted attacks, third-party component vulnerabilities are being weaponized for use in automated attacks that look for vulnerable components to exploit.

Equifax is the best-known breach in the last two years as a result of threat actors exploiting third-party components. The entry point was likely an outdated Apache Struts exploited to get remote code execution on the targeted web application. Therefore, a third-party component vulnerability was the main issue. Content Management Systems (CMS) are also becoming a significant web attack vector. Web applications using unpatched Drupal were widely exploited with Drupalgeddon (1, 2 and 3) attacks over the past several years. WordPress, used by an estimated 30% of all web applications, has also been targeted recently with CVE-2017-1001000 actively exploited in 2017.

The ability to identify and assess these third-party components is critical in web application security, and it must be part of a comprehensive web application scanning solution.

Tenable Web Application Scanning approach

Web application security assessments have to cover weaknesses and vulnerabilities for internal development and third-party components used to build the web application. The assessment process includes the following main steps:

  1. Browsing and enumerating hidden files and directories to identify web application entry points;
  2. Fingerprinting to provide information about all components used and their versions, which can identify additional entry points; and
  3. Vulnerability and misconfiguration detection based on information gathered during the previous steps to understand security issues to fix.

This full assessment process must be run frequently due to the continuously evolving attack surface and threat landscape, which create new entry points and vulnerabilities.

At Tenable, we have a product called Tenable.io Web Application Scanning (WAS) that can be used to assess common vulnerabilities in custom code, such as SQL Injection, Cross-Site Scripting (XSS), XML External Entity, Command Injection and Path Traversal, among many others. Once common web vulnerabilities are covered, WAS can also assess third-party component vulnerabilities.

For example, for web applications built with Drupal, WAS can detect Drupal and identify its version. Then vulnerabilities can be reported with version-based plugins (e.g., one of the plugins for SA-CORE-2019-003 security release) or remote-check plugins (e.g., the plugin for SA-CORE-2018-002).

Misconfiguration detection is also a potential critical security issue as it can lead to full web application takeover if a web application is not configured properly. A fully patched WordPress can leak usernames and provide access to its administration console without restriction. With these misconfigurations, an attacker is able to brute-force username passwords to get access to the WordPress administration panel and take control of the web application. To guard against this security threat example, WAS is able to enumerate WordPress usernames and detect whether a WordPress administration panel is available.

The same approach is applied to web framework components, which are more difficult to detect and assess. ThinkPHP is one of the web frameworks WAS is able to fingerprint, and for which it can provide remote-check plugins for critical vulnerabilities like CVE-2018-20062 and the most recent Remote Code Execution (RCE) for ThinkPHP 5.x < 5.0.24. JavaScript libraries are also components that must be assessed to detect Cross-Site Scripting and other critical vulnerabilities (e.g., jQuery File Upload). jQuery, Bootstrap or YUI are some of the JavaScript libraries WAS supports in its broad vulnerability coverage.

Learn more

Web applications can be extremely complex to secure, and the web application attack surface and threat landscape are continuously evolving. All third-party components must be covered in terms of misconfiguration and vulnerability detection in a web application scanning solution. Because WAS is backed by Tenable Research, the industry’s largest vulnerability research organization, the product supports a broad range of web application vulnerability detection plugins spanning custom web development and 3rd-party components.

If you’re interested in learning more, please join us on March 27 for a complimentary webinar on how to Protect Your Web Applications from Component Vulnerabilities. You can also try WAS in your environment. Click here to start a free 60-day evaluation.

Subscribe to the Tenable Blog

Subscribe
Try for Free Buy Now

Try Tenable.io

FREE FOR 60 DAYS

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Sign up now and run your first scan within 60 seconds.

Buy Tenable.io

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

65 assets

$2,190.00

Buy Now

Try for Free Buy Now

Try Nessus Professional Free

FREE FOR 7 DAYS

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy Nessus Professional

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy a multi-year license and save

Try for Free Buy Now

Try Tenable.io Web Application Scanning

FREE FOR 60 DAYS

Enjoy full access to our latest web application scanning offering designed for modern applications as part of the Tenable.io platform. Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications. Sign up now and run your first scan within 60 seconds.

Buy Tenable.io Web Application Scanning

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

5 FQDNs

$3,578.00

Buy Now

Try for Free Contact Sales

Try Tenable.io Container Security

FREE FOR 60 DAYS

Enjoy full access to the only container security offering integrated into a vulnerability management platform. Monitor container images for vulnerabilities, malware and policy violations. Integrate with continuous integration and continuous deployment (CI/CD) systems to support DevOps practices, strengthen security and support enterprise policy compliance.

Buy Tenable.io Container Security

Tenable.io Container Security seamlessly and securely enables DevOps processes by providing visibility into the security of container images – including vulnerabilities, malware and policy violations – through integration with the build process.

Learn More about Industrial Security

Get a Demo of Tenable.sc

Please fill out the form below with your contact information and a sales representative will contact you shortly to schedule a demo. You may also include a short comment (limited to 255 characters). Please note that fields with asterisks (*) are mandatory.