Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Looking at how many sites use vulnerable JavaScript libraries

snyk.io

Post reply on HN
Print view View original

11–20 of 53 posts

Re: Looking at how many sites use vulnerable JavaScript libraries

#11

Post by Klathmon »

megaman22 wrote: post #8

If it's an automated scan, I'd be skeptical. Currently dealing with some overzealous security folks who put adherence to their scan tool over common sense, and insist that we lock down Oracle PL/SQL vulnerabilities in an application that doesn't use any flavor of SQL...

I absolutely hate these kinds of "security" scans.

I once worked with a company that started using one of these. They said our "vulnerability scores" were significantly too high.

I looked at the report, turns out they were just looking at HTTP headers and throwing up every CVE that matched any version numbers they found. (One of the "worst offenders" on the system was a CVE about a vulnerability in PHP when using "magic quotes", a part of PHP that hadn't been used in many years, and our application never used)

We were officially instructed that the fix would be to hide the PHP and apache version numbers from the headers.

If I were the one running that scan, and someone "fixed" the problem by just hiding the version numbers, I'd be calling for that person to be fired for trying to hide the problem. But here they were instructing us to do just that. And once we did, the system was marked "secure"...

Re: Looking at how many sites use vulnerable JavaScript libraries

#12

Post by Klathmon »

merb wrote: post #10
bastawhiz wrote: post #9

Earlier quoted context omitted.

An XSS issue could make your users' data vulnerable.

is still only an issue if you pass untrusted data to your js code.

And there is a pretty good chance of that happening in most JS projects.

Anywhere you take or show input from the user (an input box, a URL query, displaying data stored by some other system on the DB, etc...) could be a vector for an XSS attack.

And it's not just data passed to JS, but data passed to HTML or any data that could make it's way into CSS in many cases!

Re: Looking at how many sites use vulnerable JavaScript libraries

#13

Post by wrinkl3 »

merb wrote: post #7

> One of the discoveries the report mentions is that an analysis of around 433,000 sites found that 77% of them use at least one front-end JavaScript library with a known security vulnerability. Does that even matter? No Front-End JS Library should actually make your backend vulnerable.

Vulnerabilities don't have to affect the backend - most of JQuery-related CVEs that I could find had to do with XSS.

Re: Looking at how many sites use vulnerable JavaScript libraries

#14

Post by spurcell93 »

jjnoakes wrote: post #6
irrelative wrote: post #3

One might even say that 100% of 333,410 sites use vulnerable javascript libraries

Those means different things. Their wording means "we checked X sites and 77% of them met some criteria", which can be extrapolated to higher values of X (assuming the proper statistical care is taken, etc). Your wording implies the same, but that's not good because you can't extrapolate to a larger X. You chose the sites after knowing they already met the criteria, and that changes the meaning.

I get the sense OP was being a bit snide

Re: Looking at how many sites use vulnerable JavaScript libraries

#15

Post by oneweekwonder »

bastawhiz wrote: post #9
merb wrote: post #7

> One of the discoveries the report mentions is that an analysis of around 433,000 sites found that 77% of them use at least one front-end JavaScript library with a known security vulnerability. Does that even matter? No Front-End JS Library should actually make your backend vulnerable.

An XSS issue could make your users' data vulnerable.

But cors[0] headers can mitigate some of the risk?

[0]: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS

Re: Looking at how many sites use vulnerable JavaScript libraries

#16

Post by guypod »

megaman22 wrote: post #8

If it's an automated scan, I'd be skeptical. Currently dealing with some overzealous security folks who put adherence to their scan tool over common sense, and insist that we lock down Oracle PL/SQL vulnerabilities in an application that doesn't use any flavor of SQL...

Scanning for vulnerable components is different. All the tool has to do is find out the site is using the specific library, the vulnerabilities themselves are manually validated.

Re: Looking at how many sites use vulnerable JavaScript libraries

#17

Post by guypod »

wesleytodd wrote: post #4

We run nsp on our production services in CI before merge. The number of false positives I have tracked down is infinitely higher than the number of vouln's found. I literally mean this, we have never seen one disclosure which resulted in a viable attack on our production services. For example, recently a bunch of ReDOS voulns were reported in popular libraries. None of which were in code paths hit by our configuratio…

I think it's an absolute statement about the lack of awareness to this risk.

Of course some of these site would not actually be vulnerable, but I would bet the vast majority of them don't even know they're using a library with a known vulnerability.

Post reply on HN