Our Top 5 Popular Open Source Components and Their Vulnerabilities

Overview

Sonatype operates at the forefront of open source software contribution and maintenance. With over a decade of active involvement in projects such as Maven Central, we continually work to be a leader in the open source community. Our pivotal role in managing the Central Repository, servicing billions of component releases to developers globally, demonstrates our commitment to supporting today’s software-driven world.

Open source components form the foundation of modern software development. Our research findings, outlined in the 2022 State of the Software Supply Chain report, reveal remarkable growth in the supply of open source component releases. Download volume of components across the four major ecosystems projected to surpass 3 trillion downloads overall last year. But with this boom in open source component usage, there has been a 742% average annual increase in software supply chain attacks over the past three years.

In terms of open source components, software dependencies can equal open source vulnerabilities. In 2022, the number of open source dependencies downloaded and integrated into software grew by an estimated average of 33% across all monitored ecosystems (Maven, PyPI, NuGet, and npm).

Our research also surfaced notable statistics such as:

• 6 out of every 7 project vulnerabilities come from transitive dependencies
• 1.2 billion vulnerable dependencies are downloaded every month
• 96% of known vulnerable open source components already have a fix available

To empower your organization and developers in leveraging open source components to drive innovation while mitigating risk, you need precision and complete intelligence. Tools lacking visibility and accuracy fall short in today’s fast-paced software development environment. Inaccurate or incomplete data exposes organizations to vulnerabilities, licensing challenges, and quality issues, leading to increased costs and diminished innovation.

At Sonatype, we’ve harnessed the power of precise identification to enable organizations to error-proof their software supply chains. By leveraging our 10+ years of experience and conducting 118,000 hours of data security research, we provide development and security teams with high-quality scan results for critical decision-making regarding version selection and remediation. Our customers have expressed great interest in our data capabilities, urging us to provide insights into the most popular open source components and conduct in-depth security analyses of the vulnerabilities affecting them.

In response to these demands, Sonatype has successfully identified five popular open source components used worldwide and their associated vulnerabilities.

The VM-escape paradox

Name of component: vm2

Name of vulnerability: CVE-2023-30547

Associated CVEs: CVE-2023-29199, CVE-2023-29017, CVE-2022-36067
Type of vulnerability: Sandbox escape
Versions affected: <3.9.17
Criticality:
⊲ CVSS 3.0 Score: 10.0
⊲ CVSS 3.0 Metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

DESCRIPTION

The vm2 npm package is no stranger to sandbox escape vulnerabilities that keep piling on. The vm2 sandbox escape vulnerabilities described here are deemed “critical” in severity. By no means is vm2 unheard of either. The popular npm component has been downloaded more than 315 million times (at the time of this writing) over the course of its lifetime and rakes in around 5 million weekly downloads.

ATTACK MECHANICS

The sandbox escape vulnerabilities in vm2 are essentially identical at their core. The insufficient or incomplete error handling in the vm2 project enables attackers to “break out” of the sandbox protections provided by the package. The PoC for the latest CVE-2023-30547 is provided by SeungHyun Lee, aka Xion, of KAIST Hacking Lab, who is credited with reporting the vulnerability.

REMEDIATION RECOMMENDATION

At the time of writing, the latest vm2 version 3.9.17 has resolved all these sandbox escape vulnerabilities — upgrade to that version or higher to fix. However, given the ongoing trend with vm2, it won’t be surprising if even the latest fix can be bypassed by variations of the exploit.

CONCLUSION

While virtual machines are designed to provide a secure sandbox environment, the presence of these critical vulnerabilities highlights the need for robust security practices.

ChatGPT spills out payment information due to Redis bug

Name of component: redis-py

Name of vulnerability: CVE-2023-28859

Associated CVEs: CVE-2023-28858
Type of vulnerability: Race Condition
Versions affected: Before 4.4.4, and 4.5.x before 4.5.4
Criticality:
⊲ CVSS 3.0 Score: 6.5
⊲ CVSS 3.0 Metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

DESCRIPTION

In March 2023, several ChatGPT users experienced data leaks due to a bug in Redis. This race condition in Redis poses a security risk impacting confidentiality and resource availability potentially opening doors for exploitation.

ATTACK MECHANICS

The vulnerability itself is quite straightforward, but it concerns a scenario that would typically occur only in rare circumstances. OpenAI admitted to inadvertently introducing a server change that caused a spike in Redis request cancellations, thereby increasing the probability of this race condition triggering.

REMEDIATION RECOMMENDATION

Despite Redis releasing a fix in version 4.5.3, sharp-witted testers were able to reproduce the flaw, deeming it unfixed, and thus tracking continues under CVE-2023-28859.

CONCLUSION

The incident involving the Redis bug exemplifies the potential risks associated with open source components when deployed at scale and combined with specific misconfigurations.

Google Chrome aka Chromium hackers in the wild: A heap buffer overflow in WebRTC

Name of component: Chromium

Name of vulnerability: CVE-2022-2294

Type of vulnerability: Out-of-bounds write
Versions affected: <103.0.5060.114
Criticality:
⊲ CVSS 3.0 Score: 8.8
⊲ CVSS 3.0 Metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

DESCRIPTION

The vulnerability concerns a memory corruption flaw within WebRTC which can be exploited via malicious web content. A web browser user visiting a malicious web page can potentially subject their machine to arbitrary code execution by the attacker.

ATTACK MECHANICS AND REMEDIATION

A simple one-line fix corrects the flaw involving a function call.

CONCLUSION

This heap buffer overflow vulnerability highlights the importance of adopting a comprehensive solution for software supply chain management.

The cursed session: WildFly Elytron

Name of component: WildFly Elytron

Name of vulnerability: CVE-2020-10714

Type of vulnerability: Session fixation
Versions affected: 1.11.3.Final and before
Criticality:
⊲ CVSS 3.0 Score: 7.5
⊲ CVSS 3.0 Metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

DESCRIPTION

The vulnerability allows attackers to trick victims into accessing affected applications with predefined session IDs.

REMEDIATION RECOMMENDATION

The maintainers chose to fix this security issue by regenerating the session ID after a successful login.

CONCLUSION

The session fixation vulnerability illustrates the significance of addressing vulnerabilities that can be easily exploited.

Beyond Log4Shell: An end-of-life version of Log4j with a Chainsaw vulnerability

Name of component: Apache Chainsaw

Name of vulnerability: CVE-2022-23307

Associated CVEs: CVE-2020-9493
Type of vulnerability: Deserialization of untrusted data
Versions affected: <2.1.0
Criticality:
⊲ CVSS 3.0 Score: 8.8
⊲ CVSS 3.0 Metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

DESCRIPTION

The vulnerability itself lurks in the Apache Chainsaw component, included within Log4j 1.x versions. The inclusion of this version in Log4j 1.x makes it vulnerable too.

ATTACK MECHANICS AND REMEDIATION

An attacker can trigger arbitrary code execution through untrusted deserialization.

CONCLUSION

Log4j 1.x vulnerabilities highlight the risks associated with outdated components.

Prioritizing Open Source Security: Sonatype’s Data-Driven Approach

In this whitepaper, we highlighted our top five vulnerable open source components, shedding light on the importance of security in the open source landscape. The vulnerabilities outlined serve as a wake-up call for the software industry to prioritize security in the open source landscape.