[论文解读] On the Threat of npm Vulnerable Dependencies in Node.js Applications

Mahmoud Alfadel, Diego Elias Costa+3 more|arXiv (Cornell University)|Sep 18, 2020

Security and Verification in Computing参考文献 25被引用 11

一句话总结

本研究通过将漏洞分类为三种威胁等级——低（未知）、中（已报告但未公开）和高（已公开宣布）——并分析6,673个成熟的开源Node.js应用程序，调查了npm中存在漏洞依赖项在现实世界应用中的真实威胁。研究发现，94.91%的有漏洞依赖项构成低威胁，而大多数高威胁案例源于应用未能及时更新，而非固有漏洞暴露。

ABSTRACT

Software vulnerabilities have a large negative impact on the software systems that we depend on daily. Reports on software vulnerabilities always paint a grim picture, with some reports showing that 83% of organizations depend on vulnerable software. However, our experience leads us to believe that, in the grand scheme of things, these software vulnerabilities may have less impact than what is reported. Therefore, we perform a study to better understand the threat of npm vulnerable packages used in Node.js applications. We define three threat levels for vulnerabilities in packages, based on their lifecycle, where a package vulnerability is assigned a low threat level if it was hidden or still unknown at the time it was used in the dependent application (t), medium threat level if the vulnerability was reported but not yet published at t, and high if it was publicly announced at t. Then, we perform an empirical study involving 6,673 real-world, active, and mature open source Node.js applications. Our findings show that although 67.93% of the examined applications depend on at least one vulnerable package, 94.91% of the vulnerable packages in those affected applications are classified as having low threat. Moreover, we find that in the case of vulnerable packages classified as having high threat, it is the application's lack of updating that makes them vulnerable, i.e., it is not the existence of the vulnerability that is the real problem. Furthermore, we verify our findings at different stages of the application's lifetime and find that our findings still hold. Our study argues that when it comes to software vulnerabilities, things may not be as bad as they seem and that considering vulnerability threat is key.

研究动机与目标

• 为了理解npm有漏洞依赖项在现实世界Node.js应用中实际造成的威胁，挑战所有漏洞危险性相同的假设。
• 通过关注漏洞的生命周期阶段，弥补现有研究的不足，不仅关注漏洞的存在，更关注其在现实世界中的威胁等级。
• 调查为何一些应用在修复补丁可用的情况下，仍依赖于高威胁的有漏洞依赖项。
• 评估漏洞威胁等级在整个应用开发生命周期中的演变过程。
• 为评估软件生态系统中依赖项的真实风险，提供一种具有威胁意识的框架。

提出的方法

• 基于漏洞生命周期，定义了三层次威胁分类：低（未知）、中（已报告但未公开）和高（已公开宣布）。
• 从公共代码仓库中收集并分析了6,673个成熟、活跃的开源Node.js应用，通过其package.json文件提取直接依赖项。
• 利用npm漏洞通告数据集，将每个依赖项映射到其漏洞状态，该数据集提供权威的漏洞记录。
• 通过分析版本历史和漏洞披露时间线，追踪漏洞威胁等级在应用版本间的演变。
• 开展纵向分析，评估不同应用开发阶段的威胁等级趋势。
• 通过检查修复补丁是否可用但未在应用中应用，识别高威胁漏洞的根本原因。

实验结果

研究问题

• RQ1 RQ1：基于依赖项在依赖时的生命周期阶段，现实世界Node.js应用中的有漏洞依赖项威胁程度如何？
• RQ2 RQ2：有漏洞依赖项的威胁等级在整个应用开发历史中如何演变？
• RQ3 RQ3：为何一些应用在修复补丁可用的情况下，仍依赖于高威胁的有漏洞依赖项？

主要发现

• 在所分析的6,673个Node.js应用中，67.93%依赖至少一个有漏洞的包，表明存在广泛暴露。
• 这些应用中所有有漏洞依赖项的94.91%被归类为低威胁，意味着在使用时漏洞尚属未知或未被报告。
• 在高威胁漏洞中，90.8%是由于应用不作为所致——具体而言，尽管修复补丁已可用，但应用未能更新到修复版本。
• 低威胁主导的趋势贯穿应用开发的所有阶段，表明威胁分类在时间上具有稳定性。
• 研究证实，并非所有漏洞都同样危险；真实威胁取决于披露时间和更新行为，而不仅仅是漏洞的存在。
• 研究结果表明，漏洞风险在综合报告中往往被高估，而应用维护实践是实际可利用性的关键因素。