Timeline for Is it really Security Misconfiguration to show a version number?
Current License: CC BY-SA 4.0
9 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 16, 2019 at 14:40 | comment | added | Tomáš Zato |
Can somebody point out to me how can client side library on it's own be a vulnerability in any case? For any attack to occur, attacker needs to first execute some code on client's side. Short of eval(window.location.hash) I don't see how a library that manipulates HTML can be vulnerable to attack without the website already being compromised.
|
|
| Aug 15, 2019 at 5:57 | comment | added | forest | @Echo They generally all have their own mailing lists. However oss-sec is a good catch-all mailing list. | |
| Aug 15, 2019 at 3:37 | comment | added | atk | @echo there are tools specifically designed for monitoring vulnerabilities in 3rd party components. Two of the commercial leaders in the space are current Palamida and Black Duck, but if you do some google searching you can come up with a list of newer products at different pricing (some free, but requiring substantial manual work) that might suit your needs better. | |
| Aug 14, 2019 at 9:34 | comment | added | Echo | @Sjoerd What mailing lists would you reccomend for a web-based system (Apache, nginx, JQuery, SSH, FTP, server packages in general)? | |
| Aug 14, 2019 at 8:01 | comment | added | Kaiido | @Luc if you are talking about the css, then no, there isn't something available from js (apart comments). But each bootstrap plugins have their own VERSION accessible from the constructor: stackoverflow.com/questions/43233588/… | |
| Aug 14, 2019 at 7:29 | comment | added | Luc |
@Kaiido Nice, I didn't know of $.fn.jquery. I'm not sure if this is a lucky coincidence or if it's common for other libraries to have this as well though. Looking up the library I see second-most commonly, Bootstrap, it doesn't seem like there is such a function for that.
|
|
| Aug 14, 2019 at 1:07 | comment | added | Kaiido |
@Luc I would argue that it's simply useless, you can access this through $.fn.jquery, way easier than scrapping the comments which may anyway be unreadable in most sources because of SOP.
|
|
| Aug 13, 2019 at 9:45 | comment | added | Luc | Agreed, just a small note: "Hiding the version number may make it slightly more work" I'd argue it's a bit more than "slightly": in order to map code back to a version number (in order to plug that version number into a CVE search), you have to have an index of all variants (minified, maybe with different packers) of all versions of all relevant libraries. A dedicated attacker might do this if they suspect there will be an exploitable vulnerability, but most of the time, the vulns of client-side libraries are not reachable or have a limited impact. I think few attackers would bother. | |
| Aug 13, 2019 at 9:26 | history | answered | Sjoerd | CC BY-SA 4.0 |