1

If a dependency that is used in development environment or at build time has a security vulnerability, could it cause a security threat for the application? I'm looking for an example to understand how it can have an impact on the security posture of the application.

1 Answer 1

1

Sure, though it depends on the type of vulnerability. A few examples:

  1. A dependency-fetching tool doesn't validate TLS certificates correctly. An attacker uses a man-in-the-middle attack, presents a spoofed certificate, and causes the tool to fetch malicious source or executables, even though it's supposedly pulling from a trusted source. This compromises the built code, and possibly also the build machine.
  2. A tool that makes an outbound network request is vulnerable to malicious responses (for an example, Heartbleed affected OpenSSL-based clients, not just servers, and was exploitable before server identity was verified) and this is used to steal secrets (source, credentials, keys, etc.), gain code execution in the build system, or other harms.
  3. A CI/CD system has broken authentication. An external attacker (if Internet-exposed) or a malicious insider (if not) could use this to log in as somebody else, access source, build artifacts, and deployment credentials, and run arbitrary programs on the build tools.
  4. A non-Internet-exposed CI/CD system is vulnerable to CSRF. A legitimate user logs into the CI/CD and does some web browsing in another tab. Due to a watering hole attack or a malicious ad, their browser loads some attacker-controlled content, which probes their internal network, finds the CI/CD server, and forges requests as the signed-in user that end up compromising the build machines, artifacts, and/or production environment. (This one is a real example, in the sense that I found a CI/CD system that was completely vulnerable to CSRF and it took the devs literally years to respond to the vulnerability.)
  5. A resource compiler/packer or image manipulation tool that has a memory corruption vulnerability exploitable using malformed images. Although an external attacker can't directly attack the tool, there's a risk that images found online may have been crafted to exploit the issue, and an employee might unknowingly include such an image in a set of images either bundled with the app for release or used for testing.
  6. A test or debug framework might use network sockets to communicate with a debugger (e.g. in an IDE). If the framework listens on all interfaces rather than just machine-local ones - which might even be necessary in some cases, e.g. if you're debugging in a VM or a test environment - and doesn't have authentication requirements, an attacker on the same network could remotely connect to the framework. That attacker would presumably have access to app secrets, and will probably also be able to take control of code execution within the app to gain arbitrary code execution by "testing" arbitrary functions or using the debugger to modify program flow.
  7. Not exactly a "vulnerability" in the usual sense, but dependencies can themselves become malicious via supply chain attacks if their maintainers are not careful about security of the package contributors/maintainers. Obviously, a malicious package - even only running at build time - can both run arbitrary code in the build environment (including stealing all secrets) and inject arbitrary code into the build artifacts that runs once the artifacts are deployed.

Build time is definitely a narrower window - there's less likely to be a listening socket or other easy way for an attacker to exploit any discovered issue, and the environment is harder for an outsider to probe or influence - but it's not impossible. It's definitely very high severity; such a compromise could grant access to developer permissions, source code, server-only secrets including TLS and app-signing private keys, deploy secrets such as cloud hosting credentials/API keys and API keys for third-party integrations, and of course can modify the built artifacts resulting in compromising wherever they're run, too.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .