Most Java Apps Susceptible to Widespread Attacks from Known Security Defects
Study Finds That Less Than 28 Percent of Organizations are Actively Monitoring the Components That Could Lead to Security Breaches
October 24, 2017

Chris Wysopal
Veracode

A new report by CA Veracode found that 88 percent of Java applications contain at least one vulnerable component, making then susceptible to widespread attacks. This is in part because fewer than 28 percent of companies conduct regular composition analysis to understand which components are built into their applications.

Jump to Infographic Below

“The universal use of components in application development means that when a single vulnerability in a single component is disclosed, that vulnerability now has the potential to impact thousands of applications – making many of them breachable with a single exploit,” said Chris Wysopal, CTO, CA Veracode.

Over the past 12 months, several high-profile breaches in Java applications were caused by widespread vulnerabilities in open source or commercial components. One example of a widespread component vulnerability was the “Struts-Shock” flaw disclosed in March 2017. According to the analysis, 68 percent of Java applications using the Apache Struts 2 library were using a vulnerable version of the component in the weeks following the initial attacks.

This critical vulnerability in the Apache Struts 2 library enabled remote code execution (RCE) attacks using command injection, for which as many as 35 million sites were vulnerable. Using this pervasive vulnerability, cybercriminals were able to exploit a range of victims’ applications, most notably the Canada Revenue Agency and the University of Delaware.

The 2017 State of Software Security Report also shows that approximately 53.3 percent of Java applications rely on a vulnerable version of the Commons Collections components. Even today, there are just as many applications using the vulnerable version as there were in 2016. The use of components in application development is common practice as it allows developers to reuse functional code – speeding up the delivery of software. Studies show that up to 75 percent of a typical application’s code is made up of open source components.

Wysopal continued, “development teams aren’t going to stop using components – nor should they. But when an exploit becomes available, time is of the essence. Open source and third party components aren’t necessarily less secure than code you develop in-house, but keeping an up-to-date inventory of what versions of a component you are using. We’ve now seen quite a few breaches as a result of vulnerable components and unless companies start taking this threat more seriously, and using tools to monitor component usage, I predict the problem will intensify.”

The report also shows that while many organizations prioritize fixing the most dangerous vulnerabilities, some still face challenges efficiently remediating software issues. Even the most severe flaws require significant time to fix (only 22 percent of very high severity flaws were patched in 30 days or less) and most attackers are leveraging vulnerabilities within days of discovery. Hackers and nation state organizations are given ample time to potentially infiltrate an enterprise network.

In addition to information regarding threat posed by the use of vulnerable components, the report also found:

■ Vulnerabilities continue to crop up in previously untested software at alarming rates. 77 percent of apps have at least one vulnerability on initial scan.

■ Government organizations continue to underperform those in other industries. Not only did they have a 24.7 percent pass rate at latest scan, they also had the highest prevalence of highly exploitable vulnerabilities like cross-site scripting (49 percent) and SQL injection (32 percent).

■ Comparatively, between first and last scan, critical infrastructure had the strongest OWASP pass rate (29.8 percent) across all industries studied, though it saw a slight decline in pass rate (29.5 percent) on last scan. Two industries showing slight improvements between first and last scan include healthcare (27.6 percent vs. 30.2 percent) and retail & hospitality (26.2 percent vs. 28.5 percent).



Methodology: Data for the eighth volume of CA Veracode’s 2017 State of Software Security Report is derived from scans conducted by CA Veracode’s base of 1,400+ customers, and was drawn from code-level analysis of nearly 250 billion lines of code, across 400,000 assessments performed during the 12 month period from April 1, 2016 to March 31, 2017. The findings are representative of the application security industry’s most comprehensive review of application testing data.

Chris Wysopal is Co-Founder and CTO of Veracode
Share this

Industry News

May 16, 2022

Red Hat announced new capabilities and enhancements across its portfolio of open hybrid cloud solutions aimed at accelerating enterprise adoption of edge compute architectures through the Red Hat Edge initiative.

May 16, 2022

D2iQ announced a partnership with GitLab.

May 16, 2022

Kasten by Veeam announced the new Kasten by Veeam K10 V5.0 Kubernetes data management platform.

May 12, 2022

Red Hat introduced Red Hat Enterprise Linux 9, the Linux operating system designed to drive more consistent innovation across the open hybrid cloud, from bare metal servers to cloud providers and the farthest edge of enterprise networks.

May 12, 2022

Couchbase announced version 7.1 of Couchbase Server.

May 12, 2022

Copado added Copado Robotic Testing to Copado Essentials.

May 11, 2022

Red Hat announced new advancements within its Red Hat Cloud Services portfolio, delivering a fully-managed and streamlined user experience as organizations build, deploy, manage and scale cloud-native applications across hybrid environments.

May 11, 2022

JFrog introduced a new Docker Desktop Extension for JFrog Xray that allows organizations to automatically scan Docker Containers for vulnerabilities and violations early in the development process.

May 11, 2022

Progress announced a series of updates in Progress Telerik and Progress Kendo UI.

May 11, 2022

Vultr announces that Vultr Kubernetes Engine (VKE) is generally available.

May 10, 2022

Docker announced new features and partnerships to increase developer productivity. Specifically, the company announced Docker Extensions which allow developers to discover and add complementary development tools to Docker Desktop.

May 10, 2022

Red Hat announced the general availability of Red Hat Ansible Automation Platform on Microsoft Azure, pairing hybrid cloud automation with the convenience and support of a managed offering.

May 10, 2022

The Fedora Project, a community-driven open source collaboration sponsored by Red Hat, announced the general availability of Fedora Linux 36, the latest version of the fully open source Fedora operating system.

May 10, 2022

Progress announced the release of Progress Chef Cloud Security, extending DevSecOps with compliance support for native cloud assets and enabling end-to-end management of all on premise, cloud and native cloud resources.

May 10, 2022

Platform9 announced new platform capabilities in Platform9 5.5 that make it easier for cloud-native development and operations teams to build, scale, and operate apps and Kubernetes clusters in the cloud, on-premises, and at the edge.