Components with Known Vulnerabilities

What Is Components with Known Vulnerabilities?

Attacker and defender read the same advisory on the same day. The attacker needs the flawed version left running in one place; you have to find every match in the dependency tree, patch it, test it and deploy. You'll probe an import feature, learn its library version from the response, and send a file a published CVE turns into code execution. Then you bump to the patched release, switch to a data-only rebuild, and wire a lockfile scanner into CI so the next advisory arrives as a build failure.

What You'll Learn in Components with Known Vulnerabilities

• Recognize known-vulnerability exposure as the gap between CVE publication and deployment of the patched dependency, and automated scanning as the control that shrinks it
• Read a CVE advisory and map its affected versions against a project's pinned dependency
• Apply the dependency bump as the immediate fix and the OSV, Snyk, Dependabot, or npm-audit CI integration as the systemic fix
• Understand that a vulnerable component can execute attacker-supplied input even when the surrounding application code is written correctly
• Add defense in depth for deserialization: rebuild untrusted input as plain data, never as rich typed objects, and run the service under least privilege

Components with Known Vulnerabilities — Training Steps

1. The import feature

   Verric lets a customer export a saved dashboard as a small file and import it into another workspace. The import is not done in the browser: Verric's own servers read the uploaded file and rebuild the dashboard from it. Bob opens the feature to see how it works before he touches it.

2. Where the file is rebuilt

   One line on that page is the whole reason Bob is interested.

3. Import a normal file

   First, watch the feature behave normally. Bob attaches an ordinary exported dashboard and imports it. The browser's Network panel records the request and the server's reply, exactly what a developer sees in DevTools.

4. What rebuilt the file

   The dashboard imported cleanly. One field in the response is more useful to Bob than the import itself.

5. Look up the library

   Bob opens a public package registry to see what has been reported against that library. He types the registry address into the browser himself, then searches for it.

6. Check the pinned version

   The latest release, 2.4.6, is clean. Bob needs the version Verric actually runs, 2.4.1, the one the import response named. He selects it from the version list to see its security status.

7. Start from a normal file

   Bob opens an ordinary exported dashboard in his editor. Right now it is exactly what it looks like: a title and a chart.

8. Weaponize the file

   Bob edits one field. He swaps the chart widget for a process-spawning type carrying a shell command, straight from the advisory's proof of concept. The file still parses as a dashboard.

9. The gadget

   Two lines are all it took.

10. Upload the crafted file

    Bob imports his crafted file through the same feature. To the browser it is just another upload.