VNX-1395: Dependency on a third-party component release with a well-known vulnerability

Offline floor for CWE-1395: reports manifests, lockfiles and pages that pin a well-known vulnerable or compromised release of lodash, minimist, jsonwebtoken, handlebars, jQuery, AngularJS, Bootstrap, PyYAML, Jinja2, event-stream, ua-parser-js, node-ipc, vm2 or node-serialize.

Field	Value
Rule ID	`VNX-1395`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	JavaScript / TypeScript, Python, HTML
CWE	CWE-1395
ATT&CK	T1195.001
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`dependency-on-vulnerable-third-party-component` `sca` `cwe-1395`
Source	`internal/sast/rules/vnx-1395.rego`

Overview

VNX-1395 maps to CWE-1395: Dependency on Vulnerable Third-Party Component. Dependency scanning (vulnetix sca) is the complete check: it matches every component against the vulnerability database. This rule is the offline floor that needs no lookup: a short, curated list of JavaScript and Python components whose vulnerable releases are exploited in the wild.

Component	Reported when	Advisory
lodash	before 4.17.21	CVE-2021-23337, CVE-2020-8203
minimist	before 0.2.4 / 1.2.6	CVE-2021-44906
jsonwebtoken	before 9.0.0	CVE-2022-23529, CVE-2015-9235
handlebars	before 4.7.7	CVE-2021-23369
jquery	before 3.5.0	CVE-2020-11022
event-stream, ua-parser-js, node-ipc	the compromised releases	supply-chain compromise
vm2, node-serialize	any version	no fixed release
PyYAML	before 5.4	CVE-2020-14343
Jinja2	before 2.10.1	CVE-2019-10906
AngularJS (script)	any 1.x	end of life, unfixed CVEs
Bootstrap JS (script)	3.x before 3.4.1, 4.x before 4.3.1	CVE-2019-8331

What Gets Flagged

"lodash": "4.17.15",
"jsonwebtoken": "0.4.0",
"node_modules/lodash": { "version": "4.17.11" }

PyYAML==5.1
jinja2<=2.10

<script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script>
<script src="https://ajax.googleapis.com/ajax/libs/angularjs/1.8.2/angular.min.js"></script>

Not flagged: fixed releases, caret/tilde/>= ranges that admit a fixed release (the lockfile decides), lookalikes (lodash.merge, @types/lodash, types-PyYAML, jquery-ui, jquery-migrate), stylesheets, versions in scripts or descriptions, manifests under node_modules, test and fixture paths. Java components are VNX-937; unmaintained components are VNX-1104. The engine evaluates this rule only when the scanned tree holds a file it recognises as JavaScript, Python or HTML (a lone requirements-dev.txt does not count; requirements.txt, Pipfile and package manifests do).

Remediation

Upgrade to a fixed release and regenerate the lockfile.
Replace components that have no fix (vm2, node-serialize, AngularJS).
Run vulnetix sca in CI for complete coverage.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1395
// nosec vnx-1395

Or record an ignore rule: vulnetix ignore add --rule vnx-1395 --reason "...". See Suppressing findings.