The majority of open source applications contain potentially dangerous security flaws, a new report has found.
Application security testing provider Veracode discovered that after an initial scan, seven in ten applications contain a security flaw in an open source library.
The company's research highlights how using open source can introduce flaws, increase risk and add to security debt. Veracode analyzed the component open source libraries across its platform database of 85,000 applications which account for 351,000 unique external libraries.
- Why the entire open source movement is under threat right now
- Microsoft admits it was wrong about Linux and open source
- Also check out our roundup of the best open source software
Almost all modern applications and even those that are sold commercially are built using some open source components. However, a single flaw in one library will cascade to all applications that leverage that code.
Chief research officer at Veracode, Chris Eng explained how using open source libraries can expand an application's attack surface, saying:
“Open source software has a surprising variety of flaws. An application’s attack surface is not limited to its own code and the code of explicitly included libraries, because those libraries have their own dependencies. In reality, developers are introducing much more code, but if they are aware and apply fixes appropriately, they can reduce risk exposure.”
Open source libraries
According to Veracode, commonly included libraries are present in over 75 percent of applications for each programming language. The company's research also found that flawed libraries end up in code indirectly as 47 percent of them found in applications are transitive and not pulled in directly by developers but by upstream libraries.
Programming language selection also plays a factor in both terms of the size of the ecosystem and in the prevalence of flaws in those ecosystems. For instance, including any given PHP library has a greater than 50 percent chance of bringing a security flaw along with it.
Of the OWASP Top Ten flaws, weaknesses around access control are the most common and represent over 25 percent of all flaws. Cross-Site Scripting (XSS) is the most common vulnerability category found in open source libraries (30%) followed by insecure deserialization (23.5%) and broken access control (20.3%).
- These are the best Linux distros of 2020
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
After working with the TechRadar Pro team for the last several years, Anthony is now the security and networking editor at Tom’s Guide where he covers everything from data breaches and ransomware gangs to the best way to cover your whole home or business with Wi-Fi. When not writing, you can find him tinkering with PCs and game consoles, managing cables and upgrading his smart home.