Beyond Metadata: Code-centric and Usage-based Analysis of Known Vulnerabilities in Open-source Software

TL;DR

This paper introduces VULAS, a novel code-centric, usage-based method for detecting and mitigating open-source software vulnerabilities by analyzing actual code reachability, improving over metadata-based approaches.

Contribution

The paper presents VULAS, a new static and dynamic analysis tool that assesses vulnerability reachability in OSS dependencies, enhancing vulnerability detection accuracy.

Findings

VULAS is officially recommended by SAP for Java software scanning.

Over 250,000 scans performed on about 500 applications since 2016.

VULAS effectively identifies reachable vulnerable code, reducing false positives.

Abstract

The use of open-source software (OSS) is ever-increasing, and so is the number of open-source vulnerabilities being discovered and publicly disclosed. The gains obtained from the reuse of community-developed libraries may be offset by the cost of detecting, assessing, and mitigating their vulnerabilities in a timely fashion. In this paper we present a novel method to detect, assess and mitigate OSS vulnerabilities that improves on state-of-the-art approaches, which commonly depend on metadata to identify vulnerable OSS dependencies. Our solution instead is code-centric and combines static and dynamic analysis to determine the reachability of the vulnerable portion of libraries used (directly or transitively) by an application. Taking this usage into account, our approach then supports developers in choosing among the existing non-vulnerable library versions. VULAS, the tool implementing our code-centric and usage-based approach, is officially recommended by SAP to scan its Java software, and has been successfully used to perform more than 250000 scans of about 500 applications since December 2016. We report on our experience and on the lessons we learned when maturing the tool from a research prototype to an industrial-grade solution.