Open Source, Open Attack Surface: Understanding Security in Open-Source Libraries

Modern software development relies heavily on open-source libraries and third-party packages for implementing various functionalities, from authentication and cryptography to input validation and file processing.

While these libraries make development easier by providing ready-to-use functionality, how often do we actually look into the security of the libraries we integrate into our applications?

This session focuses on understanding open-source libraries from a security perspective. It explores how commonly used libraries implement security features, what protections they offer, and where things can go wrong when they are integrated or configured incorrectly.

The session will also cover how to assess open-source dependencies before using them, including checking CVEs, security advisories, affected versions, transitive dependencies and project maintenance. Some of the tools and resources used for identifying known vulnerabilities and evaluating dependency security will also be demonstrated.

Along with this, I will share practical examples of how security issues can arise in applications that rely on open-source components, including a case study involving a PDF generation feature that used a server-side Headless Chromium environment.

The idea is to go beyond simply installing and using open-source libraries and understand what happens behind the scenes, what security risks they may introduce, and how we can make better decisions when choosing and integrating them into our projects.

1. Understand the security features offered by commonly used open-source libraries and how they work.

2. Learn how to check open-source dependencies for known vulnerabilities using CVEs, security advisories and vulnerability databases.

3. Understand the importance of checking library versions, transitive dependencies, maintenance activity and security updates before integrating a package.

4. Identify how incorrect configurations and improper implementation can introduce security vulnerabilities even when established security libraries are used.

5. Explore open-source tools that can help assess dependencies and identify potential security risks.

6. Understand how real-world vulnerabilities can arise from the way open-source components are integrated into applications.

7. Develop a more security-conscious approach towards selecting, using and maintaining open-source libraries.