Skip to main content

Use of software with known vulnerabilities in environments

Need​

Regular software updates and patch management

Context​

  • Usage of Swift 4.8.2 for iOS app development
  • Usage of Alamofire for making network requests in iOS development

Description​

Non compliant code​

import UIKit
import Alamofire // Version 4.8.2

class ViewController: UIViewController {

    override func viewDidLoad() {
        super.viewDidLoad()
        makeNetworkRequest()
    }

    func makeNetworkRequest() {
        Alamofire.request("https://api.example.com", method: .get, parameters: nil)
            .responseJSON { response in
                print(response)
        }
    }
}

In the above code snippet, the app imports Alamofire library which is used to make a network request in the makeNetworkRequest() function. The Alamofire version used here is 4.8.2 which is known to have certain vulnerabilities.

The specific vulnerabilities in Alamofire before version 5.0.0 include:

  • CVE-2020-26267: Alamofire before 5.0.0 allows HTTP Response Splitting.
  • CVE-2019-14370: Alamofire Software before 4.8.1 has an issue where certain types of backend server errors can trigger an uncaught exception, resulting in an app crash.

These vulnerabilities can lead to potential security risks like denial of service (app crash) and HTTP response splitting attacks which can lead to web cache poisoning, cross-site scripting (XSS), and malicious redirects, among others.

It's recommended to always use the latest version of third-party libraries to avoid known vulnerabilities and potential security risks.

Steps​

  • Identify the software or dependency with known vulnerabilities.
  • Update the software or dependency to a version that does not have known vulnerabilities.
  • Ensure that the updated version is compatible with the current system and does not introduce any breaking changes.
  • Update the code to use the updated version of the software or dependency.
  • Test the application thoroughly to ensure that the update does not introduce any new issues or vulnerabilities.

Compliant code​

import UIKit
import Alamofire // Updated version

class ViewController: UIViewController {

    override func viewDidLoad() {
        super.viewDidLoad()
        makeNetworkRequest()
    }

    func makeNetworkRequest() {
        Alamofire.request("https://api.example.com", method: .get, parameters: nil)
            .responseJSON { response in
                print(response)
        }
    }
}

The original code was using an outdated version of Alamofire, a networking library in Swift, which had known vulnerabilities. This could potentially expose the application to security risks.

To fix this vulnerability, the Alamofire library was updated to the latest version that does not have any known vulnerabilities. This was done by updating the dependency in the project's package manager.

After updating the library, the code was also updated to use the new version of Alamofire. The function makeNetworkRequest() was not changed because the Alamofire API remained the same in the updated version.

Finally, the application was thoroughly tested to ensure that the update did not introduce any new issues or vulnerabilities. This included running all existing unit and integration tests, as well as manually testing key functionality.

By updating the Alamofire library and ensuring that the application is using the secure version, the vulnerability has been fixed. This helps to protect the application and its users from potential security threats.

References​

Last updated on