We, as a field, are gaslighting ourselves. And I can prove it.
I will get downvoted for this... but please please hear me out.
First and foremost. Do ANY of these scenarios sound familiar in any shape or form?
1. You or someone you know is developing an app. The developer cares A LOT about security. They run code checks on their repo. Maybe even get someone to audit it. They ask their AI to check for security gaps. Any security issues found are fixed right away and they pat themselves on the back for a job well done.
Now, as they develop, they (or their AI) pulls in some dependencies. Reinventing the wheel is pointless after all, right? Gotta use those dependencies. To make sure they are not vulnerable they check them with dependabot. No CVEs. All is good (...or is it?).
2. You're doing bug bounties and are reporting vulns to a repo owner. Their security policy EXPLICITLY says: "If a vuln is in one of our dependencies, do not bother us with it. It's not our problem. Take it up to the dependency owner. We keep dependencies up to date so their fix will be pulled in".
3. A well meaning developer asks about the best practice for keeping dependencies secure. You (or someone else) say(s): Keep components up to date. Check to make sure they do not have any known CVEs. If being thorough you add: check to make sure the components are being actively supported.
Auditing the actual dependency code for vulns? that is rare. Never regularly done for all dependency updates like in a proper ci/cd flow. And forget about the dependencies pulled in by those dependencies. (see where I am going with this yet?).
4. A news of a breach is posted. PII compromised. Why? dependency vuln. Or in some rarer cases (not calling names here) - the dependency had actual malware in it.
Where am I going with all this?
As an industry we under audit dependencies. Sure, we check for CVEs. What about all the vulns no one bothered to report of get a CVE filing for? that is a big process. We're all busy. The code and apps we're auditing are so full of vulns we may not even get to the dependencies.
Anyhow. I wanted to know just how bad the situation was. so I scanned a few popular opensource libraries. Every single one had vulns. Not calling names here. Then I did a scan against a small repo. No known CVEs. The scan checked the code of the dependencies and all the child dependencies. (not cves). And here are the lovely results (I am not disclosing which one it was):
Findings Summary
Total Findings
2027
Critical 81
High 736
Medium 671
Low 24
Info 515
... as I was writing this up I realized I could not attach screenshots. I only wish I could attach screenshots here because the dependency tree the scanner built was jaw dropping. Again, this was NOT a big repo.
...
And my point in all this? I want to talk about how supply chain security could be better.