Dependency confusion vulnerability was found in early 2021 by Alex Birsan and helped hackers to gain RCE on some of the biggest tech giants like Apple, Microsoft, and many more.
This vulnerability occurred because individuals/organizations blindly trusted public repositories and commands like these `
npm install package_name` to install dependencies.
In this blog, we will cover all about this vulnerability, from what it is to how to exploit it, in a step-by-step guide.
This type of attack happens when the attacker tricks the person or organization into thinking they are using normal commands to install and upgrade things, but they are actually running bad scripts that can take control of the system. This is a Remote Code Execution attack.
But these vulnerabilities are also found in Python and ruby projects and all other applications that let users install and use some public and private packages.
The dependency confusion vulnerability mostly affects organizations that use Private packages/dependencies for their project and then share their internal package.json or requirements.txt files with the public.
This becomes an issue because an attacker can grab that internal file and check for the private packages not registered with their specific vendors.
Later, this could lead to vulnerabilities because of the blind trust we put in commands like these `
npm install package_name`.
In this vulnerability, the attacker first tries to get hold of an internal file like package.json or requirements.txt by searching public repositories through fuzzing, Dorking, or any means necessary.
The attacker then takes the package.json file and searches through all the dependencies to find if they are private or public dependencies.
We can search the dependencies manually one by one in the npm registry website or search the list of dependencies all together at once by using a tool called confused, but this tool can sometimes give a false-positive report, so always be ready to double-check with the npm registry website.
If you find a dependency or multiple dependencies that are private and not listed on public registries, then you can start your attack.
After finding those Private dependencies names, we have to register those private dependencies names with NPM public registries and remember to register with the same name.
Now let’s start our attack by creating a malicious package. (Note: – From here, we will be working with Terminal.)
You should wait for the package to install or update on some Individual/Organization systems. Sometimes this could take days, weeks, or even minutes, but once installed after that, our script will gather some info about the server and get back to us via burp collaborator.
The simple way to fix the Dependency Confusion vulnerability in most applications like npm, python, ruby, etc., is to register your private package name on public registries so that attackers can’t use that name for the attack.
If you have many private packages, you can also register a domain name in public registries and then name all your private packages under that domain. This way, you don’t need to register hundreds of names in the public registry. Just a domain name would be enough to protect against attackers.
Bonus: To find and exploit vulnerabilities in a project, you must first obtain its internal file. Then, use a ” confused ” tool to find any vulnerable private packages. Next, create a malicious package with the same name and upload it to the project’s package manager. (Note: You can pre-write those malicious packages, which will automatically call you back when started on the victim server. Later, while creating the exploit, you won’t need to create new malicious packages repeatedly.)
In this article, we only discussed how to exploit npm packages, but there are many more package managers/vendors which are vulnerable to this type of attack (i.e., node, python, ruby, Java, .NET, PHP, objective-c, docker, go, rust).
So if you are concerned about the rising threat of dependency confusion attacks and the potential for RCE vulnerabilities in your code? Don’t take any chances – partner with SecureLayer7 for expert code security and peace of mind.
Our experienced team is well-versed in the latest attack vectors, including dependency confusion. We are here to help you protect your code from any possible vulnerability. We offer a range of services and tailored solutions to meet your specific needs, including code reviews, vulnerability assessments, and penetration testing.
By choosing SecureLayer7, you can be sure that your code is in the best possible hands. Our team of experts will work closely with you to understand your unique situation and recommend the best possible approach to safeguard your code.
With our industry-leading tools and techniques, we will help you identify and remediate vulnerabilities before attackers can exploit them. Are you ready to take the necessary steps to secure your code and prevent RCE attacks, don’t wait any longer. Contact SecureLayer7 today to get started. We guarantee you’ll be glad you did!