Thou Shalt Not Depend on Me: Analysing the Use of Outdated JavaScript Libraries on the Web

Abstract

Web developers routinely rely on third-party Java-Script libraries such as jQuery to enhance the functionality of their sites. However, if not properly maintained, such dependencies can create attack vectors allowing a site to be compromised.In this paper, we conduct the first comprehensive study of client-side JavaScript library usage and the resulting security implications across the Web. Using data from over 133 k websites, we show that 37 % of them include at least one library with a known vulnerability; the time lag behind the newest release of a library is measured in the order of years. In order to better understand why websites use so many vulnerable or outdated libraries, we track causal inclusion relationships and quantify different scenarios. We observe sites including libraries in ad hoc and often transitive ways, which can lead to different versions of the same library being loaded into the same document at the same time. Furthermore, we find that libraries included transitively, or via ad and tracking code, are more likely to be vulnerable. This demonstrates that not only website administrators, but also the dynamic architecture and developers of third-party services are to blame for the Web's poor state of library management.The results of our work underline the need for more thorough approaches to dependency management, code maintenance and third-party code inclusion on the Web.

A formal framework for measuring technical lag in component repositories — and its application to npm

“…It is also useful to compare the extent of technical lag across different software component repositories and different package managers, in order to assess which policies, practices, culture, and tools lead to the best compromise. Inspired by Lauinger et al, we would also like to include other types of external applications to our analysis, like deployed websites.…”

“…They observed that systems using outdated dependencies were four times more likely to have security issues and backward incompatibilities than systems that are up‐to‐date. Lauinger et al studied the client‐side use of JavaScript libraries. They found that “the time lag behind the newest release of a library is measured in the order of years,” and that this is a major source of known vulnerabilities in websites using these libraries.…”

“…According to Tiobe's programming language index (September 2018), JavaScript is the 8th most popular programming language. npm and JavaScript have also been used as case studies by many other researchers in empirical software engineering …”

On the impact of security vulnerabilities in the npm package dependency network

“…Lauinger et al [16] examined the security implications of relying on client-side JavaScript library usage. They examined 133K websites and found that 37% of these websites use at least one library with a known vulnerability.…”

Diffusion of User Tracking Data in the Online Advertising Ecosystem

“…The Inclusion graph corrects the technical problem of the Referer graph by using the actual inclusion relationships between domains to represent edges, rather than imprecise Referer relationships. We are able to construct Inclusion graphs, thanks to advances in browser instrumentation that allow researchers to conduct web crawls that record the exact provenance of all HTTP(S) requests [6,10,41].…”