SLS-8: Insecure Third-Party Components

Before you start: make sure you are in the project directory.

cd /workspaces/very-vulnerable-serverless

Theory: What are Insecure Third-Party Components?

Our app uses libraries (Flask, Werkzeug…) written by others. If a library version has a known bug (a CVE), our app inherits it. Attackers do not need to find new bugs, they look up public exploits for old versions.

Example: You use library==1.0. A CVE is published for 1.0, fixed in 1.2. Until you upgrade, anyone can attack you with the public exploit.

Objective

Read the pinned versions in requirements.txt and see how outdated dependencies are flagged as vulnerable.

Check the pinned dependency versions:

cat requirements.txt

Output:

flask==3.1.0
werkzeug==3.1.3
markupsafe==3.0.2

GitHub Dependabot has flagged 6 known vulnerabilities on this repository — 4 moderate, 2 low. These are published CVEs with known exploit techniques. Attackers do not need to find new bugs — they use existing exploits against versions you forgot to update.

Fix: Enable Dependabot or Renovate for automated update PRs. Run pip-audit -r requirements.txt in CI to fail builds with known vulnerabilities. Keep dependencies minimal — fewer packages, fewer attack surfaces.