# Use of Unmaintained Third Party Components (CWE-1104) The product relies on third-party components that are no longer being maintained by the original developer or by the open source community. - Prevalence: Mittel 2 Sprachen abgedeckt - Impact: Mittel Review empfohlen - Prevention: Dokumentiert 5 Fix-Beispiele **OWASP:** Security Misconfiguration (A05:2021-Security Misconfiguration) - #5 ## Description Without ongoing maintenance, newly discovered vulnerabilities in these components will not be patched. This creates an increasing risk as time passes and vulnerabilities are discovered. ## Prevention Präventionsstrategien für Use of Unmaintained Third Party basierend auf 5 Shoulder-Erkennungsregeln. ### Docker Pin base images to specific version tags or SHA digests for reproducible builds Use npm ci instead of npm install for deterministic, reproducible Docker builds Update FROM to a supported Node.js LTS version (24-alpine or 22-alpine) ### JavaScript Update .nvmrc to a supported Node.js LTS version (22 or 20) Align Node.js versions across .nvmrc, Dockerfile, and package.json to the same LTS version ## Warning Signs - [MEDIUM] Dockerfile uses ...: ... - [MEDIUM] base images using "latest" tag or missing version tags - [MEDIUM] Dockerfile uses ... which is end-of-life or outdated. IMPORTANT: Update to node:24-alpine (Active LTS) or node:22-alpine - [MEDIUM] Dockerfiles using outdated or end-of-life Node - [MEDIUM] .nvmrc specifies ... - [MEDIUM] Node.js versions are inconsistent across configuration files. Check the docker-image-outdated finding for the latest rec - [MEDIUM] inconsistent Node - [LOW] Dockerfile uses 'npm install' - consider 'npm ci' for reproducible builds. ## Consequences - Nicht autorisierten Code ausführen - Anwendungsdaten lesen - DoS ## Mitigations - Dritt-Abhängigkeiten regelmäßig prüfen und aktualisieren - Einen Prozess zur Überwachung von Komponentenschwachstellen etablieren - Einen Plan zum Ersatz nicht gepflegter Komponenten haben ## Detection - Total rules: 5 - Languages: dockerfile, javascript ## Rules by Language ### Dockerfile (4 rules) - **Docker Base Image Security** [MEDIUM]: Detects base images using "latest" tag or missing version tags. - Remediation: Use specific version tags for base images. ```dockerfile FROM node:24-alpine ``` Learn more: https://shoulder.dev/learn/docker/cwe-1104/base-image-security - **Use npm ci for Reproducible Builds** [LOW]: Detects Dockerfiles using `npm install` instead of `npm ci` for production builds. - Remediation: Use `npm ci` instead of `npm install` for reproducible builds. ```dockerfile RUN npm ci ``` Learn more: https://shoulder.dev/learn/docker/cwe-1104/npm-ci - **Dockerfile Uses Outdated Node.js Version** [MEDIUM]: Detects Dockerfiles using outdated or end-of-life Node.js versions. - Remediation: Update to a supported Node.js LTS version. ```dockerfile FROM node:24-alpine ``` Learn more: https://shoulder.dev/learn/docker/cwe-1104/outdated-node-version - **Node.js Version Mismatch Between Configuration Files** [MEDIUM]: Detects inconsistent Node.js versions across project configuration files. When .nvmrc specifies one Node.js version but Dockerfile uses a different version, it causes environment drift: - "Works on my machine" bugs (code works locally but fails in production) - Security inconsistencies (development may use patched version while production uses vulnerable version) - Dependency incompatibilities (npm packages may behave differently) - Debugging difficulties (hard to reproduce production issues - Remediation: Align ALL configuration files to use the SAME Node.js version. IMPORTANT: Check the docker-image-outdated finding for the LATEST version. The API provides real-time version recommendations. After determining the latest version from docker-image-outdated, update: - Dockerfile: FROM node:-alpine - .nvmrc: - package.json engines.node: ">=.0.0" NEVER downgrade. Always use the NEWER version shown in docker-image-outdated. ### Javascript (2 rules) - **.nvmrc Specifies Outdated Node.js Version** [MEDIUM]: Detects .nvmrc files specifying outdated or end-of-life (EOL) Node.js versions. The .nvmrc file is used by Node Version Manager (nvm) to automatically switch to the correct Node.js version for a project. When this file specifies an outdated version, developers may be running insecure or incompatible Node.js versions in their development environments. Node.js version lifecycle (as of 2025): - Node 14.x: EOL April 2023 - Node 16.x: EOL September 2023 - Node 18.x: EOL April 2025 - Node 20.x: Main - Remediation: Update .nvmrc to a supported Node.js LTS version (20.x or 22.x). - **Node.js Version Mismatch Between Configuration Files** [MEDIUM]: Detects inconsistent Node.js versions across project configuration files. When .nvmrc specifies one Node.js version but Dockerfile uses a different version, it causes environment drift: - "Works on my machine" bugs (code works locally but fails in production) - Security inconsistencies (development may use patched version while production uses vulnerable version) - Dependency incompatibilities (npm packages may behave differently) - Debugging difficulties (hard to reproduce production issues - Remediation: Align ALL configuration files to use the SAME Node.js version. IMPORTANT: Check the docker-image-outdated finding for the LATEST version. The API provides real-time version recommendations. After determining the latest version from docker-image-outdated, update: - Dockerfile: FROM node:-alpine - .nvmrc: - package.json engines.node: ">=.0.0" NEVER downgrade. Always use the NEWER version shown in docker-image-outdated.