一句话：首次实证揭示 PyPI 与 Maven 生态中跨语言调用 C 库导致的 CLV 漏洞及受影响项目规模。
该论文关注跨语言调用易受攻击 C 库所引发的 CLV（cross-language vulnerability）问题。Python/Java 项目广泛依赖 C 库，但 PyPI 与 Maven 生态的构建工具无法报告对其他语言（如 C）中易受攻击库的依赖，导致开发者容易忽略此类风险。作者首次对 PyPI 和 Maven 生态系统中 CLV 问题的现状开展实证研究，通过关联项目依赖与 CVE 报告识别的易受攻击 C 项目版本来分析影响范围。结果表明，这两个生态中有 82,951 个项目直接或间接依赖由已知易受攻击的 C 项目版本编译得到的库。该研究提升了对跨生态漏洞影响的认知，并给出了相关分析结果。
Vulnerabilities, referred to as CLV issues, are induced by cross-language invocations of vulnerable libraries. Such issues greatly increase the attack surface of Python/Java projects due to their pervasive use of C libraries. Existing Python/Java build tools in PyPI and Maven ecosystems fail to report the dependency on vulnerable libraries written in other languages such as C. CLV issues are easily missed by developers. In this paper, we conduct the first empirical study on the status quo of CLV issues in PyPI and Maven ecosystems. It is found that 82,951 projects in these ecosystems are directly or indirectly dependent on libraries compiled from the C project versions that are identified to be vulnerable in CVE reports. Our study arouses the awareness of CLV issues in popular ecosystems and presents related analysis results.
DOI 原文 ·
@inproceedings{paperbot7281,
title = {Insight: Exploring Cross-Ecosystem Vulnerability Impacts},
author = {Meiqiu Xu and Ying Wang and Shing-Chi Cheung and Hai Yu and Zhiliang Zhu},
booktitle = {ASE},
year = {2022},
doi = {10.1145/3551349.3556921}
}