For many years, security professionals have relied on the CVE system to identify vulnerable OSS libraries. This approach relies on a database of known CVEs. Static scanners analyze codebases and flag CVEs for developers to address. However, the primary limitation of signature-based scanners is that they can only detect vulnerabilities that have already been documented and given a CVE ID. This traditional approach leaves a significant category of threats undetected: CVE-less threats, which surprisingly, are responsible for the majority of exploited vulnerabilities.
In this blog, we will explore the concept of CVE-less threats, examining why they are becoming increasingly prevalent and emerging as one of the most significant risks to cloud environments.
CVE-Less is a Bigger Threat Than You Think
Mandiant: Analysis of Time-to-Exploit Trends 2021-2022 (September 28, 2023)
Over 60% of exploits between 2021-2022 were CVE-Less, meaning they had no disclosed CVE at the time of the exploit.
What are CVE-Less Threats?
Simply put, CVE-less threats refer to vulnerabilities that do not have a CVE-signature. CVE-less threats include:
The Basics You Might Already Know:
Unreported Vulnerabilities: Security flaws that are discovered but never reported to a central authority for inclusion in the CVE database.
Homegrown Libraries with Vulnerabilities: Homegrown libraries might have unique vulnerabilities that will never be covered by a CVE entry.
Zero-Day Vulnerabilities: Software flaws that are unknown to the vendor and have no available patch.
Threats That Might Surprise You:
Reported But Not (yet) Published Vulnerabilities: A CVE has to be discovered, reported to the NVD, assigned a CVE-ID, analyzed, and published before it can be detected by code scanning solutions. This leaves a window of exposure where the application is vulnerable to attacks.
Raven’s analysis of 28,660 CVEs published in 2023, reveals that it takes a CVE 103 days on average from assigned date to publish date.
Flashpoint’s 2024 Global Threat Intelligence Report states “One major blind spot occurs when enterprises strictly rely on the Common Vulnerabilities and Exposure (CVE) database, which is missing over 100,000 vulnerabilities—nearly a third of known vulnerability risk.”
Library Misconfigurations: Issues that arise from improper library configurations in the code. These will never get a formal CVE signature.
Malicious Packages: Software components intentionally designed to harm systems, steal data, or exploit vulnerabilities. They are often disguised as legitimate libraries or dependencies, making them difficult to detect. Attackers upload these malicious packages to popular repositories like npm, PyPI, or Maven, where developers might inadvertently include them in their projects. Once integrated, these packages execute harmful actions such as data exfiltration, installing backdoors, or compromising the application's security. The number of malicious packages has been growing exponentially over the past five years, with 2023 having twice the amount of malicious packages as the four previous years combined and 2024 having almost twice the amount of the five previous years combined.
Sonatype: 10th Annual State of the Software Supply Chain (October, 2024)
Conclusion
To combat sophisticated attackers and ensure the security of modern cloud applications, organizations must implement a security layer capable of detecting CVE-less attacks. Just as antivirus solutions evolved into endpoint detection and response (EDR) systems, there is a growing need for a solution that inspects applications at runtime, focusing on library-level activities to identify anomalies. This approach moves beyond reliance on CVE databases and instead monitors the behavior of libraries directly. This is where Application Detection and Response (ADR) comes into play.
For more information on advanced threat detection and mitigation, explore Raven’s Runtime ADR. Book a demo today.
Until we meet, you might want to check out our blog
Oops! Something went wrong while submitting the form.
Security
7 Reasons Why Attackers Shifted Towards Cloud Applications
Attackers are increasingly shifting their focus from infrastructure to applications, exploiting vulnerabilities that traditional security measures cannot protect.
The Critical Need for Cloud Runtime Application Security
While shift left strategies are essential for building secure applications, they are not sufficient on their own. Cloud runtime application security, or protect right, is crucial especially as attackers are increasingly shifting their focus to applications.
.svg)
.svg)
.svg)
