Check Component Vulnerabilities Using OWASP Dependency-Check

Refactor Java code safely — and automatically — with OpenRewrite.

Refactoring big codebases by hand is slow, risky, and easy to put off. That’s where OpenRewrite comes in. The open-source framework for large-scale, automated code transformations helps teams modernize safely and consistently.

Each month, the creators and maintainers of OpenRewrite at Moderne run live, hands-on training sessions — one for newcomers and one for experienced users. You’ll see how recipes work, how to apply them across projects, and how to modernize code with confidence.

Join the next session, bring your questions, and learn how to automate the kind of work that usually eats your sprint time.

Distributed systems often come with complex challenges such as service-to-service communication, state management, asynchronous messaging, security, and more.

Dapr (Distributed Application Runtime) provides a set of APIs and building blocks to address these challenges, abstracting away infrastructure so we can focus on business logic.

In this tutorial, we'll focus on Dapr's pub/sub API for message brokering. Using its Spring Boot integration, we'll simplify the creation of a loosely coupled, portable, and easily testable pub/sub messaging system:

>> Flexible Pub/Sub Messaging With Spring Boot and Dapr

1. Overview

During application development, we typically need to add some third-party libraries or frameworks to our projects. These third-party libraries ease our development effort. However, they may bring possible security risks due to their vulnerabilities.

In this tutorial, we’ll introduce a plugin that can help us identify known vulnerabilities in our application.

2. Dependency-Check

The plugin that we’ll adopt is OWASP Dependency-Check. This plugin is a software component analysis tool that identifies application dependencies that have known vulnerabilities by correlating them with Common Platform Enumeration (CPE) identifiers and Common Vulnerability and Exposure (CVE) entries.

CPE is a structural naming scheme for software or packages, while CVE provides a reference for known vulnerabilities and exposures publicly.

The plugin automatically updates these entries via National Vulnerability Database (NVD) data feeds provided by NIST. In addition to the Maven plugin, it also provides other integration plugins, such as Gradle.

3. Maven Setup

In this tutorial, let’s look into the Maven integration with our application. First, we need to include the Dependency-Check plugin within the plugins section in our pom.xml file:

<plugin>
    <groupId>org.owasp</groupId>
    <artifactId>dependency-check-maven</artifactId>
    <version>11.1.1</version>
    <configuration>
        <failBuildOnCVSS>7</failBuildOnCVSS>
    </configuration>
    <executions>
        <execution>
            <goals>
                <goal>check</goal>
            </goals>
        </execution>
    </executions>
</plugin>

Once we’ve included this plugin, we call it by invoking the verify phase, as it’s already integrated into it by default:

$ mvn verify

Or, we can invoke it directly via:

$ mvn dependency-check:check

If there’s any vulnerability in our application, we’ll see a message from Maven indicating which packages contain vulnerabilities from the console. Let’s see an example:

[WARNING] 

One or more dependencies were identified with known vulnerabilities in dependency-check:

logback-core-1.5.6.jar (pkg:maven/ch.qos.logback/[email protected], cpe:2.3:a:qos:logback:1.5.6:*:*:*:*:*:*:*) : CVE-2024-12798, CVE-2024-12801

In addition, the plugin creates an HTML report that contains the details of the vulnerabilities it found. The file name is dependency-check-report.html and can be found under the build folder:

4. CVSS Score

Let’s jump into the report and dive into the details of a component vulnerability. We can see that each vulnerability is associated with a Common Vulnerability Scoring System (CVSS) score:

CVSS is a standard for measuring the severity of vulnerabilities. The score ranges from 0 to 10, where a higher score indicates a more severe vulnerability.

The Maven plugin has an option called failBuildOnCVSS, which can be configured to fail a build if any components’ CVSS score exceeds the threshold. In our example, we use 7 so that it doesn’t fail the current set of dependencies. A score equal to or greater than 7 is generally considered high severity.

The highest CVSS score that we saw in the previous report is 5.9. Now, let’s update the failBuildOnCVSS option to 5.0 and execute the plugin again. Maven will fail the build this time:

[ERROR] Failed to execute goal org.owasp:dependency-check-maven:11.1.1:check (default-cli) on project dependency-check:
[ERROR]
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '5.0': 
[ERROR]
[ERROR] logback-core-1.5.6.jar: CVE-2024-12798(5.900000095367432)
[ERROR]
[ERROR] See the dependency-check report for more details.

This could be important to us in order to fail the build when that CVSS score exceeds a given threshold. In such a way, we’ll never deploy applications with dependencies that contain vulnerabilities having high severity.

5. Conclusion

Incorporating third-party libraries can speed up application development but could introduce vulnerabilities. The OWASP Dependency-Check plugin can help identify the vulnerable dependencies based on CPE and CVE data.

We can integrate it into Maven to find out the components that are vulnerable automatically and even fail the build if there is any dependency with critical CVSS scores.

The code backing this article is available on GitHub. Once you're logged in as a Baeldung Pro Member, start learning and coding on the project.