Summary
Software supply chains are important to keep safe, but current SBOM tools only show parts of the problem. These tools can tell if a component has vulnerabilities but cannot explain how those weaknesses can actually cause harm through the chain of software pieces. The authors created a step-by-step model that looks at how vulnerabilities spread in four stages, highlighting the need for better methods to track real risk. Their tests using a well-known security issue called Log4j found that current tools only cover the first two stages, missing important details for understanding potential attacks. This work points toward new directions for making software supply chains more secure in the future.
Software supply chain (SSC)SBOM (Software Bill of Materials)vulnerability detectionexploitabilitypropagation modelLog4j vulnerabilitycode reachabilitytaint path analysiscyber risksecurity tools
Abstract
Ensuring security of software supply chains (SSC) is indispensable in today's world of modern software practices. SBOM (tools) have been introduced as relevant building blocks to ensure the transparency of SSCs. However they have serious limitations in practices as their vulnerability detection and interpretation capacity is not sufficient to explain exploitability effects that can propagte through the whole chain. To address this gap, we propose a propagation-centred approach to SSC security and introduce a four-stage propagation model. We empirically evaluate four open-source SBOM tools against each stage using three projects and Log4j vulnerability as our test case. Our results show that current SBOM tools systematically support only Stage 1 (Structural Exposure) and Stage 2 (Vulnerability Class Presence) while Stage 3 (Code Reachability) and Stage 4 (Taint Path Analysis) require capabilities absent from the SBOM ecosystem. We argue that putting propagation effects at the centre of SSC security research is essential to prevent cyber risk evolving into systemic risks. Our research findings contribute to a future research and design of modern SSC security tools.