Software and Data Integrity Failures
Description
Software and data integrity failures relate to code and infrastructure that does not protect against integrity violations. An example of this is where an application relies upon plugins, libraries, or modules from untrusted sources, repositories, and content delivery networks (CDNs). An insecure CI/CD pipeline can introduce the potential for unauthorized access, malicious code, or system compromise. Lastly, many applications now include auto-update functionality, where updates are downloaded without sufficient integrity verification and applied to the previously trusted application. Attackers could potentially upload their own updates to be distributed and run on all installations. Another example is where objects or data are encoded or serialized into a structure that an attacker can see and modify is vulnerable to insecure deserialization.
How to Prevent
- Use digital signatures or similar mechanisms to verify the software or data is from the expected source and has not been altered.
- Ensure libraries and dependencies, such as npm or Maven, are consuming trusted repositories. If you have a higher risk profile, consider hosting an internal known-good repository that's vetted.
- Ensure that a software supply chain security tool, such as OWASP Dependency Check or OWASP CycloneDX, is used to verify that components do not contain known vulnerabilities
- Ensure that there is a review process for code and configuration changes to minimize the chance that malicious code or configuration could be introduced into your software pipeline.
- Ensure that your CI/CD pipeline has proper segregation, configuration, and access control to ensure the integrity of the code flowing through the build and deploy processes.
- Ensure that unsigned or unencrypted serialized data is not sent to untrusted clients without some form of integrity check or digital signature to detect tampering or replay of the serialized data
Source: OWASP TOP 10 Software and Data Integrity Failures
Cheatsheets
Software and Data Integrity Failures Cheatcheats
Cards
Data-validation-&-encoding
- Data-validation-&-encoding 2
- Data-validation-&-encoding 3
- Data-validation-&-encoding 5
- Data-validation-&-encoding 6
- Data-validation-&-encoding 7
- Data-validation-&-encoding 8
- Data-validation-&-encoding 9
- Data-validation-&-encoding 10
- Data-validation-&-encoding J
- Data-validation-&-encoding Q
- Data-validation-&-encoding K
Authentication
- Authentication 2
- Authentication 3
- Authentication 4
- Authentication 5
- Authentication 6
- Authentication 7
- Authentication 9
- Authentication 10
- Authentication J
- Authentication Q
- Authentication K
Session-management
- Session-management 2
- Session-management 4
- Session-management 5
- Session-management 6
- Session-management 7
- Session-management 8
- Session-management 9
- Session-management 10
- Session-management J
- Session-management Q
- Session-management K
