A08 Software and Data Integrity Failures - OWASP Top 10:2021
Learn about software and data integrity failures, protecting against integrity violations, and preventing malicious code. Examples and prevention methods included.
Overview
A new category for 2021 focuses on making assumptions related to software updates, critical data, and CI/CD pipelines without verifying integrity.
Description
Software and data integrity failures relate to code and infrastructure that does not protect against integrity violations. Examples include relying on plugins, libraries, or modules from untrusted sources, insecure CI/CD pipelines, and insecure deserialization.
How to Prevent ?
To prevent software and data integrity failures, the following measures can be taken: 1. Use digital signatures or similar mechanisms to verify the software or data is from the expected source and has not been altered. 2. Ensure libraries and dependencies are consuming trusted repositories. 3. Use a software supply chain security tool to verify components for known vulnerabilities. 4. Review code and configuration changes to minimize the chance of introducing malicious code. 5. Maintain proper segregation, configuration, and access control in your CI/CD pipeline. 6. Use integrity checks or digital signatures for serialized data.
Example Attack Scenarios:
Update without signing: Many home routers, set-top boxes, device firmware, and others do not verify updates via signed firmware. This is a major concern as there may be no easy way to remediate the issue.
SolarWinds malicious update: Nation-states have been known to attack update mechanisms. The SolarWinds Orion attack is a notable example where a highly targeted malicious update was distributed to thousands of organizations.
Insecure Deserialization: An attacker exploits insecure deserialization in a React application and gains remote code execution on the application server.