Software and Data Integrity Failures
Software and data integrity failures relate to code and infrastructure that does not protect against integrity violations, including insecure deserialization.
Resumen
A new category for 2021, focuses on making assumptions related to software updates, critical data, and CI/CD pipelines without verifying integrity. Also includes Insecure Deserialization from 2017.
Cómo los Atacantes Explotan Esto
Entender los patrones de ataque te ayuda a construir mejores defensas. Estas son las técnicas que los equipos de seguridad vigilan.
Insecure deserialization
Untrusted data is deserialized by the application, potentially leading to remote code execution.
CI/CD pipeline compromise
Attackers inject malicious code through compromised build systems or update mechanisms.
Cómo Prevenir
- Use digital signatures to verify software or data is from expected source
- Ensure libraries and dependencies are from trusted repositories
- Use software supply chain security tools to verify components
- Ensure CI/CD pipeline has proper segregation and access control
- Ensure unsigned or unencrypted serialized data is not sent to untrusted clients
CWEs con Detección Shoulder (2)
Estos CWEs tienen reglas de detección Shoulder. Haz clic para ver vulnerabilidades específicas y correcciones.
Otros CWEs Mapeados (8)
Estos CWEs están mapeados a esta categoría pero aún no tienen reglas Shoulder.