#8
A08:2021
Software and Data Integrity Failures
Software and data integrity failures relate to code and infrastructure that does not protect against integrity violations, including insecure deserialization.
概要
A new category for 2021, focuses on making assumptions related to software updates, critical data, and CI/CD pipelines without verifying integrity. Also includes Insecure Deserialization from 2017.
攻撃者がこれを悪用する方法
攻撃パターンを理解することで、より優れた防御を構築できます。これらはセキュリティチームが監視する技術です。
Insecure deserialization
Untrusted data is deserialized by the application, potentially leading to remote code execution.
検出シグナル:
Serialized object patterns in requests, unexpected class instantiation errors
CI/CD pipeline compromise
Attackers inject malicious code through compromised build systems or update mechanisms.
検出シグナル:
Unexpected changes in build outputs, modified binaries without corresponding source changes
予防方法
- Use digital signatures to verify software or data is from expected source
- Ensure libraries and dependencies are from trusted repositories
- Use software supply chain security tools to verify components
- Ensure CI/CD pipeline has proper segregation and access control
- Ensure unsigned or unencrypted serialized data is not sent to untrusted clients
Shoulder検出付きCWE (2)
これらのCWEにはShoulder検出ルールがあります。クリックして特定の脆弱性と修正を確認してください。
その他のマップされたCWE (8)
これらのCWEはこのカテゴリにマップされていますが、まだShoulderルールがありません。