#8
A08:2021
Software and Data Integrity Failures
Software and data integrity failures relate to code and infrastructure that does not protect against integrity violations, including insecure deserialization.
개요
A new category for 2021, focuses on making assumptions related to software updates, critical data, and CI/CD pipelines without verifying integrity. Also includes Insecure Deserialization from 2017.
공격자가 이것을 악용하는 방법
공격 패턴을 이해하면 더 나은 방어를 구축하는 데 도움이 됩니다. 이것들은 보안 팀이 주시하는 기술입니다.
Insecure deserialization
Untrusted data is deserialized by the application, potentially leading to remote code execution.
탐지 신호:
Serialized object patterns in requests, unexpected class instantiation errors
CI/CD pipeline compromise
Attackers inject malicious code through compromised build systems or update mechanisms.
탐지 신호:
Unexpected changes in build outputs, modified binaries without corresponding source changes
예방 방법
- Use digital signatures to verify software or data is from expected source
- Ensure libraries and dependencies are from trusted repositories
- Use software supply chain security tools to verify components
- Ensure CI/CD pipeline has proper segregation and access control
- Ensure unsigned or unencrypted serialized data is not sent to untrusted clients
Shoulder 탐지가 있는 CWE (2)
이 CWE들은 Shoulder 탐지 규칙이 있습니다. 클릭하여 특정 취약점과 수정 사항을 확인하세요.
기타 매핑된 CWE (8)
이 CWE들은 이 카테고리에 매핑되어 있지만 아직 Shoulder 규칙이 없습니다.