#8
A08:2021
Software and Data Integrity Failures
Software and data integrity failures relate to code and infrastructure that does not protect against integrity violations, including insecure deserialization.
概述
A new category for 2021, focuses on making assumptions related to software updates, critical data, and CI/CD pipelines without verifying integrity. Also includes Insecure Deserialization from 2017.
攻击者如何利用此漏洞
理解攻击模式有助于您构建更好的防御。这些是安全团队监控的技术。
Insecure deserialization
Untrusted data is deserialized by the application, potentially leading to remote code execution.
检测信号:
Serialized object patterns in requests, unexpected class instantiation errors
CI/CD pipeline compromise
Attackers inject malicious code through compromised build systems or update mechanisms.
检测信号:
Unexpected changes in build outputs, modified binaries without corresponding source changes
如何预防
- Use digital signatures to verify software or data is from expected source
- Ensure libraries and dependencies are from trusted repositories
- Use software supply chain security tools to verify components
- Ensure CI/CD pipeline has proper segregation and access control
- Ensure unsigned or unencrypted serialized data is not sent to untrusted clients
有Shoulder检测的CWE (2)
这些CWE有Shoulder检测规则。点击查看具体漏洞和修复方法。
其他映射的CWE (8)
这些CWE映射到此类别，但尚无Shoulder规则。