#8
A08:2025
Data Integrity Failures
Data integrity failures relate to code and infrastructure that does not protect against integrity violations, including insecure deserialization and unsigned updates.
概述
Renamed from 'Software and Data Integrity Failures' to 'Data Integrity Failures'. Focus on making assumptions related to software updates, critical data, and CI/CD pipelines without verifying integrity.
攻击者如何利用此漏洞
理解攻击模式有助于您构建更好的防御。这些是安全团队监控的技术。
Insecure deserialization
Untrusted data is deserialized by the application, potentially leading to remote code execution.
检测信号:
Serialized object patterns in requests, unexpected class instantiation errors
Unsigned updates
Software updates are accepted without verifying their authenticity, allowing malicious updates.
检测信号:
Update mechanisms that don't verify signatures, unsigned packages accepted
Data tampering
Critical data lacks integrity verification, allowing modification without detection.
检测信号:
Missing checksums, unsigned tokens, modifiable hidden fields
如何预防
- Use digital signatures to verify software or data is from expected source
- Ensure libraries and dependencies are from trusted repositories
- Use software supply chain security tools to verify components
- Ensure CI/CD pipeline has proper segregation and access control
- Ensure unsigned or unencrypted serialized data is not sent to untrusted clients
- Implement integrity checks for critical data
有Shoulder检测的CWE (2)
这些CWE有Shoulder检测规则。点击查看具体漏洞和修复方法。
其他映射的CWE (8)
这些CWE映射到此类别，但尚无Shoulder规则。