OWASP #8: Software and Data Integrity Failures

📋 What Is It?

Software and Data Integrity Failures occur when code and infrastructure lack protection against integrity violations. This includes unsigned updates, insecure deserialization, and CI/CD pipeline compromises. Supply chain attacks are a major concern.

#8 OWASP Rank

NEW 2021 Addition

10 CWE Mappings

⚠️ Common Exploits

Unsigned Updates: Installing malicious software updates
Supply Chain Attacks: Compromised npm/PyPI packages
Insecure Deserialization: Executing malicious serialized objects
No Integrity Checks: Missing checksums or digital signatures
CI/CD Compromise: Injecting code through build pipelines
Auto-Update Vulnerabilities: Unverified automatic updates

🔴 Attack Flow

1. App auto-updates without verification
↓
2. Attacker compromises update server
↓
3. Malicious update pushed to clients
↓
4. No signature verification performed
↓
5. BREACH: Malware installed everywhere!

❌ Vulnerable Code

// Bad: No integrity check on downloads
@app.route('/upload', methods=['POST'])
def upload_file():
    file = request.files['file']
    # No checksum validation!
    file.save(filename)
    return "File uploaded"

// Bad: Insecure deserialization with pickle
import pickle

def load_user_data(data):
    # Pickle can execute arbitrary code!
    user_data = pickle.loads(data)
    return user_data

// Bad: No signature on software updates
def auto_update():
    update_url = "http://updates.example.com/latest"
    update_file = requests.get(update_url).content
    # No verification - could be malicious!
    execute_update(update_file)
                

✅ Secure Code

// Good: Verify file integrity with checksum
import hashlib

@app.route('/upload', methods=['POST'])
def upload_file():
    file = request.files['file']
    expected_hash = request.form.get('checksum')
    
    # Calculate SHA-256 hash
    file_hash = hashlib.sha256(file.read()).hexdigest()
    
    if file_hash != expected_hash:
        return "Integrity check failed", 400
    
    file.save(filename)
    return "File uploaded and verified"

// Good: Use safe JSON instead of pickle
import json

def load_user_data(data):
    # JSON is safe - no code execution
    user_data = json.loads(data)
    return user_data

// Good: Verify digital signature on updates
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import padding

def auto_update():
    update_url = "https://updates.example.com/latest"
    update_file = requests.get(update_url).content
    signature = requests.get(update_url + ".sig").content
    
    # Verify signature with public key
    try:
        public_key.verify(
            signature, update_file,
            padding.PSS(mgf=padding.MGF1(hashes.SHA256())),
            hashes.SHA256()
        )
        execute_update(update_file)
    except:
        raise ValueError("Invalid signature!")
                

✓ Prevention Checklist

Use digital signatures for software updates
Verify checksums/hashes for all downloads
Use secure serialization (JSON, not pickle)
Implement code signing for releases
Use SCA tools to verify dependencies
Secure CI/CD pipelines with authentication
Verify package integrity (lock files)
Use Subresource Integrity (SRI) for CDN
Monitor for unexpected code changes
Implement supply chain security scanning

🔍 Detection & Tools

Supply Chain Tools:

Sigstore in-toto SLSA Framework Cosign

Deserialization Tools:

Bandit ysoserial Semgrep CodeQL

How to Test:

Check if updates use digital signatures
Test file uploads without checksums
Look for pickle/YAML deserialization
Verify CI/CD pipeline security

🌍 Real-World Breaches

SolarWinds (2020): Supply chain attack via compromised build system affecting 18,000+ orgs
event-stream (2018): Malicious npm package injected Bitcoin-stealing code
CCleaner (2017): Legitimate software update compromised, affecting 2.3M users
NotPetya (2017): Supply chain attack through compromised Ukrainian accounting software

📌 Quick Tips

DO NOT use pickle for untrusted data
DO NOT skip signature verification
DO verify all software updates
DO use checksums for file integrity
DO secure CI/CD pipelines

📜 Compliance

Related Standards:

NIST 800-53 SA-12, SI-7
ISO 27001 A.14.2.9
CWE CWE-502, CWE-494
SLSA Level 3+ Recommended

✅ Software & Data Integrity Failures