security config_error ai_generated true

Missing SRI integrity attribute on script tag allows CDN tampering

ID: security/missing-sri-integrity-attribute-allows-cdn-tampering

Also available as: JSON · Markdown · 中文
90%Fix Rate
85%Confidence
1Evidence
2023-08-15First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
Subresource Integrity spec (W3C) active — — —
Chrome 45+ active — — —
Firefox 43+ active — — —
Safari 13+ active — — —
Edge 17+ active — — —

Root Cause

Script or link tags loading resources from a CDN lack the 'integrity' attribute, so a compromised CDN can serve malicious code without detection.

generic

中文

从CDN加载资源的脚本或链接标签缺少'integrity'属性，因此受感染的CDN可以在不被检测到的情况下提供恶意代码。

Official Documentation

https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity

Workarounds

  1. 90% success Add the 'integrity' attribute with the correct base64-encoded SHA-384 hash of the resource. Example: <script src='https://cdn.example.com/lib.js' integrity='sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC' crossorigin='anonymous'></script> 
    Add the 'integrity' attribute with the correct base64-encoded SHA-384 hash of the resource. Example: <script src='https://cdn.example.com/lib.js' integrity='sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC' crossorigin='anonymous'></script>
  2. 95% success Self-host the resource instead of loading from a CDN to eliminate reliance on third-party integrity. 
    Self-host the resource instead of loading from a CDN to eliminate reliance on third-party integrity.
  3. 80% success Use a CDN that supports SRI and automatically provides the integrity hash in the response headers. 
    Use a CDN that supports SRI and automatically provides the integrity hash in the response headers.

中文步骤

  1. Add the 'integrity' attribute with the correct base64-encoded SHA-384 hash of the resource. Example: <script src='https://cdn.example.com/lib.js' integrity='sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC' crossorigin='anonymous'></script>
  2. Self-host the resource instead of loading from a CDN to eliminate reliance on third-party integrity.
  3. Use a CDN that supports SRI and automatically provides the integrity hash in the response headers.

Dead Ends

Common approaches that don't work:

  1. 85% fail

    The crossorigin attribute enables CORS but does not provide integrity verification; the resource can still be tampered with.

  2. 90% fail

    Different CDNs serve different content; the hash must match the exact resource. Using a different URL without updating the hash causes a SRI mismatch.

  3. 95% fail

    This removes all protection against CDN tampering, leaving the application vulnerable to supply-chain attacks.