T03 · Remote Payload Retrieval and Execution
Warning
- Location
- assets/globe.html:186
- Finding
- Unpinned Third-Party JavaScript Allows Remote Payload Execution<![CDATA[ ## Vulnerability Details **File Location**: `assets/globe.html`, line 186 **Vulnerability Type**: Mutable remote JavaScript dependency without version pinning or integrity verification **Risk Level**: Medium ### Vulnerable Code ```html <script src="https://unpkg.com/globe.gl"></script> <script> fetch('https://unpkg.com/world-atlas@2/countries-110m.json') .then(r=>r.json()).then(topo=>initGlobe(topo)).catch(()=>initGlobe(null)); ``` ### Technical Analysis The page loads and executes `globe.gl` directly from an unversioned unpkg URL. The URL does not identify an immutable package version, and the script element does not provide a Subresource Integrity (`integrity`) hash. Consequently, the code that executes when the dashboard is opened can change after the project has been reviewed or deployed. The browser grants the downloaded script the same JavaScript execution context as the dashboard itself. HTTPS protects the response while it is in transit, but it does not protect against a compromised package release, package ownership transfer, CDN compromise, or unexpected changes to the resource resolved by the mutable URL. The adjacent `world-atlas` request is not directly executable because its response is parsed as JSON. Nevertheless, it is also an external runtime dependency, is only pinned to major version `2`, and creates an availability and privacy dependency on unpkg. ### Attack Path 1. An attacker compromises the `globe.gl` package, its publishing credentials, the package namespace, or the serving CDN. 2. The attacker causes the mutable `https://unpkg.com/globe.gl` URL to return modified JavaScript. 3. A user opens `index.html`, which redirects the browser to `assets/globe.html`. 4. The browser retrieves the remote script on line 186. 5. Because no integrity hash is present, the browser accepts and executes the modified response. 6. The payload runs in the dashboard's origin context and can manipulate the interface, read data available to t ...[truncated 1038 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Vendor the dependency locally** - Download a reviewed release of `globe.gl`. - Store it within the project, such as `assets/vendor/globe.gl.min.js`. - Reference that local immutable file rather than retrieving executable code at runtime. 2. **Pin an exact version if CDN hosting remains necessary** - Replace the mutable package URL with a URL containing an exact, reviewed version. - Avoid floating tags, major-version-only references, and unversioned package paths. 3. **Enable Subresource Integrity** - Generate and specify an approved cryptographic hash using the `integrity` attribute. - Add `crossorigin="anonymous"` so integrity verification works correctly with the CDN. - Update the hash only after reviewing and approving a dependency upgrade. 4. **Host the map data locally** - Vendor `countries-110m.json` or pin it to an exact package version. - This reduces external request disclosure and prevents upstream availability or compatibility changes from affecting the dashboard. 5. **Apply a restrictive Content Security Policy** - Prefer a policy that permits scripts only from the dashboard's own origin. - Remove inline JavaScript or authorize it with a reviewed nonce or hash. - Restrict `connect-src` to explicitly required data endpoints. 6. **Establish dependency controls** - Record dependency versions and checksums. - Review release changes before upgrades. - Periodically scan vendored or pinned dependencies for known vulnerabilities. ]]>