T08 · Insecure Dependencies
Warning
- Location
- backend/requirements.txt:1
- Finding
- Unbounded Third-Party Dependency Versions## Vulnerability Details **File Location**: `backend/requirements.txt:1-2` **Vulnerability Type**: Unbounded dependency constraints **Risk Level**: Medium ```text fastapi>=0.100.0 uvicorn>=0.20.0 ``` ### Technical Analysis Both dependencies use minimum-version constraints without upper bounds, exact pins, or package hashes. Consequently, package resolution can install any future FastAPI or Uvicorn release rather than a specifically reviewed artifact. This makes builds non-reproducible and unnecessarily expands the software supply-chain trust boundary. This finding does not establish that the currently available versions are malicious. The risk is that a future compromised, malicious, or incompatible release would satisfy these constraints and could automatically enter a fresh deployment or dependency upgrade. ### Attack Path 1. An attacker compromises an upstream package maintainer account, distribution process, or otherwise causes a malicious future FastAPI or Uvicorn release to be published. 2. The malicious release retains a version number satisfying the relevant `>=` constraint. 3. A developer, CI job, container build, or production deployment installs dependencies from `backend/requirements.txt`. 4. The resolver selects the malicious release because no exact version, lock file, or expected package hash restricts it. 5. Malicious package behavior executes during installation, import, or application startup under the privileges of the build or backend process. ### Impact Assessment Successful exploitation could execute arbitrary code with the privileges of the account performing installation or running the backend. Depending on the deployment environment, this could expose application data and environment variables, alter service behavior, access files available to the service account, or enable lateral movement using credentials accessible to that account. The scope is bounded by the privileges and netw ...[truncated 150 chars]
- Remediation
- ## Remediation Suggestions 1. Replace minimum-only constraints with exact versions that have been reviewed and tested, for example: ```text fastapi==<reviewed-version> uvicorn==<reviewed-version> ``` 2. Generate a complete lock file that pins all transitive dependencies, not only the two direct dependencies. 3. Record and enforce package hashes, such as through a hash-locked requirements file and `pip install --require-hashes`. 4. Build only from trusted package indexes over authenticated TLS, and explicitly configure approved indexes in CI rather than relying on ambient configuration. 5. Run dependency vulnerability and provenance checks in CI. 6. Update dependencies through a controlled process that includes review, automated tests, and staged deployment. 7. Install and run the application as an unprivileged service account in an isolated environment to reduce the impact of a supply-chain compromise.