T03 · Remote Payload Retrieval and Execution
Warning
- Location
- references/interactive-api-components.md:1205
- Finding
- Mutable Remote JavaScript Is Executed Without Version Pinning or Integrity Verification## Vulnerability Details **File Location**: `references/interactive-api-components.md:1205-1211` **Vulnerability Type**: Mutable remote payload retrieval through an unpinned CDN dependency **Risk Level**: Medium ### Vulnerable Code ```html <!-- Load through a CDN --> <script src="https://unpkg.com/browser-canvas-poetry/components.min.js"></script> <script> const { ParticleSystem, AnimationTween } = BCP; </script> ``` ### Technical Analysis The documentation instructs users to execute JavaScript from an unversioned `unpkg.com` URL. Because the URL does not identify an immutable package version, the response can change after this project has been reviewed. The script tag also lacks a Subresource Integrity hash, so the browser cannot verify that the downloaded content matches an audited artifact. The external package implementation is not included in the audited project. Consequently, following this example transfers execution trust to the package publisher, package registry, and CDN. This creates a remote payload substitution channel even though no malicious remote payload was observed during the static audit. ### Attack Path 1. A user follows the documented CDN integration example. 2. The generated application loads the unversioned URL from `unpkg.com`. 3. The package publisher account, package release, registry, or CDN is compromised, or the package name resolves to unintended content. 4. The remote response supplies modified JavaScript. 5. The browser executes that JavaScript in the application's origin context. 6. The substituted script can access application DOM state, non-`HttpOnly` origin data, and APIs available to scripts on that page, and can send data over the network subject to browser security controls. ### Impact Assessment Successful exploitation provides arbitrary JavaScript execution in every browser context that loads the affected page. The effective scope is ...[truncated 386 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the dependency to an explicitly reviewed, immutable version, for example: ```html <script src="https://unpkg.com/browser-canvas-poetry@X.Y.Z/components.min.js" integrity="sha384-REPLACE_WITH_VERIFIED_HASH" crossorigin="anonymous"></script> ``` 2. Generate and independently verify the Subresource Integrity hash against the reviewed release artifact. 3. Prefer self-hosting the audited JavaScript artifact under the application's deployment controls. 4. Document the package's verified publisher, repository, release commit, and expected checksums. 5. Apply an appropriate Content Security Policy that restricts script sources and disallows unsafe inline execution where feasible. 6. Use automated dependency monitoring and re-review artifacts before changing the pinned version.