Software or Data Integrity Failures happen when code, updates, or critical data are trusted without verifying their source or integrity — malicious packages, tampered CI/CD pipelines, and unsigned auto-updaters slip straight through. Try the interactive playground below to watch an unsigned auto-update get accepted blindly, then see signature verification stop it.
OWASP Top 10 · 2025 · A08 — Software or Data Integrity Failures
The Silent Auto-Update: When “Trusted” Code Isn’t
Software and data integrity failures happen when an application trusts something — an update package, a CI/CD build artifact, or serialized data — without actually verifying it hasn’t been tampered with. Attackers exploit this trust by slipping malicious code into an unsigned auto-updater, a compromised build pipeline, or an insecurely deserialized object, and the victim application happily installs or executes it. Below, watch the same update get handled two ways: once with no integrity check, and once with proper signature verification.
SYSTEM COMPROMISEDbackdoor.exe installed. Reverse shell established to 185.212.44.7:4444. The update was executed with no integrity check, so the attacker’s tampered package ran with full trust.
✓
UPDATE REJECTEDSignature verification failed — possible tampering. The package’s signature did not match AgentSync Inc.’s known public key, so installation was blocked before any code executed.
2Vulnerable vs. Secure Update Flow
✗ Vulnerable — No Integrity Check
// Auto-updater trusts the package blindlyasync function applyUpdate(pkgUrl) {
const pkg = await download(pkgUrl);
fs.writeFileSync('update.pkg', pkg);
// No signature check.
// No checksum comparison.
// Executed immediately.
exec('./update.pkg --install');
}
✓ Secure — Verify Before Execute
// Auto-updater verifies before trustingasync function applyUpdate(pkgUrl) {
const pkg = await download(pkgUrl);
const sig = await download(pkgUrl + '.sig');
const pubKey = loadTrustedKey('agentsync.pub');
const valid = crypto.verify(pkg, sig, pubKey);
if (!valid) {
log.error('Signature mismatch — abort');
return abortInstall();
}
exec('./update.pkg --install'); // only if valid
}
3Why This Matters
Auto-updaters and CI/CD pipelines are high-value targets precisely because they’re a shortcut to scale: compromise the build or update mechanism once, and every downstream user or system that trusts it can be silently compromised at the same time — no phishing, no individual exploitation needed.
4How to Detect & Fix
✓Digitally sign all releases and updates, and verify signatures against a pinned, trusted public key before any code executes.
✓Only pull dependencies and packages from trusted, pinned sources — avoid unauthenticated mirrors or floating version tags.
✓Avoid deserializing untrusted or unauthenticated data; use safe, schema-validated formats instead of native object deserialization.
✓Lock down and audit CI/CD pipeline credentials, build servers, and plugin/dependency access with least privilege and monitoring.
✓Generate and verify a Software Bill of Materials (SBOM) so tampered or unexpected components in the supply chain are detectable.