Sub resource Integrity (SRI) not implemented but all external scripts are loaded securely

Sub-resource integrity is a security feature that allows a developer to ensure that resources hosted on 3rd party services like CDN (Content Delivery Networks) are delivered to the application without any modification. The sub-resource integrity helps to load content faster as different resources like scripts and stylesheets are hosted in CDN. The SRI achieves this goal by comparing the hash value of resources present in the web server and the resources in third-party services. If the CDN gets hacked by an attacker, the SRI protects the application from attacker’s malicious move to attack the application using cross-site scripting. Example

                <script src="https://example.beaglesecurity.com/example-framework.js"
                        integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC"
                        crossorigin="anonymous"></script>

        

The above code tells the browser to check https://example.beaglesecurity.com/example-framework.js with the hash value. Same hash value proves that the values have not been changed.

Impact

An attacker can gain access to Content Delivery Networks and cause huge damage to the application. If the attacker is one of the persons who had developed one of the CDN used by the application. He can gain access to your system by tweaking the content from CDN.

Mitigation / Precaution

Beagle recommends the following fixes:-

• Make sure to implement Subresource Integrity

Written by

Febna V M

Cyber Security Engineer

Febna once spent an entire evening arguing with an AI chatbot just to prove that machines can be confidently wrong. The debate ended with no clear winner, but it did spark her curiosity for the fascinating world of artificial intelligence. Today, she works at the intersection of AI and cybersecurity, helping build smarter systems while making sure they don’t become too smart for their own good. When she’s not exploring the future of technology, she’s probably asking “but what if?” one more time.