search

ossf / s2c2f

The S2C2F Project is a group working within the OpenSSF's Supply Chain Integrity Working Group formed to further develop and continuously improve the S2C2F guide which outlines and defines how to securely consume Open Source Software (OSS) dependencies into the developer’s workflow.
Other
167 stars 23 forks source link

The phpMyAdmin example seems misclassified. #16

Closed stevep-arm closed 12 months ago

stevep-arm commented 1 year ago

In the section 'Common OSS Supply Chain Threats' there is a table of threats with examples given.

phpMyAdmin is given as an example of 'Intentional vulnerabilities/backdoors added to an OSS code base'. Following the link for the example to the ars technica article about the incident it seems that it was a single mirror of a download package that was impacted and not the code base itself.

SCA-5 "Identify zero-day vulnerabilities and confidentially contribute fixes back to the upstream maintainer" wouldn't mitigate the threat of a distribution mirror being compromised.

david-a-wheeler commented 1 year ago

Yes, the problem in this case was that a single mirror (the Korean mirror of Sourceforge) was briefly supplying a subverted file.

SCA-5 does mitigate the attack for others, but not really for the downloader. The strongest countermeasure in this case is signing & checking the signature of packages.

Do we need to modify the specification?

jasminewang0 commented 1 year ago

This sounds like phpMyAdmin should be attributed to AUD-3: Validate digital signature or hash match for each component. I will adjust this accordingly. I am having trouble locating an incident example of "Intentional vulnerabilities/backdoors added to an OSS code base" - if anyone has any suggestions?

adriandiglio commented 1 year ago

@jasminewang0 let's use colors v1.4.1 as an example here, as they intentionally added an infinite loop to their code, which would cause apps to crash https://snyk.io/blog/open-source-npm-packages-colors-faker/