1. Executive Summary & Scope
Modern web applications frequently source JavaScript libraries, analytics snippets, and fonts from external Content Delivery Networks (CDNs). If a third-party CDN is compromised, attackers can replace legitimate scripts with credential-stealing Magecart or cryptojacking payloads.
Standard Classification
OWASP Standard: OWASP Top 10 • Mapping: CWE-353 • Target Architecture: Public Web Systems & APIs
2. Threat Model & Attack Vectors
A compromised CDN serves modified JavaScript containing keyloggers that harvest passwords, credit card numbers, and PII directly from browser input fields before form submission.
3. Code Analysis & Remediation Playbook
Vulnerable Implementation Pattern
Hardened Defense-in-Depth Implementation
4. Audit Verification Checklist & Pass Criteria
| Verification Phase | Audit Test Description | Mandatory Passing Criteria |
|---|---|---|
| SRI Hash Validation | Modify single byte in local copy of external script to simulate CDN compromise. | Browser terminates script execution with strict SRI integrity mismatch error. |
| Crossorigin Attribute Audit | Verify that all script tags loading external origins include `crossorigin="anonymous"`. | Required for browsers to enforce SRI across cross-origin boundaries. |
| CSP require-sri-for Enforcement | Inspect Content-Security-Policy headers for `require-sri-for script style`. | Browser blocks any external resource lacking an explicit cryptographic hash. |
Advertisement
WE
WebOTG Application Security Directorate
Senior Security Auditor
WebOTG provides benchmark reference documentation, automated matrix evaluators, and security test harnesses for government digital platforms, WQMS architectures, and STQC compliance frameworks.