Falhas do tipo CWE-506

101 resultados

Código malicioso embutido

É quando código malicioso é intencionalmente inserido dentro de um componente legítimo de software, muitas vezes durante o desenvolvimento, build ou distribuição. O risco é que a aplicação executa lógica destrutiva ou de exfiltração de dados sem que o usuário final (ou até o proprietário) tenha consciência.

Exemplo

Um desenvolvedor comprometido adiciona uma função que envia credenciais de usuários para um servidor externo sempre que um formulário de login é submetido. O código fica dorminhoco na base de código e passa por code review se o revisor não estiver atento ou também estiver comprometido.

Como mitigar

Implemente verificação de integridade de código (assinatura digital de builds), auditoria rigorosa de mudanças via git history e acesso restrito ao repositório, testes de segurança automatizados que detectem chamadas suspeitas para servidores externos, e isolamento de ambientes de desenvolvimento e produção.

CVE-2017-16059—mssql-node was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.EPSS 1.1%CVE-2017-16058—gruntcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.EPSS 1.1%CVE-2017-16203—The coffe-script module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installaEPSS 1.1%CVE-2017-16067—node-opencv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.EPSS 1.1%CVE-2017-16050—`sqlite.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.EPSS 1.1%CVE-2017-16055—`sqlserver` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.EPSS 1.1%CVE-2017-16071—nodemailer-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.EPSS 1.1%CVE-2017-16066—opencv.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.EPSS 1.1%CVE-2017-16056—mssql.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.EPSS 1.1%CVE-2017-16045—`jquery.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.EPSS 1.1%CVE-2017-16078—shadowsock was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.EPSS 1.1%CVE-2017-16057—nodemssql was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.EPSS 1.1%CVE-2017-16205—The coffescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installatEPSS 1.1%CVE-2017-16061—tkinter was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.EPSS 1.1%CVE-2017-16062—node-tkinter was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.EPSS 1.1%CVE-2023-2003CRITICALEmbedded malicious code vulnerability in Unitronics Vision1210EPSS 0.9%CVE-2025-32965CRITICALCompromised xrpl.js versions 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.2EPSS 0.9%CVE-2026-46412CRITICALMalicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud wormEPSS 0.8%CVE-2017-16207—discordi.js is a malicious module based on the discord.js library that exfiltrates login tokens to pastebin.EPSS 0.7%CVE-2017-20203CRITICALNetSarang v5.0 Malicious Backdoor Supply Chain CompromiseEPSS 0.7%