Insufficient data authenticity validation - JAR signing
Description
The JAR files that compose the application are not correctly signed, allowing an attacker to modify the code withouth raising alerts on an integrity check.
Impact
Inject malicious code in the application without raising alerts.
Recommendation
Sign the application JAR files using a trusted key.
Threat
Anonymous attacker from Internet with access to the JAR Files.
Expected Remediation Time
⏱️ 90 minutes.
Requirements
122 - Validate credential ownership173 - Discard unsafe inputs178 - Use digital signatures320 - Avoid client-side control enforcementFixes