Kingdom: Environment

This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this kingdom are not directly related to source code, we separated it from the rest of the kingdoms.

Build Misconfiguration: Dynamic Dependency Version Usage

Abstract
Retrieving build dependencies using a dynamic version can leave the build system vulnerable to malicious binaries or cause the system to experience unexpected behavior.
Explanation
The Apache Ivy automated dependency management system allows users to specify a version status, known as a dynamic revision, for a dependency instead of listing the specific. If an attacker is able to compromise the dependency repository or trick the build system into downloading dependencies from a repository under the attacker's control, then a dynamic revision specifier may be all that's needed for the build system to silently download and run the compromised dependency. Beyond the security risks, dynamic revisions also introduce an element of risk on the code quality front: Dynamic revisions place the security and stability of your software under the control of the third-parties who develop and release the dependencies your software uses.

At build time, Ivy connects to the repository and attempts to retrieve a dependency that matches the status listed.

Ivy accepts the following dynamic revision specifiers:

- latest.integration: Selects the latest revision of the dependency module.
- latest.[any status]: Selects the latest revision of the dependency module with at minimum the specified status. For example, latest.milestone will select the latest version that is either a milestone or a release, and latest.release will only select the latest release.
- Any revision that ends in +: Selects the latest sub-revision of the dependency module. For example, if the dependency exists in revisions 1.0.3, 1.0.7 and 1.1.2, a revision specified as 1.0.+ will select revision 1.0.7.
- Version ranges: Mathematical notation for ranges, such as < and >, can be used to match a range of versions.

Example 1: The following configuration entry instructs Ivy to retrieve the latest release version of the clover component:


<dependencies>
        <dependency org="clover" name="clover"
                    rev="latest.release" conf="build->*"/>
	...


If the repository is compromised, an attacker could simply upload a version that meets the dynamic criteria to cause Ivy to download a malicious version of the dependency.
References
[1] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001167, CCI-001499, CCI-001749, CCI-001812
[2] Standards Mapping - NIST Special Publication 800-53 Revision 4 CM-5 Access Restrictions for Change (P1), CM-11 User-Installed Software (P1), SC-18 Mobile Code (P2)
[3] Standards Mapping - NIST Special Publication 800-53 Revision 5 CM-5 Access Restrictions for Change, CM-11 User-Installed Software, CM-14 Signed Components, SC-18 Mobile Code
[4] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration
[5] Standards Mapping - OWASP Mobile 2014 M7 Client Side Injection
[6] Standards Mapping - OWASP Mobile 2024 M8 Security Misconfiguration
[7] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration
[8] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration
[9] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration
[10] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 2.2.6
[11] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 2.2.6
[12] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-001390 CAT II, APSC-DV-001430 CAT II, APSC-DV-001440 CAT II, APSC-DV-003300 CAT II
[13] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-001390 CAT II, APSC-DV-001430 CAT II, APSC-DV-001440 CAT II, APSC-DV-003300 CAT II
[14] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-001390 CAT II, APSC-DV-001430 CAT II, APSC-DV-001440 CAT II, APSC-DV-003300 CAT II
[15] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-001390 CAT II, APSC-DV-001430 CAT II, APSC-DV-001440 CAT II, APSC-DV-003300 CAT II
[16] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-001390 CAT II, APSC-DV-001430 CAT II, APSC-DV-001440 CAT II, APSC-DV-003300 CAT II
[17] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-001390 CAT II, APSC-DV-001430 CAT II, APSC-DV-001440 CAT II, APSC-DV-003300 CAT II
[18] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-001390 CAT II, APSC-DV-001430 CAT II, APSC-DV-001440 CAT II, APSC-DV-003300 CAT II
[19] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-001390 CAT II, APSC-DV-001430 CAT II, APSC-DV-001440 CAT II, APSC-DV-003300 CAT II
[20] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-001390 CAT II, APSC-DV-001430 CAT II, APSC-DV-001440 CAT II, APSC-DV-003300 CAT II
[21] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-001390 CAT II, APSC-DV-001430 CAT II, APSC-DV-001440 CAT II, APSC-DV-003300 CAT II
[22] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-001390 CAT II, APSC-DV-001430 CAT II, APSC-DV-001440 CAT II, APSC-DV-003300 CAT II
[23] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-001390 CAT II, APSC-DV-001430 CAT II, APSC-DV-001440 CAT II, APSC-DV-003300 CAT II
[24] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-001390 CAT II, APSC-DV-001430 CAT II, APSC-DV-001440 CAT II, APSC-DV-003300 CAT II
[25] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-001390 CAT II, APSC-DV-001430 CAT II, APSC-DV-001440 CAT II, APSC-DV-003300 CAT II
[26] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-001390 CAT II, APSC-DV-001430 CAT II, APSC-DV-001440 CAT II, APSC-DV-003300 CAT II
desc.config.java.build_misconfiguration_dynamic_dependency_version