Social Security Administration dce-web: Multiple Vulnerabilities (CVE-2026-104371, CVE-2026-104372, CVE-2026-104373)

The Social Security Administration (SSA) 'dce-web' application was found to contain three security vulnerabilities discovered via internal audit. While the repository was decommissioned on September 18, 2026, the findings highlight risks associated with legacy build processes and configuration.

• CVE-2026-104371: Bootstrap CSS files were loaded from a CDN without subresource integrity (SRI), enabling potential CSS injection, UI redressing, or phishing within the dashboard.
• CVE-2026-104372: The project lacked a lockfile and used outdated build dependencies (2016-2017), rendering automated software composition analysis (SCA) ineffective and exposing developer environments to known vulnerabilities like WebSocket origin check bypasses and ReDoS.
• CVE-2026-104373: Build scripts (gulpfile.js) contained hardcoded internal SSA SMB/UNC network paths, facilitating internal network reconnaissance.

Recommendation

• Verify that the 'dce-web' repository and any associated build environments have been fully decommissioned as per the reported remediation date of September 18, 2026.
• Conduct a review of legacy repositories to identify and remediate hardcoded internal network paths, especially within build configurations or deployment scripts.
• Implement mandatory Subresource Integrity (SRI) for all third-party resources loaded in web applications to prevent content tampering.
• Enforce the use of lockfiles (e.g., package-lock.json, yarn.lock) in all development projects to ensure reproducible builds and allow for accurate, ongoing SCA vulnerability scanning.