{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/dce-web/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ssa:dce-web:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-104371"},{"id":"CVE-2026-104372"},{"id":"CVE-2026-104373"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["dce-web"],"_cs_severities":["low"],"_cs_tags":["web-vulnerability","supply-chain","information-disclosure","cisa"],"_cs_type":"advisory","_cs_vendors":["Social Security Administration"],"content_html":"\u003cp\u003eThe Social Security Administration (SSA) 'dce-web' application was found to contain three security vulnerabilities discovered via internal audit. While the repository was decommissioned on September 18, 2026, the findings highlight risks associated with legacy build processes and configuration.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2026-104371: Bootstrap CSS files were loaded from a CDN without subresource integrity (SRI), enabling potential CSS injection, UI redressing, or phishing within the dashboard.\u003c/li\u003e\n\u003cli\u003eCVE-2026-104372: The project lacked a lockfile and used outdated build dependencies (2016-2017), rendering automated software composition analysis (SCA) ineffective and exposing developer environments to known vulnerabilities like WebSocket origin check bypasses and ReDoS.\u003c/li\u003e\n\u003cli\u003eCVE-2026-104373: Build scripts (\u003ccode\u003egulpfile.js\u003c/code\u003e) contained hardcoded internal SSA SMB/UNC network paths, facilitating internal network reconnaissance.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eVerify that the 'dce-web' repository and any associated build environments have been fully decommissioned as per the reported remediation date of September 18, 2026.\u003c/li\u003e\n\u003cli\u003eConduct a review of legacy repositories to identify and remediate hardcoded internal network paths, especially within build configurations or deployment scripts.\u003c/li\u003e\n\u003cli\u003eImplement mandatory Subresource Integrity (SRI) for all third-party resources loaded in web applications to prevent content tampering.\u003c/li\u003e\n\u003cli\u003eEnforce the use of lockfiles (e.g., \u003ccode\u003epackage-lock.json\u003c/code\u003e, \u003ccode\u003eyarn.lock\u003c/code\u003e) in all development projects to ensure reproducible builds and allow for accurate, ongoing SCA vulnerability scanning.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-10T19:00:09Z","date_published":"2026-11-10T19:00:09Z","id":"https://feed.craftedsignal.io/briefs/2026-11-dce-web-vulnerabilities/","summary":"The decommissioned dce-web application contained vulnerabilities involving missing Subresource Integrity (CVE-2026-104371), supply chain risks from unpinned development dependencies (CVE-2026-104372), and internal SMB path exposure (CVE-2026-104373).","title":"Social Security Administration dce-web: Multiple Vulnerabilities (CVE-2026-104371, CVE-2026-104372, CVE-2026-104373)","url":"https://feed.craftedsignal.io/briefs/2026-11-dce-web-vulnerabilities/"}],"language":"en","title":"CraftedSignal Threat Feed - Dce-Web","version":"https://jsonfeed.org/version/1.1"}