# Insecure transport without integrity checks

HTTP or unverified fetches of dependencies, settings, or proxied traffic that persist attacker-controlled state

_Area: Web infrastructure and server-side requests. Seen in 2 disclosed reports; one confirmed bounty: $1,000; latest 2019-06-10. Updated 2026-10-30._

## How it works
A client fetches something security-relevant — a config file, a dependency, a proxied response — over a channel that provides no integrity guarantee, and then trusts and persists what it received. The broken assumption is that the transport authenticates the content. Plain HTTP, or a proxy that terminates TLS without validating the origin certificate, lets anyone on the network path substitute the payload. Because the client writes the result into durable state (a settings cookie, a build artifact, a response body), the tampering outlives the connection.

## Where it shows up
- Security-sensitive resources reachable over HTTP at the same path as their HTTPS version [E1](https://bugbountylibrary.com/r/h1%3A54094.md)
- Build files (`pom.xml`, `build.gradle`, `package.json`) with `http://` repository or upload URLs and no checksum/signature check [E2](https://bugbountylibrary.com/r/h1%3A506161.md)
- Proxy dispatchers that forward HTTPS without performing and validating the origin TLS handshake end-to-end [E3](https://bugbountylibrary.com/r/h1%3A1599063.md)
- Clients that persist fetched config or artifacts without verifying origin or hash

## How to review
Identify every fetch that influences security state or ships into a product, then confirm the invariant: the content is authenticated before it is trusted or persisted. Check that the URL scheme is HTTPS, that a signature or hash is verified against a trusted value, and that a proxy actually validates the origin certificate rather than terminating TLS itself. For settings UIs, confirm the HTTP path is not served or consumed at all. For builds, confirm no plaintext repository URL resolves a dependency that lands in a release.

## Variants seen
- Config UI served over HTTP writes a persistent local settings cookie granting device and CORS exemptions [E1](https://bugbountylibrary.com/r/h1%3A54094.md)
- Build-time dependency resolution over HTTP injects malicious JARs into released artifacts [E2](https://bugbountylibrary.com/r/h1%3A506161.md)
- Proxy agent skips origin certificate validation, exposing all proxied HTTPS traffic [E3](https://bugbountylibrary.com/r/h1%3A1599063.md)

## Impact and severity
Consequences ranged from permanent webcam/mic and CORS exemptions [E1](https://bugbountylibrary.com/r/h1%3A54094.md), to supply-chain injection into shipped build artifacts [E2](https://bugbountylibrary.com/r/h1%3A506161.md), to full visibility of proxied HTTPS traffic [E3](https://bugbountylibrary.com/r/h1%3A1599063.md). Severity is raised when tampering persists (durable state, released artifacts) and when the channel is a shared dependency used broadly, as with a global fetch dispatcher [E3](https://bugbountylibrary.com/r/h1%3A1599063.md).

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A54094.md
- E2: https://bugbountylibrary.com/r/h1%3A506161.md
- E3: https://bugbountylibrary.com/r/h1%3A1599063.md