What is OWASP?
The Open Web Application Security Project (OWASP) is an international non-profit organization dedicated to web application security. The OWASP has no commercial intentions and is open to all people who are interested in the topic of data and operational security of web applications. They provide resources such as documentation, tools, videos and forums. Their famous project is the OWASP Top 10.
What are the OWASP Top 10?
The OWASP Top 10 is a regularly updated report that describes security risks for web applications, focusing on the 10 most critical vulnerabilities. The list has been compiled by the OWASP non-profit organization that gave it its name since 2003 and is updated every two to three years. In 2021, the OWASP Top 10 list was updated to its latest version.
The OWASP TOP 10 - 2021
In the current OWASP Top 10 of 2021, three new categories have been added compared to the previous version of 2017: Insecure Design, Software and Data Integrity Failures and Server-Side Request Forgery. Individual categories have also been renamed or redefined.
A01:2021 - Broken access control
Access Control focuses on the implementation of restrictions for authenticated users so that they cannot perform actions that exceed their authorization level. Errors in access control can lead to uncontrolled data leakage of sensitive information or allow manipulation of accessible data.
Real-life example
Improper access control allowed a security expert to obtain the CD keys for every game on Steam.
A02:2021 - Cryptographic Failures
Cryptographic failures refers to errors in the encryption of data and data transfers and the failure to use appropriate encryption methods. Cryptographic failures clearly affect the security of applications and their data. Attackers can steal and modify data due to a lack of security, which can have serious consequences. This used to be called "Sensitive Data Exposure", but this name is not entirely accurate as it describes symptoms and effects rather than causes. The new name focuses on encryption failures, as previously indicated. Exposure of sensitive data such as private keys or passwords often occurs when vulnerabilities occur.
Real-life example
As part of Google's Project Zero, a vulnerability was discovered in Cloudflare's edge servers that allowed memory containing potentially sensitive data to be read, some of which was cached by search engines. This vulnerability has been named Cloudbleed.
A03:2021 - Injection
Injection is a hacking technique used when user input is interpreted by an application. This can result in the text being processed as a command or parameter. The processing "naturally" depends on the technology used.
For example, a malicious user can exploit the parameters in an SQL query so that they can read, change or delete sensitive or even confidential data. This manipulation is called SQL injection.
Another type of injection is command injection. This allows the attacker to start or stop system commands on the server, which enables him to gain control over the system.
An injection attack occurs when untrusted data is sent to a code interpreter via a form input or other data transmission to a web application. Data or the entire application can be compromised by malicious code placed by an attacker.
A04:2021 - Insecure design
Basically, an Insecure Design means that no security controls are integrated into the application during the entire development cycle. This can have far-reaching and profound security implications, as the application itself is not designed with security in mind.
This negligence results in the fundamental design and foundation of the application being insecure, opening the door to a variety of security vulnerabilities - which can ultimately lead to information disclosure or outright compromise of the application.
Insecure Design covers vulnerabilities caused by known/unknown flaws in the application/software architecture. This category focuses on risks resulting from errors in architecture and design. As explained by OWASP, these are distinct from risks associated with flaws in implementation. Even well-implemented insecure designs are vulnerable to attack. Insecure software designs lack security controls and business risk profiling. This makes them very vulnerable to attacks.
A05:2021 - Security misconfiguration
Security misconfiguration focuses on security controls that are not secured or configured correctly. This vulnerability is usually due to one of the following:
- Misconfigured systems such as firewalls, web servers or web applications.
- Allowing and installing unnecessary features, such as ports, services, pages, accounts or permissions.
- Default accounts/passwords are activated or unchanged.
- The software is not up to date.
Real-life example
Incorrectly configured HTTP headers on the website of the US Department of Defense. Although the X-XSS-Protection header was included, it was configured with the value DENY, which is to be used for the X-Frame option. The expert therefore recommended changing this value to 1; mode=block. The original report can be viewed here.
A06:2021 - Vulnerable and outdated components
Modern web developers use frameworks and libraries in their web applications. These are pieces of software that help developers avoid redundant work and provide the required functionality. Popular examples include front-end frameworks such as React and smaller libraries that add sharing icons or A/B testing. To orchestrate larger attacks, some attackers look for vulnerabilities in these components. Some of the most popular components are used in hundreds of thousands of websites. An attacker who finds a vulnerability in one of these components could leave hundreds of thousands of websites vulnerable.
Real-life example
On December 9, 2021, a Remote Code Execution (RCE) vulnerability was reported in the Apache logging package Log4j2, version 2.14.1.
The Log4j2 library is an open-source logging library provided by the Apache Software Foundation that is commonly used in online applications and services to log for development, operational, and security purposes.
A07:2021 - Identification and Authentication Failures
These authentication and session management vulnerabilities were previously referred to as Broken Authentication. Vulnerabilities related to logon and authentication are listed here. These include: insufficient protection against brute force, credential stuffing, credential cracking, storing passwords in plain text and missing or insufficient multi-factor authentication. This category is still an integral part of the top 10, but with the increasing popularity of standardized development frameworks, this category is becoming less and less common.
Real-Life Example
Uber failed to limit the https://biz.uber.com/confirm endpoint, which would allow an attacker to brute force business accounts and take over rides on their behalf. This vulnerability was reported on HackerOne. The original report can be viewed here.
A08:2021 - Software and Data Integrity Failures
The new categories refer to vulnerabilities in software updates with unchecked integrity of critical data and CI/CD pipelines. Such errors can occur, for example, in applications that use plug-ins, libraries or modules from unauthenticated and untrusted sources, repositories or content delivery networks (CDNs). An insecure CI/CD pipeline can provide cybercriminals with access to inject malicious code and compromise systems. A similar source of error could be the automatic update function of most applications, which does not necessarily include a thorough integrity check. This opens the door for attackers to distribute updates aimed at creating security vulnerabilities.
Real-Life Example
The most well-known example of a failing software and data integrity system is the SolarWinds Orion attack, which focused on compromised update mechanisms.
A09:2021 - Security Logging and Monitoring Failures
The category ranked tenth in 2017 and was expanded this year to include more types of vulnerabilities. In general, logging and monitoring are used to proactively detect, escalate and respond to security breaches. Problems can arise, for example, if the error generates no or insufficient log entries, the logs are only kept locally or the thresholds for the warning and escalation process are not defined correctly.
A10:2021 - Server-side request forgery (SSRF)
Server-side request forgery (SSRF) occurs when a web application cannot validate a URL specified by the user when requesting a remote resource. In this way, an attacker can force an application to send a crafted request to an unexpected destination, even if it is protected by a firewall, VPN or other type of network access control list (ACL). OWASP noted that the severity of SSRF is increasing due to cloud services and complex architectures.
