April 1, 2022
Topics
Web Application’s are an attackers first choice when trying to compromise an organization. By being one of the few attack vectors that face the public, if not secured correctly, they can be an easy way for attackers to gain a foothold in your organization. In this post we will talk about the vulnerabilities in Web Applications that the OWASP Foundation has highlighted as “Most Critical”.
Access control is used to enforce policies that keep users from acting outside their level of permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of data, or performing a business function outside the user's limits. Some common access control vulnerabilities include:
Preventing Access Control issues doesn’t have to be complicated. A good start is, unless it’s a public resource, to deny by default. Access controls should also enforce record ownership rather than allowing any user to create, read, update, or delete resources. Access to resources should also be logged and any anomalies should alert admins, especially if they are a sign of a Brute-Force attack or a user accessing resources outside of their role. Some other way to precent access control issues are:
Cryptographic Failures arise when sensitive data that should be protected is either not protected at all or protected by insufficient cryptography. Some examples of this are when passwords are saved in clear text or data sent over the internet is not encrypted using the most up-to-date cryptography.
The best ways to prevent these issues from arising are:
Encrypt all data in transit with secure protocols such as TLS with forward secrecy (FS) ciphers, cipher prioritization by the server, and secure parameters. Enforce encryption using directives like HTTP Strict Transport Security (HSTS).
Do not use legacy protocols such as FTP and SMTP for transporting sensitive data.
Store passwords using strong adaptive and salted hashing functions with a work factor (delay factor), such as Argon2, scrypt, bcrypt or PBKDF2.
Code Injections happens when unvalidated user input is used directly in application code. Depending on the type of vulnerability and goal of attack, an attacker might inject database queries, JavaScript code, operating system commands, and so on. The consequences of a successful injection attack may include information disclosure, denial of service, and even complete compromise of the target system.
An application is vulnerable to attack when:
A noticeable new entry for 2021 was the category of Insecure Design, which came in at number four. This is in recognition of the fact that, if we really want to improve the resiliency of software, security must begin right at the design phase. This can also be referred to as the Secure Development Lifecycle (SDLC). By taking security into account during every step of the Software Development process, we can ensure that new applications are protected against any known threats. According to OWASP, a few ways to prevent Insecure Design are:
Security Misconfigurations happen when an application or service is improperly hardened or configured during deployment. A good example of this is when an application server's configuration allows detailed error messages, e.g., stack traces, to be returned to users. This potentially exposes sensitive information or underlying flaws such as component versions that are known to be vulnerable. Several ways to prevent Security Misconfigurations are:
These are only half of the major web application vulnerabilities highlighted by OWASP. In the next installment of this blog, we will go over the other half of OWASP’s list including Vulnerable and Outdated Components, Identification and Authentication Failures, Software and Data Integrity Failures, Security Logging and Monitoring Failures, as well as Server Side Request Forgery.
