Owasp Top 10 - Serious Application Vulnerabilities

About 90% of applications have serious vulnerabilities. OWASP, which regularly analyzes attacks and weaknesses on Web applications, has compiled the OWASP TOP-10 - the list of the most dangerous vulnerabilities.

OWASP Top 10 is not an official standard; it is a white paper widely used by many organizations, cybersecurity experts, and vulnerability bounty programs to classify the severity of weaknesses and security breaches.

Each year OWASP (the Open Web Application Security Project) pull out the top ten security vulnerabilities. It represents a broad consensus about web applications' most critical security risks.

Below are the latest top Vulnerabilities according to OWASP

##OWASP Top 10 Vulnerabilities

Injection

Broken Authentication and Session Management

Cross-Site Scripting(XSS)

Insecure Direct Object References

Security Misconfiguration

Sensitive Data Exposure

Missing Function Level Access Control

Cross-Site Request Forgery (CSRF)

Using Components with Known Vulnerabilities

Unvalidated Redirects and Forwards

1. Injection: Injection flaws occur when untrusted data is sent to an interpreter as part of a command or query.

All data, as a rule, is stored in unique databases, and the requests are built-in queries written in a Structured Query Language.

The attacker's hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization.

This very insecure weakness can give an intruder access to the database and the ability to see, modify or delete data. In such a way, the hacker can steal confidential personal data.

2. Broken Authentication and Session Management: Most web applications use cookies to keep and validate user sessions. After input of both username and password, when the authentication in the application is completed, a unique identifier is saved in the specified storage known as cookies to keep the user session, which the program constantly sends to the server with every query for the page of the app.

This is the way web application recognizes users.

In case of this, cookies are being stolen by a hacker, and the IT structure did not implement checks. For Example, if the session's IP address checks for more than one connection in a cookies session, the intruder can gain the possibility to get into the system with the user's account.

And think if it is an Internet bank or a payment system, you can easily guess the consequences of such unauthorized access.

3. Cross-Site Scripting(XSS): This is one of the most common web application vulnerabilities. It's a user data validation error that allows injecting malicious executable JavaScript code into the user's browser for execution.

Hackers often initiate an XSS attack by sending a malicious link to a user and probing the user to click it. If the app or website lacks proper data sanitization, the injected script is performed in the user's browser, allowing hackers to steal session cookies.

Although frameworks like Django already help developers validate and sanitize user input, to prevent XSS attacks

4. Insecure Direct Object References: This Vulnerability occurs when the server fails to validate incoming HTTP requests to access objects.

Since the application cannot determine and validate the authenticity of the user trying to access a thing, it reveals the underlying object details to hackers.

The Hackers thereby gain unauthorized access to the object and modify the value of the ID parameter for the thing to fulfil their aims.

As a result, users can be redirected to access confidential pages without their knowledge. In the worst case, attackers can access sensitive personal, financial details and other confidential information.

5. Security Misconfiguration: Security misconfigurations can result from simple oversights but can expose an application to attack. In certain instances, misconfiguration may leave information disclosed.

The more code and data exposed to users, the bigger the risk for application security. For Example, the API of each organization has to be only visible to the web admins.

No other user should have access to it because it can cause significant damage; all links or endpoints leading to the API should be adequately blocked from unauthorized users.

6. Sensitive Data Exposure: Sensitive data exposure occurs because of not adequately protecting a database where information is stored.

This might result from many things, such as software flaws, no encryption, weak encryption, or when users mistakenly upload data to an incorrect database. This can make the database misbehave and pop up confidential information.

Your personal information can be exposed in different ways. Sensitive data exposure is one way, and data breach is another.

The program and applications must be updated, as weaknesses appear daily in various program components. Even if your app is commonly well protected, carefully check all incoming data. It is correctly written you still can't guarantee that no weaknesses will be found in the OS or Web server at any time. Just like the recent Uber hacks.

7. Missing Function Level Access Control: Most web applications verify function level access control rights before making that functionality accessible to the user.

However, attackers can penetrate the application without proper authorization if the same access control checks are not performed or validated on the server.

Usually, admin access requires authentication and authorization. However, an unauthenticated user can access the admin page if the application access control is not verified.

Authorization should be appropriately implemented after authentication to

8. Cross-Site Request Forgery (CSRF): Cross-site request forgery, widely known as a one-click attack or session riding, forces authenticated users to submit a request to a Web application against which they are currently certified.

For Example, A web application sends a state-changing request as plain text without encryption. With this, the attacker can construct a proposal that transfers funds from the victim's account to the hacker's account by embedding the request in an image stored on various sites under the hacker's control.

9. Using Components with Known Vulnerabilities: Businesses and organization often finds it difficult to code everything while making their website functionalities like -transaction, location, chats, etc. As a result, many organizations use third-party apps to perform tasks to ease the process of building a web application.

But the main problem is that those apps can only harm their system if updated regularly. Components with known vulnerabilities are considered one of the top 10 web application vulnerabilities listed by OWASP.

Also, features like frameworks, libraries, and other software modules run with the same privileges as the application. Therefore, an attack can allow data loss or server takeover if a vulnerable component is exploited.

Sites like https://www.exploit-db.com contain the details of how to exploit the flaws which put the protection of the whole web application under severe threat.

10. Unvalidated Redirects and Forwards: Often referred to as URL redirection, this type of flaw is found in the Web Application. The attacker uses it to manipulate the URL and sends it to the victim.

Immediately after the victim opens the URL, the website redirects it to a malicious website or website to which the hacker wants the user to get redirected.

The hacker exploits this type of Vulnerability with the help of several tools like Burpsuite, or manual manipulation in the URL, which gives an attacker various kinds of ways due to which he can manipulate the URL to get Redirected.

Remove any redirection functions from the Web Application & replace them with direct links. Also, proper validation in the URL redirecting must be integrated at the backend.