OWASP Top 10 Vulnerabilities in 2022

OWASP has just released its revised list of the top ten vulnerabilities for businesses in 2021-2022, five years after its last publication. This article explains ten prevalent vulnerabilities listed by OWASP that are most likely to affect enterprises in the coming years. 

OWASP Top 10: 2021-2022 vs 2017 

Open Web Application Security Project (OWASP) is a non-profit organization that aims to improve software security. It is a one-stop shop for individuals, enterprises, government agencies, and other global organizations seeking failure and real-world knowledge regarding application security. It doesn’t promote commercial services or products but offers its own series of lessons on application security and related areas. 

Further, it reflects an “open community” notion, which means that anybody may participate in online OWASP conversations, initiatives, and other activities. The OWASP ensures that all of its resources, including online tools, videos, forums, and events, are publicly available through its website. With cybercrime on the rise, distributed denial-of-service (DDoS) assaults, faulty access control, and data breaches occur frequently. The OWASP Foundation developed the OWASP Top 10 to help avoid these security concerns. It is a ranking of the ten most severe security dangers to contemporary online applications, sorted by perceived importance. OWASP’s last “Top 10” list was published in 2017, which was recently updated in Q4 of 2021. 

Here are some of the critical changes taking place: 

A03:2021-injections become more expansive

The first modification involves injections. Injection attacks happen when a hacker tries to send data to a web application, such that the web application performs an unintended action. These may include SQL, operating system, and lightweight directory access protocol (LDAP) injection flaws. Since this flaw is also an injectable, the current update to the OWASP Top 10 adds A07:2017 cross-site scripting (XSS). 

A05:2021-security misconfiguration rising in priority

Given the rising number of configuration options, this category has risen in the OWASP Top 10. In addition, it includes A04: 2017-XML External Entities beginning in 2021 (XXE). The XXE attack targets a client-side program that processes XML input. An XML-External-Entities-Attack happens when unsafe XML input references to external entities are interpreted and processed. However, this attack is only successful with a flawed or improperly configured XML parser. Therefore, A04:2017-XML External Entities (XXE) has been integrated into A05:2021-Security Misconfiguration as a particular sort of misconfiguration.

See More: Top 10 Open Source Cybersecurity Tools for Businesses in 2022

What Are the OWASP Top 10 Vulnerabilities for 2022?

Three new categories have emerged in the Top 10 for 2021, with scoping and naming modifications and consolidation. To get started and protect against these threats, here are the top security vulnerabilities to watch for in 2022:

1. Broken access control 

Access control implements strategies to prevent users from operating beyond the scope of their specified permissions. Due to access vulnerabilities, unauthenticated or unwanted users may access classified data and processes and user privilege settings.

Metadata manipulation, including tampering or replaying with a JSON web token (JWT) access control token, or modifying cookies or hidden fields to boost privileges or exploit JWT invalidation, is an example of an access control vulnerability. A second example is a breach of the principle of denial by default. Access must be granted only to specific roles, capabilities, or users but is accessible to everyone. Such errors may make it simple for attackers to get access to everything they want.

However, one may avoid inadequate access security mechanisms and identity or password management issues by applying secure coding approaches and taking precautions such as disabling administrator accounts and restrictions and installing multi-factor authentication.

Additional prevention techniques include:

• Enforce access control mechanisms only once and reuse them for the duration of the application to reduce cross-origin resource sharing (CORS).
• Domain models should impose distinct application business limit constraints.
• Limit access to application programming interfaces (API) and controllers to mitigate the effects of automated attack tools.
• Log failures in access control and alert administrators as required.
• Instead of granting the user permission to create, view, modify or erase any information, model access controls must enforce record ownership.

2. Cryptographic failures 

Cryptographic failures, formerly known as sensitive data exposure, rose one spot to position two. This is more of a symptom than a primary cause; the emphasis here lies on cryptographic errors or lack thereof, which frequently expose sensitive data. The following are typical examples of sensitive information exposure:

• Session tokens
• Login IDs and passwords
• Online transactions
• Personal information (switched service network or SSN, health records, etc.)

For instance, an application may securely encrypt credit card data with automated database encryption. Unfortunately, it is immediately unencrypted when this information is accessed, enabling a SQL injection fault to extract credit card information in cleartext, which an intruder may exploit. These failures can be avoided using the following prevention techniques: 

• You should use robust, salted and adaptive hashing algorithms with a delay factor to store passwords, like scrypt, Argon2, PBKDF2 or bcrypt. 
• Older protocols such as file transfer protocol (FTP) and simple mail transfer protocol (SMTP) should be avoided when transferring sensitive data.
• Instead of merely using encryption, it is advisable to implement authenticated encryption.
• Cryptographically random keys must be produced and stored as byte arrays. If passwords are employed, it has to be changed into something like a key using an algorithm for password-based key creation. 

3. Injections

Injection (or SQL injections) is a database attack against a website that uses structured query language (SQL) to obtain information or perform activities that would ordinarily need an authenticated user account. These codes are difficult for the program to interpret from its own code, allowing attackers to conduct injection attacks to gain access to protected areas and sensitive data masquerading as trusted users. Injections include SQL injections, command injections, CRLF injections, and LDAP injections, etc.

With a maximum estimated incidence of 19 percent, an average rate of incidence of 3 percent, and 274,000 instances, 94 percent of the applications were screened for injections. As a result, Injection fell to the third position in the revised list.  

Some prevention techniques include: 

• A preferable alternative is to employ an API that completely eschews the interpreter, offers a parameterized API, or translocates to object-relational mapping (ORM) instruments.
• Utilizing positive server-side validation input is recommended. Numerous applications, including text fields and APIs for mobile apps, necessitate special characters.
• Utilizing LIMIT and other SQL constraints inside queries is a great way to avoid massive data exposure in the case of a SQL injection.

See More: What Is a Firewall? Definition, Key Components, and Best Practices

4. Insecure design 

This is a brand-new category for 2021 that focuses on the design and architectural flaws, with a need for greater use of threat modeling, design safety recommendations, and reference architectures. Insecure design is a wide category that contains a variety of problems, such as .”missing or inadequate control design.” That does not imply that insecure design is the root of all other top 10 risk categories.

Insecure design is not the same as insecure implementation. Implementation flaws can lead to vulnerabilities, even when the design is secure. On the other hand, a flawed design cannot be compensated for by a flawless implementation as necessary security safeguards do not exist to defend against specific threats. 

One can avert these threats by employing the following prevention techniques:

• Set up and use a secure development lifecycle with the assistance of AppSec specialists to evaluate and build security and privacy safeguards.
• Threat modeling is advised for crucial verification, access control, application logic, and essential flows.
• Include security terminology and controls inside user stories.
• Tenant segregation by design across all tiers is also seen as a practical preventative approach. 

5. Security misconfigurations 

General security setup issues, quite like misconfigured access controls, pose significant hazards by providing attackers with quick and easy access to critical data and site regions. 

With an average rate of incidence of 4% and over 208,000 occurrences of a common weakness enumeration (CWE) in this category, OWASP checked 90% applications for misconfiguration. “CWE-16 configuration” and “CWE-611 improper restriction of XML external entity reference” are two notable CWEs included. To avoid configuration complications, secure installation techniques must be used, which include:

• A systematic reinforcement process allows for quick and easy deployment of a secure environment. The configuration of the developmental, quality control and operational environments should be similar, with distinct user privileges.
• It is ideal for automating processes for establishing a new safe environment to save the time and effort necessary. Unused features and frameworks should be removed or not installed. A primary platform with no unessential features, components, documentation, or demonstrations decreases the likelihood of configuration vulnerabilities.

6. Vulnerable and outdated components

The majority of online apps are created with the help of third-party frameworks. Unknown application codes may result in undesirable outcomes and unwanted situations such as accent control violations, SQL injections, etc.

If the program is insecure, unsupported, or outdated, there may be vulnerability-related hazards. The package includes the application/web server, operating system, applications, database management system (DBMS),  APIs, other elements, libraries, and runtime environments.

Automated approaches are available to aid attackers in finding improperly configured or unpatched machines. For instance, the Shodan IoT search engine may aid users in discovering devices that are susceptible to the Heartbleed threat, which was fixed in April 2014. Certain prevention techniques include:

• It is best to purchase components from official sources through secure channels.
• Keep a lookout for modules and elements that are not functional or do not provide security updates for older versions. If patching cannot be carried out, consider developing virtual patches to observe, identify, or safeguard against the observed vulnerability.
• Remove any excessive requirements, functionalities, elements, folders, or documentation.

See More: What Is Unified Threat Management (UTM)? Definition, Best Practices, and Top UTM Tools for 2021

7. Identification and authentication failures 

This category, formerly known as broken authentication, dropped from second place and now contains CWEs linked to identification problems.  When an attacker obtains user information, password recovery, ID sessions, and other login credentials, it poses security issues.  As the name implies, an identity and authentication failure includes hackers exploiting such vulnerabilities to take advantage of inadequate authentication. 

If the application permits automated assaults like credential stuffing — when the attacker has access to lists of real users and passwords — or predefined, weaker, and common passwords such as “Password1” or “admin/admin,” these could be signs of authentication flaws. 

To avoid such defects, one must consider the following preventive measures:

• Multi-factor authentication must be used wherever feasible to avoid automated credential stuffing, brute-force attacks, and the reuse of stolen credentials.
• By checking new or modified passwords against a database of the 10,000 worst passwords, it is possible to boost password security.
• Using the same messages for every outcome helps prevent account enumeration attacks on password recovery, registrations, and API paths.
• Do not install any default credentials, especially for administrative users. 

8. Software and data integrity failures

As more sensitive information is stored in databases, vulnerable to security breaches, data integrity concerns become essential for software.

This is a new category, and it focuses on assuming the integrity of software updates, vital data, and CI/CD procedures without verifying them. One example is when applications use extensions, modules, or repositories from content delivery networks (CDNs) or unauthorized sources. A continuous integration/continuous delivery (CI/CD) process that is not protected might raise the risk of malicious code, system compromise or unauthorized access.

Prevention techniques include:

• One might use measures such as digital signatures to confirm that data or software comes from expected sources without any tampering.
• A security tool for the software supply chains, like OWASP CycloneDX or OWASP Dependency-Check, may be used to guarantee that components don’t include design flaws.
• It is necessary to guarantee that the CI/CD workflow has the required segmentation, access control, and parameterization to safeguard the code integrity throughout the set up and deploy operations.
• Compilation data that is unsigned or unencrypted should not be sent to untrusted clients unless integrity testing or a digital signature is in place to identify data alteration or duplication.

9. Security logging and monitoring failures 

A lack of tracking in the presence of suspicious actions and occurrences can expand gaps in time that go unmonitored, allowing security breaches to go unnoticed for longer than they would with better logging. This OWASP Top 10 2021 section is meant to aid in the identification, escalation, and resolution of recent breaches. Detection of a security breach is unlikely without recording and monitoring.

A major European airline had a notifiable General Data Protection Regulation (GDPR) incident to illustrate this failure. Intruders presumably exploited payment application security flaws to gain data of over 400,000 consumer payments. In response, the privacy authorities fined the airline 20 million pounds for the misplaced data. To avoid such attacks, it is wise for users to:

• Verify that all authentication, access security systems, and server-side data validation problems are recorded with sufficient user information to detect suspicious or fraudulent accounts and stored for an adequate period to a delayed comprehensive investigation.
• Make sure that logs are created in formats consumable by log management systems.
• Create or apply a strategy for incident recovery and response efforts, like NIST 800-61r2 or a later version.
• Ensure that log data is encoded appropriately to avoid intrusions or cyber threats to the monitoring systems. 

See More: What Is Security Information and Event Management (SIEM)? Definition, Architecture, Operational Process, and Best Practices

10. Server-side request forgery (SSRF) 

The results for this category reveal an above-average testing coverage, reasonably low incidence rate, and above-average Impact and Exploit ratings. SSRF develops when server-side queries are conducted without verifying the URL given by the user. This allows an attacker to induce an application to transmit a forged request to an undesired location, even if it is protected by virtual private networks (VPN), firewalls, or network access control list (ACL). 

Fetching a URL has become a typical occurrence as new online applications give end-users convenient functionalities. Consequently, SSRF prevalence is increasing. In addition, the intensity of SSRF is growing due to cloud services and design complexity. With that in mind, one can avoid such attacks by employing the following prevention techniques:

• To limit the effects of SSRF, one should separate remote resource access functions into distinct networks.
• Install “deny by default” firewall settings or network access control rules for blocking all web traffic except for required internal traffic.
• To protect against attacks like DNS remapping and “time of check, time of usage,” in (TOCTOU) situations, it’s good to be conscious of URL accuracy. 

Acting on the OWASP Top 10 Insights 

Compared to previous releases, the 2021 upgrade contains several noteworthy additions. The new category A04:2021-insecure design strongly indicates that more emphasis should be placed on security even during the design process. The next is the security advantages of microservices over monoliths. However, A10:2021-server-side request forgery (SSRF) demonstrates that they are not impenetrable and require additional settings (A05:2021-security misconfiguration). 

Collaboration with OWASP can help make applications more resistant to cyber threats, contribute to a more robust network and cloud encryption, raise the likelihood of application success, and dramatically improve the company’s cyber resilience.

Is there another high-risk threat you believe belongs on the OWASP Top 10 for 2021-2022? Tell us on LinkedInOpens a new window , TwitterOpens a new window , or FacebookOpens a new window ! 

MORE ON SECURITY

• 10 Best Data Loss Prevention (DLP) Tools for 2021
• What Is Web Application Security? Definition, Testing, and Best Practices
• Top 11 Malware Scanners and Removers in 2021
• Top 10 Endpoint Detection and Response Tools in 2022
• 10 Best Password Managers for 2021