OWASP Top 10 2017 – Ten Most Critical Web Application Security Risks

The Open Web Application Security Project (OWASP) is an online community that provides free articles, methodologies, documentation, tools and technologies in the field of web application security.

The ten most critical security risks in web applications, popularly known as OWASP Top 10, is a powerful awareness document for web application security. OWASP Top 10 represents a broad consensus on what the most important web application security flaws are.

OWASP plans officially launch OWASP Top 10 2017 in October 2017 after a public comment period ending June 30, 2017. See the chart below for the main vulnerabilities:

Sponsorships Available

Sponsorships Available

Sponsorships Available

A1 – Injection
Injection flaws, such as SQL, OS, XXE, and LDAP injection occur when untrusted data is sent to an interpreter as part of a command or query. Injected data from the attacker can trick the interpreter into executing unintentional commands or accessing data without proper authorization.

A2 – Broken Authentication and Session Management
The application functions related to authentication and session management are often implemented incorrectly, allowing attackers to compromise passwords, keys or session tokens, or exploit other implementation flaws to assume the identities of other users (temporarily or permanently).

A3 – Cross-Site Scripting (XSS)
XSS allows attackers to execute scripts in the victim’s browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites. XSS vulnerabilities occur whenever an application allows you to include untrusted scripts on a web page without proper validation.

A4 – Broken Access Control
Restrictions on what authenticated users can do are not properly enforced. Attackers can exploit these vulnerabilities to access unauthorized data and features, such as other users ‘accounts, view sensitive files, modify other users’ data, change access rights, and so on.

A5 – Security Misconfiguration
Good security requires having a secure configuration defined and implemented for the application, frameworks, application server, web server, database server, platform, etc. Secure configurations must be defined, implemented, and maintained, since standards are often unsafe. In addition, the software must be kept up to date.

A6 – Sensitive Data Exposure
Many web applications and APIs do not adequately protect confidential / sensitive data. Attackers may steal or modify such weakly protected data to perform credit card fraud, identity theft, or other crimes. Sensitive data deserves additional protection, such as strong encryption whether at rest or in transit, as well as special precautions when exchanged with the browser.

A7 Insufficient Attack Protection
Most applications and APIs do not have the basic ability to detect, prevent and respond to manual and automated attacks. Attack protection goes far beyond basic input validation and involves detection, logging / logging, response, and even blocking of intrusion attempts. Application owners also need to be able to quickly deploy patches / patches to protect against attacks.

Cross-Site Request Forgery (CSRF)
A CSRF attack forces the logged-in victim’s browser to send a forged / spoofed HTTP request, including the victim’s session cookie and any other automatically-entered authentication information for a vulnerable web application. Such an attack allows the attacker to force the victim’s browser to generate requests that the vulnerable application believes are legitimate requests.

A9 – Using Components with Known Vulnerabilities
Components such as libraries, frameworks and other software modules run with the same privileges as the application. If a vulnerable component is exploited, such an attack can cause data loss or server acquisition by the attackers. Applications and APIs that use components with known vulnerabilities can undermine application defenses and allow for multiple attacks and impacts.

A10 – Underprotected APIs
Modern applications generally encompass applications client and APIs, such as JavaScript in the browser and mobile applications, which connect to an API of some kind (SOAP / XML, JSON / REST, RPC, GWT, etc.). These APIs are often unprotected and contain numerous vulnerabilities.

For more information and references, see: https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project

Rafael Fontes Souza is a member of the CIPHER Intelligence LAB offensive security team, recognized at the Apple Security Hall of Fame and Microsoft Security Researchers Award.