First appearing in 2003 and continuing with the regular updates the US top 10 is a compilation of the
top 10 most critical application security risks and vulnerabilities which is produced with the goal
of empowering developers security teams I.T. people to ensure that the applications they're using and
they build and have are secure against the most political risks.
Actually the US is now the de facto standard for web applications security as application security threats
are constantly evolving.
The current AWS top 10 is the 2017 list on the right side here.
This list includes detailed best practices for both the detection and limitation of the vulnerabilities
building on the success of the previous or US top 10 which is the 2013 version available on the left
side.
Spores produced further Top 10 lists mainly for Internet of Things and mobile development security risks.
The US population is mainly done by examining both the occurrence rate and the overall severity of each
of the threats.
As you can see here a couple of things changed from the 2013 version to the 2017 version.
Two of the items which are a four and a seven from the 2013 version and secured that object reference
and missing function level access control would emerge to one item in the 2017 list which is the broken
axis control couple of items from the 2013 listed aren't qualified to be in the 70 list which are the
cross site requests forgery and invalidated read that acts and forward on top of that we have a couple
of new items in the new list which are the X AML external entities from the ability we have as well
the insecure D serialization and the insufficient logging and monitoring it is worth mentioning here
that wasp is not affiliated with any technology company but it's an open community project dedicated
to enabling organization develop purchase and maintain secure applications.
I will now try to briefly explain each of the vulnerabilities in the updated 2017 list.
The first item is injection.
If your application is receiving user input that goes into the back end at the bases then your application
is vulnerable or can face cold injection attacks.
So injection flows are set of security vulnerabilities which occur when suspicious data is inserted
into the application such as commands not injection types.
R S L O S and X X E which is the exam and external entities.
As for the second vulnerability which is the broken authentication.
Actually when an application functions are not implemented correctly the attack surface is open for
attackers too easy to break and compromise password session I.D. etc..
So sessions should be unique to each individual user and without some necessary social management an
attacker can sneak and steal credentials and information.
As for sensitive data exposure as the name says it occurs when security controls such as HP s are not
implemented correctly thus leaving a hold for attackers to steal sensitive information such as payment
information user name password I.D. PII information etc. XM l external that entities attack is it type
of injection data and it happens when the application passes or takes x AML input and passes them at
that occurs when the XM input contains at a friend's to an external entity that is processed by a week.
XM l pass it so this attack will lead to different leakages such as disclosure of information denial
of service and server side request for the broken access control is actually a result of merging the
insecure direct object reference and missing function level access control access control is meant to
control what's authorized.
Users are allowed and are not allowed to do within a web application and to establish proper access
control and this is not implemented correctly.
Attackers will exploit this to perform unauthorized tasks security configuration is the most commonly
seen issue according to us so strong security requires good and secure practices of configuring applications
frameworks servers databases etc. process scripting is the most famous one on the list in my opinion
and it allows attackers to inject client site scripts into public facing what pages insecure these serialization
so serialization is the process of turning some object into a data format that can be stored later.
Users actually serialized objects or did it to save them to storage or to send as part of communications.
You serialization is taking data structure from some format and rebuilding it to an object using components
with non-verbal abilities is actually you when you use libraries frameworks and in your application
from open source community and in many cases these libraries and frameworks are vulnerable.
This will lower your application to be vulnerable as well.
The last one and according to all was insufficient logging and monitoring coupled with missing or ineffective
integration with Incident Response will allow attackers to further attack the system and actually maintain
persistent attack or proposes an access to your system in order to tamper extract and destroy data.