The New OWASP Top 10 - 2021
The Open Worldwide Application Security Project (OWASP) published the new Top 10 most common security risks for web applications on September 24. For the first time since 2010, Broken Access Control, rather than Injections, represents the greatest threat to web applications. Since the last edition of the OWASP Top 10 in 2017, three new categories have been introduced and four categories have been modified.
Overview of the Changes
Injections have been downgraded to third place and now include Cross-Site Scripting (XSS). This change is logical, as XSS is ultimately just the insertion of untrusted code into a new context. With our approaches around the Secure Software Development Life Cycle (SSDL) and Threat Modeling, we at aramido feel vindicated by the risk of Insecure Design, which has newly joined at the fourth position. Our penetration testers repeatedly discover vulnerabilities that should have been considered during the planning process. Another newcomer to the Top 10 list is Software and Data Integrity Failures in eighth place. This somewhat cumbersome point includes, among others, the insecure deserialization listed separately in the 2017 list, but also aims to cover the category of Supply Chain Attacks, which became well-known at the latest through the SolarWinds attacks. Finally, a very specific vulnerability, Server-Side Request Forgery (SSRF), has been added at tenth place.
The Limits of the OWASP Top Ten
The overview of changes to the Top 10 list illustrates the problems inherent in such a list. While some vulnerabilities have been grouped into broader categories, others are more narrowly defined vulnerability types that are not even mutually exclusive with other categories. This identity problemāwhat the OWASP Top 10 list is actually intended to beāis also discussed by others. That a Top 10 list is only a selection of all possible vulnerabilities and does not sufficiently map the entire risk potential of web applications and their probabilities is in the nature of a Top list. The OWASP Top Ten are therefore not a standard against which web applications can be verified and declared secure (for this purpose, OWASP offers the Application Security Verification Standard (ASVS)). As the authors of the list themselves write, the Top Ten is an awareness document. It has served this purpose very well in the past and will continue to do so. For example, at aramido, we use the Top 10 for developer awareness events to sensitize them to potential vulnerabilities and initiate discussions on countermeasures.
The List of Most Critical Web Application Security Vulnerabilities
The OWASP Top 10 - 2021 describes the ten most critical security risks for web applications, highlights attack vectors, and recommends protective measures on how to defend against these attacks. They are based on extensive data collection by the authors with the help of the security community.
A01:2021 - Broken Access Control
Failures in access management have moved from fifth position (2017) to first place (2021). If authorization is not stringently implemented in a web application, users can access data that has not been released to them. When designing an application ( A04:2021 ), it is therefore mandatory and clear to define how users authenticate themselves to an application and, in the subsequent step, once the identity has been established, what the user is authorized to do.
A02:2021 - Cryptographic Failures
Previously, this category was called "Sensitive Data Exposure". The new designation focuses on failures related to cryptography, as was previously the case implicitly. These vulnerabilities frequently lead to the disclosure of sensitive data such as passwords or private keys.
A03:2021 - Injection
Injections have moved from first to third rank. They arise from the processing of untrusted data by an application. This data was either not validated and handled, or handled insufficiently. In the past, SQL Injections were frequently exploited; however, other injections, such as those against LDAP directories or the operating system, must also be considered. Cross-Site Scripting (XSS), which was listed separately in previous versions, is now part of this category.
A04:2021 - Insecure Design
The new category focuses on risks associated with design flaws. Threat models and secure architectures in the development of web applications are becoming increasingly important to fend off attacks. Insecure architectures cannot be fixed by implementation alone if, for example, required security controls were not considered early in the development process.
A05:2021 - Security Misconfiguration
Errors in the configuration of systems such as firewalls, web servers, or web applications can have far-reaching consequences. Possible cases range from the disclosure of sensitive information and unauthorized system access to denial of service . Given the increasing shift toward highly configurable software, it is not surprising that this category has risen compared to the Top 10 - 2017. The previous category for XML External Entities (XXE) is now part of this risk category. The XML standard allows external data to be loaded into an XML document. Those who do not consider this when processing these documents risk unauthorized command execution, leakage of internal information, or denial of service.
A06:2021 - Vulnerable and Outdated Components
As in 2017, this category involves the use of insecure components with known vulnerabilities. In today's world of frameworks and software libraries, developers very often use third-party code. While this offers efficiency and security advantages, it can equally become a gateway for hackers. Once security vulnerabilities in software components become known, an update must be provided immediately.
A07:2021 - Identification and Authentication Failures
The category of identification and authentication failures, previously called "Broken Authentication", has dropped from second place and now specifically includes errors in user identification. This category is still a permanent fixture of the Top 10 but is becoming less common due to the increasing availability of standardized development frameworks.
A08:2021 - Software and Data Integrity Failures
The new category for 2021 focuses on security gaps regarding software updates, critical data, and CI/CD pipelines without integrity verification. The category described as "Insecure Deserialization" in 2017 is now assigned to this category. In serialization, complex data structures are converted into a sequential character string. The reverse processādeserializationācan be exploited to execute foreign commands.
A09:2021 - Security Logging and Monitoring Failures
This category was in tenth place in 2017 and was expanded this year to cover more types of security gaps. Logging and the analysis of data represent the most important way to detect an attack on one's own systems. Similarly, application errors during operation must be logged and communicated to the responsible parties. Missing or incorrect logging can directly impact visibility, incident alerting, and forensics.
A10:2021 - Server-Side Request Forgery (SSRF)
This also new category involves SSRF vulnerabilities, which occur whenever a web application retrieves a remote resource without validating the URL provided by the user. This allows an attacker to force the application to send manipulated requests from the server, even if it is protected by a firewall, a VPN, or another type of Access Control List (ACL). OWASP points out that the severity of SSRF is increasing due to cloud services and complex architectures.
Data Collection
The new edition of the OWASP Top Ten is based on statistical data on common security gaps that have been reported via relevant industry channels in the past. In addition, regular surveys of industry experts were conducted to align the existing data with the latest findings of professionals in the field of application security and development.
On 21.10.2021 in the category Web Application Security published.