Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

3/12/2019
06:05 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Web Apps Are Becoming Less Secure

Critical vulnerabilities in Web applications tripled in 2018, according to a new study.

Buggy Web applications continue to be one of the biggest security weaknesses for a majority of organizations. A new report shows that in fact, the problem actually appears to be getting worse.

Positive Technologies analyzed data from Web application security assessments that the company conducted for clients throughout 2018. The analysis showed a three-fold increase in the number of critical vulnerabilities present in Web applications compared to 2017.

On average, each Web application that Positive Technologies inspected contained 33 vulnerabilities. Of those, six were high-severity flaws, compared to just two the prior year.

More than two-thirds of the apps (67%) contained critical vulnerabilities such as insufficient authorization errors, arbitrary file upload, path traversal, and SQL injection flaws. That number was higher than the 52% of applications that contained such flaws in 2017 and the 58% in 2016.

Leigh-Anne Galloway, cybersecurity resilience lead at Positive Technologies, says the company's analysis showed Web applications were consistently buggy regardless of industry or whether the app was homegrown or commercially purchased. "Most Web applications have a low level of security," that's putting user and business data at risk.

The cause is not easy to pinpoint. "But 83% of vulnerabilities are code vulnerabilities, and critically dangerous ones as well. This suggests that during development, not enough attention is paid to safety," Galloway says.

The security vendor's analysis is consistent with that of others in recent months. In an October 2018 report, WhiteHat Security described the number of high-severity security vulnerabilities in Web applications as increasing at a rate that is making remediation nearly impossible for organizations using traditional methods. Microservices in particular are riddled with more serious vulnerabilities per line of code than traditional applications, WhiteHat said.

The WhiteHat report identified the growing use of insecure third-party components as one reason for the high and increasing prevalence of vulnerabilities in modern Web applications. The accelerating adoption of agile DevOps processes and the resulting emphasis on speedy application delivery is another factor. "The quicker applications are released, particularly those that are comprised of reusable components, the faster more vulnerabilities are introduced," WhiteHat said in its report.

The trend portends major trouble for enterprise organizations. Seventy-two of the Web applications in the Positive Technologies study had vulnerabilities that enabled unauthorized access and 19% had flaws that would give an attacker complete control of the application and the underlying server. "If such a server is on the network perimeter, the attacker can penetrate the internal corporate network," the security vendor said.

Seventy-nine percent of Web applications contained weaknesses that enabled access to debug and configuration information as well as source code, session identifiers, and other sensitive data. That's the second year that the number of applications with such vulnerabilities has increased—in 2016 just 60% of applications had such issues and in 2017 that number was 70%.

Most Common Vulnerabilities

What are the most common vulnerabilities in Web applications? Positive Technologies' analysis unearthed some 70 different types of vulnerabilities in total in Web apps. Security configuration errors—such as default settings, common passwords, full path disclosure, and other information-leak errors—were present in four out of five apps, making this class of vulnerability the most common. Cross-site scripting errors were present in 77% of applications; 74% had authentication-related issues; and more than half (53%) had access control flaws. In most cases, the vulnerabilities stemmed from coding errors and could only be fixed by coding changes.

"Vulnerabilities associated with information leaks have become extremely widespread," Galloway says. "Moreover, many applications do not protect against unauthorized access, which allows a hacker to get privileges and act more freely within the system."

Galloway says it's hard to say with certainty what impact Agile and DevOps practices have had on application security. "Unfortunately, not every company has a correct idea of these practices," she says. Many organizations have reinforced the view that security is hindering the development of applications and are postponing cyber defense issues in pursuit of new functionality, Galloway notes.

The reality is that code security analysis is required at all stages of application development, she notes. Using a Web application firewall is a must as well, since attackers upgrade their methods much faster than companies are able to build protection. "For example, it can take weeks and months to fix code errors, and new exploits can be used by attackers a few hours or days after the appearance of vulnerability or [proof of concept] information."

Related Content:

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Jon M. Kelley
50%
50%
Jon M. Kelley,
User Rank: Moderator
3/13/2019 | 10:49:47 AM
"...analysis showed Web applications were consistently buggy regardless of industry...", Really?
When I opened this webpage I got:

Line: 3, Error: Unable to get property 'event' of undefined or null reference
              Followed by
Line: 167, Error: Object doesn't support property or method 'defineSlot'
              Followed by
Line: 441, Error: Unable to get property 'offsetParent' of undefined or null reference

 

             ...and when I tried to post this comment, I got:
Line: 138, Error: '$' is undefined
              Followed by
Line: 3, Error: Unable to get property 'event' of undefined or null reference
              Followed by
Line: 373, Error: Object doesn't support property or method 'defineSlot'

 

So, really, is DarkReading just creating all these bugs to prove a point?
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-30481
PUBLISHED: 2021-04-10
Valve Steam through 2021-04-10, when a Source engine game is installed, allows remote authenticated users to execute arbitrary code because of a buffer overflow that occurs for a Steam invite after one click.
CVE-2021-20020
PUBLISHED: 2021-04-10
A command execution vulnerability in SonicWall GMS 9.3 allows a remote unauthenticated attacker to locally escalate privilege to root.
CVE-2021-30480
PUBLISHED: 2021-04-09
Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary code without user interaction. An attacker must be within the same organization, or an external party who has been accepted as a contact. NOTE: this is specific to the Zoom Chat softw...
CVE-2021-21194
PUBLISHED: 2021-04-09
Use after free in screen sharing in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2021-21195
PUBLISHED: 2021-04-09
Use after free in V8 in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.