Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

3/12/2019
06:05 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Web Apps Are Becoming Less Secure

Critical vulnerabilities in Web applications tripled in 2018, according to a new study.

Buggy Web applications continue to be one of the biggest security weaknesses for a majority of organizations. A new report shows that in fact, the problem actually appears to be getting worse.

Positive Technologies analyzed data from Web application security assessments that the company conducted for clients throughout 2018. The analysis showed a three-fold increase in the number of critical vulnerabilities present in Web applications compared to 2017.

On average, each Web application that Positive Technologies inspected contained 33 vulnerabilities. Of those, six were high-severity flaws, compared to just two the prior year.

More than two-thirds of the apps (67%) contained critical vulnerabilities such as insufficient authorization errors, arbitrary file upload, path traversal, and SQL injection flaws. That number was higher than the 52% of applications that contained such flaws in 2017 and the 58% in 2016.

Leigh-Anne Galloway, cybersecurity resilience lead at Positive Technologies, says the company's analysis showed Web applications were consistently buggy regardless of industry or whether the app was homegrown or commercially purchased. "Most Web applications have a low level of security," that's putting user and business data at risk.

The cause is not easy to pinpoint. "But 83% of vulnerabilities are code vulnerabilities, and critically dangerous ones as well. This suggests that during development, not enough attention is paid to safety," Galloway says.

The security vendor's analysis is consistent with that of others in recent months. In an October 2018 report, WhiteHat Security described the number of high-severity security vulnerabilities in Web applications as increasing at a rate that is making remediation nearly impossible for organizations using traditional methods. Microservices in particular are riddled with more serious vulnerabilities per line of code than traditional applications, WhiteHat said.

The WhiteHat report identified the growing use of insecure third-party components as one reason for the high and increasing prevalence of vulnerabilities in modern Web applications. The accelerating adoption of agile DevOps processes and the resulting emphasis on speedy application delivery is another factor. "The quicker applications are released, particularly those that are comprised of reusable components, the faster more vulnerabilities are introduced," WhiteHat said in its report.

The trend portends major trouble for enterprise organizations. Seventy-two of the Web applications in the Positive Technologies study had vulnerabilities that enabled unauthorized access and 19% had flaws that would give an attacker complete control of the application and the underlying server. "If such a server is on the network perimeter, the attacker can penetrate the internal corporate network," the security vendor said.

Seventy-nine percent of Web applications contained weaknesses that enabled access to debug and configuration information as well as source code, session identifiers, and other sensitive data. That's the second year that the number of applications with such vulnerabilities has increased—in 2016 just 60% of applications had such issues and in 2017 that number was 70%.

Most Common Vulnerabilities

What are the most common vulnerabilities in Web applications? Positive Technologies' analysis unearthed some 70 different types of vulnerabilities in total in Web apps. Security configuration errors—such as default settings, common passwords, full path disclosure, and other information-leak errors—were present in four out of five apps, making this class of vulnerability the most common. Cross-site scripting errors were present in 77% of applications; 74% had authentication-related issues; and more than half (53%) had access control flaws. In most cases, the vulnerabilities stemmed from coding errors and could only be fixed by coding changes.

"Vulnerabilities associated with information leaks have become extremely widespread," Galloway says. "Moreover, many applications do not protect against unauthorized access, which allows a hacker to get privileges and act more freely within the system."

Galloway says it's hard to say with certainty what impact Agile and DevOps practices have had on application security. "Unfortunately, not every company has a correct idea of these practices," she says. Many organizations have reinforced the view that security is hindering the development of applications and are postponing cyber defense issues in pursuit of new functionality, Galloway notes.

The reality is that code security analysis is required at all stages of application development, she notes. Using a Web application firewall is a must as well, since attackers upgrade their methods much faster than companies are able to build protection. "For example, it can take weeks and months to fix code errors, and new exploits can be used by attackers a few hours or days after the appearance of vulnerability or [proof of concept] information."

Related Content:

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Jon M. Kelley
50%
50%
Jon M. Kelley,
User Rank: Moderator
3/13/2019 | 10:49:47 AM
"...analysis showed Web applications were consistently buggy regardless of industry...", Really?
When I opened this webpage I got:

Line: 3, Error: Unable to get property 'event' of undefined or null reference
              Followed by
Line: 167, Error: Object doesn't support property or method 'defineSlot'
              Followed by
Line: 441, Error: Unable to get property 'offsetParent' of undefined or null reference

 

             ...and when I tried to post this comment, I got:
Line: 138, Error: '$' is undefined
              Followed by
Line: 3, Error: Unable to get property 'event' of undefined or null reference
              Followed by
Line: 373, Error: Object doesn't support property or method 'defineSlot'

 

So, really, is DarkReading just creating all these bugs to prove a point?
COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/5/2020
How AI and Automation Can Help Bridge the Cybersecurity Talent Gap
Peter Barker, Chief Product Officer at ForgeRock,  6/1/2020
Cybersecurity Spending Hits 'Temporary Pause' Amid Pandemic
Kelly Jackson Higgins, Executive Editor at Dark Reading,  6/2/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: What? IT said I needed virus protection!
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13881
PUBLISHED: 2020-06-06
In support.c in pam_tacplus 1.3.8 through 1.5.1, the TACACS+ shared secret gets logged via syslog if the DEBUG loglevel and journald are used.
CVE-2020-13883
PUBLISHED: 2020-06-06
In WSO2 API Manager 3.0.0 and earlier, WSO2 API Microgateway 2.2.0, and WSO2 IS as Key Manager 5.9.0 and earlier, Management Console allows XXE during addition or update of a Lifecycle.
CVE-2020-13871
PUBLISHED: 2020-06-06
SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.
CVE-2020-13864
PUBLISHED: 2020-06-05
The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from a stored XSS vulnerability. An author user can create posts that result in a stored XSS by using a crafted payload in custom links.
CVE-2020-13865
PUBLISHED: 2020-06-05
The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from multiple stored XSS vulnerabilities. An author user can create posts that result in stored XSS vulnerabilities, by using a crafted link in the custom URL or by applying custom attributes.