Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

3/12/2019
06:05 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Web Apps Are Becoming Less Secure

Critical vulnerabilities in Web applications tripled in 2018, according to a new study.

Buggy Web applications continue to be one of the biggest security weaknesses for a majority of organizations. A new report shows that in fact, the problem actually appears to be getting worse.

Positive Technologies analyzed data from Web application security assessments that the company conducted for clients throughout 2018. The analysis showed a three-fold increase in the number of critical vulnerabilities present in Web applications compared to 2017.

On average, each Web application that Positive Technologies inspected contained 33 vulnerabilities. Of those, six were high-severity flaws, compared to just two the prior year.

More than two-thirds of the apps (67%) contained critical vulnerabilities such as insufficient authorization errors, arbitrary file upload, path traversal, and SQL injection flaws. That number was higher than the 52% of applications that contained such flaws in 2017 and the 58% in 2016.

Leigh-Anne Galloway, cybersecurity resilience lead at Positive Technologies, says the company's analysis showed Web applications were consistently buggy regardless of industry or whether the app was homegrown or commercially purchased. "Most Web applications have a low level of security," that's putting user and business data at risk.

The cause is not easy to pinpoint. "But 83% of vulnerabilities are code vulnerabilities, and critically dangerous ones as well. This suggests that during development, not enough attention is paid to safety," Galloway says.

The security vendor's analysis is consistent with that of others in recent months. In an October 2018 report, WhiteHat Security described the number of high-severity security vulnerabilities in Web applications as increasing at a rate that is making remediation nearly impossible for organizations using traditional methods. Microservices in particular are riddled with more serious vulnerabilities per line of code than traditional applications, WhiteHat said.

The WhiteHat report identified the growing use of insecure third-party components as one reason for the high and increasing prevalence of vulnerabilities in modern Web applications. The accelerating adoption of agile DevOps processes and the resulting emphasis on speedy application delivery is another factor. "The quicker applications are released, particularly those that are comprised of reusable components, the faster more vulnerabilities are introduced," WhiteHat said in its report.

The trend portends major trouble for enterprise organizations. Seventy-two of the Web applications in the Positive Technologies study had vulnerabilities that enabled unauthorized access and 19% had flaws that would give an attacker complete control of the application and the underlying server. "If such a server is on the network perimeter, the attacker can penetrate the internal corporate network," the security vendor said.

Seventy-nine percent of Web applications contained weaknesses that enabled access to debug and configuration information as well as source code, session identifiers, and other sensitive data. That's the second year that the number of applications with such vulnerabilities has increased—in 2016 just 60% of applications had such issues and in 2017 that number was 70%.

Most Common Vulnerabilities

What are the most common vulnerabilities in Web applications? Positive Technologies' analysis unearthed some 70 different types of vulnerabilities in total in Web apps. Security configuration errors—such as default settings, common passwords, full path disclosure, and other information-leak errors—were present in four out of five apps, making this class of vulnerability the most common. Cross-site scripting errors were present in 77% of applications; 74% had authentication-related issues; and more than half (53%) had access control flaws. In most cases, the vulnerabilities stemmed from coding errors and could only be fixed by coding changes.

"Vulnerabilities associated with information leaks have become extremely widespread," Galloway says. "Moreover, many applications do not protect against unauthorized access, which allows a hacker to get privileges and act more freely within the system."

Galloway says it's hard to say with certainty what impact Agile and DevOps practices have had on application security. "Unfortunately, not every company has a correct idea of these practices," she says. Many organizations have reinforced the view that security is hindering the development of applications and are postponing cyber defense issues in pursuit of new functionality, Galloway notes.

The reality is that code security analysis is required at all stages of application development, she notes. Using a Web application firewall is a must as well, since attackers upgrade their methods much faster than companies are able to build protection. "For example, it can take weeks and months to fix code errors, and new exploits can be used by attackers a few hours or days after the appearance of vulnerability or [proof of concept] information."

Related Content:

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Jon M. Kelley
50%
50%
Jon M. Kelley,
User Rank: Moderator
3/13/2019 | 10:49:47 AM
"...analysis showed Web applications were consistently buggy regardless of industry...", Really?
When I opened this webpage I got:

Line: 3, Error: Unable to get property 'event' of undefined or null reference
              Followed by
Line: 167, Error: Object doesn't support property or method 'defineSlot'
              Followed by
Line: 441, Error: Unable to get property 'offsetParent' of undefined or null reference

 

             ...and when I tried to post this comment, I got:
Line: 138, Error: '$' is undefined
              Followed by
Line: 3, Error: Unable to get property 'event' of undefined or null reference
              Followed by
Line: 373, Error: Object doesn't support property or method 'defineSlot'

 

So, really, is DarkReading just creating all these bugs to prove a point?
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
MITRE Releases 2019 List of Top 25 Software Weaknesses
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2019
7 Ways VPNs Can Turn from Ally to Threat
Curtis Franklin Jr., Senior Editor at Dark Reading,  9/21/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16695
PUBLISHED: 2019-09-22
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter.php table parameter when action=add is used.
CVE-2019-16696
PUBLISHED: 2019-09-22
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit.php table parameter when action=add is used.
CVE-2018-21018
PUBLISHED: 2019-09-22
Mastodon before 2.6.3 mishandles timeouts of incompletely established sessions.
CVE-2019-16692
PUBLISHED: 2019-09-22
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter-result.php table parameter when action=add is used.
CVE-2019-16693
PUBLISHED: 2019-09-22
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/order.php table parameter when action=add is used.