What are OWASP Top 10 vulnerabilities?

What is OWASP ?

Founded in 2001, the Open Web Application Security Project (OWASP) is a non-profit foundation whose mission is to improve the security of web applications as well as software. It is also a community project that includes a variety of initiatives such as those projects aimed at ensuring the development of process software, or incubator projects. Added to that, it is worth pointing out that when it comes to application security, the Web Application Security Project has a list of priority concerns which is updated on a regular basis.

The Open Web Application Security Project is a non-profit foundation whose activity is focused on web application security. The OWASP is based on fundamental principles, one of which relates to the availability of free of charge documents which are easily accessible through its website. This principle allows any user to make the necessary improvements in terms of security at the level of his own web applications. The OWASP therefore provides material containing tools, documents, forums or even videos which all serve the same purpose. This is the first standardization work of all secure development exercises and practices. The OWASP is not subject to the regulation of any company, it provides a neutral reference system that offers different companies support in their process of securing their web applications or in their security audit.

What are OWASP Top 10 vulnerabilities ?

 The Covid-19 pandemic has shown now that internet users can no longer do without web applications as well as the services and products that they offer.A progression that was accompanied by another less beneficial namely: security risks affecting web applications. As such, ten main risks have been identified:

1️⃣Authentication system flaw :

It takes place in the event of a disguised user attack causing a flaw in the authentication system and therefore security threats. The idea is that users are led to use weak passwords that are easy to decipher.

2️⃣Broken access control :

This is the operating limit of a user such as root privileges which are only allowed to the administrator. If the control system is broken, it can cause many flaws including the modification of the information of other users, the leak of certain information or the manipulation of metadata.

3️⃣Injection attacks :

It is done through arbitrary code injection in the web application. This attack occurs during the execution of out of control data by the existing engine in the application back-end.

4️⃣XML external entities :

It is an attack against applications parsing XML inputs and occurs in the event that a misconfiguration of the XML parser is found declining a reference to an external entity.

5️⃣Misconfiguration of Security :

In this case, the attacker has full access to the system leading to its compromise at all levels. Any application can be subject to such an attack as long as it has misconfigured permissions, poor error handling, unnecessary features, etc.

6️⃣Insecure deserialization :

This flaw can make the web application vulnerable in case it deserializes fake or malicious elements that the attacker provides and who can then execute the code remotely.

7️⃣Cross-Site Scripting (XSS) :

Each time a web application integrates unreliable data at the level of a new Internet page without it being validated, so-called XSS faults occur. These latter give the attacker the possibility of the execution of scripts in the attacked’s browser, by passing this way user sessions or directing them to malicious sites.

8️⃣Use of components declining known vulnerabilities: 

In some components, developers can ignore the inner workings of a component which implies that if the latter is vulnerable to the risk of threats due to broken code, areas of threat can be triggered during its integration to the application.

9️⃣ Lack of monitoring: 

It is an essential operation that makes it possible to guarantee the security of a web application namely: the surveillance and monitoring of connections.
Given that several vulnerable servers can serve as a rebound for the attacker, it is crucial to set up monitoring to detect an anomaly.

🔟Exposure of sensitive data :

This flaw corresponds to the exposure or disclosure of sensitive data to attackers. Such an attack can lead to identity theft, Tarnishing of reputation or financial loss.

What are OWASP recommendations to secure applications ?

Once the various attacks against web application security are identified, it is necessary to know the OWASP recommendations in terms of application security. It’s about protecting the code against injection, protecting sensitive data in transit, operating in such a way as to prevent the use of access controls by malicious attackers, preventing user session hijacking, putting an end to cross-site scripting (XSS),  establishing an infallible protection of stored data on the web application, setting up a reliable security of the development environment as well as installing code protection against XXE  flaws and insecure deserialisation..

There are web vulnerabilities facing applications and that may be subject to malicious attacks if they are used.

The OWASP represents a reference which guarantees the security of web developments initially and throughout the application life cycle. Another crucial point has to do with the fact that it is essential to carry out regular tests regarding the security of applications, part of which consists of carrying out vulnerability scans. In addition, it is essential to verify on a regular basis, compliance to OWASP and to perform further tests in the event that new vulnerabilities arise.