OWASP Top 10 2021 Presentation (Jul 2022)

2021
Tzahi Arabov
Sr. IT Security Engineer, Information Security @ JET (Jul 2022)

Who is the OWASP® Foundation
The Open Web Application Security Project® (OWASP) is a nonprofit
foundation that works to improve the security of software.
Through community-led open-source software projects, hundreds of
local chapters worldwide, tens of thousands of members, and leading
educational and training conferences, the OWASP Foundation is the
source for developers and technologists to secure the web.
● Tools and Resources
● Community and Networking
● Education & Training

OWASP London
The chapter board is Sam Stepanyan, Sherif Mansour and Andra Lezza.
Common Weakness Enumeration (CWE)
Amongst Sherif Mansour’s numerous OWASP Org contributions, he has
taken an active role in mapping the many different CWEs to the ‘OWASP
Top 10 2021’ list.

OWASP Top 10:2021 List
A01 Broken Access Control
A02 Cryptographic Failures
A03 Injection
A04 Insecure Design
A05 Security Misconfiguration
A06 Vulnerable and Outdated Components
A07 Identification and Authentication Failures
A08 Software and Data Integrity Failures
A09 Security Logging and Monitoring Failures
A10 Server Side Request Forgery (SSRF)

What's changed in the Top 10 for 2021
There are three new categories, four categories with naming and scoping
changes, and some consolidation in the Top 10 for 2021. We've changed names
when necessary to focus on the root cause over the symptom.

A01:2021 - Broken Access Control
A01:2021-Broken Access Control moves up from the fifth
position to the category with the most serious web application
security risk; the contributed data indicates that on average, 3.81%
of applications tested had one or more Common Weakness
Enumerations (CWEs) with more than 318k occurrences of CWEs
in this risk category. The 34 CWEs mapped to Broken Access
Control had more occurrences in applications than any other
category.

Description
Access control enforces policy such that users cannot act
outside of their intended permissions. Failures typically lead
to unauthorized information disclosure, modification, or
destruction of all data or performing a business function
outside the user's limits. Common access control
vulnerabilities include:

Vulnerabilities:
● Information Disclosure
● Information Modification (e.g. delete, deform, etc.)
● Insecure Direct Object Reference / Horizontal Access (permitting the viewing / editing someone
else’s account by providing a unique identifier)
● Violation Of The Principle Of Least Privilege
● Bypassing Access Control Checks (by URL modification / HTML page)
● Accessing an API with missing Access Controls (for POST, PUT, DELETE)
● Metadata manipulation, such as replaying or tampering with a JSON Web Token (JWT)
access control token, or a cookie or hidden field manipulated to elevate privileges or
abusing JWT invalidation
● CORS misconfiguration allows API access from unauthorized/untrusted origins.
● Force-browsing to unauthenticated pages as an unauthenticated user / privileged pages as a
standard user

Prevention Methods:
● Deny By Default
● Implement Access Control Mechanism Once, Then Re-Use Throughout The App
● Enforce Record Ownership (rather than accepting that a user can create / read / update / delete any
record)
● Log Access Control Failures (monitoring / logging, check the logs for access control failures)
● Rate-Limit APIs & Controller Access (to minimize harm from automated attack tooling, e,g, botnets)

Example:
App

Example:
App
Users

Example:
App
Users Attackers

Example:
App
Users Attackers
Access Control

Example:
App
Users Attackers
Access Control
API URLs

Example of an API endpoint at:
‘mail.contoso.com/messages/1234’
Maliciously modifying the ‘id’ to /’5678’
At the backend:
“SELECT id, data from
messages where ID=1234” App
Attackers
API URLs

Example of an API endpoint at:
‘mail.contoso.com/messages/1234’
Maliciously modifying the ‘id’ to /’5678’
Avoid that - by input sanitization
“SELECT id, data from
messages where ID=1234
AND
message.owner = owner”
App
Attackers
API URLs

Examples of a Force-Browsing technique:
‘www.contoso.com/app/get_info’:
An unauthenticated user manages to access the ‘get_info’ web page, simply by manually typing this
address into the browser’s URL field then surfing there
‘www.contoso.com/admin_get_info’:
A non-admin user or an unauthenticated user manages to access the ‘admin_get_info’ web page,
simply by manually typing this address into the browser’s URL field then surfing there

Good Access Control Features Are Hard To Be
Added Into An Application, Late In Its Development
Lifecycle
So,
Let’s Make Certain To Begin Implementing
Access Control Early Into The SDLC

List of 34 Mapped CWEs URL:
https://owasp.org/Top10/A01_2021-Broken_Access_Control/#list-of-mapped-cwes

A02:2021 - Cryptographic Failures
A02:2021-Cryptographic Failures shifts up one position
to #2, previously known as A3:2017-Sensitive Data
Exposure, which was broad symptom rather than a root
cause. The renewed name focuses on failures related to
cryptography as it has been implicitly before. This category
often leads to sensitive data exposure or system
compromise.

Description
The first thing is to determine the protection needs of data in transit and at
rest. For example, passwords, credit card numbers, health records,
personal information, and business secrets require extra protection,
mainly if that data falls under privacy laws, e.g., EU's General Data
Protection Regulation (GDPR), or regulations, e.g., financial data
protection such as PCI Data Security Standard (PCI DSS).

Prevention Methods:
● Perform application data classification (for sensitive data / non-sensitive)
● Do not store sensitive data unnecessarily - discard as soon as possible (for
PCI-DSS, use compliant tokenization or truncation)
● Enforce HTTPS across the board
● Use trusted libraries for cryptography (Google Tink, etc.)
● Encrypt all sensitive data at-rest
● Do not automatically decrypt your data
● Use strong cypher suites, algorithms, protocols and keys
● Make certain Key Management is in place

Example 1: Injection Attack
App
Users

App
Users
SQL Query
Credit
card ##’s

Avoid auto-decryption App
Users
SQL Query
Credit
card ##’s
Attacker
Injection

Example 2: Sniffing Attack
App
Users
SQL Query
Credit
card ##’s
Attacker
Injection
URL1:
HTTPS://azure.contoso.com
URL 2:
HTTP://finance.contoso.com

https://owasp.org/Top10/A02_2021-Cryptographic_Failures/#list-of-mapped-cwes

A03:2021 - Injection
A03:2021-Injection slides down to the third position. 94%
of the applications were tested for some form of injection
with a max incidence rate of 19%, an average incidence
rate of 3.37%, and the 33 CWEs mapped into this category
have the second most occurrences in applications with
274k occurrences. Cross-site Scripting is now part of this
category in this edition.

Description
Some of the more common injections are SQL, NoSQL, OS command, Object Relational Mapping (ORM),
LDAP, and Expression Language (EL) or Object Graph Navigation Library (OGNL) injection. The concept
is identical among all interpreters. Source code review is the best method of detecting if applications are
vulnerable to injections. Automated testing of all parameters, headers, URL, cookies, JSON, SOAP, and
XML data inputs is strongly encouraged. Organizations can include static (SAST), dynamic (DAST), and
interactive (IAST) application security testing tools into the CI/CD pipeline to identify introduced injection
flaws before production deployment.
Injection types:
● SQL (Sequel)
● LDAP (Lightweight Directory Access Protocol)
● OGNL (Object Graph Navigation Library)
● XSS (Cross-Site Scripting)

Apps Are Typically Vulnerable To Injection Attacks:
● When user-supplied data is not validated, filtered or sanitized by the App
● When dynamic queries or non-parameterized calls, with no escaping context
are used directly in the App’s interpreter
● When hostile data is being directly used (SQL injection, etc.) and contain the
structure and malicious dynamic query data / commands / stored procedures

Prevention Methods:
● Keep the data separate from the commands / queries
● Parameterize the queries
● With APIs, use a safe API that would avoid using the interpreter entirely /
would provide a parameterized interface / migrate to an Object Relational
Mapping (ORM) tool
● In general, use positive server-side input validations
● Special characters (Hebrew, etc.) - escape those using the interpreter’s
specific escape syntax

Example: Injection Attack
App
Users
Input
DB
URL:
http://contoso.com/app/accountView?
id=
Query
SELECT * FROM accounts WHERE custID = ‘ “ + getParam “id” + ‘ “ ;
Calling the “id” value from the URL,
into the SQL statement

Example: Injection Attack
App
Users
Input
DB
URL:
http://contoso.com/app/accountView?
id=‘OR‘ ‘1’ = ‘1’
Query
SELECT * FROM accounts WHERE CustID = ‘ “ + getParam “id” + ‘ “ ;
Calling the “id” value from the URL,
into the SQL statement
SELECT * FROM accounts WHERE CustID = “‘OR’ ‘1’ = ‘1’;
Injected SQL statement

The Nature of An Injection Is:
● When an attacker injects code into a user’s provided data, yet the App does not validate / sanitize
the data and rather sends it back - the DB will eventually run the command with the attacker’s
supplied input
An LDAP attack would compromise files, user accounts, printer structure, etc., as it interacts with an
LDAP server
Prevention Methods:
● For SQL, use limits / other sequel controls within the query, to limit the data to be compromised if
breached:
SELECT * FROM accounts WHERE CustID = ‘ “ + getParam “id” + ‘ “ ;
LIMIT ^^

https://owasp.org/Top10/A03_2021-Injection/#list-of-mapped-cwes

A04:2021 - Insecure Design
A04:2021-Insecure Design is a new category for 2021,
with a focus on risks related to design flaws. If we
genuinely want to "move left" as an industry, we need more
threat modeling, secure design patterns and principles, and
reference architectures. An insecure design cannot be
fixed by a perfect implementation as by definition, needed
security controls were never created to defend against
specific attacks.

Description
Insecure design is a broad category representing different weaknesses, expressed as “missing or
ineffective control design.” Insecure design is not the source for all other Top 10 risk categories.
There is a difference between insecure design and insecure implementation. We differentiate
between design flaws and implementation defects for a reason, they have different root causes
and remediation. A secure design can still have implementation defects leading to vulnerabilities
that may be exploited. An insecure design cannot be fixed by a perfect implementation as by
definition, needed security controls were never created to defend against specific attacks. One of
the factors that contribute to insecure design is the lack of business risk profiling inherent in the
software or system being developed, and thus the failure to determine what level of security design
is required.

● Deals with risks that are related to design and architectural flaws, where a software was
designed insecurely, no amount of security, technology or functionality could assist with its
fundamental flaws
● Secure design is a culture / methodology that constantly evaluates threats and ensures that
code is robustly designed and tested to prevent known attacks methods into our Apps
● Secure software requires a secure development lifecycle, secure design pattern, secure
component libraries, tooling, threat modeling
● Incorporate the information security team from the beginning of software projects,
throughout the maintenance phases of the software and throughout the lifecycle of the
code
● Use threat-modeling for critical authentication, access control, business logic, key flows
throughout the App, write tests to validate that all the critical flows are resistant to threat
models
● Compile use-cases and misuse-cases for every tier of the App

https://owasp.org/Top10/A04_2021-Insecure_Design/#list-of-mapped-cwes

A05:2021 - Security Misconfiguration
A05:2021-Security Misconfiguration moves up from #6 in the
previous edition; 90% of applications were tested for some form
of misconfiguration, with an average incidence rate of 4.5%, and
over 208k occurrences of CWEs mapped to this risk category.
With more shifts into highly configurable software, it's not
surprising to see this category move up. The former category for
A4:2017-XML External Entities (XXE) is now part of this risk
category.

Applies to:
● When security configuration components do exist within the App, but are not
configured correctly (default password was not changed, etc.)
Understanding The Vulnerabilities:
● Unnecessary features are enabled or installed
● Default accounts and their passwords are still enabled / unchanged
● The latest security features are disabled by default, make certain to enable them
● The server / App server does not send security headers / directives or those are
not set to secured values, the software is out of date or vulnerable

Prevention Methods:
● Review security hardening guides for each framework that is being used for our Apps and follow the
hardening guides’ steps
● For TLS, (Mozilla’s SSL Config Generator & SSL Score, etc.)
● A repeatable hardening process that makes it fast and easy to deploy, another environment that is
appropriately locked down (modern applications, automation, spanning up containerized
microservices, etc.)
● In the Apps, have a minimal platform, that removes any kind of unnecessary features / components /
frameworks
● Consider sending security directives to clients (security headers, HTTP Strict Transport Security /
HSTS, etc.)
● Automated process to verify the effectiveness of the configurations and settings in all environments

https://owasp.org/Top10/A05_2021-Security_Misconfiguration/#list-of-mapped-
cwes

A06:2021 - Vulnerable & Outdated Components
A06:2021-Vulnerable and Outdated Components was previously
titled Using Components with Known Vulnerabilities and is #2 in
the Top 10 community survey, but also had enough data to make
the Top 10 via data analysis. This category moves up from #9 in
2017 and is a known issue that we struggle to test and assess risk.
It is the only category not to have any Common Vulnerability and
Exposures (CVEs) mapped to the included CWEs, so a default
exploit and impact weights of 5.0 are factored into their scores.

Description
You are likely vulnerable:
● If you do not know the versions of all components you use (both client-side and server-side). This includes components you directly use as
well as nested dependencies.
● If the software is vulnerable, unsupported, or out of date. This includes the OS, web/application server, database management system
(DBMS), applications, APIs and all components, runtime environments, and libraries.
● If you do not scan for vulnerabilities regularly and subscribe to security bulletins related to the components you use.
● If you do not fix or upgrade the underlying platform, frameworks, and dependencies in a risk-based, timely fashion. This commonly happens
in environments when patching is a monthly or quarterly task under change control, leaving organizations open to days or months of
unnecessary exposure to fixed vulnerabilities.
● If software developers do not test the compatibility of updated, upgraded, or patched libraries.
● If you do not secure the components’ configurations (see A05:2021-Security Misconfiguration).

Prevention Methods:
● Patch Management - ensure there is an ongoing plan for monitoring, triaging and
applying updates and configuration changes, over the whole SDLC
● Remove unused software dependencies, unnecessary features / components
(‘OWASP Dependency Check’, etc.)
● Continuously inventory the component versions of both the client-side and server-
side software
● Use only components from official sources, over secure links
● Monitor for libraries and components that are not maintained anymore, or stopped
creating security patches for older versions (‘DependaBot’, etc.)
● Stay one step below the bleeding-edge - the ‘Log4J’ vulnerability did get patched,
yet the first patches post-CVE were vulnerable still

https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components/#list-
of-mapped-cwes

A07:2021 - Identification & Authentication Failures
A07:2021-Identification and Authentication Failures
was previously Broken Authentication and is sliding
down from the second position, and now includes CWEs
that are more related to identification failures. This
category is still an integral part of the Top 10, but the
increased availability of standardized frameworks seems
to be helping.

Vulnerabilities:
● Brute-Force attack
● Proper Session timeout
● Credential Stuffing attack

Prevention Methods:
● Implement multi-factor authentication (MFA)
● Change system’s default account names and rotate default passwords,
prior to deployment in production environments
● Adhere to the corporate’s password policy guidelines if exists, or implement a
strict password policy instead
● Do not re-use the same password in more than one service, as breached
sites’ accounts find their way to the internet

Prevention Methods:
● Run password checks for complexity of new & changed passwords, verify your
passwords against well-known on-line password databases, for common
passwords & compromised ones (NIST standard 800-63B, etc.)
● Delay failed login attempts, yet provide self-account recovery portal (e.g.
https://passwordreset.microsoftonline.com) for legit users
● Use server-side, secure built-in session managers, that generate new random
session IDs with high entropy, post login
● Do not store session identifiers within URLs, but instead in highly-secured
environments
● Invalidate sessions after logout and after a certain amount of time

https://owasp.org/Top10/A07_2021-
Identification_and_Authentication_Failures/#list-of-mapped-cwes

A08:2021 - Software & Data Integrity Failures
A08:2021-Software and Data Integrity Failures is a new
category for 2021, focusing on making assumptions related to
software updates, critical data, and CI/CD pipelines without
verifying integrity. One of the highest weighted impacts from
Common Vulnerability and Exposures/Common Vulnerability
Scoring System (CVE/CVSS) data mapped to the 10 CWEs in this
category. A8:2017-Insecure Deserialization is now a part of this
larger category.

Description
Software and data integrity failures relate to code and infrastructure that does not protect
against integrity violations. An example of this is where an application relies upon plugins,
libraries, or modules from untrusted sources, repositories, and content delivery networks
(CDNs). An insecure CI/CD pipeline can introduce the potential for unauthorized access,
malicious code, or system compromise. Lastly, many applications now include auto-update
functionality, where updates are downloaded without sufficient integrity verification and
applied to the previously trusted application. Attackers could potentially upload their own
updates to be distributed and run on all installations. Another example is where objects or
data are encoded or serialized into a structure that an attacker can see and modify is
vulnerable to insecure deserialization.

Vulnerabilities:
● Software updates that lack integrity checks
● Critical data
● CI/CD pipelines that lack software integrity verification
● An App that relies on plug-ins, libraries, untrusted sources, CDNs
● IoT devices (TVs, air con, routers, access points, light bulbs, door bells, etc.)
● Monitoring software w/ propagated update mechanism (e.g. SolarWinds)

Prevention Methods:
● Implement digital signatures (checksums or hash algorithms) to verify the
software from the expected source
● Make certain that the libraries and dependencies are consuming trusted
repositories
● Utilize the ‘OWASP Dependency Check’ or ‘OWASP CycloneDX’ to ensure
that the software supply-chain is verified and that compromised tools or
software are not propagating the Development / Testing / QA environments
● Implement a review process for code and configuration changes
● CI/CD pipeline has proper segregation, access control and configuration to
ensure the integrity of the code that flows through there

https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/#list-
of-mapped-cwes

A09:2021 - Security Logging & Monitoring Failures
A09:2021-Security Logging and Monitoring Failures was
previously A10:2017-Insufficient Logging & Monitoring
and is added from the Top 10 community survey (#3), moving
up from #10 previously. This category is expanded to include
more types of failures, is challenging to test for, and isn't well
represented in the CVE/CVSS data. However, failures in this
category can directly impact visibility, incident alerting, and
forensics.

Description
Returning to the OWASP Top 10 2021, this category is to help detect, escalate, and respond to active breaches. Without logging and
monitoring, breaches cannot be detected. Insufficient logging, detection, monitoring, and active response occurs any time:
● Auditable events, such as logins, failed logins, and high-value transactions, are not logged.
● Warnings and errors generate no, inadequate, or unclear log messages.
Logs of applications and APIs are not monitored for suspicious activity.
● Logs are only stored locally.
● Appropriate alerting thresholds and response escalation processes are not in place or effective.
● Penetration testing and scans by dynamic application security testing (DAST) tools (e.g. ‘OWASP ZAP’) do not trigger alerts.
● The application cannot detect, escalate, or alert for active attacks in real-time or near real-time.
You are vulnerable to information leakage by making logging and alerting events visible to a user or an attacker (see A01:2021-Broken
Access Control).

Is There Sufficient Logging In Place, Are Existing Logs Monitored:
● Auditable events
● Access control, login attempts for both successful and unsuccessful ones
● High-value transactions
● Warnings and errors that do not generate log messages
● Error messages
● Application logs
● Server-side input validation logs
● APIs that are not monitored for suspicious activities
● Once Apps move from Staging to Production environments, do we align proper logging for
the environment
● Are there off-site logs backups, cloud services logging backups and 3rd-party vendor
services ones

Is There Sufficient Logging In Place, Are Existing Logs Monitored:
● Are there appropriate alerting thresholds and response escalation processes in place
● Ensure sufficient log data is enabled / exist, to distinguish between suspicious or malicious
activities
● Make certain the logs are generated in known formats (compatibility for the authorities
systems)
● Make certain that the log data is encoded correctly, to prevent injection attacks on the log
monitoring systems
● For active attack scenarios, appropriate detection and escalation capabilities are required for
both real-time and past incidents
● Log retention, to allow for both internal and external forensics to take place
● Adopt an Incident Response (IR) team and a Disaster Recovery Plan (DRP)

https://owasp.org/Top10/A09_2021-
Security_Logging_and_Monitoring_Failures/#list-of-mapped-cwes

A10:2021 - Server-Side Request Forgery (SSRF)
A10:2021-Server-Side Request Forgery is added from the
Top 10 community survey (#1). The data shows a relatively
low incidence rate with above average testing coverage,
along with above-average ratings for Exploit and Impact
potential. This category represents the scenario where the
security community members are telling us this is important,
even though it's not illustrated in the data at this time.

Description
SSRF flaws occur whenever a web application is fetching a remote resource without
validating the user-supplied URL. It allows an attacker to coerce the application to
send a crafted request to an unexpected destination, even when protected by a
firewall, VPN, or another type of network Access Control List (ACL).
As modern web applications provide end-users with convenient features, fetching a
URL becomes a common scenario. As a result, the incidence of SSRF is increasing.
Also, the severity of SSRF is becoming higher due to cloud services and the
complexity of architectures.

Vulnerability Explained:
Whenever a Web App fetches a remote resource, without validating a user-
supplied URL, it effectively allows an attacker to coerce the App to send a request
to an unexpected destination, even when the destination is protected with a VPN /
firewall

Prevention Methods:
Network Layer:
● Segment the network, move remote resource functionality to a separate network
● Enforce a deny-by-default network policy
● Log all accepted / blocked network flow events on the firewall
Application Layer:
● Sanitize and validate all the client-supplied input data
● Enforce the URL schema, the port and the destination with a positive allow-list

Example: SSRF
App
Users
Online
Shopping
Is an item in
stock ?

Example: SSRF
App
Users
Online
Shopping
HTTP
Request
REST API
POST / Product / Stock / HTTP v1.0
Content Type
Content Length
Is an item in
stock ?

Example: SSRF
App
Users
Online
Shopping
HTTP
Request
REST API
Content Type
Content Length
Is an item in
stock ?
URL to be sent back to the RESTful API endpoint:
StockAPI=http://stock.contoso.com/…

Example: SSRF
App
Users
Online
Shopping
HTTP
Request
REST API
Content Type
Content Length
Is an item in
stock ?
URL to be sent back to the RESTful API endpoint:
StockAPI=http://stock.contoso.com/…
A forged request to an
unexpected endpoint will be
sent from the App / server-
side
An attacker modifies a URL
Modified API URL:
StockAPI=http://localhost/admin

Mapped CWE URL:
https://owasp.org/Top10/A10_2021-Server-
Side_Request_Forgery_%28SSRF%29/#list-of-mapped-cwes

OWASP Top 10 2021 Presentation (Jul 2022)

More Related Content

What's hot

Similar to OWASP Top 10 2021 Presentation (Jul 2022)

Recently uploaded

OWASP Top 10 2021 Presentation (Jul 2022)

Editor's Notes