OWASP Top 10 2010

A1 - Injection

High Severity

Injection flaws, such as SQL, OS, and LDAP injection, occur when untrusted data is sent to an interpreter as part of a command or query. The attacker's hostile data can trick the interpreter into executing unintended commands or accessing unauthorized data.

Common Examples:

• SQL Injection: Where an attacker modifies database queries to steal or manipulate data
• Command Injection: Where an attacker executes system commands on the server
• LDAP Injection: Where an attacker manipulates LDAP statements

// Vulnerable code$query = "SELECT * FROM users WHERE username = '" . $username . "'";// If $username = "admin' --"// The query becomes: SELECT * FROM users WHERE username = 'admin' --'// Which allows authentication bypass

Prevention:

Use parameterized queries, input validation, and proper escaping of user input to prevent injection attacks.

A2 - Cross-Site Scripting (XSS)

High Severity

XSS flaws occur whenever an application takes untrusted data and sends it to a web browser without proper validation and escaping. XSS allows attackers to execute scripts in the victim's browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites.

Types of XSS:

• Stored XSS: Malicious script is permanently stored on the target server
• Reflected XSS: Malicious script is reflected off a web server, such as in an error message
• DOM-based XSS: The vulnerability exists in client-side code rather than server-side code

// Vulnerable code that reflects user input back without sanitizationecho "Hello, " . $_GET['name'] . "!";// If the URL contains ?name=// The script will be executed in the victim's browser

Prevention:

Proper output encoding, input validation, and implementing Content Security Policy (CSP) help mitigate XSS vulnerabilities.

A3 - Broken Authentication and Session Management

High Severity

Application functions related to authentication and session management are often implemented incorrectly, allowing attackers to compromise passwords, keys, or session tokens, or to exploit other implementation flaws to assume other users' identities.

Common Flaws:

• Predictable session tokens
• Session IDs exposed in URLs
• Improper credential storage
• Failure to invalidate session IDs on logout
• Timeouts that are too long or not implemented

Prevention:

Implement secure authentication mechanisms, use secure session management techniques, and employ multi-factor authentication where possible.

A4 - Insecure Direct Object References

Medium Severity

A direct object reference occurs when a developer exposes a reference to an internal implementation object, such as a file, directory, or database key. Without proper access control checks, attackers can manipulate these references to access unauthorized data.

// Code that allows access based directly on an ID parameter$account = Account.find(params[:id]);// An attacker can change the ID to access other accounts// https://example.com/account/view?id=1002

Prevention:

Use indirect object references (maps), ensure proper access control checks, and avoid exposing real keys or identifiers directly to users.

A5 - Cross-Site Request Forgery (CSRF)

High Severity

CSRF attacks force a logged-on victim's browser to send a forged HTTP request, including the victim's session cookie and any other automatically included authentication information, to a vulnerable web application. This allows the attacker to force the victim's browser to generate requests that the vulnerable application thinks are legitimate requests from the victim.

// A malicious site might contain:// If the victim is logged into example.com, the transfer will execute

Prevention:

Implement anti-CSRF tokens, enforce same-origin policies, and verify the origin of requests through headers or referrer checking.

A6 - Security Misconfiguration

High Severity

Security misconfiguration is a commonly found issue, resulting from insecure default configurations, incomplete or ad hoc configurations, open cloud storage, misconfigured HTTP headers, and verbose error messages containing sensitive information.

Common Issues:

• Default accounts with unchanged passwords
• Directory listing enabled
• Verbose error messages containing stack traces
• Unnecessary features enabled
• Outdated software components

Prevention:

Implement hardening processes, run automated security scans, ensure proper patch management, and establish secure configuration baselines.

A7 - Insecure Cryptographic Storage

High Severity

Web applications frequently fail to encrypt sensitive data, such as credit card information, SSNs, and authentication credentials, with appropriate algorithms and protocols. When applications store this data improperly, attackers can steal or modify it to conduct identity theft, credit card fraud, or other crimes.

Common Mistakes:

• Storing sensitive data in plaintext
• Using weak encryption algorithms
• Insecure key storage and management
• Not encrypting data at rest and in transit

Prevention:

Encrypt sensitive data using standard protocols, properly manage encryption keys, hash passwords with strong salted hashing algorithms, and securely handle cryptographic operations.

A8 - Failure to Restrict URL Access

Medium Severity

Many web applications check URL access rights before rendering protected links and buttons but do not enforce the same check when users request those URLs directly. Attackers can forge URLs to access hidden pages, administration screens, or perform privileged actions.

Common Vulnerabilities:

• Protected pages accessible by URL manipulation
• Admin interfaces publicly accessible
• Lack of role-based access control in the application layer
• Determinable directory listing

// An attacker might try:https://example.com/admin/delete_user?id=5// Even if the UI doesn't show this link, // if the application doesn't enforce access control // at the server level, the operation may succeed

Prevention:

Implement proper access controls in the application layer, enforce role-based access control, and use "deny by default" approach for all protected resources.

A9 - Insufficient Transport Layer Protection

High Severity

Applications frequently fail to encrypt network traffic, allowing sensitive communication to be exposed. When transport layer protection is insufficient, attackers can eavesdrop on network traffic, stealing authentication credentials, session information, and other sensitive data.

Common Issues:

• Lack of SSL/TLS on pages that handle sensitive data
• Weak SSL/TLS configurations
• Mixed content (HTTP resources on HTTPS pages)
• No use of HSTS (HTTP Strict Transport Security)

Prevention:

Use HTTPS for all authenticated connections, implement HSTS, employ strong encryption protocols, and avoid mixed content on secure pages.

A10 - Unvalidated Redirects and Forwards

Medium Severity

Web applications frequently redirect and forward users to other pages and websites, and use untrusted data to determine the destination pages. Without proper validation, attackers can redirect victims to phishing or malware sites, or use forwards to access unauthorized pages.

// Vulnerable code that redirects based on user inputheader("Location: " . $_GET['url']);// An attacker could craft a URL like:// https://example.com/redirect?url=https://malicious-site.com

Prevention:

Avoid using redirects and forwards where possible, use whitelisting of allowed URLs, and validate user-supplied input used in redirects.