Web Apps Are Becoming Less Secure

Critical vulnerabilities in Web applications tripled in 2018, according to a new study.

Buggy Web applications continue to be one of the biggest security weaknesses for a majority of organizations. A new report shows that in fact, the problem actually appears to be getting worse.
Positive Technologies analyzed data from Web application security assessments that the company conducted for clients throughout 2018. The analysis showed a three-fold increase in the number of critical vulnerabilities present in Web applications compared to 2017.
On average, each Web application that Positive Technologies inspected contained 33 vulnerabilities. Of those, six were high-severity flaws, compared to just two the prior year.
More than two-thirds of the apps (67%) contained critical vulnerabilities such as insufficient authorization errors, arbitrary file upload, path traversal, and SQL injection flaws. That number was higher than the 52% of applications that contained such flaws in 2017 and the 58% in 2016.
Leigh-Anne Galloway, cybersecurity resilience lead at Positive Technologies, says the companys analysis showed Web applications were consistently buggy regardless of industry or whether the app was homegrown or commercially purchased. Most Web applications have a low level of security, thats putting user and business data at risk.
The cause is not easy to pinpoint. But 83% of vulnerabilities are code vulnerabilities, and critically dangerous ones as well. This suggests that during development, not enough attention is paid to safety, Galloway says.
The security vendors analysis is consistent with that of others in recent months. In an October 2018 report,
WhiteHat Security
described the number of high-severity security vulnerabilities in Web applications as increasing at a rate that is making remediation nearly impossible for organizations using traditional methods. Microservices in particular are riddled with more serious vulnerabilities per line of code than traditional applications, WhiteHat said.
The WhiteHat
report
identified the growing use of insecure third-party components as one reason for the high and increasing prevalence of vulnerabilities in modern Web applications. The accelerating adoption of agile DevOps processes and the resulting emphasis on speedy application delivery is another factor. The quicker applications are released, particularly those that are comprised of reusable components, the faster more vulnerabilities are introduced, WhiteHat said in its report.
The trend portends major trouble for enterprise organizations. Seventy-two of the Web applications in the Positive Technologies study had vulnerabilities that enabled unauthorized access and 19% had flaws that would give an attacker complete control of the application and the underlying server. If such a server is on the network perimeter, the attacker can penetrate the internal corporate network, the security vendor said.
Seventy-nine percent of Web applications contained weaknesses that enabled access to debug and configuration information as well as source code, session identifiers, and other sensitive data. Thats the second year that the number of applications with such vulnerabilities has increased—in 2016 just 60% of applications had such issues and in 2017 that number was 70%.
Most Common Vulnerabilities
What are the most common vulnerabilities in Web applications? Positive Technologies analysis unearthed some 70 different types of vulnerabilities in total in Web apps. Security configuration errors—such as default settings, common passwords, full path disclosure, and other information-leak errors—were present in four out of five apps, making this class of vulnerability the most common. Cross-site scripting errors were present in 77% of applications; 74% had authentication-related issues; and more than half (53%) had access control flaws. In most cases, the vulnerabilities stemmed from coding errors and could only be fixed by coding changes.
Vulnerabilities associated with information leaks have become extremely widespread, Galloway says. Moreover, many applications do not protect against unauthorized access, which allows a hacker to get privileges and act more freely within the system.
Galloway says its hard to say with certainty what impact Agile and DevOps practices have had on application security. Unfortunately, not every company has a correct idea of these practices, she says. Many organizations have reinforced the view that security is hindering the development of applications and are postponing cyber defense issues in pursuit of new functionality, Galloway notes.
The reality is that code security analysis is required at all stages of application development, she notes. Using a Web application firewall is a must as well, since attackers upgrade their methods much faster than companies are able to build protection. For example, it can take weeks and months to fix code errors, and new exploits can be used by attackers a few hours or days after the appearance of vulnerability or [proof of concept] information.
Related Content:
How the Best DevSecOps Teams Make Risk Visible to Developers
Is Application Security Dead?
Taming the Chaos of Application Security: We Built an App for That
6 Serverless and Containerization Trends CISOs Should Track

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industrys most knowledgeable IT security experts. Check out the
Interop agenda
here.

Last News
▸ Sony, XBox Targeted by DDoS Attacks, Hacktivist Threats ◂ Discovered: 23/12/2024 Category: security	▸ There are plenty of online tools for reporting bugs. ◂ Discovered: 23/12/2024 Category: security	▸ 27 Million South Koreans Hit by Online Gaming Theft. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Web Apps Are Becoming Less Secure