Web applications are the most used tools by organizations around the world. They offer a variety of benefits for companies ranging from streamlining processes, optimizing communications and digitizing services. However, web applications have also become the #1 target for the exploitation of vulnerabilities.
According to the Acunetix’s report “Web Application Vulnerability 2019”, web application weaknesses are the most critical threat for enterprises. In order to address this problem, companies need new approaches to mitigate vulnerabilities at the network layer.
Finding an appropriate cybersecurity strategy should certainly be a priority task in 2019. For this, it is necessary to know the risks we face.
Here, we lay out the most common vulnerabilities according to the Acunetix study:
Critical Severity Vulnerabilities
Although most organizations have cybersecurity tools, traditional resources tend to be ineffective in web environments. In any case, the critical weaknesses in the web systems compromise the integrity of the processes and the confidentiality protocols. By exploiting vulnerabilities of this type, intruders can break in without special access or user interaction. In this sense, APT-style attacks are the most common.
46% of web applications have critical vulnerabilities
-
Web server vulnerabilities
Web server software are prone to security breaches. These vulnerabilities range from information disclosure to a buffer overflow that can be exploited remotely. As a result, the security hole can facilitate attacks such as remote code execution.
In this case, the most risky resources are IIS and Apache. To avoid the development of cyber attacks by these means, it is necessary to patch even the most trivial vulnerabilities in applications.
-
Vulnerabilities in WordPress
Due to its massive use, WordPress is one of the main targets of hackers. According to Acunetix, 30% of the analyzed targets had one or more vulnerabilities on their platforms.
Many of WordPress’s weaknesses are inherent in the disclosure of information. This software provides data such as user name enumeration and XML-RPC bruteforcing authentication.
In this respect, the WordPress community is working quickly to fill this type of security gap, so it is only necessary to periodically update the version of the tool.
On the other hand, the effectiveness of these security tactics does not apply to the its plugins. In this case, WordPress allows users to extend the basic functionalities of the platforms. This makes it possible for any user to generate risky adds-on and distribute them to the entire ecosystem of plugins and themes.
Vulnerabilities within the most commonly used plugins can range from the disclosure of sensitive information to SQL injection, and remote code execution.
-
JavaScript Libraries
Many web applications use older or obsolete JavaScript libraries. 33% percent of the analyzed targets depended on JS libraries with known XSS vulnerabilities.
Similarly, the most common vulnerable JavaScript libraries are the older versions of jQuery and jQuery UI; as well as the older versions of Moment.JS and YUI Library.
-
Cross-site scripting (XSS)
This vulnerability is classified into three categories: tored (Persistent) XSSReflected (Persistent) and XSSDOM-based XSS. Unlike many vulnerabilities, this problem originates from the client side due to the use of poor JS versions.
30% of web applications are vulnerable to XSS
The attacker’s objective is to make the victim inadvertently run a maliciously injected script, which is executed by a trusted web application. In this way, the cybercriminal can steal the user’s sensitive data, or even modify the design of applications to send sensitive data to any recipient.
Medium severity vulnerabilities
Medium severity vulnerabilities predominate in web applications. At this level, attackers need access to privileged users and must interact with users to enter private systems.
Besides, these vulnerabilities are often exploited along with other security breaches of varying severity to intensify the effectiveness of the attack.
87% of websites have mid-level weaknesses
-
Cross-site request forgery (CSRF)
51% of applications are susceptible to cross site request forgery, and frecuently use HTML forms without the presence of a CSRF token. With this type of vulnerability, attackers use “trusted” sites in the victim’s browser to obtain private information. In this way, each time a user executes an HTTP request to a certain application or website, the browser automatically forwards the associated cookies to the attacker.
-
Denial of Service (DoS)
18% of the analyzed targets were vulnerable to DoS; while 13% were vulnerable to a specific type of application-level HTTP denial of service known as slow HTTP denial of service (also known as Slowloris).
In the case of Applications-based DoS, the attacker can generate a costly result on the victim, using fewer requests compared to other attacks.
-
TLS/SSL Vulnerabilities
The TLS is vital for all websites; especially for sites that send and receipt confidential data. For this reason, misconfigurations of TLS, or the usage of old TLS encryptions can violate the integrity of companies through attacks such as downgrade.
While web application vulnerabilities are a constant battle for businesses of any size, automating cybersecurity tasks plays a vital role in early error detection.
At GB Advisors we have highly reliable tools such as Acunetix – Web vulnerability scanner.
Contact us to strengthen your systems.
