1. Injection
2. Broken Authentication
3. Sensitive Data Exposure
4. XML External Entities (new)
5. Broken Access Control (merged)
6. Security Misconfiguration
7. Cross-Site Scripting
8. Insecure Deserialization (new)
9. Using Components with Known Vulnerabilities
10. Insufficient Logging & Monitoring (new)

Additional Risks to Consider

• Cross-Site Request Forgery
• Uncontrolled Resource Consumption (Resource Exhaustion, AppDoS)
• Unrestricted Upload of File with Dangerous Type
• User Interface (UI) Misrepresentation of Critical Information (Clickjacking, etc.)
• Unvalidated Forward and Redirects
• Improprer Control of Interaction Frequency (Anti-Automation)
• Inclusion of Functionality from Untrusted Control Sphere (3rd Party Content)
• Server-Side Request Forgery

• Exploitability: 3 (Easy) ■
• Weakness Prevalence: 2 (Common) ■
• Weakness Detectability: 3 (Easy) ■
• Technical Impacts: 3 (Severe) ■

Considerations

• Malicious input can come through many avenues
  • Form post
  • URL query string
  • Cookies
  • Other HTML headers
  • Database content (e.g. username)
• Injection is possible in more than just SQL
  • XPath
  • NoSQL
  • LDAP
  • GraphQL
  • JSON or XML parsers

Prevention

• Use parameters for user input
• Use whitelist server validation
• Escape special characters
• Use TOP to limit disclosure

Demo

• Exploitability: 3 (Easy) ■
• Weakness Prevalence: 2 (Common) ■
• Weakness Detectability: 2 (Average) ■
• Technical Impacts: 3 (Severe) ■

Considerations

• DNN prevents brute force attacks
• DNN prevents session reuse
• DNN warns about weak and well-know passwords
• DNN defaults to hashed passwords

Prevention

• Implement multi-factor authentication
• Ensure custom session tokens (e.g. for SSO) expire
• Follow evidence-based password policies (see https://pages.nist.gov/800-63-3/sp800-63b.html#memsecret)
  • Minimum length 8 characters
  • Maximum length 64 characters
  • Allow all characters
  • No complexity requirements
  • No password expiration unless compromised

• Exploitability: 2 (Average) ■
• Weakness Prevalence: 3 (Widespread) ■
• Weakness Detectability: 2 (Average) ■
• Technical Impacts: 3 (Severe) ■

Prevention

• Identify sensitive data
  • Financial (e.g. credit cards)
  • Health records
  • Personal information
  • Consider PCI, GDPR, etc.
• Don't store the data at all (or store a hash)
• Store encrypted data
• Transmit encrypted data (e.g. HTTPS, HSTS)

• Exploitability: 2 (Average) ■
• Weakness Prevalence: 2 (Common) ■
• Weakness Detectability: 3 (Easy) ■
• Technical Impacts: 3 (Severe) ■

Prevention

• Validate XML inputs
• Disable DTD processing when using XmlTextWriter

• Exploitability: 2 (Average) ■
• Weakness Prevalence: 2 (Common) ■
• Weakness Detectability: 2 (Average) ■
• Technical Impacts: 3 (Severe) ■

Considerations

• Insecure Direct Object References
  • IDs and paths exposed and able to be manipulated
  • Exposure can occur through APIs, hidden fields, URLs, JWT, etc.
• Missing Function Level Access Control
  • Failure to restrict functionality to the correct audience
  • For example, exposing admin functionality to all users, or authenticated functionality to unauthenticated users
  • CORS misconfiguration
  • Web API verbs (GET vs. DELETE)

Prevention

• Access control must always occur server-side
• Deny by default, unless public
• Implement access control once and reuse
• Minimize CORS usage
• Enforce record ownership, don't assume everyone can edit every record
• Disable directory browsing
• Ensure backup & metadata (e.g. .git) aren't in web root
• Log and alert on repeated access failures
• Rate limit APIs
• Invalidate JWT after logout
• Include access control in test plans

Demo

• Exploitability: 3 (Easy) ■
• Weakness Prevalence: 3 (Widespread) ■
• Weakness Detectability: 3 (Easy) ■
• Technical Impacts: 2 (Moderate) ■

Prevention

• Automate creating hardened environments
• Remove unnecessary features, components, documentation, samples, frameworks, etc.
• Schedule review of configuration, updates, patches, and permissions
• Segment application by component or tenant
• Send secure headers
• Keep detailed errors turned off
• Remove or disable default accounts

Secure Headers

See OWASP Secure Headers Project

• HTTP Strict Transport Security
• Public Key Pinning Extension for HTTP
• X-Frame-Options
• X-XSS-Protection
• X-Content-Type-Options
• Content-Security-Policy
• X-Permitted-Cross-Domain-Policies
• Referrer-Policy
• Expect-CT
• Feature-Policy

• Exploitability: 3 (Easy) ■
• Weakness Prevalence: 3 (Widespread) ■
• Weakness Detectability: 3 (Easy) ■
• Technical Impacts: 2 (Moderate) ■

Prevention

• Reject invalid input
• Escape content by default
• Escape content based on context (URL, JavaScript, HTML body, HTML attribute, etc.)
• Use AntiXssEncoder
• Enable a Content Security Policy

• Exploitability: 1 (Difficult) ■
• Weakness Prevalence: 2 (Common) ■
• Weakness Detectability: 2 (Average) ■
• Technical Impacts: 3 (Severe) ■

Considerations

• Serialized inputs can come from a variety of sources
  • Remote Process Communication
  • Inter-Process Communication
  • Web services
  • Caching/Persistence
  • File systems
  • HTTP cookies, parameters, auth tokens
• Deserializing JSON in JavaScript with eval can cause code execution
• JSON and XML deserializing in .NET can specify type names
• Also includes regular data tampering

Prevention

• Don't accept serialized input from untrusted sources
• Only deserialize into primitive types
• Use digital signatures to provide trust
• Use a whitelist of expected types
• Use a low privilege process to deserialize
• Log & monitor deserialization failures and abuses

• Exploitability: 2 (Average) ■
• Weakness Prevalence: 3 (Widespread) ■
• Weakness Detectability: 2 (Average) ■
• Technical Impacts: 2 (Moderate) ■

Considerations

• Vulnerabilities can surface in components you use directly or in their dependencies
• Vulnerabilities can surface in every level of the stack, from the OS to the database to libraries and APIs
• Monthly or quarterly patching may not be soon enough

Prevention

• Regular dependency scanning
• Remove unused dependencies

Every organization must ensure that there is an ongoing plan for monitoring, triaging, and applying updates or configuration changes for the lifetime of the application or portfolio.

• Exploitability: 2 (Average) ■
• Weakness Prevalence: 3 (Widespread) ■
• Weakness Detectability: 1 (Difficult) ■
• Technical Impacts: 2 (Moderate) ■

Considerations

• DNN provides a logging framework based on Log4Net
• DNN provides a configurable event log

Prevention

• Ensure all logins, access control failures, and input validation failures are logged with enough context and sufficiently retained
• Use a centralized log management system
• Log all details about high-value transactions
• Implement alerts for suspicious events and patterns
• Use penetration testing to validate your logging and monitoring

Other Risks

• Cross-Site Request Forgery
• Unvalidated Redirects

• https://www.owasp.org/index.php/Category:OWASP_Top_Ten_2017_Project

• https://cwe.mitre.org/