W serii wpisów o testach bezpieczeństwa i pentestach przyszedł czas poruszenie tematu OWASP ZAP TOP 10. W dzisiejszym artykule OWASP TOP 10 – lista listopad 2023 przedstawię Wam aktualną listę z zagrożeniami, podatnościami. Dzisiaj poruszymy tematy związane z aplikacjami webowymi, mobilnymi, API oraz LLM.
W październiku 2023 roku dołączyłem do ZAP Proxy jako „Evangelista” i przyświeca mi szerzenie wiedzy z zakresu Security. Jednocześnie – aby nie doszło do przekłamań, podatności celowo nie są tłumaczone na język polski. Do każdego otrzymujecie odnośnik czy też jak w przypadku LLM – do pełnego dokumentu.
OWASP TOP 10 – web (2021)
OWASP Top 10 to standardowy dokument uświadamiający na temat aplikacji webowych. Reprezentuje szeroki konsensus co do najważniejszych zagrożeń bezpieczeństwa aplikacji internetowych.
- A01:2021-Broken Access Control moves up from the fifth position; 94% of applications were tested for some form of broken access control. The 34 Common Weakness Enumerations (CWEs) mapped to Broken Access Control had more occurrences in applications than any other category.
- A02:2021-Cryptographic Failures shifts up one position to #2, previously known as Sensitive Data Exposure, which was broad symptom rather than a root cause. The renewed focus here is on failures related to cryptography which often leads to sensitive data exposure or system compromise.
- A03:2021-Injection slides down to the third position. 94% of the applications were tested for some form of injection, and the 33 CWEs mapped into this category have the second most occurrences in applications. Cross-site Scripting is now part of this category in this edition.
- A04:2021-Insecure Design is a new category for 2021, with a focus on risks related to design flaws. If we genuinely want to “move left” as an industry, it calls for more use of threat modeling, secure design patterns and principles, and reference architectures.
- A05:2021-Security Misconfiguration moves up from #6 in the previous edition; 90% of applications were tested for some form of misconfiguration. With more shifts into highly configurable software, it’s not surprising to see this category move up. The former category for XML External Entities (XXE) is now part of this category.
- A06:2021-Vulnerable and Outdated Components was previously titled Using Components with Known Vulnerabilities and is #2 in the Top 10 community survey, but also had enough data to make the Top 10 via data analysis. This category moves up from #9 in 2017 and is a known issue that we struggle to test and assess risk. It is the only category not to have any Common Vulnerability and Exposures (CVEs) mapped to the included CWEs, so a default exploit and impact weights of 5.0 are factored into their scores.
- A07:2021-Identification and Authentication Failures was previously Broken Authentication and is sliding down from the second position, and now includes CWEs that are more related to identification failures. This category is still an integral part of the Top 10, but the increased availability of standardized frameworks seems to be helping.
- A08:2021-Software and Data Integrity Failures is a new category for 2021, focusing on making assumptions related to software updates, critical data, and CI/CD pipelines without verifying integrity. One of the highest weighted impacts from Common Vulnerability and Exposures/Common Vulnerability Scoring System (CVE/CVSS) data mapped to the 10 CWEs in this category. Insecure Deserialization from 2017 is now a part of this larger category.
- A09:2021-Security Logging and Monitoring Failures was previously Insufficient Logging & Monitoring and is added from the industry survey (#3), moving up from #10 previously. This category is expanded to include more types of failures, is challenging to test for, and isn’t well represented in the CVE/CVSS data. However, failures in this category can directly impact visibility, incident alerting, and forensics.
- A10:2021-Server-Side Request Forgery is added from the Top 10 community survey (#1). The data shows a relatively low incidence rate with above average testing coverage, along with above-average ratings for Exploit and Impact potential. This category represents the scenario where the security community members are telling us this is important, even though it’s not illustrated in the data at this time.
Dokument prezentujący zmiany w lukach opisywanych przez OWASP.
OWASP API Security Top 10 (2023)
Bardzo ważna lista to bezpieczeństwo API, które koncentruje się na strategiach i rozwiązaniach pozwalających zrozumieć i złagodzić luki i zagrożenia bezpieczeństwa interfejsów programowania aplikacji (API).
- API1:2023 – Broken Object Level Authorization: –APIs tend to expose endpoints that handle object identifiers, creating a wide attack surface of Object Level Access Control issues. Object level authorization checks should be considered in every function that accesses a data source using an ID from the user.
- API2:2023 – Broken Authentication: – Authentication mechanisms are often implemented incorrectly, allowing attackers to compromise authentication tokens or to exploit implementation flaws to assume other user’s identities temporarily or permanently. Compromising a system’s ability to identify the client/user, compromises API security overall.
- API3:2023 – Broken Object Property Level Authorization: This category combines API3:2019 Excessive Data Exposure and API6:2019 – Mass Assignment, focusing on the root cause: the lack of or improper authorization validation at the object property level. This leads to information exposure or manipulation by unauthorized parties.
- API4:2023 – Unrestricted Resource Consumption: Satisfying API requests requires resources such as network bandwidth, CPU, memory, and storage. Other resources such as emails/SMS/phone calls or biometrics validation are made available by service providers via API integrations, and paid for per request. Successful attacks can lead to Denial of Service or an increase of operational costs.
- API5:2023 – Broken Function Level Authorization: Complex access control policies with different hierarchies, groups, and roles, and an unclear separation between administrative and regular functions, tend to lead to authorization flaws. By exploiting these issues, attackers can gain access to other users’ resources and/or administrative functions.
- API6:2023 – Unrestricted Access to Sensitive Business Flows: APIs vulnerable to this risk expose a business flow – such as buying a ticket, or posting a comment – without compensating for how the functionality could harm the business if used excessively in an automated manner. This doesn’t necessarily come from implementation bugs.
- API7:2023 – Server Side Request Forgery: Server-Side Request Forgery (SSRF) flaws can occur when an API is fetching a remote resource without validating the user-supplied URI. This enables an attacker to coerce the application to send a crafted request to an unexpected destination, even when protected by a firewall or a VPN.
- API8:2023 – Security Misconfiguration: APIs and the systems supporting them typically contain complex configurations, meant to make the APIs more customizable. Software and DevOps engineers can miss these configurations, or don’t follow security best practices when it comes to configuration, opening the door for different types of attacks.
- API9:2023 – Improper Inventory Management: APIs tend to expose more endpoints than traditional web applications, making proper and updated documentation highly important. A proper inventory of hosts and deployed API versions also are important to mitigate issues such as deprecated API versions and exposed debug endpoints.
- API10:2023 – Unsafe Consumption of APIs: Developers tend to trust data received from third-party APIs more than user input, and so tend to adopt weaker security standards. In order to compromise APIs, attackers go after integrated third-party services instead of trying to compromise the target API directly.
OWASP Mobile Top 10 (2023)
Podobnie jak wcześniejsze list – warto zwrócić uwagę gdy pracujecie przy aplikacjach mobilnych. Jako że nasz świat się globalizuje, częściej używamy komórek niż komputerów – warto aby znać, zabezpieczać się przed takimi podatnościami.
- M1: Improper Credential Usage – Improper credential usage involves situations where existing authentication data is utilized incorrectly, leading to compromised accounts and unauthorized access to resources.
- M2: Inadequate Supply Chain Security – Lack of proper security in the software supply chain, enabling attackers to manipulate, inject, or infiltrate malicious software during the software delivery process.
- M3: Insecure Authentication/Authorization – Vulnerability related to ineffective or improper implementation of authentication and authorization mechanisms, allowing attackers to take control of the system or resources.
- M4: Insufficient Input/Output Validation – Lack or insufficient validation of input and output data, opening doors to injection attacks such as SQL Injection or Cross-Site Scripting (XSS).
- M5: Insecure Communication – Unsecured communication channels can lead to data interception and Man-in-the-Middle attacks, where attackers can capture and modify communication between two parties.
- M6: Inadequate Privacy Controls – Improper management of privacy that may result in unauthorized access to personal data or violations of user privacy.
- M7: Insufficient Binary Protections – Lack of adequate security at the binary level of software, which can lead to low-level code attacks, such as buffer overflows.
- M8: Security Misconfiguration – Errors related to improper configuration of the system, application, or server, which may allow attackers to access unauthorized resources or information.
- M9: Insecure Data Storage – Ineffective or insecure practices related to data storage, potentially leading to unauthorized access to sensitive information.
- M10: Insufficient Cryptography – Insufficient use of cryptographic techniques, which can result in attackers intercepting and decrypting data.
OWASP TOP 10 for LLM (2023)
Generatywna sztuczna inteligencja rozwija się w zawrotnym tempie. Poniżej lista w wersji 1.1. kluczowych luk opracowanej przez Open Worldwide Application Security Project.
- LLM01: Prompt injection — Used to manipulate an LLM through crafty inputs, causing unintended actions.
- LLM02: Insecure output handling — Occurs when an LLM output is accepted without scrutiny, exposing backend systems.
- LLM03: Training data poisoning— Occurs when LLM training data is tampered with, introducing vulnerabilities or biases that compromise security, effectiveness, or ethical behavior.
- LLM04: Model denial of service— Happens when attackers cause resource-heavy operations on LLMs, leading to service degradation or high costs.
- LLM05: Supply chain vulnerabilities— Can manifest when an application’s lifecycle is compromised by vulnerable components or services.
- LLM06: Sensitive information disclosure— Can arise when an LLM inadvertently reveals confidential data in its responses.
- LLM07: Insecure plugin design— Results in plugins with insecure inputs and insufficient access control, leading to consequences such as remote code execution.
- LLM08: Excessive agency— Surfaces when excessive functionality, permissions, or autonomy is granted to LLM-based systems.
- LLM09: Overreliance— Crops up when systems or people become overly dependent on LLMs without oversight.
- LLM10: Model theft— Involves unauthorized access, copying, or exfiltration of proprietary LLM models.
Szerszy opis na temat tych podatności w oficjalnym dokumencie.
Podsumowanie
Głównym celem artykułu OWASP TOP 10 – lista listopad 2023 jest zachęcanie Was do przeprowadzania skanów bezpieczeństwa. W ramach takich skanów możemy wyszukać podatności i wspierać zespoły do tworzenia bezpiecznych aplikacji.
