What is OWASP? Intro to OWASP Top 10 Vulnerabilities and Risks

The OWASP Top 10 is a widely recognized list of the most critical web application security risks. The list serves as a guide for developers, security professionals, and organizations as they prioritize their efforts in identifying and mitigating critical web application security risks. 

The presence of a risk on the OWASP Top 10 list does not necessarily indicate its prevalence or severity in all web applications, and the Top Ten is not ranked in a specific order or by priority.  

The OWASP Top 10 web application security risks for 2021 are:

1. Broken Access Controls. This vulnerability results when insufficient enforcement of access controls and authorization allow attackers to access unauthorized functionality or data. This may be due to insecure direct object references (IDORs), which can arise when an application fails to validate or authorize user input that is used as a direct reference to an internal object. It may also occur due to missing function level access controls, when the application only validates access controls at the initial authentication or authorization stage but does not consistently enforce those controls throughout the application's functions or operations. A web application firewall (WAF) can help protect against these attacks by monitoring and enforcing access controls to prevent unauthorized access to sensitive objects or resources.

2. Cryptographic failures. This risk occurs due to inadequate protection of sensitive data during transit and at rest. Cryptographic failures can lead to data breaches, unauthorized access to confidential information, and non-compliance with data privacy regulations, such as the EU General Data Protection Regulation (GDPR), and financial standards like PCI Data Security Standards (PCI DSS). These failures can result from insecure cryptographic storage, storing data in plain text, or insecure key management. The risk can also derive from information leakage, which can originate from weak key or random number generation or from flaws in cryptographic protocols. 
3. Injection attacks. Injection flaws occur when attackers insert untrusted or hostile data into command or query languages, or when user-supplied data is not validated, filtered, or sanitized by the application, leading to unintended execution of malicious commands. This risk category spans NoSQL, OS command, LDAP, and SQL injection attacks, and also includes Cross-Site Scripting (XSS), in which attackers inject malicious client-side scripts, such as JavaScript, into web pages viewed by other users. This can result in the theft of sensitive information, such as login credentials, personal data, or session cookies. A WAF can help detect and block malicious code injection attempts by inspecting and filtering incoming requests,  including reflected (non-persistent), stored (persistent), and document object module- (DOM-) based XSS, preventing them from reaching the application.
4. Insecure design. This is a broad category representing different weaknesses, expressed as missing or ineffective security controls and architectural flaws. These flaws can occur when an application is designed to rely on processes that are inherently insecure, or when needed security controls to defend against specific attacks are not implemented. These risks can be lessened through increased use of threat modeling, secure design patterns, and reference architectures.  
5. Security misconfigurations. A lack of security hardening in web application frameworks, platforms, servers, or security controls can lead to unauthorized access, exposure of sensitive information, or other security vulnerabilities. Risks due to security misconfigurations can also result from improperly configured permissions on cloud services or the installation or enablement of unnecessary features such as unused ports, services, accounts, or privileges. Misconfiguration for both web apps and APIs is a significant risk because major cloud providers have varying default security postures and architecture is increasingly becoming decentralized and distributed across a multi-cloud fabric.    
6. Vulnerable and outdated components. Using outdated, unpatched, or vulnerable components, such as libraries, frameworks, or plugins can expose applications to known security flaws, increasing the risk of exploitation. These risks can result from unsupported or out-of-date software, including the operating system (OS), web/application server, database management system (DBMS), applications, APIs, and all components, runtime environments, and libraries. These threats are particularly dangerous when organizations do not have timely, risk-based measures in place for fixing or upgrading a system’s underlying platform, frameworks, and dependencies, leaving the system open to days or weeks of unnecessary exposure to known risks. Complex software supply chains and automation via CI/CD pipelines increase the risk of introducing vulnerable software into the IT stack. A WAF can serve as a critical stopgap to guard against vulnerability exploitation.  
7. Identification and authentication failures. Weaknesses in authentication, identity, and session management can allow attackers to compromise user accounts, passwords, session tokens, or to exploit insecure session handling. Failures in these areas can permit automated attacks such as credential stuffing. Password-related vulnerabilities are the most common source of these risks, as many people reuse passwords or use default, weak, or well-known passwords. Session management issues can also lead to authentication-related attacks, particularly if user sessions or authentication tokens aren't properly invalidated during logout or a period of inactivity. Attacks that bypass authentication controls are an increasing risk for both web apps and APIs, as detailed in the OWASP Top 10, API Security Top 10, and Automated Threats projects.  
8. Software and data integrity failures. These vulnerabilities result from application code and infrastructure that fail to protect against integrity violations of data and software. This can result when an application relies upon plugins, libraries, or modules from untrusted sources, repositories, and CDNs. It can also occur during software updates, sensitive data modifications, and CI/CD pipeline changes that are not validated. Attackers can potentially upload their own updates to be distributed and run on all installations. Insecure deserialization, where an application takes untrusted serialized data and consumes that data without ensuring that it is valid, is also a part of this risk category, allowing for attacks such as remote code execution (RCE) and privilege escalation. 
9. Security logging and monitoring failures. Inadequate logging and monitoring can hinder timely detection and response to security incidents, making it difficult to identify and mitigate attacks or unauthorized activities. This can mean that auditable events, such as logins, failed logins, and high-value transactions are not identified or logged, and that applications do not detect active attacks in real-time.  
10. Server-side request forgery (SSRF). These vulnerabilities occur when an application does not validate or sanitize a URL input by a user before pulling data from a remote resource. Attackers can use these flaws to force applications to access malicious web destinations even if protected by a firewall or other defense. These attacks can also result if the targeted resource has trust relationships with other systems, such as a cloud metadata service or backend APIs, allowing an attacker to make requests to those trusted services and extract sensitive information or perform unauthorized actions. To  help mitigate SSRF, design systems for least privilege access and use a WAF to explicitly define the uniform resource identifier (URI) parameters in your security policy and allow/disallow hosts that can access them.

The 2021 OWASP Top 10 reflects some new categories and naming changes from the previous 2017 OWASP Top 10. These changes included the integration of the 2017 risk threat XML External Entities (XXE) into the 2021 Security Misconfiguration category and adding 2017 Cross-Site Scripting (XSS) to the 2021 Injection category. The 2017 risk Insecure Deserialization is now part of the 2021 Software and Data Integrity Failures category.