Top 10 Security Risks in Web Applications (and Museums)

Transcript

1. © Okta, Inc. and/or its affiliates. All rights reserved. © Okta, Inc. and/or its affiliates. All rights reserved. Top 10 Security Risks in Web Applications (and Museums) Roche HackTheLab 2025 Barcelona (he/him) José Carlos Chávez Security Software Engineer
2. © Okta, Inc. and/or its affiliates. All rights reserved. José Carlos Chávez Security Software Engineer - Okta • Open Source contributor and maintainer for 10+ years • OWASP Coraza WAF co-leader • Loving father of 2 • Mathematician in quarantine
3. © Okta, Inc. and/or its affiliates. All rights reserved.
4. © Okta, Inc. and/or its affiliates. All rights reserved. What is the OWASP Top 10? One of the oldest projects of OWASP and the appsec community It is updated every 4 years depending on current changes and data. Next update will be in Nov 2025 Awareness document for developers and web application security Most critical security risks for web applications And why is it so important?
5. © Okta, Inc. and/or its affiliates. All rights reserved. A09: Security Logging and Monitoring Failures Image Source: CNN World
6. © Okta, Inc. and/or its affiliates. All rights reserved. Access the app Monitor all actions Logs system … 1 User Logs in Search for products Buy products Server Jun 10 06:06:23 | GET /app 200 Jun 10 06:07:03 | POST /login 200 Jun 10 06:07:06 | GET /app 302 Jun 10 06:07:23 | GET /item?id=23 200 Jun 10 06:07:43 | GET /stock?d=23 200 Jun 10 06:10:23 | POST /buy?id=23 200 Jun 10 06:10:33 | GET /purchase?id=3 302 | INFO | User 1 access the application | INFO | User 1 logs in the application | DEBUG | User redirect to application | INFO | User 1 list product 23 | DEBUG | User see stock of product 23 | INFO | User 1 buys product id 23 | INFO | User 1 confirmed purchase 3 2 1 2 3 3 4 4 Alert system A09: Security Logging and Monitoring Failures
7. © Okta, Inc. and/or its affiliates. All rights reserved. A09: Security Logging and Monitoring Failures Prevention Make sure all crucial events are recorded Create rules and alerts based on attacks and behaviors Verify that logs are immutable, reliable, and cannot be manipulated
8. © Okta, Inc. and/or its affiliates. All rights reserved. A08: Software and Data Integrity Failures Image Source: Pueblos Mágicos de España
9. © Okta, Inc. and/or its affiliates. All rights reserved. Developer CI/CD Pipeline User Code repository 1 2 3 Push code to the repository Access the app Code is deployed in prod A08: Software and Data Integrity Failures
10. © Okta, Inc. and/or its affiliates. All rights reserved. Attacker Developer CI/CD Pipeline User Code repository 1 2 3 4 Push code to the repository Modifies to include malicious code Uses infected app Code is deployed in prod A08: Software and Data Integrity Failures
11. © Okta, Inc. and/or its affiliates. All rights reserved. A08: Software and Data Integrity Failures Prevention It uses mechanisms such as hash functions to ensure data integrity Build an internal inventory of components/software/libraries Check and verify that those libraries/software are reliable and secure
12. © Okta, Inc. and/or its affiliates. All rights reserved. A07: Identification and Authentication Failures 8 Image Source: obonparis.com, chatgpt
13. © Okta, Inc. and/or its affiliates. All rights reserved. Attacker Leaked Credentials Right authentication: Breached password Authentication failure A07: Identification and Authentication Failures
14. © Okta, Inc. and/or its affiliates. All rights reserved. A07: Identification and Authentication Failures Prevention It uses multi-factor authentication mechanisms Monitors suspicious activity
15. © Okta, Inc. and/or its affiliates. All rights reserved. A06: Vulnerable and Outdated Components Image Source: paristickets.com
16. © Okta, Inc. and/or its affiliates. All rights reserved. Proprietary code Open Source libraries 3rd party libraries) Your code is as weak as your weakest library A06: Vulnerable and Outdated Components
17. © Okta, Inc. and/or its affiliates. All rights reserved. A06: Vulnerable and Outdated Components Attacker 1 2 Vulnerable component in credit website • Lack of internal procedures for continuous update • Lack of inventory of artifacts and materials • Lack of monitoring of vulnerabilities Users RCE in host Apache Struts 2 [CVE-2017-5638] 3
18. © Okta, Inc. and/or its affiliates. All rights reserved. A06: Vulnerable and Outdated Components Prevention Ensure that only the necessary components are used Evaluate the components, the sources, and verify that they are safe for use Maintain an up-to-date inventory of components with vulnerability alerts
19. © Okta, Inc. and/or its affiliates. All rights reserved. A05: Security Misconfiguration Image Source: chatgpt sorry about the fakeness
20. © Okta, Inc. and/or its affiliates. All rights reserved. HTTP headers Accessible filesystem Default configuration Bloated images Verbose errors A05: Security Misconfiguration Incorrect security settings can allow unauthorized access or abuse of resources.
21. © Okta, Inc. and/or its affiliates. All rights reserved. A05: Security Misconfiguration Prevention Less is more Explicit >>> Implicit Verification policies and usage of templates
22. © Okta, Inc. and/or its affiliates. All rights reserved. A04: Insecure design Image Source: louvreguide.com
23. © Okta, Inc. and/or its affiliates. All rights reserved. The security-by-design approach is crucial for proactively identifying unsafe designs and mitigating them before they are put into production. A04: Insecure design
24. © Okta, Inc. and/or its affiliates. All rights reserved. A04: Insecure design Prevention Involve security from the beginning: controls, threat modeling, pentesting, bug bounties, etc Security is a process, not a checklist Training, workshops and tools
25. © Okta, Inc. and/or its affiliates. All rights reserved. A03: Code injection Image Source: www.nytimes.com
26. © Okta, Inc. and/or its affiliates. All rights reserved. An application that does not validate, filter, or sanitize input data may be susceptible to code or logic injection attacks, compromising user information or infrastructure. Attacker SELECT * FROM users WHERE name=’John Smith’; --’ and password=’wrong’ A03: Code injection
27. © Okta, Inc. and/or its affiliates. All rights reserved. A03: Code injection Prevention Sanitize and validate input data: never trust the client Deal with structured messages vs raw data Multiple layers of protection
28. © Okta, Inc. and/or its affiliates. All rights reserved. A02: Cryptographic Failures
29. © Okta, Inc. and/or its affiliates. All rights reserved. The correct use of cryptography ensures that data communicated over the internet or stored can only be decrypted by authorized agents. HTTP (Port 80) User Insecure Connection Private Message A02: Cryptographic Failures
30. © Okta, Inc. and/or its affiliates. All rights reserved. A02: Cryptographic Failures Prevention Less is more: store and transfer only what is necessary Categorize data to choose an appropriate security level Use reliable encryption algorithms
31. © Okta, Inc. and/or its affiliates. All rights reserved. A01: Broken access control
32. © Okta, Inc. and/or its affiliates. All rights reserved. This occurs when a system does not properly enforce access restrictions, allowing users to access resources or perform actions they should not. Attacker Nico /account?u=nico A01: Broken access control /account?u=nico
33. © Okta, Inc. and/or its affiliates. All rights reserved. A01: Broken access control Prevention Less is more: fewer permits, more granular Contextualized access controls Have an up-to-date, documented, and visible permission map
34. © Okta, Inc. and/or its affiliates. All rights reserved. A10: Server-Side Request Forgery (SSRF)
35. © Okta, Inc. and/or its affiliates. All rights reserved. A10: Server-Side Request Forgery (SSRF) User GET http://webserver/?product= http://stock.product.com/id?1 Request Stock API Response Response: Product stock 1 2 3 4 stock.product.com Web server
36. © Okta, Inc. and/or its affiliates. All rights reserved. Attacker GET /proxy?dir=http://169.254.169. 254/latest/meta-data/iam/sec urity-credentials Request EC2 internal Response Response: AWS creds 1 2 3 4 Internal network 169.254.169.254 Proxy S3 Bucket GET /s3/data 5 Response: personal + sensitive info 6 A10: Server-Side Request Forgery (SSRF)
37. © Okta, Inc. and/or its affiliates. All rights reserved. A10: Server-Side Request Forgery (SSRF) Prevention Build a well-segmented network Avoid blocklists and opt for allowlists Limit unreliable data received from the user
38. © Okta and/or its affiliates. All rights reserved. Q&As