WEB APPLICATIONS SECURITY ASSESSMENT
Web applications are becoming critical to enterprises. Most organizations have learned from past mistakes and have implemented strong network perimeter defenses. However, business in the 21st century is conducted largely via the Internet. As with most security issues involving client/server communications, Web application vulnerabilities generally stem from improper handling of client requests and/or a lack of input validation checking on the part of the developer.
As part of SeNet’s security services we offer comprehensive web application vulnerability assessments. For these assessments we use a combination of automated and manual techniques. Common web application vulnerabilities and misconfigurations we examine include:
- Deficiencies of Input Data Validation: Information from web requests is not validated before being used by a web application. Attackers can use these flaws to attack backend components through a web application.
- Access Controls Security Vulnerabilities: Restrictions on what authenticated users are allowed to do are not properly enforced. Attackers can exploit these flaws to access other users’ accounts, view sensitive files, or use unauthorized functions.
- Misconfigured Authentication and Session Management Schemes: Account credentials and session tokens are not properly protected. Attackers that can compromise passwords, keys, session cookies, or other tokens can defeat authentication restrictions and assume other users’ identities.
- Cross Site Scripting (XSS) Flaws: The web application can be used as a mechanism to transport an attack to an end user’s browser. A successful attack can disclose the end user’s session token, attack the local machine, or spoof content to fool the user.
- SQL Injection: Web applications pass parameters when they access external systems (databases) or the local operating system. If an attacker can embed malicious commands in these parameters, the external system may execute those commands on behalf of the web application.
- Improper Error Handling: Error conditions that occur during normal operation are not handled properly. If attackers can cause errors that the web application does not handle properly, they can gain detailed system information, deny service, cause security mechanisms to fail, or crash the server.
- Insecure Storage: Web applications frequently use cryptographic functions to protect information and credentials. These functions and the code to integrate them have proven difficult to code properly, frequently resulting in weak protection.
- Denial of Service (DoS): Attackers can consume web application resources to a point where other legitimate users can no longer access or use the application. Attackers can also lock users out of their accounts or even cause the entire application to fail.
- Insecure Configuration Management: Having a strong server configuration standard is critical to a secure web application. These servers have many configuration options that affect security and are not secure out of the box.
- Buffer Overflows: Web application components in some languages that do not properly validate input can be crashed and, in some cases, used to take control of a process. These components can include CGI, libraries, drivers, and web application server components.
