New OWASP Top 10 List Includes Three New Web Vulns

After months of review, the Open Web Application Security Project has finally formally updated its widely used, if somewhat disputed, ranking of top Web application security vulnerabilities.

OWASP's Top 10 list for 2017 replaces three vulnerability categories from the previous list with new ones and shuffles a couple of others around in moves that not everybody agrees with.

As with previous years, injection vulnerabilities such as SQL and LDAP injection topped the list of OWASP's concerns for 2017, followed by incorrectly implemented authentication and session management functions. Cross-site scripting errors, which ranked third in OWASP's 2013 list, dropped to the seventh spot in this year's ranking, while cross-site request forgeries (CSRF) dropped out altogether.

Making its appearance for the first time in OWASP's top 10 list is a category dubbed XML external entities (XXE), pertaining to older and poorly configured XML processors. Data gathered from source code analysis testing tools supported inclusion of XXE as a new vulnerability in the top 10 list, according to OWASP.

The two other new additions to the list are insecure deserialization errors, which enable remote code execution on affected platforms, and insufficient logging and monitoring. Both of these new vulnerability categories were added to the list based on feedback from community members who contribute to the OWASP effort.

Making way for these new categories were insecure direct object references and missing function level access control errors, which along with CSRF, dropped out of the OWASP's top 10 ranking.

The list was compiled using community feedback, from data collected from dozens of organizations that specialized in application security and from a survey of more than 500 individuals. Data in the report was distilled from vulnerability information gathered from more than 100,000 applications and APIs used by hundreds of organizations.

Like OWASP's previous vulnerability rankings, the new one — the first major revision to the list in four years — should end up being a vital asset for organizations looking for high-level guidance on prioritizing Web application vulnerabilities. But not everyone is convinced that the updated list necessarily includes the top Web application security concerns.

Jeremiah Grossman, chief of security strategy at SentinelOne, says one problem is that the list focuses less on legacy application concerns and more on what developers of modern applications should be paying attention to. It's a bit surprising, for instance, that CSRF has been removed from the list, considering how common the vulnerability is in existing legacy environments. In contrast, XXE, one of the flaws on the list, is not very common but is of high severity.

"The change speaks partially to bias in the data and a split between what legacy applications and modern applications tend to be vulnerable to," Grossman says.  While modern application frameworks tend to have native protections against CSRF, legacy applications do not.

"It's important to remember that the OWASP top 10 is not an accounting for all the vulnerabilities that might cause an organization to get hacked, but more a list of the most common and risky issues that should be considered. In that way, the list is a great community resource."

Others, such as infosec consultant Josh Grossman has also expressed some skepticism in the past over the influence some security vendors have had in shaping the OWASP list. He has called out how a single vendor with a potentially vested interest has influenced two of the newly listed vulnerability categories in the OWASP list.

Ryan Barnett, principal security researcher at Akamai, expressed similar surprise at the removal of CSRF from the list and lowering the importance of cross-site scripting errors.

"While strides have been made within frameworks to build in protections for these issues, many are not used or are incorrectly applied. Additionally, XSS and CSRF are often linked in attack chains. If you have an XSS flaw on your site, it can circumvent CSRF protections," he notes.

Another concern is that the data used to justify inclusion of some security vulnerabilities in the list is almost exclusively based on static and dynamic code analysis and penetration testing from vendors, Barnett says.

While the data highlights vulnerability prevalence, it does not offer much perspective on attack likelihood. "I hope in the future that we can get more data from Web application defender organizations such as Web application firewall vendors," he says. "This data could help to justify including/excluding different items as well as help with rankings."

Some of the new vulnerability categories in OWASP's list, such as security misconfigurations, are also a bit too broad and may lead to confusion for organizations in detecting and remediating security issues, says Ilia Kolochenko, CEO of High-Tech Bridge.

But while the ordering and prioritizing of some of the flaws in the list are certainly subjective, the OWASP list does a decent job reflecting the overall state of affairs in Web security, he said. "It's pretty difficult to make a one-size-fits-all rating for Web vulnerabilities," he says.

The OWASP top 10 provides a valuable application security framework for companies and organizations. "It reminds, enumerates, and guides through the most common perils and pitfalls related to Web applications," Kolochenko says.

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry's most knowledgeable IT security experts. Check out the INsecurity agenda here.