Table of Contents
January 29, 2024
|4m
Injection – The #3 Web Application Security Risk
Injection attacks have long been one of the most dangerous application security risks facing developers. Despite better frameworks and increasing awareness, injection remains the number three web application security risk in OWASP’s latest Top 10 report. This post examines why injection risks continue to plague applications and how positive input validation can mitigate over 90% of injection attacks.
Injection attacks allow attackers to insert malicious code or commands into an application to alter, delete, or expose sensitive data. These risks are not new – In fact, 20 of the 33 Common Weakness Enumerations (CWEs) in the Injection category have ID numbers under 100, indicating they were identified early in the CWE project’s history starting in 2006.
The first documented SQL injection vulnerability emerged over 20 years ago. Since then, OWASP has associated 33 CWEs and over 32,000 Common Vulnerabilities and Exposures (CVEs) with the Injection category. Though injection attacks have gradually declined thanks to better awareness and frameworks, the average exploitability remains high at 7.3 out of 10.
| CWEs Mapped | 33 |
| Max Incidence Rate | 19.09% |
| Avg Incidence Rate | 3.37% |
| Avg Weighted Exploit | 7.25 |
| Avg Weighted Impact | 7.15 |
| Max Coverage | 94.04% |
| Avg Coverage | 47.90% |
| Total Occurrences | 274,228 |
| Total CVEs | 32,078 |
Common Injection Attack Vectors
Two well-known CWEs help illustrate why injection continues to threaten applications:
CWE-20 (Improper Input Validation): Never trust any external input, whether it’s form fields, search bars, metadata or anything else. All external inputs must be validated against an allow list of expected, structured data. For example, validate credit card numbers against known formats, email addresses against address structures, etc. Input lengths should also match expected ranges. Validating associations (like postal codes to cities/countries) adds another layer of protection.
CWE-89 (SQL Injection): By inserting unexpected SQL code via input fields, attackers can modify, delete, or access private data. A single quote, closing parenthesis, or other carefully crafted input can allow them to take over SQL statements.
How to Mitigate Injection Attacks?
The good news is OWASP states properly implemented input validation can eliminate over 90% of injection attacks. Here’s what proper implementation entails:
Validate all input against a defined schema for data types, formats, lengths, relationships, etc.
Use allow lists over deny lists where possible.
Employ strong data typing everywhere.
Follow OWASP SQL Injection Prevention Cheat Sheet guidelines.
Use frameworks and APIs with built-in protections against common attacks.
The rise of modern frameworks has helped curb some injection attacks, but vulnerabilities remain abundant without comprehensive input validation policies. By ensuring all external inputs align to structured allow lists and strong data types, developers can make exploitation far more difficult. Eliminating injection’s foothold delivers immense security and compliance benefits for minimal effort.
Call to Action
Evaluate your input validation policies against the OWASP Application Security Verification Standard (ASVS) requirements. Implement missing protections with a focus on allow listing, strong typing, and securing associations. Pilot changes with high-risk inputs first, then expand coverage. Drastically reducing your injection surface is one of the most effective application security improvements available today.
We hope this post helped in learning about OWASP Top #3 application security risk Injection. Thanks for reading this post. Please share this post and help secure the digital world. Visit our website, thesecmaster.com, and our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, Medium, and Instagram and subscribe to receive updates like this.
You may also like these articles:
Rajeshwari KA
Rajeshwari KA is a Software Architect who has worked on full-stack development, Software Design, and Architecture for small and large-scale mission-critical applications in her 18 + years of experience.
