Application Security for Developers: Part-1

Developing a secure application is an important aspect of software development. Unfortunately, it often receives insufficient attention. This article highlights prevalent vulnerabilities.

XSS (Cross-Site Scripting)

Cross-site scripting (XSS) is an attack in which an attacker injects malicious executable scripts into the code of a trusted application or website, that can be interpreted as valid and executable as a part of the application. The malicious script can access any cookies, session tokens, or other sensitive information retained by the browser and used with that site. These scripts can even rewrite the content of the HTML page.

Types of XSS attack

• Reflected XSS

  Attackers inject malicious javascript code, that the browser processes, accesses, and manipulates the page content and cookie.

• Stored XSS

  Malicious payloads are stored database. It executes/renders to users when data is requested

How to prevent it?

• Properly sanitize the user inputs.

• Use proper output encoding techniques to sanitize user-generated content before displaying it in the browser.

• Set the HttpOnly flag on cookies to prevent them from being accessed through JavaScript

• Use frameworks and libraries (like React) that provide built-in protection from XSS

Broken authentication

Broken authentication is a security vulnerability that occurs when an application's authentication and session management mechanisms are flawed, allowing unauthorized users to gain access to sensitive data or perform actions as if they were authenticated users. This vulnerability can have severe implications for the security of a system.

What can cause this?

• Weak password policy

  If an application allows weak passwords, such as those easily guessable or commonly used, it becomes susceptible to brute-force attacks.

• Insecure storage of credentials

  Storing passwords or other sensitive information in an insecure manner, such as plain text or using weak hashing algorithms, exposes them to unauthorized access. One of the most common mistakes is to store authentication tokens in the local storage of the browser.

• Insufficient Multi-Factor Authentication (MFA)

  Lack of or poorly implemented multi-factor authentication can make it easier for attackers to compromise user accounts by relying solely on username/password combinations.

How to prevent it?

• Enforce the use of strong and unique passwords to prevent brute-force attacks. Also, including a limited number of login trials.

• Store passwords securely using strong cryptographic hashing algorithms and salting techniques.

• Conduct regular security audits and penetration testing to identify and address authentication vulnerabilities.

• Enable multi-factor authentication to add an additional layer of security beyond passwords.

SQL Injection (SQLi)

SQL Injection is a serious security vulnerability that exploits improper input validation in a web application's code, allowing attackers to manipulate the underlying SQL queries. By injecting malicious SQL code into user inputs, such as form fields or URL parameters, attackers can gain unauthorized access to a database, view or modify sensitive information, and even execute administrative operations.

What can cause this?

• Lack of Input Validation

  Failing to validate and sanitize user inputs before incorporating them into SQL queries allows attackers to inject malicious code.

• Improperly Configured Permissions

  Insufficiently restrictive database permissions can amplify the impact of SQL injection attacks by providing attackers with broader access to the database.

• Dynamic SQL Queries

  Using dynamic SQL queries that concatenate user inputs without proper validation can create vulnerabilities, as attackers can manipulate the query structure.

• Inadequate Error Handling

  Revealing detailed error messages to users can aid attackers in understanding the database structure and formulating more effective injection payloads.

How to prevent it?

• Use parameterized statements or prepared statements with parameter binding to ensure that user inputs are treated as data and not executable code

• Validate and sanitize all user inputs to ensure they conform to expected formats and do not contain malicious SQL code, by employing server-side input validation

• Sticking to the principle of least privilege by configuring database accounts with the minimum required permissions. Limiting access helps mitigate the impact of a successful SQL injection attack.

• Utilize stored procedures to encapsulate database logic. This reduces the risk of injection by separating user input from the SQL code.