MSDN Documentation

1. Injection Flaws

Injection flaws, such as SQL injection, NoSQL injection, OS command injection, and LDAP injection, occur when untrusted data is sent to an interpreter as part of a command or query. The attacker's hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization.

Prevention:

• Use parameterized queries or prepared statements for database interactions.
• Validate and sanitize all user inputs rigorously.
• Avoid directly executing user-supplied commands or queries.

Example (SQL Injection):

-- Vulnerable code
SELECT * FROM users WHERE username = 'userInput';

-- Secure code (using parameterized query)
SELECT * FROM users WHERE username = ?; -- then bind userInput to the placeholder

2. Broken Authentication

Broken authentication vulnerabilities allow attackers to compromise passwords, keys, or session tokens, or to exploit other implementation flaws to temporarily or permanently assume other users' identities. This can lead to unauthorized access and data breaches.

Prevention:

• Implement strong password policies and multi-factor authentication (MFA).
• Securely manage session IDs and invalidate them upon logout.
• Protect against brute-force attacks with rate limiting and account lockout mechanisms.

3. Sensitive Data Exposure

Applications often handle sensitive data, such as financial information, health records, and personal identification numbers. If this data is not properly protected, attackers can steal or modify it to conduct credit card fraud, identity theft, or other crimes.

Prevention:

• Encrypt sensitive data at rest and in transit using strong encryption algorithms.
• Minimize the amount of sensitive data stored and transmitted.
• Implement proper access controls to restrict access to sensitive data.

4. XML External Entities (XXE)

XXE flaws occur when an XML parser processes XML input containing references to external entities. Attackers can leverage this to disclose internal files with the file URI, internal file shares, internal port scanning, and remote code execution.

Prevention:

• Disable the processing of external entities in XML parsers.
• Use less complex data formats like JSON when possible.
• Sanitize and validate all XML input.

5. Broken Access Control

Restrictions on what authenticated users are allowed to do are often not properly enforced. Attackers can exploit these flaws to access unauthorized functionality and data, such as accessing other users' accounts, viewing sensitive files, modifying other users’ data, changing prices, and more.

Prevention:

• Implement the principle of least privilege.
• Enforce access control checks on every request for sensitive resources.
• Do not rely on client-side controls for security.

6. Security Misconfiguration

Security misconfiguration is the most commonly found issue, and it is often a result of an insecure default configuration, incomplete or ad hoc configurations, open cloud storage, misconfigured HTTP headers, and verbose error messages containing sensitive information.

Prevention:

• Harden all system components by removing or disabling unnecessary features and services.
• Regularly review and update security configurations.
• Use automated tools to check for misconfigurations.

7. Cross-Site Scripting (XSS)

XSS flaws happen when an application includes untrusted data in a new web page without proper validation or escaping. XSS allows attackers to execute scripts in the victim’s browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites.

Prevention:

• Use context-aware output encoding when displaying user-supplied data.
• Implement a strong Content Security Policy (CSP).
• Validate and sanitize user inputs.

Example (Stored XSS):

<p>Welcome, <script>alert('XSS!');</script>!</p>

8. Insecure Deserialization

Insecure deserialization occurs when untrusted serialized data is deserialized by a program. This can lead to remote code execution, denial-of-service attacks, and unauthorized access.

Prevention:

• Avoid deserializing untrusted data.
• If deserialization is necessary, use integrity checks or digital signatures to ensure data hasn't been tampered with.
• Use safe deserialization mechanisms when available.