Contents

Introduction

The exploitation of software and hardware vulnerabilities, as well as web applications, has been one of the three most popular methods of attacks on organizations for the past five years. According to our data, in 2023, the share of successful attacks involving vulnerability exploitation was 32%, which is 14 p.p. higher than in 2019.

The number of vulnerabilities is also steadily increasing, while the time it takes attackers to develop exploits for discovered vulnerabilities is decreasing. According to Mandiant analysts, the average time to exploit a vulnerability after its disclosure has decreased from 63 days in 2018-2019 to 32 days in 2021-2022.

The frequent use of attack vectors involving vulnerability exploitation, the constant growth in the number of discovered vulnerabilities, and the reduction in time to exploit should spur information security teams within organizations to work harder to detect, manage, and promptly eliminate vulnerabilities.

About the report

In this study, we share our statistics on vulnerabilities identified by PT SWARM (PT Security Weakness Advanced Research and Modeling) experts. It's worth noting that the nature of the research determines the type of vulnerabilities they identify: the experts focus on complex, critical vulnerabilities that could be used by malicious actors in real attacks on infrastructure and impact the victim's business processes.

In addition, this report also presents the results of analyzing dark web posts about vulnerabilities: we study the posts to estimate the time that elapses between a vulnerability being reported and proof of concept (PoC) exploits appearing and starting to be discussed on forums. We have also highlighted the most discussed vulnerabilitiesAt the time of the study..

The report addresses the main issues of working with vulnerabilities and provides recommendations for resolving them and minimizing negative consequences. Vulnerability severity was evaluated based on the Common Vulnerability Scoring System (CVSS v3.1), with each vulnerability assigned a rating of Low, Medium, High, or Critical.

Statistics on vulnerabilities discovered by PT SWARM experts

PT SWARM researchers manage to find vulnerabilities in various products ([1], [2]) and successfully interact with vendors regarding the remediation of these vulnerabilities. From 2022 to 2023, the security analysis experts identified 285 vulnerabilities (70% of which were of High and Critical severity levels) in the software and hardware of 84 vendors.

Distribution of detected vulnerabilities by OWASP Top 10 2021 categories

The experts focus on identifying the most impactful and dangerous vulnerabilities in software or hardware systems, which can be exploited by malicious actors in real attacks on target systems and significantly affect them.

Injection

Vulnerabilities related to code injection into user requests has become the most popular category (42%). These vulnerabilities allow malicious code to be injected into user requests to servers and executed. As a result, malicious actors can steal confidential data, attack users, and even take control of the server.

The majority of code injection vulnerabilities (42%) were the ones allowing cross-site Scripting (XSS). The most common types of cross-site scripting were storedStored XSS is an attack in which the malicious actor stores harmful code on the application's server. Each time a user accesses the infected page, the script is executed in the browser. and reflectedReflected XSS is an attack where the malicious actor must persuade the user to click a specially crafted link for the attack to succeed. XSS.

The share of vulnerabilities allowing remote code execution (RCE) was 21%. These vulnerabilities pose a serious threat: their exploitation can lead to full remote control over the system, deployment of malware, and even attacks on other systems.

Rounding out the top three is SQL injection (18%): vulnerabilities related to this type of attack allow malicious code to be inserted into database queries through input forms, which can lead to deletion, modification, or leakage of data, as well as execution of various actions on the database server.

Of all the vulnerabilities in this class, 26% are related to path traversal attacks, which allow attackers to manipulate URL parameters to access local files and directories not intended for access by the application's logic.

The share of vulnerabilities whose exploitation leads to disclosure of confidential data without appropriate rights is 14%; the obtained data can be used by attackers to conduct further attacks on the system or users.

In 13% of cases, access control failures were due to the presence of a vulnerability that enables a cross-site request forgery (CSRF) attack, where the application does not verify the legitimacy of a HTTP request sender. Using this vulnerability and a specially crafted script, an attacker can perform actions on behalf of an authorized user.

Identification and Authentication Failures

Identification and authentication failures rank third among the current threat categories from the OWASP Top 10 2021, constituting 10% of all identified vulnerabilities in 2022–2023. Weaknesses in identity verification, authentication, and session management mechanisms allow attackers to obtain identifiers in URL addresses, perform brute-force and credential stuffing attacks, intercept user sessions, and even gain full control over the system.

The researchers observed the use of hardcoded credentials in products from various vendors (34%). It's a serious vulnerability, easy to exploit and difficult to fix. Eliminating such weaknesses may require significant effort from the vendor and prompt delivery of updates to users. Lack of authentication for critical functions was noted in 31% of cases; this vulnerability allows attackers unauthorized access to critical system functionalities without appropriate legitimacy checks.

Vulnerabilities not included in the OWASP Top 10

Among vulnerabilities not included in the OWASP Top 10 2021, PT SWARM experts frequently identified improper restriction of write operations beyond the bounds of a memory buffer (58%), which can lead to arbitrary code injection and execution or denial of service (DoS). Uncontrolled resource consumption vulnerabilities (28%) can be exploited by attackers to overload and disable the target system.

Vulnerabilities on the dark web

During the study, we analyzed 217 Telegram channels and dark web forums, with a total of 12,270,258 users and 51,143,292 messages. We focused on messages for the years 2022 and 2023 containing references to various vulnerabilities (by their identifiers) in Russian, English and Chinese.

One significant result of the study is that we were able to calculate the time it takes for a vulnerability to be published on the dark web after its discovery. We paid special attention to criticalA critical vulnerability is a vulnerability in software or hardware that, when exploited, has a significant impact on the system and can lead to serious consequences, such as allowing an attacker to gain unauthorized access to the system, steal or modify confidential data, or disrupt or disable the system. vulnerabilities. Non-criticalA non-critical vulnerability is a vulnerability in software or hardware that, when exploited, has limited or minor impact and poses a relatively low level of potential harm. vulnerabilities also have the potential to cause damage, just like critical ones, so we considered both types. We believe these results will help businesses and vendors understand how quickly they need to respond to the detection of vulnerabilities and take measures to protect their systems from attacks.

After the publication of information about the discovered vulnerability, an experimental PoC exploit becomes available on average within six days for critically dangerous vulnerabilities and within a week for non-critical ones. After another five days or six days respectively, discussions begin on specialized dark web platforms: the longer the discussion, the higher the likelihood of developing exploits intended for use in real attacks to compromise target systems and spread malware. In the overwhelming majority of messages on the dark web (92%), attackers discuss public versions of PoC exploits, and in 8% of messages, there is a discussion about buying or selling exploits for real attacks.

Vulnerabilities with Critical or High severity are of greatest interest to attackers. As for attack vectors, vulnerabilities with networkNetwork vectors include vulnerabilities in network protocols, open ports, weak passwords, or a lack of security measures that allow attackers to penetrate the system via the Internet. attack vectors provoke more active discussion among malicious actors on the dark web: the share of messages mentioning them was 70%, while the share of messages about vulnerabilities used in localLocal vectors include vulnerabilities in the system itself, weaknesses in software, and a lack of system updates, which allow attackers to gain access to the system physically or using local resources. attack vectors was 30%.

Table 1. Most mentioned vulnerabilities on the dark web

The consequences of delays in remediating vulnerabilities

Failure to promptly resolve vulnerabilities can have serious consequences for organizations. Below are examples of trending vulnerabilities from 2022–2023 and the consequences of their exploitation.

Table 2. Vulnerability exploitation consequences

Vulnerability management problems

In 2023, Positive Technologies analysts conducted a study on vulnerability management activities in organizations, identifying the main problems in dealing with vulnerabilities.

Incomplete asset categorization

Uncertainty in asset categorization increases the likelihood of missing critical systems that are vulnerable to attacks. To minimize risks, we recommend starting the vulnerability management process by assessing and categorizing assets in order to identify the most significant ones and prioritize their protection.

After conducting the assessment, ensure that all assets are classified. This is crucial to ensure that important information systems and other significant components of the organization's infrastructure are not missed.

Delayed fixes

Failure to adhere to established vulnerability remediation timelines allows attackers to exploit system weaknesses and successfully execute attacks. Our previous research showed that in every third company, the policies for vulnerability remediation were not followed as required by the organization. Around 30% of high-importance systems contained an average of seven overdue trending vulnerabilities.

Conclusion

To prevent exploitation of vulnerabilities and triggering of non-tolerable events, it's necessary to take proactive measures to protect individual services and the IT infrastructure as a whole. Based on our research findings, we recommend that organizations conduct regular asset inventory and categorization, considering their importance, risk, and trending vulnerabilities when prioritizing them. It's also important to conduct regular security analysis of systems and applications and monitor dark web activity to identify the most relevant threats. Establishing adequate vulnerability elimination time frames and monitoring the process are also crucial steps.

To implement these recommendations effectively, it's advisable to use vulnerability management (VM) systems. Specialized tools enable timely detection and mitigation of dangerous vulnerabilities both at the network perimeter and within the IT infrastructure—information about current vulnerabilities is delivered to today's VM systems within 12 hours. Monitoring the status of the target and key systems on a regular basis helps to prevent non-tolerable events directly associated with the exploitation of vulnerabilities in important assets.

Utilizing up-to-date systems that provide real-time information about high-risk vulnerabilities enables organizations to effectively comply with regulatory recommendations regarding remediation timelines. It's crucial that vulnerability management tools provide information about the most dangerous vulnerabilities as promptly as possible.