In 84 percent of applications under study, threats related to unauthorized access to users' personal accounts, including those of administrators, were identified. In 72 percent of web applications, an attacker can gain access to features or content that should not be available to them, such as viewing other users' personal accounts or changing the length of a subscription trial period.

Most dangerous of all are attacks on local corporate networks and server-side execution of OS commands. Such cybercriminal actions can lead to data disclosure, access to application source code, and, most significantly, access to local network resources and attacks on other infrastructure nodes.

Most dangerous threats

In 17 percent of web applications, attacks on LAN resources were found to be feasible. Just as many applications contained vulnerabilities that could lead to server-side execution of OS commands.

Since 2017, number one in the list of live threats to web applications has been attacks on users. One in two attacks on web application users may have been carried out using cross-site scripting (XSS; CWE-79)—a type of attack in which arbitrary code created by the attacker is executed in the user's browser. XSS allows attackers to redirect web application clients to phishing sites, download malware to user devices, and impersonate other users.

XSS comes in three flavors:

1. Stored XSS, in which malicious code is pre-injected into the application page.
2. Reflected XSS, in which a successful attack requires the user to click a specially crafted link.
3. DOM-based XSS, in which the code of a web application page processes transmitted data and attempts to execute the received data set as programming language commands.

In addition, a misconfigured or missing X-Frame-Options header (CWE-16) has become a cause of attacks on users. This header is responsible for allowing or blocking the display of the page if it is in a frame. This header misconfigured or missing can lead to a clickjacking attack, whereby a vulnerable application is loaded in a frame and disguised as a button or other element, or not displayed to the user at all (a transparent iframe). By clicking this element, a user performs the attacker-chosen action in the context of the vulnerable website.

To protect against such attacks, we recommend preprocessing all data arriving from the user and then displayed in the browser. Characters that could potentially be used for HTML page formatting should be replaced with non-formatting characters. We also recommend taking more care with HTTP headers and using application-level firewalls to protect against XSS.

Information Leakage

Information leakage is the second most acute security threat to the web applications under study. The results of the security analysis showed that more than three-quarters of web applications were vulnerable to disclosure of user IDs. Personal data was disclosed in 60 percent of applications, and user credentials in 47 percent, up 13 and 16 percentage points on 2019, respectively. Personal data and credentials are desirable targets for attackers, as confirmed by the Cyberthreats Analysis 2021 report.

The threat of disclosure of sensitive information is often associated with improper authorization and authentication vulnerabilities.

When investigating one of the sites, experts gained access to sensitive information about web application users (CWE-359). This was made possible due to a vulnerable form for outputting a list of application users. Through a specific HTTP request, the names, email addresses, identifiers, and password hashes of all users were retrieved. From the information received, the passwords of almost 400 users were recovered. Such information could be used by cybercriminals for authorization in the application with appropriate privileges.

Unauthorized Access to Application

Unauthorized access to application was identified in 84 percent of web applications. Unauthorized access to the application is attainable due to authentication vulnerabilities, unlimited session lifetime, leaks, or lack of protection against brute-force attacks—in one of the applications, experts found that the application allowed users to set weak passwords that are easily crackable. By brute-forcing credentials, experts managed to gain access to the application with the privileges of the corresponding user, as well as to brute-force and obtain other users' promo codes.

Nowadays, a single password rarely provides the required level of security. We recommend that organizations use multi-factor or two-factor (2FA) authentication to protect web services against cyberattacks. However, these processes too are prone to vulnerabilities, so care needs to be taken in implementing them. In one of the web applications, experts identified an improper 2FA implementation (CWE-287) allowing them to intercept an HTTP request to send a confirmation code to the server. Using this intercepted request, they created a template for generating HTTP requests with different code values. These requests were then sent to the application server in a matter of seconds. All invalid requests were rejected by the server, but when the correct confirmation code was entered, all other invalid codes were accepted by the application. After refreshing the page, the 2FA code request form disappeared and access to the user's personal account was granted.

Unauthorized access to application can lead to sensitive information leakage, data modification or deletion, attacks on users, and penetration of corporate infrastructure.

In 2020–2021 black-box or gray-box testing was most popular among clients; 79 percent of web applications were analyzed using these methods. Black-box testing involves analyzing and evaluating the security of a web application with no source data other than its address. Gray-box testing is essentially the same as black-box, except that investigators have information about points of entry into the system, plus an authorized user account with standard privileges.

Expert appraisal shows that many website vulnerabilities are due to coding flaws: in the past two years, 72 percent of vulnerabilities discovered were related to vulnerable code in web applications, such as SQL injection, XSS, and incorrect condition checking or exception handling. The other vulnerabilities were caused by improper administration and are fixable in the application settings. To rule out code-related vulnerabilities, we strongly recommend that organizations incorporate a secure development process in the web application lifecycle and use a code analyzer. For a more thorough survey of application vulnerabilities, white-box testing is used.

In white-box testing, the customer provides all available data about the application, including source code, for subsequent analysis.

Web applications subjected to white-box testing are analyzed by several researchers at once; alongside automated security analysis, manual code verification is carried out, which, although more time-consuming, eliminates false positives and guarantees that identified vulnerabilities are live. All this allows experts to thoroughly study the application and not miss a single line of code or hidden flaw. During the research, it was found that white-box testing detected twice as many high-severity vulnerabilities as black-box or gray-box.

To sum up the past two years, it must be said that the level of web application security still leaves much to be desired. However, we have observed a positive trend in the decrease in the average number of high- and medium-risk vulnerabilities per application, which indicates the adoption of secure development approaches and a more serious attitude toward web application protection. We hope in the near term to see the level of website security increase, and the number of identified vulnerabilities and successful attacks fall.

Achieving a high security level is hard, and maintaining this level is an equally labor-intensive process. Careful and secure web application design, development with source code analysis, quick remediation of vulnerabilities, and maximum automation of processes are our guiding principles to ensure a high level of web application security.

For security analysis, we recommend using productive copies of the web application. Test systems are usually not fully developed and lack full functionality, and various system modifications can cause new vulnerabilities to appear.

On top of security analysis, organizations need to take a proactive approach to protection and use a web application firewall (WAF) to mitigate the risks related to the ongoing introduction of new application features that may contain potential vulnerabilities. For its part, besides detection and prevention of known attacks, a WAF should detect exploitation of zero-day vulnerabilities, prevent attacks on users, analyze and correlate multiple events to identify attack chains, and block malware.

This report contains the results of a study in 2020–2021 of 58 web applications for which in-depth security analysis with a full range of checks was performed. The study does not include the results of security analysis of mobile applications, online banking, penetration testing, and automated scanning (see our website). The owners of web applications included in the study have consented to the use of their data for research purposes.

The security level of each application was assessed manually, using black-, gray-, or white-box testing with the assistance of automated tools.

Vulnerabilities were classified according to the industry-standard Common Weakness Enumeration (CWE) system. For the sake of convenience, vulnerabilities from the OWASP Top 10 — 2021 are highlighted, since the classification of vulnerabilities is quite detailed, plus it is shown how often these vulnerabilities occur in the web applications we studied.

The report covers only vulnerabilities related to web application code and configuration. Other common security weaknesses, such as failure to manage software updates, are not considered. Severity was evaluated based on the Common Vulnerability Scoring System (CVSS v3.1), assigning each vulnerability a rating of Low, Medium, or High.