Web App Security Threats

There are four main types of injection attacks. SQL injection, where attackers insert malicious SQL code into input fields. The application executes this code as part of a database query, allowing attackers to manipulate data, bypass authentication, or delete information. Another technique is OS command injection, which tricks an application into running arbitrary operating system commands, giving attackers deeper control over the system. LDAP injection targets Lightweight Directory Access Protocol (LDAP) servers, and attackers are able to inject malicious code to modify LDAP queries and gain unauthorized access or manipulate directory information. Lastly, NoSQL injection, which is when attackers get to inject arbitrary text into NoSQL queries, targets NoSQL databases (like MongoDB and ArangoDB).

In 2023, the Cl0p ransomware gang exploited a zero-day SQL injection vulnerability in the MOVEit Transfer app (CVE-2023-34362). This breach allowed unauthorized database access, leading to the theft of sensitive data across multiple organizations. The Cl0p gang used the stolen data for extortion, threatening to publicly release it unless a ransom was paid.

XSS attacks come in several forms. In reflected XSS, the malicious script is injected into a URL and reflected back to the user in the response. In stored XSS, the harmful script is saved on the server, such as in a forum post or comment, and is executed later when another user views the content. DOM-based XSS runs entirely within the client’s browser, without direct interaction with the server.

In 2020, a significant cross-site scripting (XSS) vulnerability was discovered in WhatsApp Web. It allowed attackers to send specially crafted messages that, when opened by the user, executed malicious code and enabled the attackers to read files from the user's local system. This vulnerability affected WhatsApp Desktop prior to v0.3.9309 paired with WhatsApp for iPhone versions prior to 2.20.10.

Attackers use various approaches to abuse these vulnerabilities. They can exploit weak password policies, such as those that allow passwords of less than eight characters or that do not enforce the use of multiple character types for complexity. Attackers can exploit systems bypassing access controls when role-based limitations are not applied or a “deny by default” policy is not enforced. Another way is through the management of session errors, which often involve poor handling of session cookies, inadequate timeouts and lack of session regeneration. Credential stuffing can also be used to gain access to user sessions.

In early 2023, Norton LifeLock experienced a data breach due to credential stuffing attacks. Cybercriminals gained unauthorized access to customer accounts, exposing sensitive personal data such as names, addresses, phone numbers and stored passwords in Norton’s Password Manager.

Although IDOR is considered a single type of vulnerability, it can appear in different forms. Horizontal privilege escalation happens when an attacker accesses data or performs actions intended for other users at the same privilege level. Vertical privilege escalation involves accessing data or functions meant for users with higher privileges.

In 2019, First American Financial Corp suffered a massive data leak due to an IDOR vulnerability, exposing nearly 885 million sensitive records related to mortgage transactions. By simply altering digits in a URL, anyone with a web browser could access these documents, which included bank account numbers, Social Security numbers, driver’s license images and other financial records. This vulnerability was discovered through manual penetration testing.

Attackers exploit these misconfigurations in various ways. One common method is taking advantage of default credentials since many devices come with preset usernames and passwords that often are left unchanged. Weak configurations are another target, such as incorrect firewall settings, outdated protocols and weak encryption. Outdated software poses a significant risk as unpatched systems are vulnerable to known threats. Cloud misconfigurations, such as improper settings in storage buckets or virtual machines, can also expose data and resources to unauthorized access.

In 2021, the Microsoft Power Apps data leak exposed sensitive information due to misconfigured portal settings. Power Apps, a platform for building custom applications, suffered from a critical error where settings meant for authenticated users with specific permissions were set to be publicly accessible without adequate security controls.

CSRF attacks are typically carried out by crafting malicious links or scripts that, when clicked, automatically send forged requests to a vulnerable application. Attackers can also spoof double *cookie submission requests (DSC) to bypass established safeguards by exploiting how cookies are handled. Social engineering techniques are often employed to persuade users to interact with harmful links or attachments.

In 2008, a notable CSRF attack exploited vulnerabilities in YouTube’s web application. Attackers created malicious requests that, when a logged-in user visited a crafted web page or clicked a link, triggered unintended actions on their YouTube account, such as adding videos to their favorites list without their consent.

Attackers exploit this gap in several ways. When a web app operates without triggering logs for key events, malicious actors can remain undetected for long periods. They may manipulate or delete logs to hide their tracks. Exploiting systems with limited or no logging capabilities also enables them to take advantage of blind spots where their actions go unrecorded. The absence of real-time monitoring worsens these risks by delaying the detection of ongoing threats, leaving systems exposed.

A prominent example is the 2013 Target data breach, where attackers infiltrated the network through a third-party portal and installed malware on point-of-sale systems. A major contributing factor to this breach was Target’s inadequate logging and monitoring practices, allowing attackers to steal millions of credit card numbers.

As you may have noticed, the prevention strategy that repeats the most across the sections is security testing, which luckily, we offer. Our Continuous Hacking solution includes penetration testing, vulnerability management and secure code review, to name a few. All are key steps in identifying and addressing various vulnerabilities such as injection, XSS, broken authentication, and more. Consistent security testing, which is performed with automated tools and manual techniques, proactively discovers weaknesses in your web applications before attackers can exploit them.

Let Fluid Attacks work for you in the fight against these and other security threats. Contact us now.