The 5 Most Common Security Vulnerability Types of 2020
By: Scott Cosentino
Tags: Ethical Hacking, Computer Security, Vulnerability

Top 10 Vulnerabilities of 2020

As we come close to the end of the year, it is interesting to analyze the vulnerability data to get an idea of what security issues were most commonly exploited in the year. Understanding this data can help us focus on critical and common issues to harden our application.

Note: The products mentioned in this article are not necessarily insecure, but rather large complex projects that are frequently used, and frequently targeted by attackers. It is important to be aware of security vulnerabilities in products, those that report the most vulnerabilities often end up being the most secure.

Analysis Methodology

All of the data in this article is from NVD. To analyze the data, I downloaded the JSON feed, parsed it into a SQL database using Python, then used SQL queries to pull the required data.

Number 1: CWE-79 - Improper Neutralization of Input During Web Page Generation (Cross-Site Scripting)

Cross-Site Scripting is listed as the cause of 1384 vulnerabilities, which accounts for around 10% of the vulnerabilities reported this year. Cross-site scripting can occur in a number of different ways, but the root cause of the issue is failing to validate user input. When this happens, an attacker is able to leverage the injection to execute javascript code in a targets session. The impact of this can vary, and we say CVSS scores ranging from 3.5 to 9.9.

Cross-site scripting primarily affects web applications, specifically ones written in javascript or related languages. If we look at the CPEs associated with these vulnerabilities, we can find more information on the types of products that are affected by this. Among the products affected by this are PHPkb, Gitlab, Sharepoint, and Jira. As discussed, primarily web applications and websites are affected by this type of vulnerability.

The primary ways to avoid this type of vulnerability is through server side verification of user input. If the user attempts to input any special characters such as < or >, they should be sanitized or filtered immediately before they are processed by the application.

Number 2: CWE-269 - Improper Privilege Management

Improper privilege management occurs when an attacker is able ot bypass privileges assigned to them by the system. This vulnerability type was the cause of 921 vulnerabilities, which accounts for around 7% of the vulnerabilities this year. The CVSS scores for this vulnerability range from 3.1 to 10.0.

Improper Privilege Management primarily affects Operating Systems, although it can affect any application that requires authentication or privilege to access resources. The most commonly affected products are Windows OS (server and desktop) and Android OS.

Avoiding priviledge management issues can be tricky, as it mostly relies on good architecture, design, and implementation. Following principles such as the principle of least priviledge can help when designing systems to avoid these issues. Patching other weaknesses and vulnerabilities can also help mitigate these issues, as often they are found in conjunction with other existing vulnerabilities.

Number 3: CWE-20 - Improper Input Validation

This issue is a rather general issue related to validation of any user input. When a user inputs data, it should always be validated in some way that the user cannot control. The most common examples of this include bypassing client side verification, inputting large or negative values, and inputting code sequences. In total there were 801 vulnerabilities of this type, or around 6% of the vulnerabilties reported this year.

Input validation is required for almost any application a user can interact with. This year, we saw input validation issues in products such as 3D visual enterprise viwer, Windows and Big IP Access Policy Manager.

Avoiding input validation issues is similar to cross site scripting. Always validate any user input, and do it in a way that cannot be modified by the user. Pay extra attention to things like files, network packets, and certificates. Vectors such as malformed files are becoming more common, and often aren’t considered as possible attack vectors.

Number 4: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Information disclosures often come in the form of leakage of data, through improper access control or other related vectors. This sort of vulnerability tends to exist anywhere that priviledged information exists. This year there were 710 vulnerabilities in this category, making up around 5% of the reported vulnerabilities.

Information disclosures can impact any product that has privileged information stored or used. Priviledged information is any information that should not be visible to the typical user. Data like passwords, bank details, personal information, and cryptography keys all count as privileged data. Some of the most commonly impacted products include Windows, Gitlab, Android and Jira.

One way to prevent information disclosures is robust permissions and access control. Whenever a user attempts to access data, we should check permissions, and deny any illegal access. In addition to this, attention must be paid to patching any other vulnerabilities like SQL injections, to help prevent malicious access.

Number 5: CWE-787 - Out-of-bounds Write

Out-of-bounds write has to do with memory management of applications. If a user can manage to write data outside of the bounds of a data structure, they can potentially overwrite important data, and cause execution of arbitrary code. This year there were around 521 vulnerabilities in this category, making up around 4% of the total vulnerabilities this year.

Out-of-bounds data vulnerabilities primarily appear in low level languages such as C, C++, and assembly. This year we primiarly saw these issues in Android, Chrome, and icloud.

When writing code in low level languages, it is essential to always check the size of what is being written before it is written into dynamic memory. In addition to this, using memory safe functions is crucial to ensuring an application does not overwrite their bounds.

Summary

The key things to learn from this data is where issues lie in applications. We need to be exceptionally careful when handling any type of user input, and we need to make sure that we validate everything.

The vulnerabilities discussed in this article are well known, and have been for many years. If we look at the OWASP top 10 from 2017 and 2013, we will see many of the same vulnerabilities. The way that vulnerabilities are exploited are constantly evolving. As a developer and security expert, you need to stay on top of these exploitation methods in order to write good software.

Interested in learning more about the techniques used to find vulnerabilities in applications? Check out my course on bug bounty hunting: https://www.udemy.com/course/the-complete-guide-to-bug-bounty-hunting/?referralCode=8EAC1FBB4F25761AA133