SPOTLIGHT Cracks in the Foundation: Web and Application Framework Vulnerabilities RiskSense Spotlight Report • March 2020 Introduction An organization’s software stacks and web-facing And while resources such as the OWASP Top 10 and Top applications are some of the most fundamentally 25 Programming Most Dangerous Software Errors provide important assets in an enterprise digital environment. an important way of classifying the most common types Everything from blogs to the most sophisticated of weaknesses, it is often hard for developers and security applications are essential to how organizations serve their staff to know how specific choices such as coding users and interact with the outside world. The language and application frameworks impact the attack applications’ exposure to the outside world also means surface of their web assets. that they are some of the assets most exposed to attack. This Spotlight Report puts some of the most popular languages and frameworks under the microscope to see: The languages and frameworks where vulnerabilities are most common Which vulnerabilities are weaponized the most The underlying weaknesses that lead to vulnerabilities Patterns of weaknesses found in particular frameworks How to prioritize vulnerabilities based on real-world context Spotlight • Cracks in the Foundation: Web and Application Framework Vulnerabilities Page 1 RiskSense Spotlight Report • March 2020 Key Findings 2019 Vulnerabilities are Down, But Weaponization is Up technologies when evaluated over both a 10- and 5-year Web and application frameworks have largely been time horizon. While the types of weaknesses have changed immune to the massive spike in vulnerabilities observed in considerably over the course of a decade, the same players the U.S. National Vulnerability Database (NVD) over the have remained responsible. past few years. And while the overall number of framework vulnerabilities is down compared to previous years, the Frameworks Are Getting XSS Under Control weaponization rate has jumped to 8.6%; more than double While XSS issues were the most common weakness in that of the NVD average (3.9%) for the same time frame. the full 10-year dataset, it dropped to 5th when analyzed This uptick in weaponization was primarily due to increased over the last 5 years. This is a good sign that frameworks weaponization in Ruby on Rails, WordPress, and Java. are making progress in this important area. XSS weaknesses over the past 5 years have largely been due WordPress and Struts are the Most Weaponized to issues in WordPress. In terms of web and app frameworks, WordPress and Apache Struts were responsible for the most weaponized Input Validation Becomes the Top Weakness vulnerabilities – those vulnerabilities for which exploit Input Validation has become the top problem for code exists that can actually take advantage of the frameworks, accounting for 24% of all weaponized weakness. These two frameworks alone accounted for vulnerabilities over the past five years. Input validation 55% of the weaponized vulnerabilities over the past 10 covers a wide range of techniques and is one of the most years. WordPress faced a wide variety of issues, but important capabilities of an application framework. Input cross-site scripting (XSS) was the most common validation problems have been largely tied to Struts, problem, while Struts was dominated by input validation WordPress, and Drupal. Access control issues were also problems. Their respective underlying languages, PHP for on the rise, and mostly attributable to Java. WordPress and Java for Struts, were also the most weaponized languages in the study. Injection Weaknesses are Highly Weaponized Vulnerabilities tied to SQL injection, code injections, and Keep an Eye on Node.js and Django various command injections remained fairly rare, but had As a whole, JavaScript and Python frameworks showed some of the highest weaponization rates, often over 50%. the lowest weaponization of vulnerabilities, however the In fact, the top three weaknesses by weaponization rate news wasn’t all good. Node.js had a notably higher number were Command Injection (60% weaponized), OS of vulnerabilities than other JavaScript frameworks with 56 Command Injection (50% weaponized), and Code vulnerabilities, although only one has been weaponized to Injection (39% weaponized).This often makes them some date. The vulnerabilities covered a wide range of issues of the most sought after weaknesses by attackers. including input validation, information exposure, and resource exhaustion issues. Likewise, Django had 66 Scoring Systems Need Real-World Context vulnerabilities with only one weaponized. While CVSS v2 and v3 scores were not particularly efficient at weaponization remains low, the large number of predicting vulnerability weaponization. Only 12.4% of CVSS vulnerabilities in these frameworks leaves them open for v2 High vulnerabilities were weaponized, while 9% of the potential for risk. CVSS v3 Critical vulnerabilities were weaponized. By comparison, models that include intelligence from the wild Certain Frameworks Produce the Most Vulnerabilities showed 95% of Critical vulnerabilities were weaponized. The majority of weaponized vulnerabilities have This ability to quickly find and work on the issues that consistently been tied to the same technologies over the pose the greatest risk is crucial for organizations to ensure course of the past decade. WordPress, PHP, Apache Struts, they spend their effort on the right tasks. Java, and Drupal remained the top five weaponized Spotlight • Cracks in the Foundation: Web and Application Framework Vulnerabilities Page 2 RiskSense Spotlight Report • March 2020 Table of Contents Introduction 1 Key Findings 2 1. Background on Application Frameworks 4 What are Application Frameworks? 4 The Importance of Vulnerabilities in Languages and Frameworks 4 2. Overview of Vulnerabilities 5 Vulnerabilities by Year 6 3. The Most Vulnerable Frameworks 7 WordPress and Struts Lead the Way 7 Language and Framework Breakout 8 Trends in 2015-2019 9 4. Analyzing Framework Weaknesses 10 The Most Weaponized Weaknesses of the 2010s 10 2015-2019: Big Changes in the Weakness Landscape 12 Summary of Key Frameworks 16 5. Comparison of Vulnerability Scoring Systems 18 Scoring by Year 18 The Importance of Real-World Context 19 Conclusion 20 Spotlight • Cracks in the Foundation: Web and Application Framework Vulnerabilities Page 3 RiskSense Spotlight Report • March 2020 1. Background on Application Frameworks Modern applications rely on a wide range of interdependent What are Application Frameworks? Most importantly, the nature of web applications means using a specially crafted URL. When a new vulnerability is technologies in order to deliver functionality. These layers of Web frameworks streamline the development and that these vulnerabilities are typically exposed to the discovered, attackers can easily identify sites built from technology are commonly referred to as an application deployment of applications and websites. Instead of internet. For example a recent PHP vulnerability the vulnerable framework or language and automatically “stack,” which can include things like the web server, requiring the developer to code every line of PHP, HTML, (CVE-2019-11043) allowed even unskilled attackers to scan for specific vulnerabilities. databases, programming or coding languages and scripting etc., a framework can provide the developer with force a site to execute a malicious payload simply by components, virtualization and containers, and a variety of ready-made building blocks for many common tasks. This other components. might include things like session management or validating user input to the application. Instead of manually coding The most traditional view of the application stack is defined these functions over and over, the framework can provide by the LAMP stack. LAMP is an acronym built from the these components automatically. Likewise the framework most standard components of the stack including: can handle the dynamic generation of HTML and other code based on user interaction. In short, they vastly • Operating System – LINUX simplify the development of dynamic web applications. • Web Server – Apache • Database – MySQL These frameworks are likewise built on one of the parent • Language/Scripting – PHP, Perl, Python technologies we have seen earlier. For example, the Laravel and Symfony frameworks are built on PHP. Web cache Linux kernel Hardware Environment: CCC Likewise, Node.js, AngularJS, and React are common AppArmor Squid SELinux Polipo Smack frameworks built on JavaScript. TOMOYO Crackers Traffic server CPU cracking attempts Process Scheduler & RAM Web server Netfilter Attacks stave off The Importance of Vulnerabilities in Frameworks Apache Competitors Linux network stack & compete for customers Cherokee Requests In general, application frameworks have made Lighttpd Network scheduler serve Nginx NIC Networking application development more secure overall. Instead of CGI scripting device Internet driver hardware Perl relying on manual coding to validate input every time a PHP kmod-fs-ext4 Responses kmod-fs-btrfs low latency Python Customers user interacts with an application, the framework can Lustre want attendance ... Storage Database SATA handle this automatically. With less manual coding SAS MariaDB RAID frameworks can reduce the chance of manual errors. MySQL iSCSI NAS Botnets Drizzle DDoS-Attacks However, better does not mean foolproof. Languages and Figure 1(a): The Traditional