2011 CWE/SANS Top 25 with OWASP Top 10 and PCI DSS V2 Mapping

1. OWASP Education Computer based training 2011 CWE/SANS Top 25 with OWASP Top 10 and PCI DSS V2 Mapping • Keith TurpinThe Boeing CompanyApplication Security Assessments Lead • OWASP Secure Coding Practices Lead • OWASP Global Projects Committee • keith.turpin@owasp.org • Nishi Kumar • IT Architect Specialist • Chair, Software Security Forum at FIS • OWASP CBT Project Lead • OWASP Global ProjectsCommittee • Nishi.Kumar@owasp.org

2. Objectives • Provide an overview of the 2011 CWE/SANS Top 25 • Discuss mapping relationships between CWE/SANS Top 25, OWASP Top 10 for 2010 and PCI DSS V2 • Understand the CWE/SANS Top 25 weaknesses and • how to remediate them

3. Organizations • MITRE - http://www.mitre.org/ The MITRE Corporation is a not-for-profit organization that manages several Federally Funded Research and Development Centers. Mitre currently runs various IT security projects including the Common Weakness Enumeration (CWE) and it is the official source for the CWE/SANS Top 25 Most Dangerous Software Errors. CWE Database - http://cwe.mitre.org/ • SANS - http://www.sans.org The SysAdmin, Audit, Network, Security (SANS) Institute operates as a commercial research and education company. SANS is well known for its Internet Storm Center, its comprehensive list of computing security training programs and its work with Mitre on the CWE/SANS Top 25 Most Dangerous Software Errors.

4. Selection and Ranking • Builds on the original 2009 and 2010 versions • Methodology - Qualitative rather than quantitative • Factors in ranking: • Prevalence • Importance • Likelihood of exploit • Initially started with 41 candidate weaknesses

5. 2011 CWE/SANS Top 25

6. 2011 CWE/SANS Top 25

7. OWASP Top 10 & SANS CWE Top 25 mapping

8. OWASP Top 10 & SANS CWE Top 25 mapping

9. SANS CWE Top 25

10. Mapping Considerations • SANS CWE Top 25 is only a fraction of the full CWE list of weaknesses • SANS CWE Top 25 applies to both web and non-web applications • OWASP defines ten risks focused on web applications • OWASP's list tends to use broader risk categories • PCI DSS requirements points to both of the above lists as industry best practices • PCI DSS specifies its own set of requirements

11. [1] CWE-89Improper Neutralization of Special Elements used in an SQL Command('SQL Injection')

12. [1] CWE-89Improper Neutralization of Special Elements used in an SQL Command('SQL Injection')

13. [2] CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

14. [2] CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

15. [3] CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') • Example: C • char last_name[20];...................................Declare array with 20 character limit • printf ("Enter your last name: "); • scanf ("%s", last_name); ...........................Get input (no limit) and store in array • The software does not limit the size of the name entered by the user, so an entry of more than 20 characters will cause a buffer overflow, since the "last_name" array can only hold 20 characters

16. [3] CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

17. [4] CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Try this in your browser's address bar: javascript:alert(document.cookie)

18. [4] CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') E.g. outputencodingwith HTML entity encoding:The < character becomes: &lt; The " character becomes: &quot; This tag <script> becomes: &lt;script&gt

19. [5] CWE-306Missing Authentication for Critical Function

20. [5] CWE-306Missing Authentication for Critical Function

21. [6] CWE-862 Missing Authorization

22. [6] CWE-862Missing Authorization

23. [7] CWE-798Use of Hard-coded Credentials

24. [7] CWE-798Use of Hard-coded Credentials

25. [8] CWE-311Missing Encryption of Sensitive Data

26. [8] CWE-311Missing Encryption of Sensitive Data

27. [9] CWE-434Unrestricted Upload of File with Dangerous Type Example: This PHP file provides access to the host OS <?php system($_GET['cmd']); ?> http://server.example.com/upload_dir/malicious.php?cmd=ls%20-l

28. [9] CWE-434Unrestricted Upload of File with Dangerous Type

29. [10] CWE-807Reliance on Untrusted Inputs in a Security Decision https://example.com/accountInfo?acct=Bob) Bob makes request for his own acct https://example.com/accountInfo?acct=Tom) Bob makes request for Tom’s acct

30. [10] CWE-807Reliance on Untrusted Inputs in a Security Decision

31. [11] CWE-250Execution with Unnecessary Privileges

32. [11] CWE-250Execution with Unnecessary Privileges

33. [12] CWE-352Cross-Site Request Forgery (CSRF) • Example of a legitimate request: • http://example.com/app/transferFunds?amount=1500&destinationAccount=4673243243 • Example or a forged request using a hidden image tag: • <img src=http://example.com/app/transferFunds?amount=1500&destinationAccount= • attackersAcct#width="0" height="0" />

34. [12] CWE-352Cross-Site Request Forgery (CSRF)

35. [13] CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Expected Request:http://app/page.jsp?include=file.txt Malicious Request: http://app/page.jsp?include=/../../../../../../../../../etc/passwd Expected Request:http://app/page.jsp?file=graphic.gif Malicious Request: http://app/page.jsp?file=serverlogs.txt%00.gif

36. [13] CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Direct object reference: http://app?file=Report123.xls Mapped value reference: http://app?file=1 (In sever side code: 1 = Report123.xls)

37. [14] CWE-494Download of Code Without Integrity Check Example: Java URL[] classURLs= new URL[]{ new URL("file:subdir/") }; URLClassLoader loader = new URLClassLoader(classURLs); Class loadedClass = Class.forName("loadMe", true, loader); This code does not ensure that the class loaded is the intended one, for example by verifying the class's checksum. An attacker may be able to modify the class file to execute malicious code.

38. [14] CWE-494Download of Code Without Integrity Check

39. [15] CWE-863 Incorrect Authorization Attacker notices the URL indicates his role /user/getAccounts He modifies it to another directory (role) /admin/getAccounts Attacker views more accounts than just their own

40. [15] CWE-863 Incorrect Authorization

41. [16] CWE-829 Inclusion of Functionality from Untrusted Control Sphere • <div id="WeatherWidget"> • <script type="text/javascript" src="externalDomain.example.com/weatherwidget.js"></script> • </div>

42. [16] CWE-829 Inclusion of Functionality from Untrusted Control Sphere

43. [17] CWE-732Incorrect Permission Assignment for Critical Resource

44. [17] CWE-732Incorrect Permission Assignment for Critical Resource

45. [18] CWE-676 Use of Potentially Dangerous Function

46. [18] CWE-676 Use of Potentially Dangerous Function

47. [19] CWE-327Use of a Broken or Risky Cryptographic Algorithm

48. [19] CWE-327Use of a Broken or Risky Cryptographic Algorithm

49. [20] CWE-131Incorrect Calculation of Buffer Size Example: C int *id_sequence; id_sequence = (int*) malloc(3); if (id_sequence == NULL) exit(1); id_sequence[0] = 13579; id_sequence[1] = 24680; id_sequence[2] = 97531; The size parameter used during the malloc() call is set to '3' which results in a buffer of 3 bytes. The intent was to create a buffer that holds three ints, and in C, each int requires 4 bytes, so an array of 12 bytes is needed. Executing the above code could result in a buffer overflow as 12 bytes of data is being saved into 3 bytes worth of allocated space

50. [20] CWE-131Incorrect Calculation of Buffer Size