Click here to close now.

Welcome!

Microservices Journal Authors: Carmen Gonzalez, Elizabeth White, Blue Box Blog, Liz McMillan, Pat Romanski

Related Topics: Microservices Journal, Security

Microservices Journal: Article

Common Web Application Security Vulnerabilities and Mitigation

It's easy to avoid common vulnerabilities with little precaution

Web applications are vulnerable to a multitude of security attacks. This exposes the underlying businesses and the consumer data to public view. However it is a common observation that web developers hardly take any preventive steps to secure their web applications.

Most of the time web application developers focus only on authentication and authorization to secure the web applications. This may be a viable approach for designing an intranet application. However, for the Internet application, multiple programming practices need to be followed to prevent such attacks.

This article details in brief the various security vulnerabilities web applications face and how they can be mitigated.

Bypassing Input Validation
Generally developers validate the user input using JavaScript validations. Once the information is sent to the server side, developers do not validate again, since they assume that JavaScript validations can block all invalid data.

Hackers, however, can simply save the page to their local hard disk and modify the JavaScript to not do the validation. They can then submit the page.

Mitigation
All input should be validated twice - first on the client side and then on the server side. Client-side validation is done using Java Script. The server-side validation is done using the respective server-side technology like Java, .NET or PHP

SQL Injection
An attacker can submit input that would pass the JavaScript and server-side validation. However, the input is actually an SQL query. Since the input is used to construct the SQL queries, such an input would alter the SQL query and give unauthorized information back to the attacker.

Mitigation
Use Prepared Statements to fire queries. Don't use string concatenation with the user input to create dynamic queries

Unprotected Resources
The attacker can guess the URLs of unprotected resources. Such information can be divulged by reading the code comments or it could be guessed.

Mitigation
All web content must be protected by authentication. In the case of Java web application programming, keep all the unprotected and sensitive code under WEB-INF. A similar solution exists for PHP and other server-side technologies.

Reverse Engineering
For rich client applications such as those using Java Applets, Adobe Flex, Microsoft Silverlight, etc., the entire byte code gets transmitted to the client side. An attacker can decompile the byte code and gain sensitive information.

Mitigation
The client-side code shouldn't contain any business logic. It also shouldn't contain business logic validation. The code should be obfuscated before sending to the client.

Weak Authentication
Many times attackers can gain access to a secure website by using common terms like ‘admin,' ‘test,' etc. Developers often use these user names and passwords for testing purposes and often forget to remove them from the production systems.

Mitigation
Developers should not be given access to a production database for testing purposes. All testing must happen in UAT and it should use real user names and passwords.

Cross-Site Scripting (XSS)
When you open two websites in two different browser tabs, you don't expect one website on a given tab to steal your passwords from another tab.

However, this is possible, if you are using an old version of the browser or if you're using an infected browser

Mitigation
Encourage users to upgrade to the latest version of the browsers. Also technologies that use secure sandboxing such as Java Applets and Adobe Flex and many others should be used for creating rich-client applications.

Conclusion
About 80% of all web security breaches can be prevented by addressing the above vulnerabilities. A regular code review is very much required to correct the oversight on the part of programmers.

There are also various tools available that will detect the common vulnerabilities for you. Many of these tools, however, generate false positives and need substantial time to separate false positives from real alerts.

Ultimately these tools can't fix the code. That has to be done by the developer. Thus, appropriate review procedures must be established and awareness should be propagated to educate developers on the vulnerabilities and their mitigation.

More Stories By Mahesh K Punjabi

Mahesh K Punjabi is a senior technology architect with Infosys Technologies Ltd. He has extensive experience designing enterprise applications using Java and multitude of RIA technologies including Flex and GWT. His other passions include photography and speaking with Toastmasters' clubs.

@MicroservicesExpo Stories
SYS-CON Events announced today the DevOps Foundation Certification Course, being held June ?, 2015, in conjunction with DevOps Summit and 16th Cloud Expo at the Javits Center in New York City, NY. This sixteen (16) hour course provides an introduction to DevOps – the cultural and professional movement that stresses communication, collaboration, integration and automation in order to improve the flow of work between software developers and IT operations professionals. Improved workflows will res...
SYS-CON Events announced today that Ciqada will exhibit at SYS-CON's @ThingsExpo, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. Ciqada™ makes it easy to connect your products to the Internet. By integrating key components - hardware, servers, dashboards, and mobile apps - into an easy-to-use, configurable system, your products can quickly and securely join the internet of things. With remote monitoring, control, and alert messaging capability, you will mee...
SYS-CON Events announced today that Column Technologies, a global technology solutions company, will exhibit at SYS-CON's DevOps Summit 2015 New York, which will take place June 9-11, 2015, at the Javits Center in New York City, NY. Established in 1998, Column Technologies is a leader in application performance and infrastructure management for commercial and federal markets. The company is headquartered in the United States, with a diverse and talented team of more than 350 employees around th...
As we recently previewed (read more about our London PoP in Jesse's post), Blue Box is opening a new Data Center in London, but hadn't announced the provider. Today we're excited to partner with TelecityGroup, whom we've selected as our data center partner in London. We chose their Powergate location, which is one of the U.K.'s most advanced, flexible and energy efficient carrier-neutral data centres. Why does that matter to you? Well, when customers choose Blue Box, they're trusting us with ...
Cloud Expo New York is happening from June 9 - 11. This event brings together the worlds of Cloud Computing, DevOps, IoT, WebRTC, Big Data and SDDC. We hope to see you there-members of the Blue Box team will exhibit in booth 218 next to the DevOps area. Plus, our Chief Product Officer, Hernan Alvarez, will present his talk "The Cloud Has a Down-and-Dirty Lining" as part of the Operations track in the DevOps Summit portion of the event on June 9 at 11 am. Learn more about his session her...
Financial services organizations were among the earliest enterprise adopters of cloud computing. The ability to leverage massive compute, storage and networking resources via RESTful APIs and automated tools like Chef and Puppet made it possible for their high-horsepower IT users to develop a whole new array of applications. Companies like Wells Fargo, Fidelity and BBVA are visible, vocal and engaged supporters of the OpenStack community, running production clouds for applications ranging from d...
SYS-CON Events announced today the IoT Bootcamp – Jumpstart Your IoT Strategy, being held June 9–10, 2015, in conjunction with 16th Cloud Expo and Internet of @ThingsExpo at the Javits Center in New York City. This is your chance to jumpstart your IoT strategy. Combined with real-world scenarios and use cases, the IoT Bootcamp is not just based on presentations but includes hands-on demos and walkthroughs. We will introduce you to a variety of Do-It-Yourself IoT platforms including Arduino, Ras...
SYS-CON Events announced today Sematext Group, Inc., a Brooklyn-based Performance Monitoring and Log Management solution provider, will exhibit at SYS-CON's DevOps Summit 2015 New York, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. Sematext is a globally distributed organization that builds innovative Cloud and On Premises solutions for performance monitoring, alerting and anomaly detection (SPM), log management and analytics (Logsene), search analytics (S...
SYS-CON Events announced today Isomorphic Software, the global leader in high-end, web-based business applications, will exhibit at SYS-CON's DevOps Summit 2015 New York, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. Isomorphic Software is the global leader in high-end, web-based business applications. We develop, market, and support the SmartClient & Smart GWT HTML5/Ajax platform, combining the productivity and performance of traditional desktop software ...
The 5th International DevOps Summit, co-located with 17th International Cloud Expo – being held November 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA – announces that its Call for Papers is open. Born out of proven success in agile development, cloud computing, and process automation, DevOps is a macro trend you cannot afford to miss. From showcase success stories from early adopters and web-scale businesses, DevOps is expanding to organizations of all sizes, including the...
SYS-CON Events announced today that Cisco, the worldwide leader in IT that transforms how people connect, communicate and collaborate, has been named “Gold Sponsor” of SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. Cisco makes amazing things happen by connecting the unconnected. Cisco has shaped the future of the Internet by becoming the worldwide leader in transforming how people connect, communicate and collaborat...
Operationalizing the network continues to be a driving force behind DevOps and SDN. The ability to solve real problems using programmability to automate and orchestrate infrastructure provisioning and configuration across the application release process remains the hope for many interested in one or the other - and often times both. A recent Avaya sponsored, Dynamic Markets survey (reg required) dove deep into the demesne of SDN and found that many of the problems companies have - and expect ...
We just finished the first O’Reilly Software Architecture Conference and the overwhelming most popular topic was microservices. Why all the hype about an architectural style? Microservices are the first post-DevOps revolution architecture. The DevOps revolution highlighted how much inadvertent friction an outdated operations mindset can cause, starting the move towards automating away manual tasks.
SYS-CON Media announced today that Blue Box as launched a popular blog feed on Cloud Computing Journal. Cloud Computing Journal aims to help open the eyes of Enterprise IT professionals to the economics and strategies that utility/cloud computing provides. Blue Box Cloud gives you unequaled agility, without the burden of designing, deploying and managing your own infrastructure. It’s the right choice when public cloud just won’t do. Blue Box Cloud is a managed Private Cloud as a Service (...
SYS-CON Events announced today that Soha will exhibit at SYS-CON's DevOps Summit New York, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. Soha delivers enterprise-grade application security, on any device, as agile as the cloud. This turnkey, cloud-based service enables customers to solve secure application access and delivery challenges that traditional or virtualized network solutions cannot solve because they are too expensive, inflexible and operational...
SYS-CON Events announced today that ProfitBricks, the provider of painless cloud infrastructure, will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY., and the 17th International Cloud Expo®, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. ProfitBricks is the IaaS provider that offers a painless cloud experience for all IT users, with no learning curve. ...
With the advent of micro-services, the application design paradigm has undergone a major shift. The days of developing monolithic applications are over. We are bringing in the principles (read SOA) hereto the preserve of applications or system integration space into the application development world. Since the micro-services are consumed within the application, the need of ESB is not there. There is no message transformation or mediations required. But service discovery and load balancing of ...
SYS-CON Events announced today that Open Data Centers (ODC), a carrier-neutral colocation provider, will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place June 9-11, 2015, at the Javits Center in New York City, NY. Open Data Centers is a carrier-neutral data center operator in New Jersey and New York City offering alternative connectivity options for carriers, service providers and enterprise customers.
of cloud, colocation, managed services and disaster recovery solutions, will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. TierPoint, LLC, is a leading national provider of information technology and data center services, including cloud, colocation, disaster recovery and managed IT services, with corporate headquarters in St. Louis, MO. TierPoint was formed through the strategic combination of some of t...
SYS-CON Events announced today that Akana, formerly SOA Software, has been named “Bronze Sponsor” of SYS-CON's 16th International Cloud Expo® New York, which will take place June 9-11, 2015, at the Javits Center in New York City, NY. Akana’s comprehensive suite of API Management, API Security, Integrated SOA Governance, and Cloud Integration solutions helps businesses accelerate digital transformation by securely extending their reach across multiple channels – mobile, cloud and Internet of Thi...