The CWE/SANS Top 25 is a list of the most dangerous common software errors that can leave your application vulnerable to bad actors. It’s put together by MITRE and the SANS Institute as part of the Common Weakness Enumeration (CWE) project. The list can help you prioritize your application security efforts based on prevalence and potential impact.
Here’s a closer look at some of the most prominent errors in the CWE/SANS Top 25, including how they can be exploited for malicious intent.
The top error on the newest version of the list occurs when a program writes data outside of the memory boundaries. This can allow attackers to execute malicious code or crash your application.
Cross-site scripting (XSS) is an error that lets hackers inject scripts into web pages. This can trick a trusted site on a user’s browser into executing malware.
An SQL injection attack opens up an avenue for an attacker to manipulate the queries your application makes to a database. Hackers can use an SQL injection attack to view, change, or delete sensitive data.
Hackers can exploit a use after free error by continuing to use memory after it’s been “freed” by the application. They can escalate privileges, gain unauthorized access, or trick the program into running a malicious script.
Some of the other most significant errors include:
The 2023 version of the CWE/SANS Top 25 was updated to reflect changes in the threat landscape and new technologies. The top three positions weren’t changed from the 2021 version. However, some weaknesses were reranked due to higher or lower priorities, while others were added or removed.
Existing weaknesses that were reranked include:
Two new vulnerabilities were added to the list:
Two others moved out of the top 25:
AI is contributing to cyberattacks at scale by automating processes related to finding and exploiting weaknesses. Many of the CWE/SANS Top 25 highlight the need to bolster your applications defenses by blocking these vulnerabilities, such as input validation weaknesses and authentication flaws.
The following errors facilitate these types of attacks:
Ransomware-as-a-Service platforms have lowered the barrier to committing these types of attacks. They often exploit vulnerabilities that give hackers access to your systems critical functions or allow for unauthorized code execution.
The following vulnerabilities are particularly relevant for ransomware attacks:
As application security has become a more significant focus for many organizations, hackers have found less obvious methods of attack through third-party vendors or software dependencies. These supply chain attacks allow them to infiltrate systems through more vulnerable side channels.
The errors that relate to supply chain attacks include:
Due to their minimalist names and limited computing power, many IoT devices aren’t adequately protected, making them a prime target for attackers. They also open up a pathway into more high-value systems that malicious actors can exploit for access.
The following vulnerabilities can allow IoT device attacks:
Security practices to manage these vulnerabilities have also changed. Development teams are shifting left to address security earlier in the software development lifecycle (SDLC) — ideally during the planning phase.
Kiuwan’s SAST tool automatically scans your code for vulnerabilities in the CWE/SANS Top 25 list. Many of these errors can be automatically mitigated with the Kiuwan’s SAST solution. You can can incorporate it into your integrated development environment (IDE) so developers will get immediate feedback on best coding practices.
Kiuwan’s SCA tool gives you 100% visibility into your open-source vulnerabilities, which is important for understanding third-party risks that can lead to supply chain attacks. SCA scans code and automatically identifies any open-source or third-party libraries and components.
A combination of tools and techniques will improve your application security and help you avoid many of the top 25 exploitable software errors. Request a demo to see how Kiuwan can help secure your applications against today’s top software vulnerabilities
