The Top 10 Application Security Vulnerabilities of 2018

What do British Airways, Ticketmaster, the USPS and TaskRabbit all have in common?

• By Mark Rogan
• Jan 17, 2019

Today’s applications touch millions if not billions of people on a daily basis. With virtually every business using applications to grow, they are critical to companies’ success—yet the vulnerabilities and risks associated with them continue to increase exponentially.

And the proof is in the breach. British Airways, Ticketmaster, the United States Postal Service (USPS), Air Canada and TaskRabbit were just some of the major household names plagued by application security vulnerabilities in 2018, leading to headline-grabbing hacks.

To help educate the market on avoiding breaches of this nature, the experts at the WhiteHat Security Threat Research Center (TRC) have compiled the Top 10 Application Security Vulnerabilities of 2018, detailing the most common web exploits used by malicious attackers during the past 12 months—as well as valuable prevention tips for enterprises to implement in the new year.

1. jQuery File Upload RCE - CVE-2018-9206

jQuery File Upload is a popular open source package that allows users to upload files to a website – however, it can be abused by creating a shell that is uploaded to run commands on the server. This vulnerability can be traced back to 2015, and all versions prior to 9.22.1 are vulnerable. Therefore, organizations should ensure any site using jQuery is updated to the most current version.

2. Magecart

Although not a common vulnerability and exposure (CVE), Magecart is a card-skimming attack that cannot be overlooked. It originated from a black hat group in 2018, and companies like Ticketmaster, British Airways, Feedify, ABS-CBN and Newegg were among the victims of this attack. Magecart breaches systems and replaces the JavaScript that handles payments with malicious code to send payment details to the hackers completely unbeknownst to the end user.

3. Wordpress DoS - CVE-2018-6989

In Wordpress, unauthenticated users can perform a Denial of Service (DoS) attack by abusing the functionality of the load-scripts.php file to request a large number of JavaScript files via a single request. This allows for each request to quickly consume the resources of the server, leading to a DoS.

4. Drupalgeddon 2 - CVE-2018-7600

With the release of Drupalgeddon 2 and immediate proof of concept (PoC) exploit, over 100,000 Drupal websites were considered vulnerable to this remote code execution vulnerability. The exploit worked by manipulating the functionality to inject a render array containing executable code and then trick the application into rendering the injection. Upgrading to the most recent version of Drupal 7 or 8 core mitigates the vulnerability.

5. Drupalgeddon 3 - CVE-2018-7602

Hot off the heels of Drupalgeddon 2’s patch came Drupalgeddon 3, which reported that the exploit could still be achieved by using the destination parameter in Drupal. This parameter could be found on the cancel links during confirmation of deletions on various functions for Drupal 7. It also required the attacker to be authenticated and have delete permissions to execute this attack. Again, upgrading to the most recent version of Drupal 7 or 8 core mitigates the vulnerability.

6. Telerik's RadAsyncUpload

RadAsyncUpload uses a default, hard coded key, which if not changed, an attacker can use to decrypt the data and modify configurations such as ‘where to upload the file’ and ‘what are the allowable extensions.’ This allows the attacker to encrypt data and send it back to the server with a request, which results in unrestricted file upload. To ensure your site is not vulnerable, WhiteHat advises setting strong custom encryption keys.

7. Spring Data Commons - CVE-2018-1273

Within the Spring Framework, the data commons are used to provide an API for accessing NoSQL and relational databases. However, in versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions of Spring Data Commons, the MapDataBinder class could be exploited using projection-based request payload binding through the Spring Expression Language Injection, leading to remote code execution. Upgrading the version will remediate the vulnerability.

8. Cross Site Scripting - CVE-2018-1999024

While cross site scripting can occur in any instance where the server does not validate input and encode output, CVE-2018-1999024 was created to report an instance in MathJax where the \unicode{} macro could be manipulated to execute malicious JavaScript in the victim’s browser. Upgrading to version 2.7.4 + remediates this specific XSS instance.

9. Flash Player Hack - CVE-2018-4878

Remote code execution is possible within Adobe Flash Player before 28.0.0.161.

The vulnerability is within the Primetime SDK, which contains a dangling pointer in the media player’s handling of the listener object. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.

10. Spring OAuth Approval - CVE-2018-1260

The default approval endpoint for Spring Security OAuth, found in versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15, and older unsupported versions, is vulnerable to remote code execution through a Spring Expression Language Injection. This remote code execution occurs when a malicious attacker creates an authorized request to the authorization endpoint, and the resource owner is then able to forward to the approval endpoint. To ensure sites are not vulnerable, companies should upgrade Spring Security OAuth.