MITRE lately launched its yearly checklist of the 2024 CWE Prime 25 Most Harmful Software program Weaknesses.
This checklist differs from lists that comprise the most typical vulnerabilities, as it’s not an inventory of vulnerabilities, however moderately weaknesses in system design that may be exploited to leverage vulnerabilities.
“By definition, code injection is an assault, and after we take into consideration the Prime 25 it’s figuring out the weaknesses beneath,” stated Alec Summers, undertaking chief for the CVE Program at MITRE.
These weaknesses can doubtlessly pave the best way for vulnerabilities and assaults, so it’s necessary to pay attention to them and mitigate them as a lot as attainable.
In accordance with Summers, one pattern on this yr’s checklist is that whereas some weaknesses moved up or down the checklist, plenty of the weaknesses on the checklist are basic weaknesses which were round for years, comparable to those who allow SQL injection and cross-site scripting.
“The extra you perceive these weaknesses, and also you draw connections between this stuff, you possibly can truly begin to remove complete courses of issues that we see so many instances,” he stated.
Addressing these weaknesses not solely improves product safety, but in addition has the potential to avoid wasting corporations cash as a result of “the extra weaknesses we keep away from in product growth, the much less vulnerabilities to handle after deployment,” he defined.
This yr’s checklist contains the next weaknesses:
- Improper Neutralization of Enter Throughout Internet Web page Technology (‘Cross-site Scripting’)
- Out-of-bounds Write
- Improper Neutralization of Particular Components utilized in an SQL Command (‘SQL Injection’)
- Cross-Website Request Forgery (CSRF)
- Improper Limitation of a Pathname to a Restricted Listing (‘Path Traversal’)
- Out-of-bounds Learn
- Improper Neutralization of Particular Components utilized in an OS Command (‘OS Command Injection’)
- Use After Free
- Lacking Authorization
- Unrestricted Add of File with Harmful Sort
- Improper Management of Technology of Code (‘Code Injection’)
- Improper Enter Validation
- Improper Neutralization of Particular Components utilized in a Command (‘Command Injection’)
- Improper Authentication
- Improper Privilege Administration
- Deserialization of Untrusted Knowledge
- Publicity of Delicate Info to an Unauthorized Actor
- Incorrect Authorization
- Server-Aspect Request Forgery (SSRF)
- Improper Restriction of Operations throughout the Bounds of a Reminiscence Buffer
- NULL Pointer Dereference
- Use of Arduous-coded Credentials
- Integer Overflow or Wraparound
- Uncontrolled Useful resource Consumption
- Lacking Authentication for Vital Operate
The dataset the checklist relies on contains data for 31,779 Widespread Vulnerabilities and Exposures (CVEs) revealed between June 1, 2023 and June 1, 2024.
In accordance with Summers, this yr, the technique by which the checklist was created was completely different than in previous years as a result of MITRE and CISA concerned the broader safety neighborhood to research the dataset, whereas in earlier years MITRE’s Widespread Weak point Enumeration (CWE) workforce labored alone.
This may occasionally have resulted in lots of modifications from earlier years, and this yr’s checklist solely featured three weaknesses that retained the identical rating as final yr: #3 Improper Neutralization of Particular Components utilized in an SQL Command (‘SQL Injection’), #10 Unrestricted Add of File with Harmful Sort, and #19 Server-Aspect Request Forgery (SSRF).
The weaknesses that had the most important upward transfer from final yr’s checklist are #4 Cross-Website Request Forgery, which moved up 5 ranks; #11 Improper Management of Technology of Code (‘Code Injection’), which moved up 12 ranks; #15 Improper Privilege Administration, which moved up seven ranks; and #18 Incorrect Authorization, which moved up six ranks.
Weaknesses that moved down in rank considerably embody #12 Improper Enter Validation, which moved down six ranks; #21 NULL Pointer Dereference, which moved down 9 ranks; #23 Integer Overflow or Wraparound, which moved down 9 ranks; and #25 Lacking Authentication for Vital Operate, which moved down 5 ranks.
This yr additionally noticed two new entries to the checklist and two entries that left the Prime 25. New entries embody #17 Publicity of Delicate Info to an Unauthorized Actor and #24 Uncontrolled Useful resource Consumption. Earlier entries now not within the Prime 25 are Concurrent Execution utilizing Shared Useful resource with Improper Synchronization (‘Race Situation’) and Incorrect Default Permissions.
In accordance with MITRE, one attainable explanation for the modifications is that they didn’t obtain CWE mappings from the U.S. Nationwide Vulnerability Database analysts for the CVE data from the primary half of 2024.
“It’s not clear whether or not these gaps have an effect on the relative rankings, for the reason that distribution of unmapped CVEs appears prone to align roughly with the CWE distribution of your complete information set,” MITRE wrote.
