Skip to main content

5.1 Application and Data Vulnerabilities and Attacks

Topic 5.1: Application and Data Vulnerabilities and Attacks​

The security of applications and the data they process is a critical aspect of cybersecurity. Vulnerabilities in how data is stored, accessed, and handled by applications can be exploited by adversaries to cause significant harm.

A fundamental vulnerability exists with any unencrypted data. If an adversary gains access to a device or storage drive, they can read any files that are not encrypted. Similarly, misconfigured access controls pose a significant risk. Computers typically have different user levels, with administrative users having broad permissions to access all files and system settings. If standard users are granted unnecessary administrative privileges, and their account is compromised, the adversary gains powerful control over the system. Weak access control settings on files and directories, which allow too many users to view or edit sensitive information, create opportunities for data theft or unauthorized modification.

Applications themselves are a major target for attacks. Many applications, especially web applications, accept input from users through text fields. If this input is not properly checked and validated before being processed, the application can be vulnerable to injection attacks.

  • SQL Injection (SQLi): Structured Query Language (SQL) is used to communicate with databases. In an SQL injection attack, an adversary enters SQL commands into a user input field. If the application does not properly sanitize this input, these malicious commands are executed by the database. This can allow the adversary to bypass authentication, retrieve sensitive data from the database, or even modify or delete data, compromising its confidentiality and integrity.

  • Cross-Site Scripting (XSS): This attack targets the users of a web application rather than the application itself. An adversary injects malicious scripts (usually JavaScript) into a web page that is then viewed by other users. When a victim's browser loads the compromised page, it executes the malicious script. This can allow the adversary to steal the user's session cookies, capture their login credentials, or redirect them to malicious websites.

  • Buffer Overflow: Applications allocate fixed-size blocks of memory called buffers to temporarily store user input. A buffer overflow attack occurs when an adversary intentionally enters more data than the buffer can hold. This excess data overflows into adjacent memory regions, potentially overwriting critical data or executable code. A successful buffer overflow can cause the application to crash or, more dangerously, allow the adversary to execute their own arbitrary code on the system.

  • Directory Traversal: Web applications serve files from specific directories on a server. A directory traversal attack involves an adversary manipulating a URL to access files and directories stored outside the web root directory. By using character sequences like ../, an adversary can navigate the server's file system and potentially access sensitive configuration files or system data.

The risks associated with these vulnerabilities are significant. A high-risk scenario might involve the unencrypted storage of highly sensitive intellectual property, such as the design for a new jet engine. A moderate risk could be a company storing customers' personally identifiable information (PII) in a spreadsheet that is protected with weak encryption. A low risk might involve a company executive storing internal memos on an unencrypted, open share drive. A thorough risk assessment is necessary to identify these application and data vulnerabilities and prioritize their mitigation.