What’s New in the OWASP Top 10 for 2023?

The need for application security has never been greater. In a world where technology is ubiquitous and applications are key to day-to-day operations, organizations must protect their data against the threats of the ever-changing cybersecurity landscape. That’s why staying up-to-date on the latest tools and techniques is important to help organizations secure their applications. The Open Web Application Security Project (OWASP) Top 10 is a great resource to help organizations stay current and follow best application security (appsec) practices.

The OWASP Top 10 comprehensively lists the most critical web application security risks and their corresponding mitigation strategies. First launched in 2003, the OWASP Top 10 list is updated every three to four years as a way for organizations to benchmark their security vulnerabilities and better protect themselves from cyber threats. This article will highlight the changes in 2023’s OWASP Top 10 and compare them with the last update from 2021.

OWASP Top 10 2023 

OWASP recently announced that the OWASP Top 10 2023 release candidate is now available for review and contribution on its GitHub page. Here are the Top 10 security risks for 2023:

Changes to the OWASP Top 10 Vulnerabilities for 2023

Let’s now look at what’s new, what’s remained the same, and what’s been modified in the OWASP Top 10 vulnerabilities for 2023. The release candidate for OWASP Top 10 2023 includes the following:

• Five new vulnerability additions
• Changes to the names of three existing vulnerabilities
• The deletion of four vulnerabilities from the 2021 list

New Risks

The OWASP Top 10 for 2023 release candidate lists five new risks:

• Lack of Protection from Automated Threats: As automation technologies like bots and scripts become harder to detect and defend against, the risk of malicious attacks, such as distributed denial-of-service (DDoS) attacks, brute-force attacks, and credential stuffing attacks, increases. Automated attacks can cause serious security issues without effective protection, including data breaches, system downtime, and financial losses.
• Unsafe Consumption of APIs: While APIs can provide immense benefits, such as faster development time and increased agility, they also introduce new security risks if not properly managed or authenticated. Unsafe consumption of APIs can lead to data leakage, malicious code execution, and privilege escalation attacks.
• Broken Object Property Level Authorization: This new vulnerability focuses on the security of a system’s access control configuration and the ability to limit privileges at the object property level. 
• Broken Function Level Authorization: This occurs when an application’s authorization system fails to restrict access to certain functions, privileges, or features properly.
• Unrestricted Resource Consumption: This vulnerability occurs when an application fails to restrict the consumption of resources, such as memory, CPU cycles, or network bandwidth. It can lead to denial-of-service (DoS) attacks and other malicious activities.

Renamed Risks

While the names of three existing vulnerabilities on the OWASP Top 10 2021 list have been modified for the 2023 release candidate, their security implications remain largely unchanged.

• Broken Access Control, now “Broken Object Level Authorization”: Access controls remain one of software applications’ most fundamental security controls. Broken object level authorization occurs when an application fails to enforce authorization, allowing an attacker to access resources. This can lead to data breaches, credential theft, and other malicious activities.
• Identification and Authentication Failures, now “Broken Authentication”: Broken authentication is a vulnerability that occurs when an application fails to authenticate or authorize users properly. This can allow attackers to use weak credentials, brute-force attacks, or other authentication bypass techniques to access resources they should not be able to access.
• Vulnerable and Outdated Components, now “Improper Assets Management”: Improper assets management occurs when an application fails to properly manage the assets used in its development, deployment, and operation. This can lead to vulnerabilities in the form of patch management, outdated components, and unsecured dependencies.

Deleted Risks

Four vulnerabilities from the OWASP Top 10 2021 list didn’t make it to the 2023 list:

• Logging and Monitoring: This vulnerability occurs when applications lack proper logging and monitoring. Effective logging and proactive monitoring can help organizations detect system anomalies in real time, allowing them to identify and respond to threats before significant damage can be done.
• Injection: Injection attacks occur when an attacker can execute malicious code by exploiting a vulnerability in user-supplied input. These attacks can lead to data exfiltration, privilege escalation attacks, and other malicious activities.
• Software and Data Integrity Failures: This vulnerability occurs when an application cannot detect unauthorized modifications of data or code. Without proper integrity checks, malicious actors may be able to bypass security controls and compromise system data.
• Insecure Design: Insecure design occurs when an application does not implement security features or if the architecture allows for weak authentication. Without proper security controls, applications are susceptible to various attacks, such as privilege escalation, cross-site scripting, and data exfiltration.
• Cryptographic Failures: Cryptographic failures occur when an application does not properly encrypt or protect data in transit. Without proper encryption, attackers may be able to gain access to confidential information or modify existing data.

Unchanged Risks

The remaining vulnerabilities on the OWASP Top 10 2023 release candidate list remain unchanged from the 2021 list. These are:

• Server-Side Request Forgery (SSRF): SSRF is an attack in which an attacker can manipulate an application to make requests from the server, bypassing authentication and authorization. By exploiting SSRF, an attacker can access internal networks, launch DoS attacks, and retrieve sensitive information such as credentials.
• Security Misconfiguration: Security misconfiguration occurs when an application is poorly configured, making it susceptible to malicious attacks. Common security misconfigurations include open directories, unpatched software, exposed services, and weak authentication mechanisms.

Keep Up With OWASP Top 10 for Industry Best Practices With Kiuwan

It helps developers identify security risks early in the development process, reducing time to resolution and enabling organizations to meet the OWASP Top 10 guidelines for application security. Kiuwan’s SAST tool supports easy integration with your DevOps and DevSecOps environment, allowing a quick and seamless setup, so you can start scanning.

Get a free trial of Kiuwan’s SAST and start scanning today!