03 | Contrast Riskscore™ for March—April 2021
As described in a recent report,8 the Contrast RiskScore is a numerical score that provides a dynamic ranking of application vulnerability types based on real-world data about vulnerability prevalence and attack rates. The underlying algorithm, developed by Contrast Labs, is regularly refined to improve its accuracy.
This report applies the RiskScore algorithm to the entire dataset from all Contrast customers, which can be useful to security and development teams as they prioritize their application security activities. For a more individualized view, Contrast Labs is developing an open-source version of RiskScore that will be available soon. This will enable a more precise measurement of risk—down to the organizational level or even for each application.
For March–April, the top four vulnerabilities by RiskScore remained in the same order— broken access control, cross-site scripting (XSS), insecure configuration, and sensitive data exposure (Figure 1). In the fifth position is broken authentication, which moved from sixth to fifth position despite its RiskScore remaining flat (Figure 2).
SQL injection, which had the fifth-highest RiskScore in January–February, has seen volatility in its RiskScore over the past year, with a sharp downward trend—down from 8.87 in July 2020 (the second-highest score that month) to 5.37 in April 2021. Its bimonthly score of 5.49 for March–April moves SQL injection to the sixth position by just 0.02 points. The decline in the RiskScore for SQL injection occurs because it is both less likely to exist in applications and slightly less likely to be attacked when it does occur.
Further down the list, insecure deserialization returns to the top 10 with the ninth highest score after its RiskScore increased by more than a point from the last bimonthly period, to 4.39. However, this is very much a reversion to the mean, as this vulnerability type has an average score of 4.96 during the eight months between July 2020 (when we first calculated RiskScores) and February 2021.
One long-standing trend continued in March–April: Overall RiskScores trended downward. The average RiskScore for all vulnerability types has declined from 6.28 in July 2020 to 5.06 in April 2021.
04 | Application vulnerability trends
For custom code,9 the overall vulnerability picture improved somewhat in March–April, perhaps because the Contrast customers in the dataset made headway in reducing their security debt. Contrast Labs noted the following application vulnerability trends during March–April 2021:
TREND: THE PERCENTAGE OF APPLICATIONS WITH SERIOUS VULNERABILITIES STABILIZED
At least one vulnerability occurred in 97% of applications, down from 98% in January– February but very close to the average over time (Figure 3). More importantly, at least one serious vulnerability—rated as High or Critical—was found in just 32% of applications in March–April, down from 34% in January–February, but still higher than any month prior to November 2020.
Only two vulnerability types saw an increase in likelihood: insecure configuration and SMTP header injection (Figure 4). But the percentage of applications with serious insecure configuration vulnerabilities held steady at 5%, while no serious SMTP header injection vulnerabilities exist in the dataset. The top four vulnerability types all saw a decline in prevalence of one or two percentage points (Figure 5).
Looking at all vulnerabilities in the dataset, the percentage that were serious declined from 39% in January–February to 38% in March–April (Figure 6), a small move back toward numbers in the high 20s and low 30s that were common in 2020.
TREND: FEWER APPLICATIONS HAVE A LARGE NUMBER OF OVERALL VULNERABILITIES, BUT SERIOUS VULNERABILITIES HOLD STEADY
One consistent story that emerges from the data is that a relatively small subset of applications has a very large number of vulnerabilities—often well into the hundreds. Fortunately, the percentage of applications with more than 50 vulnerabilities declined from 11% to 9% compared with January–February (Figure 7). Similarly, the percentage of applications with more than 20 serious vulnerabilities declined from 7% to 6%.
One result of this decline in applications with many vulnerabilities is that the average number of vulnerabilities found in a vulnerable application (that is, an application with at least one vulnerability) declined from 61 in January–February to 52 in March–April (Figure 8). Unfortunately, the same is not true of serious vulnerabilities. The number of serious vulnerabilities per vulnerable application actually increased from 58 to 59—a reversion to the mean.
TREND: FEWER .NET APPLICATIONS HAD SERIOUS VULNERABILITIES
Looking at vulnerability data by programming language, an encouraging data point emerges with .NET applications, for which vulnerabilities had been trending upward for six months. For March–April, only 23% of .NET applications contained a serious vulnerability, down from 28% in the last bimonthly period (Figure 9). Specifically, the percentage of .NET applications with XSS and broken access control vulnerabilities declined by three and two percentage points, respectively.
Serious vulnerabilities were also found in fewer Java applications—37% in March–April compared with 39% in January–February, again a reversion to the mean. Again, broken access control saw the biggest decline, impacting 22% of applications compared with 24% in the last bimonthly period.
05 | Attack trends
While many of the vulnerability trends were positive in March–April, attack trends were more concerning as a whole. Data from Contrast Protect during March–April reveals the following trends regarding application attacks on the custom code in applications:
TREND: VULNERABILITIES WERE ATTACKED MUCH MORE FREQUENTLY
Almost every attack type impacted a larger percentage of applications in March–April than in January–February, and the increases were dramatic for some. For example, XSS attacks impacted 55% of applications compared with 29% in the prior bimonthly period—a 90% increase (Figure 11). Similarly, the percentage of applications targeted by broken access control attacks increased by 79% and command injection by 74%. Overall, the average attack type impacted 9% more applications in March–April than in January–February.
Broken access control regained the top spot in terms of percentage of applications impacted, at 86%. This is similar to the numbers seen during another spike in broken access control attacks in September–December 2020. The rest of the top five are the same as they have been since last fall—SQL injection, XSS, command injection, and expression language (EL) injection. But broken access control and XSS together accounted for 82% of all attacks in March–April (Figure 12).
TREND: BAD ACTORS DELIVERED MORE VIABLE ATTACKS ON JAVA APPLICATIONS
In January–February, the viability of attacks hit an all-time low since Contrast has been measuring it, with less than 0.5% of attacks hitting an existing vulnerability in both Java and .NET applications. This meant that more than 99.5% of attacks were probes. That trend reversed itself in March–April for the Java language, in which fully 3% of attacks were viable (Figure 13). The last time we saw this rate was in May–June 2020, and it is near the highest percentage observed by Contrast Labs.
Despite that increased viability rate, most attack types impacted a somewhat lower percentage of Java applications than in January–February, with the percentage of applications hit with command injection attacks declining by 35% (Figure 14).
The viability rate with .NET remained below 0.5%, with the percentage of applications impacted by insecure deserialization, XSS, and EL injection attacks increasing by 25% or more.
